Viewing File: /opt/imunify360/venv/share/imunify360/core-releases/imunify-core-release.tar
defence360agent/ 0000755 0000000 0000000 00000000000 00000000000 010546 5 ustar defence360agent/__init__.py 0000644 0000000 0000000 00000000447 00000000000 012664 0 ustar import os as _os
# Import machinery records the path through site-packages, including symlinks.
# Resolve it once so lazy submodule imports stay on the core release selected
# when this process first imported defence360agent.
__path__ = [_os.path.realpath(path) for path in __path__]
del _os
defence360agent/__main__.py 0000644 0000000 0000000 00000000053 00000000000 012636 0 ustar from defence360agent import cli
cli.run()
defence360agent/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 012756 5 ustar defence360agent/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000757 00000000000 020167 0 ustar
r_j' ( d dl Zd eD Z[dS ) Nc L g | ]!}t j | "S )_ospathrealpath).0r s M/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/__init__.py
<listcomp>r
s( 9 9 9CH d # # 9 9 9 )osr __path__r r r <module>r s- : 9 9 9 9CCr defence360agent/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000757 00000000000 017230 0 ustar
r_j' ( d dl Zd eD Z[dS ) Nc L g | ]!}t j | "S )_ospathrealpath).0r s M/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/__init__.py
<listcomp>r
s( 9 9 9CH d # # 9 9 9 )osr __path__r r r <module>r s- : 9 9 9 9CCr defence360agent/__pycache__/__main__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000441 00000000000 020136 0 ustar
r_j+ 0 d dl mZ ej dS ) )cliN)defence360agentr run M/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/__main__.py<module>r s( r defence360agent/__pycache__/__main__.cpython-311.pyc 0000644 0000000 0000000 00000000441 00000000000 017177 0 ustar
r_j+ 0 d dl mZ ej dS ) )cliN)defence360agentr run M/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/__main__.py<module>r s( r defence360agent/__pycache__/_version.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000317 00000000000 020244 0 ustar
r_jS
d Z dS )z8.12.1N) __version__ M/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/_version.py<module>r s r defence360agent/__pycache__/_version.cpython-311.pyc 0000644 0000000 0000000 00000000317 00000000000 017305 0 ustar
r_jS
d Z dS )z8.12.1N) __version__ M/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/_version.py<module>r s r defence360agent/__pycache__/defence360.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000015161 00000000000 020245 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlmZ d dlZd dlm Z
d dl m Z d dl
mZmZ d dlmZ d dlmZmZmZmZmZ d dlmZmZ d d lm Z ej e Z ed
Z d Z!d Z"dS )
N)Path)Core)
ResponseError)SUCCESS SocketError) is_root_user)
EXIT_CODESEXITCODE_GENERAL_ERROR print_errorprint_responseprint_warnings) EnvParsercreate_cli_parser) flush_sentryz5/var/lib/rpm-state/imunify360-transaction-in-progressc t j t j t j j | t }| | }|j
s t j d rHt j j
|j
p t j d |j r)t j j |j t! |d r&ddlm} t' |||j d S t! |d rPt! |d r? | | }t- j t j |j |j | } |j d i ||\ }}t7 | t9 |t: k r"t= |j ||j |j n=tC |||j |j tE j# tH | d S d S # tJ $ rU} t= d d d
& | i|j |j tE j# tN Y d } ~ d S d } ~ ww xY wt' |( d S ) N)args IMUNIFY360_LOGGING_CONFIG_FILEcompletions_commandr )generate_completionsendpointgenerate_endpoint_params)excludeitemsz ERROR: {} ))osumaskConfig
FILE_UMASKdefence360agent internalslogger reconfigurer
parse_args
log_configenvironget update_logging_config_from_fileconsole_log_levelsetConsoleLogLevelhasattr!defence360agent.utils.completionsr printshellr r parsecommandenvvar_parameter_optionsr r
r r r jsonverboser sysexitr r formatr
format_help)
rpc_handlers_initcli_argsparserr r
cli_kwargs
envvar_kwargsresultdataes
O/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/defence360.pymainr@ s HV
$00222
F ( + +D
"*..)IJJ
!(HH O Orz~~.N O O
!(;; "
t*++ JJJJJJ
""64:66777tZ $WT3M%N%N $ - 66t<<J %O
-" M )4=GG=GJGGLFD 4 NNN t|T49dlKKKKFD$)T\BBBF+,,,,, LK - - - w 2 21 5 56 4<
H+ , , , , , , , , , - f ""#####s 'CI
J"
A
J J"c t sYt dt j t dt j t
j t t | t j dd nv# t $ r7 t
d t
j t Y n6t $ r>}t d| t
j t Y d }~nd }~wt $ r}t" rPt d| t dt j t
j t n3t d t
j t Y d }~nFd }~wt( $ r6 t d t
j t Y nw xY wt+ j d S # t+ j w xY w)
Nz'%s could be used by the root user only!z/Imunify360 CLI is unavailable for non-root user)file z User pressed Ctrl+C, exiting...zResponse error: %sz"RPM transaction is in progress. %szPRPM transaction is in progress. Please, wait until it is finished and try again.z5Unknown error happened. See logs for more information)r r! infor NAMEr, r3 stderrr4 r
r@ argvKeyboardInterruptwarningr error ImportErrorRPM_TRANSACTION_LOCKexists exception Exceptionasyncioget_event_loopclose)r7 r> s r?
entrypointrS Q s< >> ) =v{KKK
=CJ
'((( )
---- ) ) )8999 '((((( ) ) ) )1--- '((((((((
-
-
- & & ( ( - LL=q A A A *Z
H+ , , , , G
H+ , , , ) ) ) C
'((((( ) &&((((( &&((((s\ )"B
H*
=H
H*
H 4D
H*
H B F=8H* =A H =H* ?H H* *'I)#rP loggingr r3 pathlibr defence360agent.internals.loggerr defence360agent.contracts.configr r $defence360agent.rpc_tools.exceptionsr defence360agent.simple_rpcr r defence360agent.utilsr defence360agent.utils.clir r
r r r
defence360agent.utils.parsersr r defence360agent.sentryr getLogger__name__r! rL r@ rS r r? <module>ra sZ
' ' ' ' ; ; ; ; ; ; > > > > > > ; ; ; ; ; ; ; ; . . . . . . G F F F F F F F / / / / / /
8 $ $t;
1$ 1$ 1$h%) %) %) %) %)r` defence360agent/__pycache__/defence360.cpython-311.pyc 0000644 0000000 0000000 00000015161 00000000000 017306 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlmZ d dlZd dlm Z
d dl m Z d dl
mZmZ d dlmZ d dlmZmZmZmZmZ d dlmZmZ d d lm Z ej e Z ed
Z d Z!d Z"dS )
N)Path)Core)
ResponseError)SUCCESS SocketError) is_root_user)
EXIT_CODESEXITCODE_GENERAL_ERROR print_errorprint_responseprint_warnings) EnvParsercreate_cli_parser) flush_sentryz5/var/lib/rpm-state/imunify360-transaction-in-progressc t j t j t j j | t }| | }|j
s t j d rHt j j
|j
p t j d |j r)t j j |j t! |d r&ddlm} t' |||j d S t! |d rPt! |d r? | | }t- j t j |j |j | } |j d i ||\ }}t7 | t9 |t: k r"t= |j ||j |j n=tC |||j |j tE j# tH | d S d S # tJ $ rU} t= d d d
& | i|j |j tE j# tN Y d } ~ d S d } ~ ww xY wt' |( d S ) N)args IMUNIFY360_LOGGING_CONFIG_FILEcompletions_commandr )generate_completionsendpointgenerate_endpoint_params)excludeitemsz ERROR: {} ))osumaskConfig
FILE_UMASKdefence360agent internalslogger reconfigurer
parse_args
log_configenvironget update_logging_config_from_fileconsole_log_levelsetConsoleLogLevelhasattr!defence360agent.utils.completionsr printshellr r parsecommandenvvar_parameter_optionsr r
r r r jsonverboser sysexitr r formatr
format_help)
rpc_handlers_initcli_argsparserr r
cli_kwargs
envvar_kwargsresultdataes
O/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/defence360.pymainr@ s HV
$00222
F ( + +D
"*..)IJJ
!(HH O Orz~~.N O O
!(;; "
t*++ JJJJJJ
""64:66777tZ $WT3M%N%N $ - 66t<<J %O
-" M )4=GG=GJGGLFD 4 NNN t|T49dlKKKKFD$)T\BBBF+,,,,, LK - - - w 2 21 5 56 4<
H+ , , , , , , , , , - f ""#####s 'CI
J"
A
J J"c t sYt dt j t dt j t
j t t | t j dd nv# t $ r7 t
d t
j t Y n6t $ r>}t d| t
j t Y d }~nd }~wt $ r}t" rPt d| t dt j t
j t n3t d t
j t Y d }~nFd }~wt( $ r6 t d t
j t Y nw xY wt+ j d S # t+ j w xY w)
Nz'%s could be used by the root user only!z/Imunify360 CLI is unavailable for non-root user)file z User pressed Ctrl+C, exiting...zResponse error: %sz"RPM transaction is in progress. %szPRPM transaction is in progress. Please, wait until it is finished and try again.z5Unknown error happened. See logs for more information)r r! infor NAMEr, r3 stderrr4 r
r@ argvKeyboardInterruptwarningr error ImportErrorRPM_TRANSACTION_LOCKexists exception Exceptionasyncioget_event_loopclose)r7 r> s r?
entrypointrS Q s< >> ) =v{KKK
=CJ
'((( )
---- ) ) )8999 '((((( ) ) ) )1--- '((((((((
-
-
- & & ( ( - LL=q A A A *Z
H+ , , , , G
H+ , , , ) ) ) C
'((((( ) &&((((( &&((((s\ )"B
H*
=H
H*
H 4D
H*
H B F=8H* =A H =H* ?H H* *'I)#rP loggingr r3 pathlibr defence360agent.internals.loggerr defence360agent.contracts.configr r $defence360agent.rpc_tools.exceptionsr defence360agent.simple_rpcr r defence360agent.utilsr defence360agent.utils.clir r
r r r
defence360agent.utils.parsersr r defence360agent.sentryr getLogger__name__r! rL r@ rS r r? <module>ra sZ
' ' ' ' ; ; ; ; ; ; > > > > > > ; ; ; ; ; ; ; ; . . . . . . G F F F F F F F / / / / / /
8 $ $t;
1$ 1$ 1$h%) %) %) %) %)r` defence360agent/__pycache__/migrate.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000022460 00000000000 020053 0 ustar
r_j
d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl m
Z
ddl m Z ddl
mZ ddlZddlmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
l m Z ddl m Z ddl!m"Z"m#Z#m$Z$ ddl%m&Z& e
e' Z(dZ)ej* de+de,fd Z-dedee+ fdZ. e/ fdee+ de/e/e+e+f df fdZ0d Z1d ed d Z2e'd k r e2 dS dS ) zbThis module import peewee_migrate and apply migrations, for Imunify-AV
it's entrypoint for service N)Iterable) getLogger)migrator)SqliteExtDatabase)app) configure)Core)Model)Router)systemd_notifier)db) tls_check)write_pid_fileIM360_RESIDENT_PID_PATHcleanup_pid_file)recreate_schema_modelsz/usr/bin/imunify-residentlog_msgreraisec # v K dV dS # t $ r$ t | | |r Y dS w xY w)z
Logs error in case of exception.
Depending on `reraise`:
- re-raise exception and don't include exception info in the log operation
- do not re-raise exception and include exception info in the log operation
N)exc_info) Exceptionloggererror)r r s L/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrate.py exc_handlerr ) se
W7{ 333 s
*88r
migrations_dirsc ~ t | |t }t t _ | dS )z4Apply migrations: restructure db, config files, etc.)r r N)r r r LOGGERrun)r
r routers r apply_migrationsr! : s;
' F HO
JJLLLLL attached_dbs.c t j t j t j g }|D ]1\ }}t j d||f | | 2 t d t j t j j
t j d 5 t dd 5 t! t | ddd n # 1 swxY w Y ddd n # 1 swxY w Y t d t j d 5 t d d
5 t# t | t d d
5 t! t | ddd n # 1 swxY w Y ddd n # 1 swxY w Y ddd n # 1 swxY w Y t j dS # t j w xY w) a>
Apply migrations and recreate attached databases.
The workflow:
1. Apply migrations
2. Regardless whether the migrations were applied - recreate attached databases
3. If the recreation of the attached databases was successful - apply migrations again
- this is done to verify that migrations will successfully apply in future for the recreated databases
- the recreation + the migrations in this step are within the same transaction,
so databases will only be recreated if the migrations can applied after the recreation.
z
ATTACH ? AS ?z Applying database migrations... EXCLUSIVEzError applying migrationsF)r Nz Recreating attached databases...z#Error recreating attached databasesTz=Error applying migrations after recreating attached databases)r reset db_instanceinitr
PATH execute_sqlappendr infor notify
AgentState MIGRATINGatomicr r! r close)r r# attached_schemasdb_path schema_names r prepare_databasesr5 H s2 " OUZ , - - ';1GHHH ,,,, 5666 0 ; EFFF
,
, ; ;k '/
/
/
; ;
[/ : : : ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;
6777
,
,
?
?k 14/
/
/
?
?
#;0@ A A A
?
?
!o>>>
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?" s )AG' :D C." D.C2 2D5C2 6D9 G' D G' D
1G' >G'F07F
F0F F0 F !F0$ G0F4 4G7F4 8G; G' G G' G G' 'G<c t d| t dt j t j t j t d t j d d S )Nz$Received signal %s in signal_handlerz0waiting %d seconds so that migrations can finishExitingr ) r warningr %SIGNAL_HANDLER_MIGRATION_TIMEOUT_SECStimesleepr, sysexit)sig_s r signal_handlerr@ ~ sn
NN93???
NN: 2 Jt9:::
KK HQKKKKKr" defence360agent) start_pkgr c t j t j t j fD ] }t j |t | dk rt t t j t j
| t j j
t j t" t$ j t$ j f }| | t/ j t. j j t d t/ j t. j j | dk rqt j d t d t j t@ t@ gtB j" dd z dS t j tB j# tB j# d d
$ | gtB j" dd z dS # tJ $ r! | dk rtM t Y dS Y dS w xY w) zoEntry point for Imunify-AV service. Apply migrations,
and then replace process with {start_pkg}.run module.zim360.run_resident)targetargszStarting main process...T)exist_okz Run imunify-resident service Nz-mz{})'signalSIGINTSIGTERMSIGHUPr@ r r osumaskr
FILE_UMASKrA internalsr reconfigure threadingThreadr5 r MIGRATIONS_DIRSMIGRATIONS_ATTACHED_DBSstartjoinr r- r. READYr, STARTING GO_FLAG_FILEtouchexecvGO_SERVICE_NAMEr< argv
executableformatr r )rB r r> migration_threads r r r s*
v~v}= + +
c>****"6 , , , 2 3 3 3
!!! !(44666$+$%s'BC
0 ; ABBB ./// 0 ; DEEE , , , # #T # 2 2 2 KK6 7 7 7 H # (122,
H t{{9'='=>!"" M
6 6 6 , , , 4 5 5 5 5 5 5 - , ,6s FH- AH- -$II__main__)3__doc__
contextlibrL r< rH rQ r: collections.abcr loggingr peewee_migrater playhouse.sqlite_extr defence360agent.internals.loggerrA defence360agent.applicationr $defence360agent.application.settingsr defence360agent.contracts.configr r
defence360agent.routerr defence360agent.subsysr defence360agent.model.instancer
r' defence360agent.modelr defence360agent.utilsr r r defence360agent.utils.check_dbr __name__r r\ contextmanagerstrboolr r! tupler5 r@ r r" r <module>rx s
$ $ $ $ $ $ # # # # # # 2 2 2 2 2 2 ' ' ' ' + + + + + + : : : : : : 1 1 1 1 1 1 2 2 2 2 2 2 ) ) ) ) ) ) 3 3 3 3 3 3 < < < < < < + + + + + +
8 -
t
* Xc] 162 2 c]2 c3h,-2 2 2 2 l ') (6 (6 (6 (6 (6V zCEEEEE r" defence360agent/__pycache__/migrate.cpython-311.pyc 0000644 0000000 0000000 00000022460 00000000000 017114 0 ustar
r_j
d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl m
Z
ddl m Z ddl
mZ ddlZddlmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
l m Z ddl m Z ddl!m"Z"m#Z#m$Z$ ddl%m&Z& e
e' Z(dZ)ej* de+de,fd Z-dedee+ fdZ. e/ fdee+ de/e/e+e+f df fdZ0d Z1d ed d Z2e'd k r e2 dS dS ) zbThis module import peewee_migrate and apply migrations, for Imunify-AV
it's entrypoint for service N)Iterable) getLogger)migrator)SqliteExtDatabase)app) configure)Core)Model)Router)systemd_notifier)db) tls_check)write_pid_fileIM360_RESIDENT_PID_PATHcleanup_pid_file)recreate_schema_modelsz/usr/bin/imunify-residentlog_msgreraisec # v K dV dS # t $ r$ t | | |r Y dS w xY w)z
Logs error in case of exception.
Depending on `reraise`:
- re-raise exception and don't include exception info in the log operation
- do not re-raise exception and include exception info in the log operation
N)exc_info) Exceptionloggererror)r r s L/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrate.py exc_handlerr ) se
W7{ 333 s
*88r
migrations_dirsc ~ t | |t }t t _ | dS )z4Apply migrations: restructure db, config files, etc.)r r N)r r r LOGGERrun)r
r routers r apply_migrationsr! : s;
' F HO
JJLLLLL attached_dbs.c t j t j t j g }|D ]1\ }}t j d||f | | 2 t d t j t j j
t j d 5 t dd 5 t! t | ddd n # 1 swxY w Y ddd n # 1 swxY w Y t d t j d 5 t d d
5 t# t | t d d
5 t! t | ddd n # 1 swxY w Y ddd n # 1 swxY w Y ddd n # 1 swxY w Y t j dS # t j w xY w) a>
Apply migrations and recreate attached databases.
The workflow:
1. Apply migrations
2. Regardless whether the migrations were applied - recreate attached databases
3. If the recreation of the attached databases was successful - apply migrations again
- this is done to verify that migrations will successfully apply in future for the recreated databases
- the recreation + the migrations in this step are within the same transaction,
so databases will only be recreated if the migrations can applied after the recreation.
z
ATTACH ? AS ?z Applying database migrations... EXCLUSIVEzError applying migrationsF)r Nz Recreating attached databases...z#Error recreating attached databasesTz=Error applying migrations after recreating attached databases)r reset db_instanceinitr
PATH execute_sqlappendr infor notify
AgentState MIGRATINGatomicr r! r close)r r# attached_schemasdb_path schema_names r prepare_databasesr5 H s2 " OUZ , - - ';1GHHH ,,,, 5666 0 ; EFFF
,
, ; ;k '/
/
/
; ;
[/ : : : ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;
6777
,
,
?
?k 14/
/
/
?
?
#;0@ A A A
?
?
!o>>>
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?" s )AG' :D C." D.C2 2D5C2 6D9 G' D G' D
1G' >G'F07F
F0F F0 F !F0$ G0F4 4G7F4 8G; G' G G' G G' 'G<c t d| t dt j t j t j t d t j d d S )Nz$Received signal %s in signal_handlerz0waiting %d seconds so that migrations can finishExitingr ) r warningr %SIGNAL_HANDLER_MIGRATION_TIMEOUT_SECStimesleepr, sysexit)sig_s r signal_handlerr@ ~ sn
NN93???
NN: 2 Jt9:::
KK HQKKKKKr" defence360agent) start_pkgr c t j t j t j fD ] }t j |t | dk rt t t j t j
| t j j
t j t" t$ j t$ j f }| | t/ j t. j j t d t/ j t. j j | dk rqt j d t d t j t@ t@ gtB j" dd z dS t j tB j# tB j# d d
$ | gtB j" dd z dS # tJ $ r! | dk rtM t Y dS Y dS w xY w) zoEntry point for Imunify-AV service. Apply migrations,
and then replace process with {start_pkg}.run module.zim360.run_resident)targetargszStarting main process...T)exist_okz Run imunify-resident service Nz-mz{})'signalSIGINTSIGTERMSIGHUPr@ r r osumaskr
FILE_UMASKrA internalsr reconfigure threadingThreadr5 r MIGRATIONS_DIRSMIGRATIONS_ATTACHED_DBSstartjoinr r- r. READYr, STARTING GO_FLAG_FILEtouchexecvGO_SERVICE_NAMEr< argv
executableformatr r )rB r r> migration_threads r r r s*
v~v}= + +
c>****"6 , , , 2 3 3 3
!!! !(44666$+$%s'BC
0 ; ABBB ./// 0 ; DEEE , , , # #T # 2 2 2 KK6 7 7 7 H # (122,
H t{{9'='=>!"" M
6 6 6 , , , 4 5 5 5 5 5 5 - , ,6s FH- AH- -$II__main__)3__doc__
contextlibrL r< rH rQ r: collections.abcr loggingr peewee_migrater playhouse.sqlite_extr defence360agent.internals.loggerrA defence360agent.applicationr $defence360agent.application.settingsr defence360agent.contracts.configr r
defence360agent.routerr defence360agent.subsysr defence360agent.model.instancer
r' defence360agent.modelr defence360agent.utilsr r r defence360agent.utils.check_dbr __name__r r\ contextmanagerstrboolr r! tupler5 r@ r r" r <module>rx s
$ $ $ $ $ $ # # # # # # 2 2 2 2 2 2 ' ' ' ' + + + + + + : : : : : : 1 1 1 1 1 1 2 2 2 2 2 2 ) ) ) ) ) ) 3 3 3 3 3 3 < < < < < < + + + + + +
8 -
t
* Xc] 162 2 c]2 c3h,-2 2 2 2 l ') (6 (6 (6 (6 (6V zCEEEEE r" defence360agent/__pycache__/router.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006725 00000000000 017751 0 ustar
r_j X d Z ddlZddlmZ ddlmZ ddlmZ dgZ G d de ZdS )z!Provide Router for db migrations. N)suppress)Router)voidr c > e Zd ZdZ fdZed Zd Z xZS )r zALike peewee_migrate.Router but supports multiple migrations dirs.c Z t j |fd|d i| || _ d S )N migrate_dirr )super__init__migrations_dirs)selfdatabaser kwargs __class__s K/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/router.pyr
zRouter.__init__ s: LLq/ALVLLL . c 0 j D ]P}t j | s/ j d| t j | Qg } j D ]2}|t fdt j | D z
}3|S )z Scan migrations in file system.z'Migration directory: %s does not exist.c 3 | K | ]6}j | |d t d V 7d S )N.py)filemaskmatchlen).0fr s r <genexpr>z Router.todo.<locals>.<genexpr> s^ & &=&&q))&-SZZK- & & & & & &r ) r ospathexistsloggerwarnmakedirssortedlistdir)r r migration_namess ` r todoz Router.todo s / ) )K7>>+..
) ={ K((( / K v & & & &K00& & &
OO
r c i }| j D ]}t t 5 t t j ||dz 5 }t | ddd }t || ddd n # 1 swxY w Y ddd n # 1 swxY w Y |
dt |
dt fS ) zRead migration from file.r z<string>execT) dont_inheritNmigraterollback) r r FileNotFoundErroropenr r joincompilereadr& getr )r namescoper r codes r r. z Router.read& sR / & &K+,,
&
&"',,{D5LAABB &a"*f4 D u%%% & & & & & & & & & & & & & & &
&
&
&
&
&
&
&
&
&
&
&
&
&
&
& yyD))599Z+F+FFFs5 1B*6B B*B B*B B**B. 1B. ) __name__
__module__ __qualname____doc__r
propertyr$ r.
__classcell__)r s @r r r so KK/ / / / / X "
G
G
G
G
G
G
Gr )
r6 r
contextlibr peewee_migrater PeeweeRouterpeewee_migrate.routerr __all__ r r <module>r? s ' ' 1 1 1 1 1 1 & & & & & & *$G $G $G $G $G\ $G $G $G $G $Gr defence360agent/__pycache__/router.cpython-311.pyc 0000644 0000000 0000000 00000006725 00000000000 017012 0 ustar
r_j X d Z ddlZddlmZ ddlmZ ddlmZ dgZ G d de ZdS )z!Provide Router for db migrations. N)suppress)Router)voidr c > e Zd ZdZ fdZed Zd Z xZS )r zALike peewee_migrate.Router but supports multiple migrations dirs.c Z t j |fd|d i| || _ d S )N migrate_dirr )super__init__migrations_dirs)selfdatabaser kwargs __class__s K/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/router.pyr
zRouter.__init__ s: LLq/ALVLLL . c 0 j D ]P}t j | s/ j d| t j | Qg } j D ]2}|t fdt j | D z
}3|S )z Scan migrations in file system.z'Migration directory: %s does not exist.c 3 | K | ]6}j | |d t d V 7d S )N.py)filemaskmatchlen).0fr s r <genexpr>z Router.todo.<locals>.<genexpr> s^ & &=&&q))&-SZZK- & & & & & &r ) r ospathexistsloggerwarnmakedirssortedlistdir)r r migration_namess ` r todoz Router.todo s / ) )K7>>+..
) ={ K((( / K v & & & &K00& & &
OO
r c i }| j D ]}t t 5 t t j ||dz 5 }t | ddd }t || ddd n # 1 swxY w Y ddd n # 1 swxY w Y |
dt |
dt fS ) zRead migration from file.r z<string>execT) dont_inheritNmigraterollback) r r FileNotFoundErroropenr r joincompilereadr& getr )r namescoper r codes r r. z Router.read& sR / & &K+,,
&
&"',,{D5LAABB &a"*f4 D u%%% & & & & & & & & & & & & & & &
&
&
&
&
&
&
&
&
&
&
&
&
&
&
& yyD))599Z+F+FFFs5 1B*6B B*B B*B B**B. 1B. ) __name__
__module__ __qualname____doc__r
propertyr$ r.
__classcell__)r s @r r r so KK/ / / / / X "
G
G
G
G
G
G
Gr )
r6 r
contextlibr peewee_migrater PeeweeRouterpeewee_migrate.routerr __all__ r r <module>r? s ' ' 1 1 1 1 1 1 & & & & & & *$G $G $G $G $G\ $G $G $G $G $Gr defence360agent/__pycache__/run.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000430 00000000000 017220 0 ustar
r_jm
d Z dS ))zdefence360agent.pluginsz*defence360agent.feature_management.pluginsN)CORE_PLUGINS_PACKAGES H/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/run.py<module>r s r defence360agent/__pycache__/run.cpython-311.pyc 0000644 0000000 0000000 00000000430 00000000000 016261 0 ustar
r_jm
d Z dS ))zdefence360agent.pluginsz*defence360agent.feature_management.pluginsN)CORE_PLUGINS_PACKAGES H/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/run.py<module>r s r defence360agent/__pycache__/sentry.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000020553 00000000000 017750 0 ustar
r_j z d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m
Z
m Z ddl Z ddl
Z
ddlmZ ddlmZ dZd Zd
Zd Zd Zd
ZdZ ed ZdZdefdZ defdZ de e defdZ dedefdZ dedefdZ d Z!d Z"defdZ#d Z$d Z% d&d ed e
e& d!e d" d#e
e d$e
e f
d%Z'dS )'z2Helper for integrate sentry in stand-alone scripts N)suppress)Path)ListOptionalLiteral)tags)sentry
imunify360zimunify-antiviruszimunify360-firewallz /var/imunify360/license.jsonz!/var/imunify360/license-free.json IMUNIFYAVUNKNOWNz,/opt/imunify360/venv/share/imunify360/sentryzQhttps://6de77a2763bd40c58fc9e3a89285aaa8@im360.sentry.cloudlinux.com/3?timeout=20returnc t d S # t t f$ r
t
cY S w xY w)z,Return dsn from the file or the default one.ascii)encoding)SENTRY_DSN_PATH read_textstripOSErrorUnicodeDecodeErrorSENTRY_DSN_DEFAULT K/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/sentry.pyget_sentry_dsnr sW " (('(::@@BBB ' ( " " "!!!!"s ,/ A
A
c t t 5 t t fD ]} t t 5 t | 5 }t
j | d cd d d cd d d c cd d d S # 1 swxY w Y d d d n # 1 swxY w Y d d d n # 1 swxY w Y t S )Nid) r ExceptionLICENSE LICENSE_FREEFileNotFoundErroropenjsonload
UNKNOWN_ID)filenamefiles r
get_server_idr' $ s ) - - ,/ - -H+,,
-
-d8nn
-yt,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-- - - - - - - -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- -- - - - - - - - - - - - - - - s^ %B;B"
B $ B"0B; B
B"B
B" B;"B& &B;)B& *B;;B?B?cmdc t j | t j t j t j }n# t $ r Y dS w xY w|j dk rdS t
j |j S )N)stdinstdoutstderr r )
subprocessrunDEVNULLPIPEr
returncodeosfsdecoder+ )r( cps r collect_outputr6 , s{
^ $ ? %
rr }r
;ry ! !!s 69
AApkgc , ddd| g}t | S )Nrpmz-qz#--queryformat=%{VERSION}-%{RELEASE}r6 r7 r( s r get_rpm_versionr< ; s $=s
CC # r c , ddd| g}t | S )Nz
dpkg-queryz--showformat=${Version}z--showr: r; s r get_dpkg_versionr> @ s 2Hc
BC # r c \ t j d } | S )Nr )distrolinux_distributionlower) platform_oss r get_current_osrD E s' +--a0K r c t } t }| dk r t t rt }nt }|S Nubuntu)rD IMUNIFY360_PKGr< r
IMUNIFY360)rC service_names r get_package_namerK J s< ""K!Lh ?9#=#= ! r c l t }|dk rt | }nt | }|S rF )rD r< r> )rJ rC versions r get_service_versionrN T s9 ""Kh !,//"<00 Nr c t j t t j 5 } t }dt i| _ | d| | dt | t j
t j D ]\ }}| || d d d d S # 1 swxY w Y d S )N)dsnr namerM )
sentry_sdkinitr configure_scoperK r' userset_tagrN r cached_fillr items)scopepackagetagvalues r configure_sentryr] ] s) O(()))) # % % &"$$MOO,
fg&&&
i!4W!=!=>>> +----// & &JC MM#u % % % % &
& & & & & & & & & & & & & & & & & &s B1C44C8;C8c f t j j j } | | d d S d S )Ng @)timeout)rR Hubcurrentclientflush)rb s r flush_sentryrd k s7
^
#
*F
S !!!!! r warningmessage format_argslevel)fatalcriticalerrorre infodebug fingerprint componentc | |i }|r! | j di |}n# t $ r | }Y nw xY w| }| dd |s|rdt j 5 }|r|g|_ |r| d| t j |fd|i| ddd dS # 1 swxY w Y dS t j |fd|i| dS )a
Helper function to log messages to Sentry with optional fingerprinting.
This is useful when you need to log messages to Sentry without relying on error handling.
Args:
message: The message to log
format_args: Dictionary of arguments to format the message with (optional)
level: Log level (default: "warning")
fingerprint: String for Sentry fingerprinting (optional)
component: Component name to tag the message with (optional)
**kwargs: Additional keyword arguments passed to sentry_sdk.capture_message()
Common options include:
- extra: dict of extra data to include
- tags: dict of additional tags
- contexts: dict of additional contexts
Nrh ro r )formatKeyErrorpoprR
push_scopern rV capture_message)rf rg rh rn ro kwargsformatted_messagerY s r log_messagerx q s 6 $ ( . = = = = ( ( ( ' ( $ JJw
Mi
M
"
$
$
2%0M!
6
k9555 &!
).
28
"#4LLELVLLLLLs
%%7BB "B )Nre NN)(__doc__r" r3 r.
contextlibr pathlibr typingr r r r@ rR defence360agent.applicationr defence360agent.contractsr rI r rH r r FREE_IDr$ r r strr r' r6 r< r> rD rK rN r] rd dictrx r r r <module>r sW 8 8 * * * * * * * * * *
, , , , , , , , , , , ,
&
(2
$EFFh " " " " "s "S "c " " " "
# #
& & & " " " #' !% #5M 5M
5M$ 5M @ 5M #
5M }5M 5M 5M 5M 5M 5Mr defence360agent/__pycache__/sentry.cpython-311.pyc 0000644 0000000 0000000 00000020553 00000000000 017011 0 ustar
r_j z d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m
Z
m Z ddl Z ddl
Z
ddlmZ ddlmZ dZd Zd
Zd Zd Zd
ZdZ ed ZdZdefdZ defdZ de e defdZ dedefdZ dedefdZ d Z!d Z"defdZ#d Z$d Z% d&d ed e
e& d!e d" d#e
e d$e
e f
d%Z'dS )'z2Helper for integrate sentry in stand-alone scripts N)suppress)Path)ListOptionalLiteral)tags)sentry
imunify360zimunify-antiviruszimunify360-firewallz /var/imunify360/license.jsonz!/var/imunify360/license-free.json IMUNIFYAVUNKNOWNz,/opt/imunify360/venv/share/imunify360/sentryzQhttps://6de77a2763bd40c58fc9e3a89285aaa8@im360.sentry.cloudlinux.com/3?timeout=20returnc t d S # t t f$ r
t
cY S w xY w)z,Return dsn from the file or the default one.ascii)encoding)SENTRY_DSN_PATH read_textstripOSErrorUnicodeDecodeErrorSENTRY_DSN_DEFAULT K/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/sentry.pyget_sentry_dsnr sW " (('(::@@BBB ' ( " " "!!!!"s ,/ A
A
c t t 5 t t fD ]} t t 5 t | 5 }t
j | d cd d d cd d d c cd d d S # 1 swxY w Y d d d n # 1 swxY w Y d d d n # 1 swxY w Y t S )Nid) r ExceptionLICENSE LICENSE_FREEFileNotFoundErroropenjsonload
UNKNOWN_ID)filenamefiles r
get_server_idr' $ s ) - - ,/ - -H+,,
-
-d8nn
-yt,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-- - - - - - - -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- -- - - - - - - - - - - - - - - s^ %B;B"
B $ B"0B; B
B"B
B" B;"B& &B;)B& *B;;B?B?cmdc t j | t j t j t j }n# t $ r Y dS w xY w|j dk rdS t
j |j S )N)stdinstdoutstderr r )
subprocessrunDEVNULLPIPEr
returncodeosfsdecoder+ )r( cps r collect_outputr6 , s{
^ $ ? %
rr }r
;ry ! !!s 69
AApkgc , ddd| g}t | S )Nrpmz-qz#--queryformat=%{VERSION}-%{RELEASE}r6 r7 r( s r get_rpm_versionr< ; s $=s
CC # r c , ddd| g}t | S )Nz
dpkg-queryz--showformat=${Version}z--showr: r; s r get_dpkg_versionr> @ s 2Hc
BC # r c \ t j d } | S )Nr )distrolinux_distributionlower) platform_oss r get_current_osrD E s' +--a0K r c t } t }| dk r t t rt }nt }|S Nubuntu)rD IMUNIFY360_PKGr< r
IMUNIFY360)rC service_names r get_package_namerK J s< ""K!Lh ?9#=#= ! r c l t }|dk rt | }nt | }|S rF )rD r< r> )rJ rC versions r get_service_versionrN T s9 ""Kh !,//"<00 Nr c t j t t j 5 } t }dt i| _ | d| | dt | t j
t j D ]\ }}| || d d d d S # 1 swxY w Y d S )N)dsnr namerM )
sentry_sdkinitr configure_scoperK r' userset_tagrN r cached_fillr items)scopepackagetagvalues r configure_sentryr] ] s) O(()))) # % % &"$$MOO,
fg&&&
i!4W!=!=>>> +----// & &JC MM#u % % % % &
& & & & & & & & & & & & & & & & & &s B1C44C8;C8c f t j j j } | | d d S d S )Ng @)timeout)rR Hubcurrentclientflush)rb s r flush_sentryrd k s7
^
#
*F
S !!!!! r warningmessage format_argslevel)fatalcriticalerrorre infodebug fingerprint componentc | |i }|r! | j di |}n# t $ r | }Y nw xY w| }| dd |s|rdt j 5 }|r|g|_ |r| d| t j |fd|i| ddd dS # 1 swxY w Y dS t j |fd|i| dS )a
Helper function to log messages to Sentry with optional fingerprinting.
This is useful when you need to log messages to Sentry without relying on error handling.
Args:
message: The message to log
format_args: Dictionary of arguments to format the message with (optional)
level: Log level (default: "warning")
fingerprint: String for Sentry fingerprinting (optional)
component: Component name to tag the message with (optional)
**kwargs: Additional keyword arguments passed to sentry_sdk.capture_message()
Common options include:
- extra: dict of extra data to include
- tags: dict of additional tags
- contexts: dict of additional contexts
Nrh ro r )formatKeyErrorpoprR
push_scopern rV capture_message)rf rg rh rn ro kwargsformatted_messagerY s r log_messagerx q s 6 $ ( . = = = = ( ( ( ' ( $ JJw
Mi
M
"
$
$
2%0M!
6
k9555 &!
).
28
"#4LLELVLLLLLs
%%7BB "B )Nre NN)(__doc__r" r3 r.
contextlibr pathlibr typingr r r r@ rR defence360agent.applicationr defence360agent.contractsr rI r rH r r FREE_IDr$ r r strr r' r6 r< r> rD rK rN r] rd dictrx r r r <module>r sW 8 8 * * * * * * * * * *
, , , , , , , , , , , ,
&
(2
$EFFh " " " " "s "S "c " " " "
# #
& & & " " " #' !% #5M 5M
5M$ 5M @ 5M #
5M }5M 5M 5M 5M 5M 5Mr defence360agent/_version.py 0000644 0000000 0000000 00000000123 00000000000 012740 0 ustar # DO NOT EDIT: bump_version.py keeps it in sync with *.spec
__version__ = "8.12.1"
defence360agent/api/ 0000755 0000000 0000000 00000000000 00000000000 011317 5 ustar defence360agent/api/__init__.py 0000644 0000000 0000000 00000000000 00000000000 013416 0 ustar defence360agent/api/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 013527 5 ustar defence360agent/api/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000276 00000000000 020734 0 ustar
r_j d S )N r Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/__init__.py<module>r s r defence360agent/api/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000276 00000000000 017775 0 ustar
r_j d S )N r Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/__init__.py<module>r s r defence360agent/api/__pycache__/health.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000011422 00000000000 020435 0 ustar
r_j
f d Z ddlZ ej dddg Z G d d Z e ZdS )a This module implements health status reporting for watchdog operation.
Module receive important health metrics and exports its status of overall
health assessment. This health assessment can be used by external watchdog
scripts to initiate agent restart.
Process is considered "healthy" if:
* it is being shut down and shutdown timeout has not elapsed -> HEALTHY
* it is not registered -> HEALTHY
* process was started more than 6 hours ago and no data was sent to server
within last 6 hours -> FAULTY
* process was started more than 18 hours ago and no data was received from
server within last 18 hours -> FAULTY
Otherwise process is considered HEALTHY.
As agent exports this information through RPC interface there is an additional
implicit "health" requirement that:
* it responds to RPC requests.
This implicit requirement considered valid because UI fully depends on RPC
so it does not make health assessment any worse than it should. N HealthStatushealthywhyc e Zd ZdZdZdZdZd Zdeddfd Z deddfd
Z
deddfd Z deddfd Z dd
Z
ddZdedefdZdS ) HealthSensora HealthSensor receives events about agent operation and provides
information about overall status.
Initially, new HealthSensor object assumes:
* process was started long ago;
* process is not being shut down;
* data from server has been received long ago;
* data to server was sent long ago;
* agent is registered (license is valid).
So, initial health status is False (faulty).i i`T iX c L d| _ d| _ d| _ d| _ d| _ d S )Ng T) _started_at _shutdown_at_last_received
_last_sent_is_registeredselfs O/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/health.py__init__zHealthSensor.__init__1 s/ ! " whenreturnNc || _ dS )z!Records a moment of agent startupN)r r r s r startingzHealthSensor.starting8 s r c || _ dS )z7Records a moment of externally initiated agent shutdownN)r
r s r
shutting_downzHealthSensor.shutting_down< s r c || _ dS )z3Records a moment when data was received from serverN)r r s r server_data_receivedz!HealthSensor.server_data_received@ "r c || _ dS )z-Records a moment when data was sent to serverN)r r s r server_data_sentz HealthSensor.server_data_sentD s
r c d| _ dS )z Marks agent as being registeredTNr
r s r
registeredzHealthSensor.registeredH r r c d| _ dS )z#Marks agent as being not registeredFNr r s r unregisteredzHealthSensor.unregisteredL s #r nowc | j dk r3|| j z
| j k rt dd S t dd S | j st dd S || j z
| j k r#|| j z
| j k rt dd S || j z
| j k r#|| j z
| j k rt dd S t dd S )
Nr Fzstuck at shutdownTzshutdown is in progressznot registeredz no data received from serverzno data sent to serverz all is ok) r
SHUTDOWN_TIMEOUTr r
r RECEIVE_WINDOWr SEND_WINDOWr )r r$ s r statuszHealthSensor.statusP s q T&&$*???#E+>??? &?@@ @" 8 &677 7 $" "d&9 9 9d))T-@@@ 'EFF F $" "d&6 6 6do%)999 '?@@ @D+...r )r N)__name__
__module__ __qualname____doc__r' r( r& r floatr r r r r! r# r r) r r r r s 4 4 NK# # # U t !% !D ! ! ! !# #4 # # # # U t # # # #$ $ $ $/% /L / / / / / /r r )r- collections
namedtupler r sensorr/ r r <module>r3 sz C C2 %{%ny%6HII B/ B/ B/ B/ B/ B/ B/ B/J
r defence360agent/api/__pycache__/health.cpython-311.pyc 0000644 0000000 0000000 00000011422 00000000000 017476 0 ustar
r_j
f d Z ddlZ ej dddg Z G d d Z e ZdS )a This module implements health status reporting for watchdog operation.
Module receive important health metrics and exports its status of overall
health assessment. This health assessment can be used by external watchdog
scripts to initiate agent restart.
Process is considered "healthy" if:
* it is being shut down and shutdown timeout has not elapsed -> HEALTHY
* it is not registered -> HEALTHY
* process was started more than 6 hours ago and no data was sent to server
within last 6 hours -> FAULTY
* process was started more than 18 hours ago and no data was received from
server within last 18 hours -> FAULTY
Otherwise process is considered HEALTHY.
As agent exports this information through RPC interface there is an additional
implicit "health" requirement that:
* it responds to RPC requests.
This implicit requirement considered valid because UI fully depends on RPC
so it does not make health assessment any worse than it should. N HealthStatushealthywhyc e Zd ZdZdZdZdZd Zdeddfd Z deddfd
Z
deddfd Z deddfd Z dd
Z
ddZdedefdZdS ) HealthSensora HealthSensor receives events about agent operation and provides
information about overall status.
Initially, new HealthSensor object assumes:
* process was started long ago;
* process is not being shut down;
* data from server has been received long ago;
* data to server was sent long ago;
* agent is registered (license is valid).
So, initial health status is False (faulty).i i`T iX c L d| _ d| _ d| _ d| _ d| _ d S )Ng T) _started_at _shutdown_at_last_received
_last_sent_is_registeredselfs O/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/health.py__init__zHealthSensor.__init__1 s/ ! " whenreturnNc || _ dS )z!Records a moment of agent startupN)r r r s r startingzHealthSensor.starting8 s r c || _ dS )z7Records a moment of externally initiated agent shutdownN)r
r s r
shutting_downzHealthSensor.shutting_down< s r c || _ dS )z3Records a moment when data was received from serverN)r r s r server_data_receivedz!HealthSensor.server_data_received@ "r c || _ dS )z-Records a moment when data was sent to serverN)r r s r server_data_sentz HealthSensor.server_data_sentD s
r c d| _ dS )z Marks agent as being registeredTNr
r s r
registeredzHealthSensor.registeredH r r c d| _ dS )z#Marks agent as being not registeredFNr r s r unregisteredzHealthSensor.unregisteredL s #r nowc | j dk r3|| j z
| j k rt dd S t dd S | j st dd S || j z
| j k r#|| j z
| j k rt dd S || j z
| j k r#|| j z
| j k rt dd S t dd S )
Nr Fzstuck at shutdownTzshutdown is in progressznot registeredz no data received from serverzno data sent to serverz all is ok) r
SHUTDOWN_TIMEOUTr r
r RECEIVE_WINDOWr SEND_WINDOWr )r r$ s r statuszHealthSensor.statusP s q T&&$*???#E+>??? &?@@ @" 8 &677 7 $" "d&9 9 9d))T-@@@ 'EFF F $" "d&6 6 6do%)999 '?@@ @D+...r )r N)__name__
__module__ __qualname____doc__r' r( r& r floatr r r r r! r# r r) r r r r s 4 4 NK# # # U t !% !D ! ! ! !# #4 # # # # U t # # # #$ $ $ $/% /L / / / / / /r r )r- collections
namedtupler r sensorr/ r r <module>r3 sz C C2 %{%ny%6HII B/ B/ B/ B/ B/ B/ B/ B/J
r defence360agent/api/__pycache__/inactivity.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007130 00000000000 021354 0 ustar
r_j r d Z ddlZddlmZmZ ddlmZ ee Z G d d Z e Z
dS )zThis module implement inactivity tracker for ImunifyAV to automaticaly
shutdown the process when it is idle for certain time (no RPC calls and
long running tasks).
N)contextmanagersuppress) getLoggerc X e Zd Zd Zd Zed Zd Zd Zd Z d Z
de d d
fd Z d
S ) InactivityTrackerc ` t j | _ d| _ g | _ d| _ d S )Nr )time monotonic_last_action_timestamp_long_action_counter_long_actions_list_timeoutselfs S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/inactivity.py__init__zInactivityTracker.__init__
s- &*n&6&6#$%!"$
c j d t j | j z
| j S )Nz0Time from last action is {:.0f}, long actions {})formatr r
r r
r s r __str__zInactivityTracker.__str__ s3 AHH N t : : #
r c # K | | d V | | d S # | | w xY wN)startstopr names r taskzInactivityTracker.task sM
4 EEE IIdOOOOODIIdOOOOs 4 A c 6 t j | _ d S r )r r
r r s r reset_timerz InactivityTracker.reset_timer! s &*n&6&6###r c | xj dz
c_ | j | | d S N )r r
appendr r s r r zInactivityTracker.start$ sE !!Q&!! &&t,,, r c | xj dz c_ t t 5 | j | d d d n # 1 swxY w Y | d S r! )r r
ValueErrorr
remover r s r r zInactivityTracker.stop) s !!Q&!!
j
!
! 1 1 # * *4 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 s A AAc Z | j o#| j | j z t j k S r )r r r r r
r s r
is_timeoutz InactivityTracker.is_timeout/ s/ --
'$- 74>;K;K K
r timeoutreturnNc || _ d S r )r )r r) s r set_timeoutz InactivityTracker.set_timeout4 s
r )
__name__
__module__ __qualname__r r r r r r r r( intr, r r r r s
^ 7 7 7
3 4 r r ) __doc__r
contextlibr r loggingr r- loggerr trackr1 r r <module>r7 s / / / / / / / / 8 ) ) ) ) ) ) ) ) X r defence360agent/api/__pycache__/inactivity.cpython-311.pyc 0000644 0000000 0000000 00000007130 00000000000 020415 0 ustar
r_j r d Z ddlZddlmZmZ ddlmZ ee Z G d d Z e Z
dS )zThis module implement inactivity tracker for ImunifyAV to automaticaly
shutdown the process when it is idle for certain time (no RPC calls and
long running tasks).
N)contextmanagersuppress) getLoggerc X e Zd Zd Zd Zed Zd Zd Zd Z d Z
de d d
fd Z d
S ) InactivityTrackerc ` t j | _ d| _ g | _ d| _ d S )Nr )time monotonic_last_action_timestamp_long_action_counter_long_actions_list_timeoutselfs S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/inactivity.py__init__zInactivityTracker.__init__
s- &*n&6&6#$%!"$
c j d t j | j z
| j S )Nz0Time from last action is {:.0f}, long actions {})formatr r
r r
r s r __str__zInactivityTracker.__str__ s3 AHH N t : : #
r c # K | | d V | | d S # | | w xY wN)startstopr names r taskzInactivityTracker.task sM
4 EEE IIdOOOOODIIdOOOOs 4 A c 6 t j | _ d S r )r r
r r s r reset_timerz InactivityTracker.reset_timer! s &*n&6&6###r c | xj dz
c_ | j | | d S N )r r
appendr r s r r zInactivityTracker.start$ sE !!Q&!! &&t,,, r c | xj dz c_ t t 5 | j | d d d n # 1 swxY w Y | d S r! )r r
ValueErrorr
remover r s r r zInactivityTracker.stop) s !!Q&!!
j
!
! 1 1 # * *4 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 s A AAc Z | j o#| j | j z t j k S r )r r r r r
r s r
is_timeoutz InactivityTracker.is_timeout/ s/ --
'$- 74>;K;K K
r timeoutreturnNc || _ d S r )r )r r) s r set_timeoutz InactivityTracker.set_timeout4 s
r )
__name__
__module__ __qualname__r r r r r r r r( intr, r r r r s
^ 7 7 7
3 4 r r ) __doc__r
contextlibr r loggingr r- loggerr trackr1 r r <module>r7 s / / / / / / / / 8 ) ) ) ) ) ) ) ) X r defence360agent/api/__pycache__/integration_conf.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000014367 00000000000 022533 0 ustar
r_jg | d Z ddlZddlmZ ddlmZ G d d Z G d de Z G d d
e ZdS ) a Schema reference for `integration.conf`.
Values are always returned as strings by `BaseConfig.get`. Type parsing
(int, int list, bool, rule-id map) is the caller's responsibility. The
format columns below are advisory conventions shared between producers
(wizard, installers, panel templates) and consumers, not runtime-enforced
schemas.
Validation today is narrow: `other/compatibility-check.sh` validates INI
syntax, `[paths] ui_path`, and the `panel_info` script at install time;
integration-script JSON outputs are validated at runtime via Cerberus
schemas under `panels/generic/users_script_schemas/`. All other keys are
read on demand and trusted.
Non-obvious `.get()` behavior:
- Missing file returns `None` (ConfigParser.read silently ignores missing
paths; use `BaseConfig.exists()` to distinguish).
- Malformed INI propagates `configparser.Error`; `.get()` only catches
`KeyError`.
- Section names are case-sensitive (ConfigParser default); option names
are case-insensitive. Match the casing documented below.
Sections
--------
`[PAM]`
- `SERVICE_NAME` (str): PAM service used for UI login
authentication.
`[panel]`
- `type` (str, `cpanel`|`plesk`|`directadmin`|`generic`):
master switch for panel class selection.
`[panel_ports]`
Comma-separated integer lists (e.g. `2082, 2095`). Empty or absent
means "no ports of this class".
- `http_ports`: ports the panel listens on for HTTP admin traffic.
- `https_ports`: HTTPS equivalents.
- `webshield_protected_ports`: subset of the above that WebShield
should protect.
`[panel_login]`
- `ossec_rules` (str, comma-separated `rule_id:bool` pairs, e.g.
`11006:false,11009:true`): OSSEC rule IDs to auto-whitelist for
panel-login events.
`[features]`
Boolean feature flags. Conventional values: `true` / `false`
(case-insensitive).
- `webshield_enabled` (bool)
- `cphulk_enabled` (bool)
`[smtp]`
- `allow_users` (str, comma-separated list of usernames): system
users allowed to send SMTP when the SMTP block feature is active.
- `conflict_config_file` (str, absolute path): panel config file
whose value toggles the SMTP-block conflict check.
- `conflict_config_key` (str): key inside `conflict_config_file`
that holds the conflicting setting.
`[web_server]`
- `server_type` (str, `apache`|`nginx`|...): web server in use.
- `modsec_audit_log` (str, absolute path): ModSecurity audit log
file.
- `modsec_audit_logdir` (str, absolute path): ModSecurity audit log
directory (concurrent writer layout).
- `graceful_restart_script` (str, command string): whitespace-split
command used to gracefully restart the web server
(e.g. `/usr/bin/systemctl restart apache2`).
- `config_test_script` (str, command string): whitespace-split
command used to validate the web server configuration before
reload (e.g. `/usr/sbin/apache2ctl -t`).
`[integration_scripts]`
Values are absolute paths to scripts executed by the agent as root.
Populate with trusted, integrator-controlled paths only; do not
interpolate user-controlled data.
- `users` (str path): emits JSON user list.
- `domains` (str path): emits JSON domain -> owner mapping.
- `admins` (str path): emits JSON admin list.
- `panel_info` (str path): emits JSON `{name, version, ...}`
describing the panel.
- `modsec_domain_config_script` (str path): emits per-domain
ModSecurity overrides.
`[paths]`
- `ui_path` (str, absolute path): document root for the standalone
UI.
- `ui_path_owner` (str, `user:group`): owner applied to UI files
during install.
`[malware]`
- `basedir` (str, **whitespace-separated** paths): base directories
scanned for malware. Note the separator differs from port lists
(whitespace here, comma for port lists).
`[metadata]`
- `schema_version` (int): schema version number.
- `created_by` (str, `wizard`|`agent`|`manual`): who wrote the file;
useful for support triage.
N)Optional)GP_FILEc j e Zd Zed Zed Zedededee fd ZdS )
BaseConfigc J t j | j S )N)ospathexists
_conf_path)clss Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/integration_conf.pyr
zBaseConfig.existsq s w~~cn--- c Z ddl m} | }| | j |S )Nr ) ConfigParser) configparserr readr )r r integration_confs r
to_dictzBaseConfig.to_dictu s< ------'<>> cn--- r sectionoptionreturnc f | | | S # t $ r Y dS w xY w)z`
Return *option* value in *section* in config if exist,
None otherwise.
N)r KeyError)r r r s r
getzBaseConfig.get~ sA ;;==)&1 1 44 s "
00N) __name__
__module__ __qualname__ classmethodr
r strr r r r
r r p s . . [. [ # s x} [ r r c e Zd ZeZdS )IntegrationConfigN)r r r r r r r r
r" r" s JJJr r" c e Zd ZdZdS )ClIntegrationConfigz!/opt/cpvendor/etc/integration.iniN)r r r r r r r
r$ r$ s 4JJJr r$ ) __doc__r typingr 3defence360agent.application.determine_hosting_panelr r r" r$ r r r
<module>r( s g gR
G G G G G G 4
5 5 5 5 5* 5 5 5 5 5r defence360agent/api/__pycache__/integration_conf.cpython-311.pyc 0000644 0000000 0000000 00000014367 00000000000 021574 0 ustar
r_jg | d Z ddlZddlmZ ddlmZ G d d Z G d de Z G d d
e ZdS ) a Schema reference for `integration.conf`.
Values are always returned as strings by `BaseConfig.get`. Type parsing
(int, int list, bool, rule-id map) is the caller's responsibility. The
format columns below are advisory conventions shared between producers
(wizard, installers, panel templates) and consumers, not runtime-enforced
schemas.
Validation today is narrow: `other/compatibility-check.sh` validates INI
syntax, `[paths] ui_path`, and the `panel_info` script at install time;
integration-script JSON outputs are validated at runtime via Cerberus
schemas under `panels/generic/users_script_schemas/`. All other keys are
read on demand and trusted.
Non-obvious `.get()` behavior:
- Missing file returns `None` (ConfigParser.read silently ignores missing
paths; use `BaseConfig.exists()` to distinguish).
- Malformed INI propagates `configparser.Error`; `.get()` only catches
`KeyError`.
- Section names are case-sensitive (ConfigParser default); option names
are case-insensitive. Match the casing documented below.
Sections
--------
`[PAM]`
- `SERVICE_NAME` (str): PAM service used for UI login
authentication.
`[panel]`
- `type` (str, `cpanel`|`plesk`|`directadmin`|`generic`):
master switch for panel class selection.
`[panel_ports]`
Comma-separated integer lists (e.g. `2082, 2095`). Empty or absent
means "no ports of this class".
- `http_ports`: ports the panel listens on for HTTP admin traffic.
- `https_ports`: HTTPS equivalents.
- `webshield_protected_ports`: subset of the above that WebShield
should protect.
`[panel_login]`
- `ossec_rules` (str, comma-separated `rule_id:bool` pairs, e.g.
`11006:false,11009:true`): OSSEC rule IDs to auto-whitelist for
panel-login events.
`[features]`
Boolean feature flags. Conventional values: `true` / `false`
(case-insensitive).
- `webshield_enabled` (bool)
- `cphulk_enabled` (bool)
`[smtp]`
- `allow_users` (str, comma-separated list of usernames): system
users allowed to send SMTP when the SMTP block feature is active.
- `conflict_config_file` (str, absolute path): panel config file
whose value toggles the SMTP-block conflict check.
- `conflict_config_key` (str): key inside `conflict_config_file`
that holds the conflicting setting.
`[web_server]`
- `server_type` (str, `apache`|`nginx`|...): web server in use.
- `modsec_audit_log` (str, absolute path): ModSecurity audit log
file.
- `modsec_audit_logdir` (str, absolute path): ModSecurity audit log
directory (concurrent writer layout).
- `graceful_restart_script` (str, command string): whitespace-split
command used to gracefully restart the web server
(e.g. `/usr/bin/systemctl restart apache2`).
- `config_test_script` (str, command string): whitespace-split
command used to validate the web server configuration before
reload (e.g. `/usr/sbin/apache2ctl -t`).
`[integration_scripts]`
Values are absolute paths to scripts executed by the agent as root.
Populate with trusted, integrator-controlled paths only; do not
interpolate user-controlled data.
- `users` (str path): emits JSON user list.
- `domains` (str path): emits JSON domain -> owner mapping.
- `admins` (str path): emits JSON admin list.
- `panel_info` (str path): emits JSON `{name, version, ...}`
describing the panel.
- `modsec_domain_config_script` (str path): emits per-domain
ModSecurity overrides.
`[paths]`
- `ui_path` (str, absolute path): document root for the standalone
UI.
- `ui_path_owner` (str, `user:group`): owner applied to UI files
during install.
`[malware]`
- `basedir` (str, **whitespace-separated** paths): base directories
scanned for malware. Note the separator differs from port lists
(whitespace here, comma for port lists).
`[metadata]`
- `schema_version` (int): schema version number.
- `created_by` (str, `wizard`|`agent`|`manual`): who wrote the file;
useful for support triage.
N)Optional)GP_FILEc j e Zd Zed Zed Zedededee fd ZdS )
BaseConfigc J t j | j S )N)ospathexists
_conf_path)clss Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/integration_conf.pyr
zBaseConfig.existsq s w~~cn--- c Z ddl m} | }| | j |S )Nr ) ConfigParser) configparserr readr )r r integration_confs r
to_dictzBaseConfig.to_dictu s< ------'<>> cn--- r sectionoptionreturnc f | | | S # t $ r Y dS w xY w)z`
Return *option* value in *section* in config if exist,
None otherwise.
N)r KeyError)r r r s r
getzBaseConfig.get~ sA ;;==)&1 1 44 s "
00N) __name__
__module__ __qualname__ classmethodr
r strr r r r
r r p s . . [. [ # s x} [ r r c e Zd ZeZdS )IntegrationConfigN)r r r r r r r r
r" r" s JJJr r" c e Zd ZdZdS )ClIntegrationConfigz!/opt/cpvendor/etc/integration.iniN)r r r r r r r
r$ r$ s 4JJJr r$ ) __doc__r typingr 3defence360agent.application.determine_hosting_panelr r r" r$ r r r
<module>r( s g gR
G G G G G G 4
5 5 5 5 5* 5 5 5 5 5r defence360agent/api/__pycache__/jwt_issuer.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000012574 00000000000 021377 0 ustar
r_j d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlmZ d dl m
Z
m Z d dl m
Z
e
j e j e
j e j iZ G d d ZdS ) N)datetime timedelta)Path)InvalidTokenException)UIRoleUserType)atomic_rewritec n e Zd Z ed Z ed Z ej dd Z ej dd Z e
e e Z e
e e Z
ed Zed efd
Zed ed ed efd
Zededed edz fd Zedefd ZdS ) JWTIssuerz /var/imunify360/.api-secret.keyz$/var/imunify360/.api-secret-prev.key#I360_JWT_TOKEN_EXPIRATION_TTL_HOURS $I360_JWT_SECRET_EXPIRATION_TTL_HOURS )hoursc t j | j }|j }n# t $ r d}Y nw xY wt j |z
| j j k S )Ng )
osstatJWT_SECRET_FILEst_mtimeFileNotFoundErrorr now timestampSECRET_EXPIRATION_TTLseconds)clsr r s S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/jwt_issuer.pyis_secret_expiredzJWTIssuer.is_secret_expired sy %73.//D }HH ! HHH
LNN $ $ & & 1'/
0
s # 22returnc | rt j t j z d fdt d D }| j s| j t t | j |t | j dd |S | j S )N c 3 @ K | ]}t j V d S )N)secretschoice).0_alphabets r <genexpr>z(JWTIssuer._get_secret.<locals>.<genexpr>0 s- M Ma !9!9 M M M M M M @ i )backupuid permissions)
r stringascii_uppercasedigitsjoinranger existstouchr strJWT_SECRET_FILE_PREV read_text)r
new_secretr& s @r _get_secretzJWTIssuer._get_secret, s " " 3 -
=H M M M M599 M M MMMJ&--//
,#))+++ C'((3344 !
&0022 2r( user_name user_typec ddl }| ||t j | j z d| S )z
Generates a token with several encoded fields:
user name,
user type,
expiration timestamp
r N)r; usernameexp)jwtencoder r TOKEN_EXPIRATION_TTLr r9 )r r: r; r? s r get_tokenzJWTIssuer.get_token> s_
zz & % )AALLNN
OO
r( tokensecretNc ` dd l } | ||dg S # |j $ r Y d S w xY w)Nr HS256)
algorithms)r? decode
PyJWTError)r rC rD r? s r _parse_tokenzJWTIssuer._parse_tokenR sN
::eV :BB B~ DD s
--c | j | j fD ]_}| s| || }|r |d t
|d dc S `t
d )Nr= r; )r: r;
INVALID_TOKEN)r r6 r3 rJ r7 UIRoleToUserTyper )r rC
secret_pthdecodeds r parse_tokenzJWTIssuer.parse_token^ s .0HI
9
9J $$&&
&&uj.B.B.D.DEEG
!(!4!1'+2F!G
(88 8r( )__name__
__module__ __qualname__r r r6 r getenv JWT_TOKEN_EXPIRATION_TTL_HOURS JWT_SECRET_EXPIRATION_TTL_HOURSr intrA r classmethodr r5 r9 r rB dictrJ rP r( r r r s d<==O 4 FGG%.RY-q& &" '0bi.' '# %933/M+N+NOOO %Ic122
[
3C 3 3 3 [3"
#
&
S
[
& c dTk [ 9 9 9 9 [ 9 9 9r( r )r r" r. r r pathlibr "defence360agent.subsys.panels.baser defence360agent.contracts.configr r defence360agent.utilsr ADMINROOTCLIENTNON_ROOTrM r rZ r( r <module>rc s
( ( ( ( ( ( ( ( D D D D D D = = = = = = = = 0 0 0 0 0 0 L(-
M8$ Y9 Y9 Y9 Y9 Y9 Y9 Y9 Y9 Y9 Y9r( defence360agent/api/__pycache__/jwt_issuer.cpython-311.pyc 0000644 0000000 0000000 00000012574 00000000000 020440 0 ustar
r_j d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlmZ d dl m
Z
m Z d dl m
Z
e
j e j e
j e j iZ G d d ZdS ) N)datetime timedelta)Path)InvalidTokenException)UIRoleUserType)atomic_rewritec n e Zd Z ed Z ed Z ej dd Z ej dd Z e
e e Z e
e e Z
ed Zed efd
Zed ed ed efd
Zededed edz fd Zedefd ZdS ) JWTIssuerz /var/imunify360/.api-secret.keyz$/var/imunify360/.api-secret-prev.key#I360_JWT_TOKEN_EXPIRATION_TTL_HOURS $I360_JWT_SECRET_EXPIRATION_TTL_HOURS )hoursc t j | j }|j }n# t $ r d}Y nw xY wt j |z
| j j k S )Ng )
osstatJWT_SECRET_FILEst_mtimeFileNotFoundErrorr now timestampSECRET_EXPIRATION_TTLseconds)clsr r s S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/jwt_issuer.pyis_secret_expiredzJWTIssuer.is_secret_expired sy %73.//D }HH ! HHH
LNN $ $ & & 1'/
0
s # 22returnc | rt j t j z d fdt d D }| j s| j t t | j |t | j dd |S | j S )N c 3 @ K | ]}t j V d S )N)secretschoice).0_alphabets r <genexpr>z(JWTIssuer._get_secret.<locals>.<genexpr>0 s- M Ma !9!9 M M M M M M @ i )backupuid permissions)
r stringascii_uppercasedigitsjoinranger existstouchr strJWT_SECRET_FILE_PREV read_text)r
new_secretr& s @r _get_secretzJWTIssuer._get_secret, s " " 3 -
=H M M M M599 M M MMMJ&--//
,#))+++ C'((3344 !
&0022 2r( user_name user_typec ddl }| ||t j | j z d| S )z
Generates a token with several encoded fields:
user name,
user type,
expiration timestamp
r N)r; usernameexp)jwtencoder r TOKEN_EXPIRATION_TTLr r9 )r r: r; r? s r get_tokenzJWTIssuer.get_token> s_
zz & % )AALLNN
OO
r( tokensecretNc ` dd l } | ||dg S # |j $ r Y d S w xY w)Nr HS256)
algorithms)r? decode
PyJWTError)r rC rD r? s r _parse_tokenzJWTIssuer._parse_tokenR sN
::eV :BB B~ DD s
--c | j | j fD ]_}| s| || }|r |d t
|d dc S `t
d )Nr= r; )r: r;
INVALID_TOKEN)r r6 r3 rJ r7 UIRoleToUserTyper )r rC
secret_pthdecodeds r parse_tokenzJWTIssuer.parse_token^ s .0HI
9
9J $$&&
&&uj.B.B.D.DEEG
!(!4!1'+2F!G
(88 8r( )__name__
__module__ __qualname__r r r6 r getenv JWT_TOKEN_EXPIRATION_TTL_HOURS JWT_SECRET_EXPIRATION_TTL_HOURSr intrA r classmethodr r5 r9 r rB dictrJ rP r( r r r s d<==O 4 FGG%.RY-q& &" '0bi.' '# %933/M+N+NOOO %Ic122
[
3C 3 3 3 [3"
#
&
S
[
& c dTk [ 9 9 9 9 [ 9 9 9r( r )r r" r. r r pathlibr "defence360agent.subsys.panels.baser defence360agent.contracts.configr r defence360agent.utilsr ADMINROOTCLIENTNON_ROOTrM r rZ r( r <module>rc s
( ( ( ( ( ( ( ( D D D D D D = = = = = = = = 0 0 0 0 0 0 L(-
M8$ Y9 Y9 Y9 Y9 Y9 Y9 Y9 Y9 Y9 Y9r( defence360agent/api/__pycache__/newsfeed.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000020416 00000000000 020773 0 ustar
r_j1 d Z ddlZddlZddlZddlZddlZddlmZ ddl m
Z
ddl m Z ddl
mZ ddlmZ ddlmZ ee Zd Zd
Zg d Zd d
gZ G d d
Zd Z G d d ZdS )z4
This module gets and caches news from imunify blog
N) HTTPError) ElementTree)suppress) getLogger) HostingPanel)retry_onz!https://blog.imunify360.com/feed/i, )titlepubDateguidlinkr NewsFeedc e Zd ZdZdZe eej e j
j fdd d Z ed Z
ed Zeefd Zed
Zd S ) r
< z"/var/imunify360/tmp/feed_cache.rss
c t j | S N)r
clear_cache)argss Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/newsfeed.py<lambda>zNewsFeed.<lambda>" s x 3T : ) max_trieson_errorc K | r| d {V t t j t | j 5 }t j | }|
d }fd|D cd d d S # 1 swxY w Y d S )Nitemc R g | ]#} | d |D $S )c D i | ] }|j t v |j |j S )tag TAGS_TO_READtext.0childs r
<dictcomp>z+NewsFeed.get.<locals>.<listcomp>.<dictcomp>- s5 yL00 Iuz000r )
is_allowed)r# r
category_infos r
<listcomp>z NewsFeed.get.<locals>.<listcomp>, sX ++D11 !% r ) _expired_refresh
PanelCategoryr NAMEopencache_file_pathr
fromstringreaditer)cls
cache_fileroot imunify_newsr' s @r getz NewsFeed.get s <<>> !,,.. %lnn&9::
#%
&
& * )*//*;*;<<D 99V,,L )
s &A B<<C C c K t j | j }t j | st j | t d t | j d 5 }| |
d {V d d d d S # 1 swxY w Y d S )NzRefresh news cachewb) ospathdirnamer. existsmakedirsloggerinfor- write_fetch)r2 cache_file_dir_pathr3 s r r* zNewsFeed._refresh6 s gooc.A B Bw~~ 122 - K+ , , , ()))
#%t
,
, 1
3::<< / / / / / / 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1s .CC Cc t j | j r%t j | j }nd}t j |z
dz }|| j k S )Nr r )r9 r: r< r. getmtimetime cache_ttl)r2 last_modified_time cache_ages r r) zNewsFeed._expired? s`
7>>#- . . #!#!1!1#2E!F!F !" Y[[#55; 3=((r c x K t j d t t | d {V S r )asyncioget_event_looprun_in_executor
_fetch_urlRSS_FEED_REMOTE_URL)r2 timeouts r rA zNewsFeed._fetchI sO +--== * 17
r c K t d| t t 5 t j | j d d d d S # 1 swxY w Y d S )Nz Clearing cache due to error: %s)r> warningr FileNotFoundErrorr9 unlinkr. )r2 r s r r zNewsFeed.clear_cacheO s 8$???
'
(
( + + Ic) * * * + + + + + + + + + + + + + + + + + +s AA A N)__name__
__module__ __qualname__rF r. classmethodr r
ParseErrorurllibrequestURLErrorr6 r* r) _TIMEOUTrA r r r r r
r
s I:O
X !89::
[ $ 1 1 [1 ) ) [) "*
[
+ + [+ + +r c ddi}t j | | }t j || 5 }| cd d d S # 1 swxY w Y d S # t
j $ r t w xY w)Nz
User-Agentzimunify360-urllib/0.1)headers)rO )rY rZ Requesturlopenr0 socketrO TimeoutError)urlrO r^ reqresponses r rM rM V s !89n$$S'$::
^
#
#C
#
9
9 #X==?? # # # # # # # # # # # # # # # # # # > s0 AA6 A) A6 )A--A6 0A-1A6 6B
c & e Zd Zh dZdZd Zd ZdS )r+ > pleskcpanel directadminzstandalone-imunifyc | }|t j v r|n t j | _ t j t j h| j hz
z | _ d S r )lowerr+ panel_categoriesno_panel_categorycurrent competitors)selfp_names r __init__zPanelCategory.__init__i sb 777
F 0
)9 +=
\N= r c d |D }d | | j v }t fd| j D }| p|S )Nc 2 h | ]}|j d k
|j S )category)r r! r" s r <setcomp>z+PanelCategory.is_allowed.<locals>.<setcomp>u s-
EI,C,CEJ,C,C,Cr z|||c 3 K | ]}|v V d S r r )r# comjoined_categorys r <genexpr>z+PanelCategory.is_allowed.<locals>.<genexpr>} s9 &
&
'*C? "&
&
&
&
&
&
r )joinrk rn anyro )rp r item_categoriescurrent_in_categorycompetitors_in_categoryry s @r r& zPanelCategory.is_allowedt s
$(
**_55;;== "lo ="% &
&
&
&
.2.>&
&
&
#
#
+*A.AAr N)rT rU rV rl rm rr r& r r r r+ r+ c sK :99, B B B B Br r+ ) __doc__rJ r9 ra rE urllib.requestrY urllib.errorr xml.etreer
contextlibr loggingr (defence360agent.simple_rpc.hosting_panelr defence360agent.utilsr __file__r> rN r\ r __all__r
rM r+ r r r <module>r sP
" " " " " " ! ! ! ! ! ! A A A A A A * * * * * * 8 9 333
#9+ 9+ 9+ 9+ 9+ 9+ 9+ 9+x
B B B B B B B B B Br defence360agent/api/__pycache__/newsfeed.cpython-311.pyc 0000644 0000000 0000000 00000020416 00000000000 020034 0 ustar
r_j1 d Z ddlZddlZddlZddlZddlZddlmZ ddl m
Z
ddl m Z ddl
mZ ddlmZ ddlmZ ee Zd Zd
Zg d Zd d
gZ G d d
Zd Z G d d ZdS )z4
This module gets and caches news from imunify blog
N) HTTPError) ElementTree)suppress) getLogger) HostingPanel)retry_onz!https://blog.imunify360.com/feed/i, )titlepubDateguidlinkr NewsFeedc e Zd ZdZdZe eej e j
j fdd d Z ed Z
ed Zeefd Zed
Zd S ) r
< z"/var/imunify360/tmp/feed_cache.rss
c t j | S N)r
clear_cache)argss Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/newsfeed.py<lambda>zNewsFeed.<lambda>" s x 3T : ) max_trieson_errorc K | r| d {V t t j t | j 5 }t j | }|
d }fd|D cd d d S # 1 swxY w Y d S )Nitemc R g | ]#} | d |D $S )c D i | ] }|j t v |j |j S )tag TAGS_TO_READtext.0childs r
<dictcomp>z+NewsFeed.get.<locals>.<listcomp>.<dictcomp>- s5 yL00 Iuz000r )
is_allowed)r# r
category_infos r
<listcomp>z NewsFeed.get.<locals>.<listcomp>, sX ++D11 !% r ) _expired_refresh
PanelCategoryr NAMEopencache_file_pathr
fromstringreaditer)cls
cache_fileroot imunify_newsr' s @r getz NewsFeed.get s <<>> !,,.. %lnn&9::
#%
&
& * )*//*;*;<<D 99V,,L )
s &A B<<C C c K t j | j }t j | st j | t d t | j d 5 }| |
d {V d d d d S # 1 swxY w Y d S )NzRefresh news cachewb) ospathdirnamer. existsmakedirsloggerinfor- write_fetch)r2 cache_file_dir_pathr3 s r r* zNewsFeed._refresh6 s gooc.A B Bw~~ 122 - K+ , , , ()))
#%t
,
, 1
3::<< / / / / / / 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1s .CC Cc t j | j r%t j | j }nd}t j |z
dz }|| j k S )Nr r )r9 r: r< r. getmtimetime cache_ttl)r2 last_modified_time cache_ages r r) zNewsFeed._expired? s`
7>>#- . . #!#!1!1#2E!F!F !" Y[[#55; 3=((r c x K t j d t t | d {V S r )asyncioget_event_looprun_in_executor
_fetch_urlRSS_FEED_REMOTE_URL)r2 timeouts r rA zNewsFeed._fetchI sO +--== * 17
r c K t d| t t 5 t j | j d d d d S # 1 swxY w Y d S )Nz Clearing cache due to error: %s)r> warningr FileNotFoundErrorr9 unlinkr. )r2 r s r r zNewsFeed.clear_cacheO s 8$???
'
(
( + + Ic) * * * + + + + + + + + + + + + + + + + + +s AA A N)__name__
__module__ __qualname__rF r. classmethodr r
ParseErrorurllibrequestURLErrorr6 r* r) _TIMEOUTrA r r r r r
r
s I:O
X !89::
[ $ 1 1 [1 ) ) [) "*
[
+ + [+ + +r c ddi}t j | | }t j || 5 }| cd d d S # 1 swxY w Y d S # t
j $ r t w xY w)Nz
User-Agentzimunify360-urllib/0.1)headers)rO )rY rZ Requesturlopenr0 socketrO TimeoutError)urlrO r^ reqresponses r rM rM V s !89n$$S'$::
^
#
#C
#
9
9 #X==?? # # # # # # # # # # # # # # # # # # > s0 AA6 A) A6 )A--A6 0A-1A6 6B
c & e Zd Zh dZdZd Zd ZdS )r+ > pleskcpanel directadminzstandalone-imunifyc | }|t j v r|n t j | _ t j t j h| j hz
z | _ d S r )lowerr+ panel_categoriesno_panel_categorycurrent competitors)selfp_names r __init__zPanelCategory.__init__i sb 777
F 0
)9 +=
\N= r c d |D }d | | j v }t fd| j D }| p|S )Nc 2 h | ]}|j d k
|j S )category)r r! r" s r <setcomp>z+PanelCategory.is_allowed.<locals>.<setcomp>u s-
EI,C,CEJ,C,C,Cr z|||c 3 K | ]}|v V d S r r )r# comjoined_categorys r <genexpr>z+PanelCategory.is_allowed.<locals>.<genexpr>} s9 &
&
'*C? "&
&
&
&
&
&
r )joinrk rn anyro )rp r item_categoriescurrent_in_categorycompetitors_in_categoryry s @r r& zPanelCategory.is_allowedt s
$(
**_55;;== "lo ="% &
&
&
&
.2.>&
&
&
#
#
+*A.AAr N)rT rU rV rl rm rr r& r r r r+ r+ c sK :99, B B B B Br r+ ) __doc__rJ r9 ra rE urllib.requestrY urllib.errorr xml.etreer
contextlibr loggingr (defence360agent.simple_rpc.hosting_panelr defence360agent.utilsr __file__r> rN r\ r __all__r
rM r+ r r r <module>r sP
" " " " " " ! ! ! ! ! ! A A A A A A * * * * * * 8 9 333
#9+ 9+ 9+ 9+ 9+ 9+ 9+ 9+x
B B B B B B B B B Br defence360agent/api/__pycache__/pam_auth.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003401 00000000000 020764 0 ustar
r_j D d dl mZ d dlmZ d dlmZ G d d ZdS ) )IntegrationConfig)UIRole)get_admin_listc . e Zd ZdZdefdZdedefdZdS )PamAuthz system-authreturnc ddl m } t }|d d }n# t $ r
| j }Y nw xY w | }| ||| S )Nr )pamPAM SERVICE_NAME)service)r
r to_dictKeyErrorDEFAULT_AUTH_SERVICE authenticate)selfusernamepasswordr
configr
ps Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/pam_auth.pyr zPamAuth.authenticate s 0&((0022F UmN3GG 0 0 0/GGG 0
CEE~~h'~BBBs .7 A
A r c f K t d {V }||v r t j n t j S )N)r r ADMINCLIENT)r r adminss r
get_user_typezPamAuth.get_user_type s; %'''''''' '6 1 1v||v}D N) __name__
__module__ __qualname__r boolr strr r r r r r sd (
C$
C
C
C
CEC EF E E E E E Er r N)$defence360agent.api.integration_confr defence360agent.contracts.configr +defence360agent.subsys.panels.generic.panelr r r# r r <module>r' sw B B B B B B 3 3 3 3 3 3 F F F F F FE E E E E E E E E Er defence360agent/api/__pycache__/pam_auth.cpython-311.pyc 0000644 0000000 0000000 00000003401 00000000000 020025 0 ustar
r_j D d dl mZ d dlmZ d dlmZ G d d ZdS ) )IntegrationConfig)UIRole)get_admin_listc . e Zd ZdZdefdZdedefdZdS )PamAuthz system-authreturnc ddl m } t }|d d }n# t $ r
| j }Y nw xY w | }| ||| S )Nr )pamPAM SERVICE_NAME)service)r
r to_dictKeyErrorDEFAULT_AUTH_SERVICE authenticate)selfusernamepasswordr
configr
ps Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/pam_auth.pyr zPamAuth.authenticate s 0&((0022F UmN3GG 0 0 0/GGG 0
CEE~~h'~BBBs .7 A
A r c f K t d {V }||v r t j n t j S )N)r r ADMINCLIENT)r r adminss r
get_user_typezPamAuth.get_user_type s; %'''''''' '6 1 1v||v}D N) __name__
__module__ __qualname__r boolr strr r r r r r sd (
C$
C
C
C
CEC EF E E E E E Er r N)$defence360agent.api.integration_confr defence360agent.contracts.configr +defence360agent.subsys.panels.generic.panelr r r# r r <module>r' sw B B B B B B 3 3 3 3 3 3 F F F F F FE E E E E E E E E Er defence360agent/api/health.py 0000644 0000000 0000000 00000006603 00000000000 013143 0 ustar """This module implements health status reporting for watchdog operation.
Module receive important health metrics and exports its status of overall
health assessment. This health assessment can be used by external watchdog
scripts to initiate agent restart.
Process is considered "healthy" if:
* it is being shut down and shutdown timeout has not elapsed -> HEALTHY
* it is not registered -> HEALTHY
* process was started more than 6 hours ago and no data was sent to server
within last 6 hours -> FAULTY
* process was started more than 18 hours ago and no data was received from
server within last 18 hours -> FAULTY
Otherwise process is considered HEALTHY.
As agent exports this information through RPC interface there is an additional
implicit "health" requirement that:
* it responds to RPC requests.
This implicit requirement considered valid because UI fully depends on RPC
so it does not make health assessment any worse than it should."""
import collections
HealthStatus = collections.namedtuple("HealthStatus", ["healthy", "why"])
class HealthSensor:
"""HealthSensor receives events about agent operation and provides
information about overall status.
Initially, new HealthSensor object assumes:
* process was started long ago;
* process is not being shut down;
* data from server has been received long ago;
* data to server was sent long ago;
* agent is registered (license is valid).
So, initial health status is False (faulty)."""
RECEIVE_WINDOW = 18 * 3600
SEND_WINDOW = 6 * 3600
SHUTDOWN_TIMEOUT = 600
def __init__(self):
self._started_at = 0.0
self._shutdown_at = 0.0
self._last_received = 0.0
self._last_sent = 0.0
self._is_registered = True
def starting(self, when: float) -> None:
"""Records a moment of agent startup"""
self._started_at = when
def shutting_down(self, when: float) -> None:
"""Records a moment of externally initiated agent shutdown"""
self._shutdown_at = when
def server_data_received(self, when: float) -> None:
"""Records a moment when data was received from server"""
self._last_received = when
def server_data_sent(self, when: float) -> None:
"""Records a moment when data was sent to server"""
self._last_sent = when
def registered(self) -> None:
"""Marks agent as being registered"""
self._is_registered = True
def unregistered(self) -> None:
"""Marks agent as being not registered"""
self._is_registered = False
def status(self, now: float) -> HealthStatus:
if self._shutdown_at > 0:
if now - self._shutdown_at >= self.SHUTDOWN_TIMEOUT:
return HealthStatus(False, "stuck at shutdown")
return HealthStatus(True, "shutdown is in progress")
if not self._is_registered:
return HealthStatus(True, "not registered")
if (
now - self._started_at >= self.RECEIVE_WINDOW
and now - self._last_received >= self.RECEIVE_WINDOW
):
return HealthStatus(False, "no data received from server")
if (
now - self._started_at >= self.SEND_WINDOW
and now - self._last_sent >= self.SEND_WINDOW
):
return HealthStatus(False, "no data sent to server")
return HealthStatus(True, "all is ok")
sensor = HealthSensor()
defence360agent/api/inactivity.py 0000644 0000000 0000000 00000002770 00000000000 014062 0 ustar """This module implement inactivity tracker for ImunifyAV to automaticaly
shutdown the process when it is idle for certain time (no RPC calls and
long running tasks).
"""
import time
from contextlib import contextmanager, suppress
from logging import getLogger
logger = getLogger(__name__)
class InactivityTracker:
def __init__(self):
self._last_action_timestamp = time.monotonic()
self._long_action_counter = 0
self._long_actions_list = []
self._timeout = 0
def __str__(self):
return "Time from last action is {:.0f}, long actions {}".format(
time.monotonic() - self._last_action_timestamp,
self._long_actions_list,
)
@contextmanager
def task(self, name):
self.start(name)
try:
yield
finally:
self.stop(name)
def reset_timer(self):
self._last_action_timestamp = time.monotonic()
def start(self, name):
self._long_action_counter += 1
self._long_actions_list.append(name)
self.reset_timer()
def stop(self, name):
self._long_action_counter -= 1
with suppress(ValueError):
self._long_actions_list.remove(name)
self.reset_timer()
def is_timeout(self):
return (not self._long_action_counter) and (
self._last_action_timestamp + self._timeout <= time.monotonic()
)
def set_timeout(self, timeout: int) -> None:
self._timeout = timeout
track = InactivityTracker()
defence360agent/api/integration_conf.py 0000644 0000000 0000000 00000011547 00000000000 015231 0 ustar """Schema reference for `integration.conf`.
Values are always returned as strings by `BaseConfig.get`. Type parsing
(int, int list, bool, rule-id map) is the caller's responsibility. The
format columns below are advisory conventions shared between producers
(wizard, installers, panel templates) and consumers, not runtime-enforced
schemas.
Validation today is narrow: `other/compatibility-check.sh` validates INI
syntax, `[paths] ui_path`, and the `panel_info` script at install time;
integration-script JSON outputs are validated at runtime via Cerberus
schemas under `panels/generic/users_script_schemas/`. All other keys are
read on demand and trusted.
Non-obvious `.get()` behavior:
- Missing file returns `None` (ConfigParser.read silently ignores missing
paths; use `BaseConfig.exists()` to distinguish).
- Malformed INI propagates `configparser.Error`; `.get()` only catches
`KeyError`.
- Section names are case-sensitive (ConfigParser default); option names
are case-insensitive. Match the casing documented below.
Sections
--------
`[PAM]`
- `SERVICE_NAME` (str): PAM service used for UI login
authentication.
`[panel]`
- `type` (str, `cpanel`|`plesk`|`directadmin`|`generic`):
master switch for panel class selection.
`[panel_ports]`
Comma-separated integer lists (e.g. `2082, 2095`). Empty or absent
means "no ports of this class".
- `http_ports`: ports the panel listens on for HTTP admin traffic.
- `https_ports`: HTTPS equivalents.
- `webshield_protected_ports`: subset of the above that WebShield
should protect.
`[panel_login]`
- `ossec_rules` (str, comma-separated `rule_id:bool` pairs, e.g.
`11006:false,11009:true`): OSSEC rule IDs to auto-whitelist for
panel-login events.
`[features]`
Boolean feature flags. Conventional values: `true` / `false`
(case-insensitive).
- `webshield_enabled` (bool)
- `cphulk_enabled` (bool)
`[smtp]`
- `allow_users` (str, comma-separated list of usernames): system
users allowed to send SMTP when the SMTP block feature is active.
- `conflict_config_file` (str, absolute path): panel config file
whose value toggles the SMTP-block conflict check.
- `conflict_config_key` (str): key inside `conflict_config_file`
that holds the conflicting setting.
`[web_server]`
- `server_type` (str, `apache`|`nginx`|...): web server in use.
- `modsec_audit_log` (str, absolute path): ModSecurity audit log
file.
- `modsec_audit_logdir` (str, absolute path): ModSecurity audit log
directory (concurrent writer layout).
- `graceful_restart_script` (str, command string): whitespace-split
command used to gracefully restart the web server
(e.g. `/usr/bin/systemctl restart apache2`).
- `config_test_script` (str, command string): whitespace-split
command used to validate the web server configuration before
reload (e.g. `/usr/sbin/apache2ctl -t`).
`[integration_scripts]`
Values are absolute paths to scripts executed by the agent as root.
Populate with trusted, integrator-controlled paths only; do not
interpolate user-controlled data.
- `users` (str path): emits JSON user list.
- `domains` (str path): emits JSON domain -> owner mapping.
- `admins` (str path): emits JSON admin list.
- `panel_info` (str path): emits JSON `{name, version, ...}`
describing the panel.
- `modsec_domain_config_script` (str path): emits per-domain
ModSecurity overrides.
`[paths]`
- `ui_path` (str, absolute path): document root for the standalone
UI.
- `ui_path_owner` (str, `user:group`): owner applied to UI files
during install.
`[malware]`
- `basedir` (str, **whitespace-separated** paths): base directories
scanned for malware. Note the separator differs from port lists
(whitespace here, comma for port lists).
`[metadata]`
- `schema_version` (int): schema version number.
- `created_by` (str, `wizard`|`agent`|`manual`): who wrote the file;
useful for support triage.
"""
import os
from typing import Optional
from defence360agent.application.determine_hosting_panel import GP_FILE
class BaseConfig:
@classmethod
def exists(cls):
return os.path.exists(cls._conf_path)
@classmethod
def to_dict(cls):
from configparser import ConfigParser
integration_conf = ConfigParser()
integration_conf.read(cls._conf_path)
return integration_conf
@classmethod
def get(cls, section: str, option: str) -> Optional[str]:
"""
Return *option* value in *section* in config if exist,
None otherwise.
"""
try:
return cls.to_dict()[section][option]
except KeyError:
return None
class IntegrationConfig(BaseConfig):
_conf_path = GP_FILE
class ClIntegrationConfig(BaseConfig):
_conf_path = "/opt/cpvendor/etc/integration.ini"
defence360agent/api/jwt_issuer.py 0000644 0000000 0000000 00000006373 00000000000 014100 0 ustar import os
import secrets
import string
from datetime import datetime, timedelta
from pathlib import Path
from defence360agent.subsys.panels.base import InvalidTokenException
from defence360agent.contracts.config import UIRole, UserType
from defence360agent.utils import atomic_rewrite
UIRoleToUserType = {
UIRole.ADMIN: UserType.ROOT,
UIRole.CLIENT: UserType.NON_ROOT,
}
class JWTIssuer:
JWT_SECRET_FILE = Path("/var/imunify360/.api-secret.key")
JWT_SECRET_FILE_PREV = Path("/var/imunify360/.api-secret-prev.key")
JWT_TOKEN_EXPIRATION_TTL_HOURS = os.getenv(
"I360_JWT_TOKEN_EXPIRATION_TTL_HOURS", 6
)
JWT_SECRET_EXPIRATION_TTL_HOURS = os.getenv(
"I360_JWT_SECRET_EXPIRATION_TTL_HOURS", 24
)
TOKEN_EXPIRATION_TTL = timedelta(hours=int(JWT_TOKEN_EXPIRATION_TTL_HOURS))
SECRET_EXPIRATION_TTL = timedelta(
hours=int(JWT_SECRET_EXPIRATION_TTL_HOURS)
)
@classmethod
def is_secret_expired(cls):
try:
stat = os.stat(cls.JWT_SECRET_FILE)
except FileNotFoundError:
st_mtime = 0.0
else:
st_mtime = stat.st_mtime
return (
datetime.now().timestamp() - st_mtime
> cls.SECRET_EXPIRATION_TTL.seconds
)
@classmethod
def _get_secret(cls) -> str:
if cls.is_secret_expired():
alphabet = string.ascii_uppercase + string.digits
new_secret = "".join(secrets.choice(alphabet) for _ in range(64))
if not cls.JWT_SECRET_FILE.exists():
cls.JWT_SECRET_FILE.touch()
atomic_rewrite(
str(cls.JWT_SECRET_FILE),
new_secret,
backup=str(cls.JWT_SECRET_FILE_PREV),
uid=-1,
permissions=0o600,
)
return new_secret
else:
return cls.JWT_SECRET_FILE.read_text()
@classmethod
def get_token(cls, user_name: str, user_type: UIRole) -> str:
"""
Generates a token with several encoded fields:
user name,
user type,
expiration timestamp
"""
import jwt
return jwt.encode(
{
"user_type": user_type,
"username": user_name,
"exp": (datetime.now() + cls.TOKEN_EXPIRATION_TTL).timestamp(),
},
cls._get_secret(),
)
@classmethod
def _parse_token(cls, token: str, secret: str) -> dict | None:
import jwt
# if handle these exceptions at global level,
# jwt shoud be imported there,
# increasing memory consumation
try:
return jwt.decode(token, secret, algorithms=["HS256"])
except jwt.PyJWTError:
pass
@classmethod
def parse_token(cls, token: str):
for secret_pth in [cls.JWT_SECRET_FILE, cls.JWT_SECRET_FILE_PREV]:
if not secret_pth.exists():
continue
decoded = cls._parse_token(token, secret_pth.read_text())
if decoded:
return {
"user_name": decoded["username"],
"user_type": UIRoleToUserType[decoded["user_type"]],
}
else:
raise InvalidTokenException("INVALID_TOKEN")
defence360agent/api/newsfeed.py 0000644 0000000 0000000 00000010461 00000000000 013473 0 ustar """
This module gets and caches news from imunify blog
"""
import asyncio
import os
import socket
import time
import urllib.request
from urllib.error import HTTPError
from xml.etree import ElementTree
from contextlib import suppress
from logging import getLogger
from defence360agent.simple_rpc.hosting_panel import HostingPanel
from defence360agent.utils import retry_on
logger = getLogger(__file__)
RSS_FEED_REMOTE_URL = "https://blog.imunify360.com/feed/"
_TIMEOUT = 300 # default timeout for network operations here
TAGS_TO_READ = ["title", "pubDate", "guid", "link"]
__all__ = ["HTTPError", "NewsFeed"]
class NewsFeed:
cache_ttl = 60 # in minutes
cache_file_path = "/var/imunify360/tmp/feed_cache.rss"
@classmethod
@retry_on(
(ElementTree.ParseError, urllib.request.URLError),
max_tries=10,
on_error=lambda *args: NewsFeed.clear_cache(*args),
)
async def get(cls):
if cls._expired():
await cls._refresh()
category_info = PanelCategory(HostingPanel().NAME)
with open(cls.cache_file_path) as cache_file:
root = ElementTree.fromstring(cache_file.read())
imunify_news = root.iter("item")
return [
{
child.tag: child.text
for child in item
if child.tag in TAGS_TO_READ
}
for item in imunify_news
if category_info.is_allowed(item)
]
@classmethod
async def _refresh(cls):
cache_file_dir_path = os.path.dirname(cls.cache_file_path)
if not os.path.exists(cache_file_dir_path):
os.makedirs(cache_file_dir_path)
logger.info("Refresh news cache")
with open(cls.cache_file_path, "wb") as cache_file:
cache_file.write(await cls._fetch())
@classmethod
def _expired(cls):
if os.path.exists(cls.cache_file_path):
last_modified_time = os.path.getmtime(cls.cache_file_path)
else:
last_modified_time = 0
cache_age = (time.time() - last_modified_time) / 60 # in minutes
return cache_age > cls.cache_ttl
@classmethod
async def _fetch(cls, timeout=_TIMEOUT):
return await asyncio.get_event_loop().run_in_executor(
None, _fetch_url, RSS_FEED_REMOTE_URL, timeout
)
@classmethod
async def clear_cache(cls, *args):
logger.warning("Clearing cache due to error: %s", args)
with suppress(FileNotFoundError):
os.unlink(cls.cache_file_path)
def _fetch_url(url, timeout):
try:
# Cloudflare Browser Integrity Check blocks the default urllib
# User-Agent. RSS feed URL was added to exceptions but they are
# not free, so let's set a custom User-Agent anyway.
headers = {"User-Agent": "imunify360-urllib/0.1"}
req = urllib.request.Request(url, headers=headers)
with urllib.request.urlopen(req, timeout=timeout) as response:
return response.read()
except socket.timeout:
raise TimeoutError
class PanelCategory:
# RSS news categories, value saved in xml category tag
# categories are case-insensitive so lowercase it
panel_categories = {"cpanel", "plesk", "directadmin"}
no_panel_category = "standalone-imunify"
def __init__(self, p_name):
p_name = p_name.lower()
self.current = (
p_name
if p_name in PanelCategory.panel_categories
else PanelCategory.no_panel_category
)
self.competitors = PanelCategory.panel_categories | {
PanelCategory.no_panel_category
} - {self.current}
def is_allowed(self, item):
item_categories = {
child.text for child in item if child.tag == "category"
}
# category tag can include not only exact panel name, but also some
# phrase for SEO purpose, so check it by `in` on joined string
joined_category = "|||".join(item_categories).lower()
current_in_category = self.current in joined_category
competitors_in_category = any(
com in joined_category for com in self.competitors
)
# current panel didn't mentioned in categories,
# but competitor was -> don't add to result
return not competitors_in_category or current_in_category
defence360agent/api/pam_auth.py 0000644 0000000 0000000 00000001413 00000000000 013466 0 ustar from defence360agent.api.integration_conf import IntegrationConfig
from defence360agent.contracts.config import UIRole
from defence360agent.subsys.panels.generic.panel import get_admin_list
class PamAuth:
DEFAULT_AUTH_SERVICE = "system-auth"
def authenticate(self, username, password) -> bool:
from pam import pam
try:
config = IntegrationConfig().to_dict()
service = config["PAM"]["SERVICE_NAME"]
except KeyError:
service = self.DEFAULT_AUTH_SERVICE
p = pam()
return p.authenticate(username, password, service=service)
async def get_user_type(self, username: str) -> UIRole:
admins = await get_admin_list()
return UIRole.ADMIN if username in admins else UIRole.CLIENT
defence360agent/api/server/ 0000755 0000000 0000000 00000000000 00000000000 012625 5 ustar defence360agent/api/server/__init__.py 0000644 0000000 0000000 00000005702 00000000000 014742 0 ustar import asyncio
import http.client
import json
import logging
import socket
import urllib.error
import urllib.request
from defence360agent.contracts.config import Core
logger = logging.getLogger(__name__)
class APIError(Exception):
def __init__(self, *args, **kwargs) -> None:
super().__init__(*args, **kwargs)
if len(args) >= 2:
_, status_code, *args = args
self.status_code = status_code
else:
self.status_code = None
class APIErrorTooManyRequests(APIError):
...
class APITokenError(APIError):
...
class FGWSendMessgeException(Exception):
...
class NATSSendMessageException(Exception):
def __init__(self, *args, published=0):
super().__init__(*args)
self.published = published
class API:
_BASE_URL = Core.API_BASE_URL
# socket timeout is for blocking operations
# it should be as less as possible, but for sync api (remote_iplist)
# we may wait for response for 25 seconds, let's set it to 45 from our side
_SOCKET_TIMEOUT = 45
@classmethod
def request(cls, request: urllib.request.Request, json_loads=True):
try:
with urllib.request.urlopen(
request,
# agent should be able to wait for a while
# in lb queue before being connected
timeout=cls._SOCKET_TIMEOUT,
) as response:
logger.info(
"Performed request for url=%s method=%s body size=%s"
" status=%s",
request.full_url,
getattr(request, "method", None),
len(request.data) if request.data else 0,
response.status,
)
if response.status != 200:
raise APIError(
"status code is {}".format(response.status),
response.status,
)
plain_response = response.read()
logger.info("Response=%s ...", plain_response[:50])
if json_loads:
result = json.loads(plain_response.decode())
else:
result = plain_response
return result
except (
UnicodeDecodeError,
http.client.HTTPException,
json.JSONDecodeError,
socket.timeout,
urllib.error.URLError,
) as e:
status_code = getattr(e, "code", None)
if status_code == 429:
raise APIErrorTooManyRequests(
"request failed, reason: %s" % (e,), status_code
) from e
raise APIError(
"request failed, reason: %s" % (e,), status_code
) from e
@classmethod
async def async_request(cls, request, executor=None):
loop = asyncio.get_event_loop()
return await loop.run_in_executor(executor, cls.request, request)
defence360agent/api/server/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 015035 5 ustar defence360agent/api/server/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000012240 00000000000 022234 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
ej e Z
G d de Z G d de Z G d de Z G d d
e Z G d d e Z G d
d ZdS ) N)Corec e Zd Zd fd Z xZS )APIErrorreturnNc t j |i | t | dk r|^}}}|| _ d S d | _ d S )N )super__init__len status_code)selfargskwargs_r __class__s X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/__init__.pyr
zAPIError.__init__ sV $)&))) t99>>$( !A{T *D #D )r N__name__
__module__ __qualname__r
__classcell__r s @r r r s= $ $ $ $ $ $ $ $ $ $r r c e Zd ZdS )APIErrorTooManyRequestsNr r r r r r r Cr r c e Zd ZdS )
APITokenErrorNr r r r r r r r r c e Zd ZdS )FGWSendMessgeExceptionNr r r r r" r" r r r" c $ e Zd Zdd fd
Z xZS )NATSSendMessageExceptionr ) publishedc B t j | || _ d S N)r r
r% )r
r% r r s r r
z!NATSSendMessageException.__init__% s" $ "r r r s @r r$ r$ $ sE () # # # # # # # # # # #r r$ c j e Zd Zej ZdZeddej j
fd Z edd Z dS ) API- Trequestc
p t j || j 5 }t d|j t |dd |j rt |j nd|j
|j
dk r-t d |j
|j
|
}t d|d d |r't j | }n|}|cd d d S # 1 swxY w Y d S # t" t$ j j t j t, j t j j f$ rD}t |d d }|d
k rt5 d || |t d || |d }~ww xY w) N)timeoutz=Performed request for url=%s method=%s body size=%s status=%smethodr zstatus code is {}zResponse=%s ...2 codei zrequest failed, reason: )urllibr+ urlopen_SOCKET_TIMEOUTloggerinfofull_urlgetattrdatar statusr formatreadjsonloadsdecodeUnicodeDecodeErrorhttpclient
HTTPExceptionJSONDecodeErrorsocketr- errorURLErrorr )clsr+
json_loadsresponseplain_responseresulter s r r+ z API.request1 s ) '' + (
!$GXt44)0 <C %%%1 O
?c))"+228?CC "* -~crc/BCCC , !Z(=(=(?(? @ @FF +F 3
6
K % N L !
"!VT22Kc!!--45A7 (013[
s< &D0 C.D# D0 #D''D0 *D'+D0 0AF51?F00F5Nc p K t j }| || j | d {V S r' )asyncioget_event_looprun_in_executorr+ )rH r+ executorloops r
async_requestzAPI.async_request^ s@ %''))(CKIIIIIIIIIr )Tr' ) r r r r API_BASE_URL _BASE_URLr4 classmethodr2 r+ RequestrT r r r r) r) * sy !I O* *fn 4 * * * [*X J J J [J J Jr r) )rO http.clientrA r= loggingrE urllib.errorr2 urllib.request defence360agent.contracts.configr getLoggerr r5 Exceptionr r r r" r$ r) r r r <module>r` s
1 1 1 1 1 1 8 $ $$ $ $ $ $y $ $ $ h H Y # # # # #y # # # 7J 7J 7J 7J 7J 7J 7J 7J 7J 7Jr defence360agent/api/server/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000012240 00000000000 021275 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
ej e Z
G d de Z G d de Z G d de Z G d d
e Z G d d e Z G d
d ZdS ) N)Corec e Zd Zd fd Z xZS )APIErrorreturnNc t j |i | t | dk r|^}}}|| _ d S d | _ d S )N )super__init__len status_code)selfargskwargs_r __class__s X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/__init__.pyr
zAPIError.__init__ sV $)&))) t99>>$( !A{T *D #D )r N__name__
__module__ __qualname__r
__classcell__r s @r r r s= $ $ $ $ $ $ $ $ $ $r r c e Zd ZdS )APIErrorTooManyRequestsNr r r r r r r Cr r c e Zd ZdS )
APITokenErrorNr r r r r r r r r c e Zd ZdS )FGWSendMessgeExceptionNr r r r r" r" r r r" c $ e Zd Zdd fd
Z xZS )NATSSendMessageExceptionr ) publishedc B t j | || _ d S N)r r
r% )r
r% r r s r r
z!NATSSendMessageException.__init__% s" $ "r r r s @r r$ r$ $ sE () # # # # # # # # # # #r r$ c j e Zd Zej ZdZeddej j
fd Z edd Z dS ) API- Trequestc
p t j || j 5 }t d|j t |dd |j rt |j nd|j
|j
dk r-t d |j
|j
|
}t d|d d |r't j | }n|}|cd d d S # 1 swxY w Y d S # t" t$ j j t j t, j t j j f$ rD}t |d d }|d
k rt5 d || |t d || |d }~ww xY w) N)timeoutz=Performed request for url=%s method=%s body size=%s status=%smethodr zstatus code is {}zResponse=%s ...2 codei zrequest failed, reason: )urllibr+ urlopen_SOCKET_TIMEOUTloggerinfofull_urlgetattrdatar statusr formatreadjsonloadsdecodeUnicodeDecodeErrorhttpclient
HTTPExceptionJSONDecodeErrorsocketr- errorURLErrorr )clsr+
json_loadsresponseplain_responseresulter s r r+ z API.request1 s ) '' + (
!$GXt44)0 <C %%%1 O
?c))"+228?CC "* -~crc/BCCC , !Z(=(=(?(? @ @FF +F 3
6
K % N L !
"!VT22Kc!!--45A7 (013[
s< &D0 C.D# D0 #D''D0 *D'+D0 0AF51?F00F5Nc p K t j }| || j | d {V S r' )asyncioget_event_looprun_in_executorr+ )rH r+ executorloops r
async_requestzAPI.async_request^ s@ %''))(CKIIIIIIIIIr )Tr' ) r r r r API_BASE_URL _BASE_URLr4 classmethodr2 r+ RequestrT r r r r) r) * sy !I O* *fn 4 * * * [*X J J J [J J Jr r) )rO http.clientrA r= loggingrE urllib.errorr2 urllib.request defence360agent.contracts.configr getLoggerr r5 Exceptionr r r r" r$ r) r r r <module>r` s
1 1 1 1 1 1 8 $ $$ $ $ $ $y $ $ $ h H Y # # # # #y # # # 7J 7J 7J 7J 7J 7J 7J 7J 7J 7Jr defence360agent/api/server/__pycache__/analyst_cleanup.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000026246 00000000000 023672 0 ustar
r_j d dl Zd dlZd dlZd dlZd dlZd dlmZmZ d dl m
Z
d dl m Z d dl
mZmZ d dlmZ d dlmZ ej e Z ed Zd
Zd Z G d d
e
ZdS ) N)datetime timedelta)API)ANTIVIRUS_MODE)IndependentAgentIDAPIIAIDTokenError)run_in_executor_decorator) parse_params
)minutesno_agent_tokenc P t j | }nK# t t t j j f$ r'}t d| i cY d }~S d }~ww xY wt |t r|S t dt | j i S )Nz#Cannot decode API response body: %sz&API response body is %s, not an object)
jsonload
ValueErrorOSErrorhttpclient
HTTPExceptionloggerwarning
isinstancedicttype__name__)responsebodyes _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/analyst_cleanup.py _json_objectr s y"" !: ; <a@@@ $
NN0$t**2E Is !A AA A c 0 e Zd ZdZdZdZdZdej dZ e
d Z e
e d Z
e
d egd
egfd Ze
e d Ze
d
Ze
e d Ze
d Ze
e d ZdS )AnalystCleanupAPIz.{base}/api/analyst-assisted-cleanup/is-allowedz+{base}/api/analyst-assisted-cleanup/ticketsz1{base}/api/analyst-assisted-cleanup/is-registeredz1{base}/api/analyst-assisted-cleanup/create-ticketN)result timestampc K t j }| j d &|| j d z
t k r
| j d S t j | j | j dt j d{V id }| | d{V }|| j d< t j | j d< |S # t $ r Y dS w xY w) z9Check if analyst cleanup is allowed for this installationr# Nr$ baseX-AuthGETheadersmethodF)r now_cache CACHE_TTLurllibrequestRequest CLEANUP_ALLOWED_URL_TEMPLATEformat _BASE_URLr get_token_check_allowedr )cls current_timer1 r# s r check_cleanup_allowedz'AnalystCleanupAPI.check_cleanup_allowed9 s |~~ Jx , sz+ 66BB:h' ' n,,077S]7KK!)>)H)J)J#J#J#J#J#J#JK - G --g66666666F#)CJx &.lnnCJ{ #M
55 s
AC% %
C32C3c | | }| dd S # t $ r&}t d| Y d}~dS d}~ww xY w)&Execute the actual request in executorr# Fz&Failed to check cleanup permission: %sNT)r1 get Exceptionr errorr8 r1 r# r s r r7 z AnalystCleanupAPI._check_allowedQ so [[))F::h.. . LLA1 E E E
44444
s *-
A AA idsreturnc K t |t r d d |D }nt | }| j | j }d|i} t j t || dt j d{V id }n0# t $ r#}t d | d}~ww xY w| | d{V S )
a
Retrieve tickets from Zendesk API using the show_many endpoint
Args:
ids (list or str): List of ticket IDs or comma-separated string of IDs
Returns:
list: List of dictionaries with 'id', 'status', and 'updated_at' fields
,c 3 4 K | ]}t | V d S )N)str).0_ids r <genexpr>z0AnalystCleanupAPI.get_tickets.<locals>.<genexpr>m s( 7 7Cs3xx 7 7 7 7 7 7 r& rA r( Nr) r* z&Failed to get IAID token for tickets: )r listjoinrF SHOW_MANY_URL_TEMPLATEr4 r5 r0 r1 r2 r
r r6 r r r? _execute_get_tickets)r8 rA ids_strurlparamsr1 r s r get_ticketsz AnalystCleanupAPI.get_tickets` s, c4 hh 7 73 7 7 777GG#hhG (//S]/CC! n,, VS))!)>)H)J)J#J#J#J#J#J#JK - GG
LLE!EE F F F --g666666666s ,A B6 6
C# C C#c g } | | }| dg D ]T}| | d | d | d d U||c S # t $ r'}t d| Y d}~nd}~ww xY w |S # |c cY S xY w)z2Execute the actual get_tickets request in executorticketsidstatus
updated_at)rU rV rW zFailed to get tickets: N)r1 r= appendr> r r? )r8 r1 simplified_ticketsr# ticketr s r rN z&AnalystCleanupAPI._execute_get_tickets s &[[))F !**Y33
")) $jj . ."(**X"6"6&,jj &>&> & & % % % 8 8 8 LL6166 7 7 7 7 7 7 7 7 8 7% %% % % % % % % % %s* BB
B: B50C 5B::C Cc K t j | j | j t
j d{V ddt j d|i
d }| | d{V }|S # t $ r t d i cY S w xY w) z'Check if email is registered in Zendeskr& Napplication/jsonr( z Content-Typecustomer_emailPOSTr+ datar, zGot IAIDTokenError)r0 r1 r2 IS_REGISTERED_URL_TEMPLATEr4 r5 r r6 r dumpsencode_register_statusr r r? )r8 emailr1 r# s r check_registeredz"AnalystCleanupAPI.check_registered s n,,.553=5II$9$C$E$E E E E E E E$6 Z!15 9::AACC - G //88888888FM LL- . . .III s BB" "&C
C c | | }|S # t $ r'}t d| i cY d}~S d}~ww xY w)r< z&Failed to check email registration: %sN)r1 r> r r? r@ s r re z"AnalystCleanupAPI._register_status s` [[))FM LLA1 E E EIIIIII s
A
AA
A
c K t j d{V }n# t $ r ddt ifcY S w xY wt j | j | j |ddt j |||t rdndd
d
}| | d{V S ) zAsk the backend to open a support ticket.
Return an (HTTP status, response body) pair; the status is None when
the backend could not be reached at all.
Nmessager& r\ r]
pr_imunify_avpr_im360)rf subject descriptionproductr_ r` )r r6 r NO_AGENT_TOKENr0 r1 r2 CREATE_TICKET_URL_TEMPLATEr4 r5 r rc r rd _send_create_ticket)r8 rf rm rn tokenr1 s r
create_ticketz AnalystCleanupAPI.create_ticket s 5/9;;;;;;;;EE 5 5 5)^44 4 4 4 5 .(( * 1 1s} 1 E E 2 " &#.+9Iz fhh! )
$ ,,W555555555s 66c t j || j 5 }|j t | fcddd S # 1 swxY w Y dS # t j j $ r)}|j |j t | ni fcY d}~S d}~wt $ r)}t d| di fcY d}~S d}~ww xY w)r< )timeoutNz*Failed to reach create-ticket endpoint: %s)
r0 r1 urlopen_SOCKET_TIMEOUTrV r r? HTTPErrorcodefpr> r r )r8 r1 r r s r rr z%AnalystCleanupAPI._send_create_ticket s4 ''!4 (
? X(>(>>
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
? |% G G G6ad.><???BF F F F F F F NNG K K K8OOOOOO sQ &A A A AA AA C, B
C
C C;CC)r
__module__ __qualname__r3 rM rb rq r minr. classmethodr: r r7 rF r rR rN rg re rt rr rJ r r" r" ' si 8 ! K; < \ F
[. [ 7SE 7tf 7 7 7 [ 7@ & & [&, [& [ 6 6 [ 6> [ rJ r" ) http.clientr r urllib.errorr0 urllib.requestloggingr r defence360agent.api.serverr defence360agent.contracts.configr defence360agent.internals.iaidr r defence360agent.rpc_tools.utilsr defence360agent.utils.supportr
getLoggerr r r/ rp r r" r rJ r <module>r s> ( ( ( ( ( ( ( ( * * * * * * ; ; ; ; ; ; F E E E E E 6 6 6 6 6 6 8 $ $ Ib ! ! ! " ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ rJ defence360agent/api/server/__pycache__/analyst_cleanup.cpython-311.pyc 0000644 0000000 0000000 00000026246 00000000000 022733 0 ustar
r_j d dl Zd dlZd dlZd dlZd dlZd dlmZmZ d dl m
Z
d dl m Z d dl
mZmZ d dlmZ d dlmZ ej e Z ed Zd
Zd Z G d d
e
ZdS ) N)datetime timedelta)API)ANTIVIRUS_MODE)IndependentAgentIDAPIIAIDTokenError)run_in_executor_decorator) parse_params
)minutesno_agent_tokenc P t j | }nK# t t t j j f$ r'}t d| i cY d }~S d }~ww xY wt |t r|S t dt | j i S )Nz#Cannot decode API response body: %sz&API response body is %s, not an object)
jsonload
ValueErrorOSErrorhttpclient
HTTPExceptionloggerwarning
isinstancedicttype__name__)responsebodyes _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/analyst_cleanup.py _json_objectr s y"" !: ; <a@@@ $
NN0$t**2E Is !A AA A c 0 e Zd ZdZdZdZdZdej dZ e
d Z e
e d Z
e
d egd
egfd Ze
e d Ze
d
Ze
e d Ze
d Ze
e d ZdS )AnalystCleanupAPIz.{base}/api/analyst-assisted-cleanup/is-allowedz+{base}/api/analyst-assisted-cleanup/ticketsz1{base}/api/analyst-assisted-cleanup/is-registeredz1{base}/api/analyst-assisted-cleanup/create-ticketN)result timestampc K t j }| j d &|| j d z
t k r
| j d S t j | j | j dt j d{V id }| | d{V }|| j d< t j | j d< |S # t $ r Y dS w xY w) z9Check if analyst cleanup is allowed for this installationr# Nr$ baseX-AuthGETheadersmethodF)r now_cache CACHE_TTLurllibrequestRequest CLEANUP_ALLOWED_URL_TEMPLATEformat _BASE_URLr get_token_check_allowedr )cls current_timer1 r# s r check_cleanup_allowedz'AnalystCleanupAPI.check_cleanup_allowed9 s |~~ Jx , sz+ 66BB:h' ' n,,077S]7KK!)>)H)J)J#J#J#J#J#J#JK - G --g66666666F#)CJx &.lnnCJ{ #M
55 s
AC% %
C32C3c | | }| dd S # t $ r&}t d| Y d}~dS d}~ww xY w)&Execute the actual request in executorr# Fz&Failed to check cleanup permission: %sNT)r1 get Exceptionr errorr8 r1 r# r s r r7 z AnalystCleanupAPI._check_allowedQ so [[))F::h.. . LLA1 E E E
44444
s *-
A AA idsreturnc K t |t r d d |D }nt | }| j | j }d|i} t j t || dt j d{V id }n0# t $ r#}t d | d}~ww xY w| | d{V S )
a
Retrieve tickets from Zendesk API using the show_many endpoint
Args:
ids (list or str): List of ticket IDs or comma-separated string of IDs
Returns:
list: List of dictionaries with 'id', 'status', and 'updated_at' fields
,c 3 4 K | ]}t | V d S )N)str).0_ids r <genexpr>z0AnalystCleanupAPI.get_tickets.<locals>.<genexpr>m s( 7 7Cs3xx 7 7 7 7 7 7 r& rA r( Nr) r* z&Failed to get IAID token for tickets: )r listjoinrF SHOW_MANY_URL_TEMPLATEr4 r5 r0 r1 r2 r
r r6 r r r? _execute_get_tickets)r8 rA ids_strurlparamsr1 r s r get_ticketsz AnalystCleanupAPI.get_tickets` s, c4 hh 7 73 7 7 777GG#hhG (//S]/CC! n,, VS))!)>)H)J)J#J#J#J#J#J#JK - GG
LLE!EE F F F --g666666666s ,A B6 6
C# C C#c g } | | }| dg D ]T}| | d | d | d d U||c S # t $ r'}t d| Y d}~nd}~ww xY w |S # |c cY S xY w)z2Execute the actual get_tickets request in executorticketsidstatus
updated_at)rU rV rW zFailed to get tickets: N)r1 r= appendr> r r? )r8 r1 simplified_ticketsr# ticketr s r rN z&AnalystCleanupAPI._execute_get_tickets s &[[))F !**Y33
")) $jj . ."(**X"6"6&,jj &>&> & & % % % 8 8 8 LL6166 7 7 7 7 7 7 7 7 8 7% %% % % % % % % % %s* BB
B: B50C 5B::C Cc K t j | j | j t
j d{V ddt j d|i
d }| | d{V }|S # t $ r t d i cY S w xY w) z'Check if email is registered in Zendeskr& Napplication/jsonr( z Content-Typecustomer_emailPOSTr+ datar, zGot IAIDTokenError)r0 r1 r2 IS_REGISTERED_URL_TEMPLATEr4 r5 r r6 r dumpsencode_register_statusr r r? )r8 emailr1 r# s r check_registeredz"AnalystCleanupAPI.check_registered s n,,.553=5II$9$C$E$E E E E E E E$6 Z!15 9::AACC - G //88888888FM LL- . . .III s BB" "&C
C c | | }|S # t $ r'}t d| i cY d}~S d}~ww xY w)r< z&Failed to check email registration: %sN)r1 r> r r? r@ s r re z"AnalystCleanupAPI._register_status s` [[))FM LLA1 E E EIIIIII s
A
AA
A
c K t j d{V }n# t $ r ddt ifcY S w xY wt j | j | j |ddt j |||t rdndd
d
}| | d{V S ) zAsk the backend to open a support ticket.
Return an (HTTP status, response body) pair; the status is None when
the backend could not be reached at all.
Nmessager& r\ r]
pr_imunify_avpr_im360)rf subject descriptionproductr_ r` )r r6 r NO_AGENT_TOKENr0 r1 r2 CREATE_TICKET_URL_TEMPLATEr4 r5 r rc r rd _send_create_ticket)r8 rf rm rn tokenr1 s r
create_ticketz AnalystCleanupAPI.create_ticket s 5/9;;;;;;;;EE 5 5 5)^44 4 4 4 5 .(( * 1 1s} 1 E E 2 " &#.+9Iz fhh! )
$ ,,W555555555s 66c t j || j 5 }|j t | fcddd S # 1 swxY w Y dS # t j j $ r)}|j |j t | ni fcY d}~S d}~wt $ r)}t d| di fcY d}~S d}~ww xY w)r< )timeoutNz*Failed to reach create-ticket endpoint: %s)
r0 r1 urlopen_SOCKET_TIMEOUTrV r r? HTTPErrorcodefpr> r r )r8 r1 r r s r rr z%AnalystCleanupAPI._send_create_ticket s4 ''!4 (
? X(>(>>
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
? |% G G G6ad.><???BF F F F F F F NNG K K K8OOOOOO sQ &A A A AA AA C, B
C
C C;CC)r
__module__ __qualname__r3 rM rb rq r minr. classmethodr: r r7 rF r rR rN rg re rt rr rJ r r" r" ' si 8 ! K; < \ F
[. [ 7SE 7tf 7 7 7 [ 7@ & & [&, [& [ 6 6 [ 6> [ rJ r" ) http.clientr r urllib.errorr0 urllib.requestloggingr r defence360agent.api.serverr defence360agent.contracts.configr defence360agent.internals.iaidr r defence360agent.rpc_tools.utilsr defence360agent.utils.supportr
getLoggerr r r/ rp r r" r rJ r <module>r s> ( ( ( ( ( ( ( ( * * * * * * ; ; ; ; ; ; F E E E E E 6 6 6 6 6 6 8 $ $ Ib ! ! ! " ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ rJ defence360agent/api/server/__pycache__/cleanup_revert.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003577 00000000000 023530 0 ustar
r_j1 d dl Z d dlmZ d dlmZ d dlmZmZ d dlm Z m
Z
e j e Z
G d de ZdS ) N)urljoin)Request)APIAPIError)IndependentAgentIDAPIIAIDTokenErrorc F e Zd Z eej d Zed ZdS )CleanupRevertAPIz/api/cleanup/revertc B K t j d {V }n# t $ r g cY S w xY wt | j d|i } | | d {V }n4# t $ r'}t d| g cY d }~S d }~ww xY w|d S )NzX-Auth)headersz'Failed to fetch cleanup revert data: %spaths) r get_tokenr r URL
async_requestr loggerwarning)clstokenrequestresultexcs ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/cleanup_revert.pyr
zCleanupRevertAPI.paths s /9;;;;;;;;EE III #'He+<=== ,,W55555555FF NNDc J J JIIIIII g s* -- A% %
B/ B BBN) __name__
__module__ __qualname__r r _BASE_URLr classmethodr
r r
r
sA
'#-!6
7
7C
[
r r
)logging urllib.parser urllib.requestr defence360agent.api.serverr r defence360agent.internals.iaidr r getLoggerr r r
r r r <module>r& s " " " " " " 4 4 4 4 4 4 4 4
8 $ $ s r defence360agent/api/server/__pycache__/cleanup_revert.cpython-311.pyc 0000644 0000000 0000000 00000003577 00000000000 022571 0 ustar
r_j1 d dl Z d dlmZ d dlmZ d dlmZmZ d dlm Z m
Z
e j e Z
G d de ZdS ) N)urljoin)Request)APIAPIError)IndependentAgentIDAPIIAIDTokenErrorc F e Zd Z eej d Zed ZdS )CleanupRevertAPIz/api/cleanup/revertc B K t j d {V }n# t $ r g cY S w xY wt | j d|i } | | d {V }n4# t $ r'}t d| g cY d }~S d }~ww xY w|d S )NzX-Auth)headersz'Failed to fetch cleanup revert data: %spaths) r get_tokenr r URL
async_requestr loggerwarning)clstokenrequestresultexcs ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/cleanup_revert.pyr
zCleanupRevertAPI.paths s /9;;;;;;;;EE III #'He+<=== ,,W55555555FF NNDc J J JIIIIII g s* -- A% %
B/ B BBN) __name__
__module__ __qualname__r r _BASE_URLr classmethodr
r r
r
sA
'#-!6
7
7C
[
r r
)logging urllib.parser urllib.requestr defence360agent.api.serverr r defence360agent.internals.iaidr r getLoggerr r r
r r r <module>r& s " " " " " " 4 4 4 4 4 4 4 4
8 $ $ s r defence360agent/api/server/__pycache__/events.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006600 00000000000 022004 0 ustar
r_jI ~ d dl Zd dlZd dlZd dlmZ d dlmZ d dlm Z ej
e Z G d de Z
dS ) N)API)IndependentAgentIDAPI)run_in_executor_decoratorc e Zd ZdZdZdZeed Zed Z ed Z
eed Z dS ) EventsAPIzV{base}/api/dashboard/events?dashboard=false&popup=true¬_snoozed_at={not_snoozed_at}z:{base}/api/dashboard/v2/events?notification=1&enduser=truez/{base}/api/dashboard/v2/events?smartadvice=truec 2 t j | j | j t
t j d }| | }|d S )N)basenot_snoozed_atGET)methodresult)
urllibrequestRequestADVICES_API_URL_TEMPLATEformat _BASE_URLintdatetimenow timestampclsr r
s V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/events.pyadviceszEventsAPI.advices s .(( ( / /] "8#4#8#8#:#:#D#D#F#F G G
0
)
W%%h c K t j | j | j ddt
j d {V i }| | d {V S )Nr r X-Authr headers) r r r NOTIFICATIONS_API_URL_TEMPLATEr r r get_token_send_notificationsr r s r notificationzEventsAPI.notification% s .(( . 5 53= 5 I I %:%D%F%F F F F F F FG )
,,W555555555r c K t j | j | j ddt
j d {V i }| | d S )Nr r r r r
)r r r SMART_ADVICE_API_URL_TEMPLATEr r r r# r% s r
smart_adviceszEventsAPI.smart_advices. s{ .(( - 4 4#- 4 H H %:%D%F%F F F F F F FG )
{{7##H--r c < | | }|d S )Nr
)r r s r r$ z EventsAPI._send_notifications7 s W%%h r N) __name__
__module__ __qualname__r r" r( classmethodr r r& r) r$ r r r r s 5
E # : " [ 6 6 [6 . . [. [ r r )urllib.requestr loggingr defence360agent.api.serverr defence360agent.internals.iaidr defence360agent.rpc_tools.utilsr getLoggerr+ loggerr r/ r r <module>r7 s * * * * * * @ @ @ @ @ @ E E E E E E 8 $ $/ / / / / / / / / / r defence360agent/api/server/__pycache__/events.cpython-311.pyc 0000644 0000000 0000000 00000006600 00000000000 021045 0 ustar
r_jI ~ d dl Zd dlZd dlZd dlmZ d dlmZ d dlm Z ej
e Z G d de Z
dS ) N)API)IndependentAgentIDAPI)run_in_executor_decoratorc e Zd ZdZdZdZeed Zed Z ed Z
eed Z dS ) EventsAPIzV{base}/api/dashboard/events?dashboard=false&popup=true¬_snoozed_at={not_snoozed_at}z:{base}/api/dashboard/v2/events?notification=1&enduser=truez/{base}/api/dashboard/v2/events?smartadvice=truec 2 t j | j | j t
t j d }| | }|d S )N)basenot_snoozed_atGET)methodresult)
urllibrequestRequestADVICES_API_URL_TEMPLATEformat _BASE_URLintdatetimenow timestampclsr r
s V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/events.pyadviceszEventsAPI.advices s .(( ( / /] "8#4#8#8#:#:#D#D#F#F G G
0
)
W%%h c K t j | j | j ddt
j d {V i }| | d {V S )Nr r X-Authr headers) r r r NOTIFICATIONS_API_URL_TEMPLATEr r r get_token_send_notificationsr r s r notificationzEventsAPI.notification% s .(( . 5 53= 5 I I %:%D%F%F F F F F F FG )
,,W555555555r c K t j | j | j ddt
j d {V i }| | d S )Nr r r r r
)r r r SMART_ADVICE_API_URL_TEMPLATEr r r r# r% s r
smart_adviceszEventsAPI.smart_advices. s{ .(( - 4 4#- 4 H H %:%D%F%F F F F F F FG )
{{7##H--r c < | | }|d S )Nr
)r r s r r$ z EventsAPI._send_notifications7 s W%%h r N) __name__
__module__ __qualname__r r" r( classmethodr r r& r) r$ r r r r s 5
E # : " [ 6 6 [6 . . [. [ r r )urllib.requestr loggingr defence360agent.api.serverr defence360agent.internals.iaidr defence360agent.rpc_tools.utilsr getLoggerr+ loggerr r/ r r <module>r7 s * * * * * * @ @ @ @ @ @ E E E E E E 8 $ $/ / / / / / / / / / r defence360agent/api/server/__pycache__/reputation.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007716 00000000000 022703 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlZd dl Z d dl
m Z m Z d dl
mZmZ e j e Z G d de ZdS ) N)List)retry_onsplit_for_chunk)APIAPIErrorc e Zd ZdZdZdZdZdZdZe de
e de
e fd Z
e de
e de
e fd
Ze eee de fd Ze eee d
e fd ZdS )
ReputationAPIz/api/reputation/checkz/api/reputation/resulti i < domainsreturnc K t d| t j }| d | j | d {V S )Nz DomainListRequest domains: %s)loggerinfoasyncioget_event_looprun_in_executor_check)clsr loops Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/reputation.pycheckzReputationAPI.check sU 3W===%''))$
GDDDDDDDDD c g }t || j D ]7}| | }| |d }||z
}8|S )N result_id)r
CHUNK_SIZE _check_chunk _get_result)r r result_listchunkresult
next_chunks r r zReputationAPI._check" s] $Wcn== & &E%%e,,F )<==J : %KKr )timeoutc
t j | j | j z dddit j t | }| | S )NPOSTz Content-Typezapplication/json)r )methodheadersdata) urllibrequestRequest _BASE_URL REQUEST_URLjsondumpsdictencode)r r
check_requests r r zReputationAPI._check_chunk+ sp .. MCO +#%78D / / /007799 /
{{=)))r r c r t | }d | j | j z t j | }t j | }| | }|d }|(t j
| j t d |S )N)r z{}?{}r! zResponse not ready yet)
r0 formatr,
RESULT_URLr) parse urlencoder* r+ timesleepWAIT_BEFORE_RETRYr )r r r( urlr* responser! s r r zReputationAPI._get_result6 s i(((nn MCN *FL,B,B4,H,H
.((--;;w''(# > Js, - - -344 4
r N)__name__
__module__ __qualname__r- r5 r r: WAIT_FOR_RESULT_SOCKET_TIMEOUT classmethodr strr0 r r r r r r r r r r s' )K)J
JOOE$s) ET
E E E [E
T#Y 4: [
Xh000*D * * * 10 [*
Xh000 C 10 [ r r )r. urllib.errorr) urllib.request urllib.parser typingr r8 loggingdefence360agent.utilsr r defence360agent.api.serverr r getLoggerr= r r rD r r <module>rM s ; ; ; ; ; ; ; ; 4 4 4 4 4 4 4 4 8 $ $4 4 4 4 4C 4 4 4 4 4r defence360agent/api/server/__pycache__/reputation.cpython-311.pyc 0000644 0000000 0000000 00000007716 00000000000 021744 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlZd dl Z d dl
m Z m Z d dl
mZmZ e j e Z G d de ZdS ) N)List)retry_onsplit_for_chunk)APIAPIErrorc e Zd ZdZdZdZdZdZdZe de
e de
e fd Z
e de
e de
e fd
Ze eee de fd Ze eee d
e fd ZdS )
ReputationAPIz/api/reputation/checkz/api/reputation/resulti i < domainsreturnc K t d| t j }| d | j | d {V S )Nz DomainListRequest domains: %s)loggerinfoasyncioget_event_looprun_in_executor_check)clsr loops Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/reputation.pycheckzReputationAPI.check sU 3W===%''))$
GDDDDDDDDD c g }t || j D ]7}| | }| |d }||z
}8|S )N result_id)r
CHUNK_SIZE _check_chunk _get_result)r r result_listchunkresult
next_chunks r r zReputationAPI._check" s] $Wcn== & &E%%e,,F )<==J : %KKr )timeoutc
t j | j | j z dddit j t | }| | S )NPOSTz Content-Typezapplication/json)r )methodheadersdata) urllibrequestRequest _BASE_URL REQUEST_URLjsondumpsdictencode)r r
check_requests r r zReputationAPI._check_chunk+ sp .. MCO +#%78D / / /007799 /
{{=)))r r c r t | }d | j | j z t j | }t j | }| | }|d }|(t j
| j t d |S )N)r z{}?{}r! zResponse not ready yet)
r0 formatr,
RESULT_URLr) parse urlencoder* r+ timesleepWAIT_BEFORE_RETRYr )r r r( urlr* responser! s r r zReputationAPI._get_result6 s i(((nn MCN *FL,B,B4,H,H
.((--;;w''(# > Js, - - -344 4
r N)__name__
__module__ __qualname__r- r5 r r: WAIT_FOR_RESULT_SOCKET_TIMEOUT classmethodr strr0 r r r r r r r r r r s' )K)J
JOOE$s) ET
E E E [E
T#Y 4: [
Xh000*D * * * 10 [*
Xh000 C 10 [ r r )r. urllib.errorr) urllib.request urllib.parser typingr r8 loggingdefence360agent.utilsr r defence360agent.api.serverr r getLoggerr= r r rD r r <module>rM s ; ; ; ; ; ; ; ; 4 4 4 4 4 4 4 4 8 $ $4 4 4 4 4C 4 4 4 4 4r defence360agent/api/server/__pycache__/send_message.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000104137 00000000000 023141 0 ustar
r_jb : d dl Z d dlZd dlZd dlZd dlZd dlZd dlZ d dlZd dl Zd dl
ZdZ ej j
Zej j j Zn)# e$ r! dZ G d de Z G d de ZY nw xY wd dlZd dlmZmZ d d lmZ d d
lmZ d dl Z d dl Z d d l m Z mZm Z m!Z!m"Z" d d l#m$Z$ d d
l%m&Z&m'Z' d dl(m)Z) d dl*m+Z+m,Z, d dl-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4 d dl5m6Z6 d dl7m8Z8 ee9 Z: e3 Z; e3 Z<d a=d a>de?fdZ@deAdeBddfdZCdZDdZE G d d e ZF eGd d h ZHd ZIdeJfd!ZKd"eAdeAfd#ZLdeMfd$ZNd% ZOd& ZPeIfd'eAfd(ZQd)eAfd*ZRd+eddfd,ZS G d- d.e e ZT G d/ d0eT ZU G d1 d2eU ZV G d3 d4 ZWdS )5 NTFc e Zd ZdS )_NATSMaxPayloadErrorN)__name__
__module__ __qualname__ \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/send_message.pyr r s r r c e Zd ZdZdS )
_NATSAPIErrorN)r r r err_coder r r
r r s r r )ABCabstractmethod) getLogger)Optional)APIAPIError
APITokenErrorFGWSendMessgeExceptionNATSSendMessageException)Core)
estimate_sizeMessage) delivery_ack) MESSAGE_LOSS_OBSERVABILITY_FLAG
is_enabled)g)IndependentAgentIDAPIIAIDTokenError)Gen publisher) AsyncIterate)ServerJSONEncoderreturnc t dc} a | S )z:Method-less drops since the last call, then reset (delta).r ) _method_missing_dropped_deltavalues r
pop_method_missing_droppedr) A s ,I!(E ( Lr messagesinkc
t dz
a t dz
at d|| d | d | d t | t dS )z*Count and log a message no sink can route. zkDropping message without a method: sink=%s message_id=%s plugin_id=%s timestamp=%s keys=%s dropped_total=%d
message_id plugin_id timestampN) _method_missing_dropped_totalr& loggererrorgetsorted)r* r+ s r
_drop_method_lessr6 H s{ "Q&!!Q&!
LL > L!! K K w% r i]' iF' c e Zd ZdZdS ) _StreamFullzDStream is at capacity: re-queue the rest, the connection is healthy.N)r r r __doc__r r r
r8 r8 d s NNNNr r8 scanidscan_id c P t | t r d | D S t }| D ]s}t |t r| | -t |t r1| d | D t|S )zrStrings a sibling map could be keyed on: a dict's own keys, or the
scalar values carried by a list's elements.c < h | ]}t |t |S r
isinstancestr).0keys r
<setcomp>z _element_ids.<locals>.<setcomp>v s' AAAJsC,@,@AAAAr c 3 D K | ]}t |t |V d S Nr? )rB r( s r
<genexpr>z _element_ids.<locals>.<genexpr>| sE z%7M7M r )r@ dictsetrA addupdatevalues) containeridselements r
_element_idsrP r s )T"" BAAyAAAA
%%C gs # # GGG
&
& JJ #*>>#3#3
Jr fieldsc ` d D fd D S )zSibling dicts keyed entirely by a field's elements, which have to follow
those records rather than be bisected away from them.c 4 i | ]\ }}|t | S r )rP rB namer( s r
<dictcomp>z _paired_maps.<locals>.<dictcomp> s&
G
G
Gu4 e$$
G
G
Gr c V i | ]$fd D %S )c h | ]=\ }}|k r2t |t r |rt | k ;|>S r )r@ rH rI )rB otherr( rN rU s r
rD z*_paired_maps.<locals>.<dictcomp>.<setcomp> sc
u}}5$'' E
c$i''
(''r items)rB rU rQ rN s @r
rV z _paired_maps.<locals>.<dictcomp> s_
&
r rZ )rQ rN s `@r
_paired_mapsr\ sT H
G
G
G
GC
r c b t | t ot | S rF )r@ rH _INDEX_KEYS
isdisjointr' s r
_carries_index_keyr` s( eT " " H;+A+A%+H+H'HHr c |dk rd S t | t rt | |dz
S t | t rt | |dz
S d S )Nr r- )r@ rH _split_largest_fieldlist_split_container)rO depths r
_split_elementrf sa zzt'4 8#GUQY777'4 4 333 4r c t t rt t dk r>t dz } fdd| D fd|d D gS sdS t d | }|dS fd|D S t dk r&t dz } d| |d gS sdS t d | }|dS d |D S ) zxBisect a list or dict, descending into a lone element so a single
oversized record can still be split within itself.r- c " i | ] }|| S r r rB rC r( s r
rV z$_split_container.<locals>.<dictcomp> 777SeCj777r Nc " i | ] }|| S r r rj s r
rV z$_split_container.<locals>.<dictcomp> rk r r c $ g | ] }d |i
S )r r )rB halfkeyss r
<listcomp>z$_split_container.<locals>.<listcomp> s! 222Da$222r c g | ]}|gS r r )rB rn s r
rp z$_split_container.<locals>.<listcomp> s % % %tTF % % %r )r@ rH rc lenrf )r( re midinnerro s ` @r
rd rd sJ %
3E{{ t99q==d))q.C7777D#J7777777DJ777
4 uT!W~u55 =42222E2222
5zzA~~%jjAodsd U344[)) t 58U + +E }t % %u % % %%r itemc
d | D
t
d
D fd
D }
fd}t ||d D ] }t
| | }| n dS g }|D ]b}t | i | ||i}
| D ]+} fd
| D || < ,| | c|S ) zBisect the heaviest payload field, while index-carrying fields and maps
paired with another field's records ride along instead of being split.c R i | ]$\ }}t |t t f !||%S r )r@ rc rH rT s r
rV z(_split_largest_field.<locals>.<dictcomp> sB D% edD\ * * e r c h | ] }|D ]}|
S r r )rB mapsrU s r
rD z'_split_largest_field.<locals>.<setcomp> s% CCC$dCCdCCCCr c @ g | ]\ }}|v t | |S r )r` )rB rU r( followerss r
rp z(_split_largest_field.<locals>.<listcomp> s@ D% y );E)B)B
r c r t | t fd| D z S )Nc 3 B K | ]}t | V d S rF )r )rB rY rQ s r
rG z7_split_largest_field.<locals>.weight.<locals>.<genexpr> s@ 1
1
-2M&- ( (1
1
1
1
1
1
r )r sum)rU rQ paireds r
weightz$_split_largest_field.<locals>.weight sR VD\**S 1
1
1
1
6<Tl1
1
1
.
.
r T)rC reverseNc $ i | ] \ }}|v ||
S r r )rB rC r( kepts r
rV z(_split_largest_field.<locals>.<dictcomp> s0 C$;; U ;;r )r[ r\ rL r5 rd rP append)ru re
candidatesr fieldhalvespartsrn partrU rQ r{ r r s @@@@r
rb rb s ::<< F
&
!
!FCC&--//CCCI !<<>> J
=== !&-77 E t E D!!$$$t$$5M D "(,"4"4"6"6 DJJ
T Lr loadedc d }t |t rEt | dk r2t | dz }i d|d| ii d||d igS t |t rt | dk r|d nd}t |t r2 t | }n# t $ r Y dS w xY w| fd|D S dS )zSplit an oversized message into smaller parts. Returns a list of parts,
or None when the message carries a single irreducible record.r[ r- rh Nr c " g | ] }i d |gi S rZ r )rB rn r s r
rp z$_split_oversized.<locals>.<listcomp> s+ CCCD/v/w//CCCr )r4 r@ rc rr rH rb RecursionError)r r[ rs singler s ` r
_split_oversizedr s!
JJw E%
3u::>>%jjAo ,v ,wdsd , , ,v ,wcdd , ,
$E400
NSZZ1__U1XX$F&$ D )&11FF 44
CCCCFCCC C 4s 9C
CCexc @ K t d| dS )a Downgrade nats-py internal errors to DEBUG.
Transient errors (ConnectionRefused, AuthorizationViolation) are
expected during agent restarts. Our code already logs a WARNING
with context, so the nats-py default ERROR + traceback is noise.
znats: %sN)r2 debug)r s r
_nats_error_cbr s" LLR r c R e Zd ZdZedefd ZdeddfdZdede ddfd Z
dS )
BaseSendMessageAPIz /api/v2/send-message/{method}r$ c
K d S rF r )selfmessage_methodheaders post_datas r
_send_requestz BaseSendMessageAPI._send_request s r resultNc d|vr"t d | |d dk r5t d | d d S )Nstatusz unexpected server response: {!r}okzserver error: {}msg)r formatr4 )r r s r
check_responsez!BaseSendMessageAPI.check_response sk 6 ! !=DDVLLMM M ( t # #-44VZZ5F5FGGHH H $ #r methodr c K t j d {V }n$# t $ r}t d| d }~ww xY wd|d}| ||| d {V }| | d S )NzIAID token error occurred zapplication/json)z Content-TypezX-Auth)r get_tokenr r r r )r r r tokener r s r
send_dataz BaseSendMessageAPI.send_data s B/9;;;;;;;;EE B B B @Q @ @AA A B /
))&'9EEEEEEEE F#####s
?:?) r r r URLr rH r r rA bytesr r r r
r r s
)C
^
IT Id I I I I
$c
$e
$
$
$
$
$
$
$r r c e Zd Zej ZddedefdZdeddfdZde e ddfd Z
d
e ddfd Z d Z
d
eddfdZdS )SendMessageAPINrpm_verbase_urlc z || _ || _ d| _ d | _ i | _ |r || _ d S | j | _ d S )N ) _executorr product_name server_idlicenser _BASE_URL)r r r executors r
__init__zSendMessageAPI.__init__+ sF ! + $DMMM NDMMMr r r$ c || _ d S rF )r )r r s r
set_product_namez SendMessageAPI.set_product_name6 s (r r c || _ d S rF )r )r r s r
set_server_idz SendMessageAPI.set_server_id9 s
"r r c || _ d S rF )r )r r s r
set_licensezSendMessageAPI.set_license< s
r c K t j | j | j | z ||d }| || j d {V S )Nr POST)datar r )r )urllibrequestRequestr r r
async_requestr )r r r r r s r
r z SendMessageAPI._send_request? st .(( MDHOO>O B B B )
''$.'IIIIIIIIIr r* c K | d st |d d S d|vrt j |d< d|vrt j j |d< |j | j |j | j | j
d}t j |t }| |j | d {V d S )Nr httpr0 r. )payloadr r. r rU )cls)r4 r6 timeuuiduuid4hexr r r. r r jsondumpsr# encoder r )r r* data2sendr s r
send_messagezSendMessageAPI.send_messageH s {{8$$ gv . . . F g % %#'9;;GK w & &$(JLL$4GL ! |!, %
Jy.?@@@GGII nnW^Y77777777777r )NN)r r r r DEFAULT_SOCKET_TIMEOUT_SOCKET_TIMEOUTrA r r r r rH r r r r r r r
r r ( s 1O + + +s + + + +)S )T ) ) ) )#x} # # # # # 4 D J J J8' 8d 8 8 8 8 8 8r r c F e Zd ZdefdZdeeeef ddfdZ dS )FileBasedGatewayAPIr$ c K |4 d {V t j t j | d {V }|d d | D dcd d d d {V S # 1 d {V swxY w Y d S )Nr c & i | ]\ }}|d k ||S r r )rB kvs r
rV z8FileBasedGatewayAPI._prepare_message.<locals>.<dictcomp>e s# JJJ$!QAMMAMMMr )r r )asyncio to_threadr loadsr[ )r r* semaphorer s r
_prepare_messagez$FileBasedGatewayAPI._prepare_message` s ",TZAAAAAAAAF *JJ&,,..JJJ s A A**
A47A4messagesNc K d}t j | fdt | 2 d {V }t j | d {V }|D ]N}i | di d| dd i}t j |t d Ot j t j
| d {V }t j dd }t j
|d
} | d d g}
t j |
t j j t j j t j j d
d {V } t% j | } | | d {V \ }
}t- j d r*t. dt3 | |
| | j dk r`t. d| t; t= d| |D ]:}t> j ! |d d ;d S )N c T K g | 3 d {V \ }} | "6 S rF )r )rB _r r r s r
rp z5FileBasedGatewayAPI.send_messages.<locals>.<listcomp>k sd
a
! !#y 1 1
s (r r r zagent-fgw-sendingstage I360_MESSAGE_GATEWAY_BIN_PATHz
/usr/libexec/zimunify-message-gatewayz send-manyz"--producer=i360-agent-non-resident)stdinstdoutstderr)inputDEBUGz Message sent to fgw: %s %s %sr zError sending message: r. )"r Semaphorer" gatherr4 r! report_reporter_gen_fgwr r r osgetenvpathjoincreate_subprocess_exec
subprocessPIPEbase64 b64encoder communicater r2 inforr
returncoder3 decoder rA r registryconfirm)r r max_threadstasksprepared_messagesr flatdumped_messages
bin_file_pathbin_filecommandprocessb64datar r r s ` @r
send_messagesz!FileBasedGatewayAPI.send_messagesh s %k22
,X 6 6
#*.%"8 8 8 8 8 8 8$ CKcggfb))K8SWWXr5J5JKKD '/B
!( 1 J)!
!
+_
7<<
/HII
0
6
$)%*%*
"?#9#9#;#;<< & 2 2 2 A AAAAAAA 5>> KK/X
" " LLD6==??DD E E E(?fmmoo??@@
% I IC ! ) )#f+//,*G*G H H H H I Ir )
r r r rH r rc tuplefloatr r
r r r
r r _ sg D 2IDue|1D,E 2I$ 2I 2I 2I 2I 2I 2Ir r c e Zd ZdZdZdZdZdZdZdZ d Z
de fd Z e
d
Zd Zd eeeef dd
fdZd Zd Zd
S )NATSGatewayAPIzPublishes messages to the embedded NATS server via localhost TCP.
Connects to nats://127.0.0.1:<port> with an auth token read from
a file written by the resident-agent on startup.
z imunify.api.i z /var/run/imunify360/nats.tokenz /var/run/imunify360/nats.addrr c > d | _ d| _ d| _ d| _ d S )Nr )_nc_last_connect_attempt_oversized_dropped_oversized_rejectedr s r
r zNATSGatewayAPI.__init__ s' %&""# #$ r r$ c $ | j dc}| _ |S )z=Oversized rejections since the last call, then reset (delta).r )r )r r( s r
pop_oversized_rejectedz%NATSGatewayAPI.pop_oversized_rejected s *.*BA't' r c t j dt j } t | 5 }| }ddd n # 1 swxY w Y |r|S n# t $ r Y nw xY wt t j dt t j
}d| S )zBRead NATS listen address from addr file, fall back to env/default.I360_NATS_ADDR_PATHNI360_NATS_PORTz
127.0.0.1:) r r r DEFAULT_ADDR_PATHopenreadstripOSErrorintrA DEFAULT_PORT) addr_pathfaddrports r
_read_addrzNATSGatewayAPI._read_addr s I !>#C
i
(Avvxx~~''
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
D I&N,G(H(H I I
#D"""s4 A3 'A# A3 #A''A3 *A'+A3 3
B ?B c K | j | j j rd S t st d t j }|| j z
}|| j k r t d| j |z
dd || _ | d {V | }t j d| j } t | 5 }| }d d d n # 1 swxY w Y t! j d| || j dt& d {V | _ t( d | d S # t, $ r}t d
| |d }~ww xY w) Nznats-py is not installedzNATS reconnect backoff (z.1fz s remaining)I360_NATS_TOKEN_PATHznats://r )r connect_timeoutmax_reconnect_attemptserror_cbzConnected to NATS at %szFailed to connect to NATS: )r is_connected _has_natsr r monotonicr MIN_RECONNECT_INTERVAL_closer% r r DEFAULT_TOKEN_PATHr r r natsconnectCONNECT_TIMEOUTr r2 r Exception)r now
since_lastr#
token_pathr" r r s r
_ensure_connectedz NATSGatewayAPI._ensure_connected s
8 DH$9 F G*+EFF Fn 455
3 3 3*P0:=OP P P
&)" kkmm Y 5t7NOO
j!!
)Q((
)
)
)
)
)
)
)
)
)
)
)
)
)
)
) !\ $ $ 4'(' DH
KK14 8 8 8 8 8 *1a11
s= E 'D8 E DE D AE
E?'E::E?r Nc K | d {V d} | j }|D ]\ }} t j | }nC# t j t f$ r*}t d| |dz
}Y d }~Wd }~ww xY w| d st |d |dz
}| d }| j |z } t j || d fg }
g } |
r|
\ } }
t j | }|
rd|
ind } | | || d {V }nY# t& t( f$ rD}t+ |t( r:|j t. k rt1 d | d
|
d | ||j t2 k r t5 | }|A| |
t9 | t; | |d d f Y d }~ |
p%t= j | }tC | D ](\ }}| d
| }||d< |
||f )t d| |
t9 | t9 | Y d }~d }~ww xY wtE j d r't # d| |j$ |j% |
| r| xj& dz
c_& tO tP r| xj) dz
c_) | d \ }}}}t * d| | d t9 | tW d | D d | D | j& || nTtY j- i |d|it\ d t^ j0 1 | d |dz
}d S # t0 $ rU}t d|t9 | t9 | |z
| te d| | |d }~wtf $ r^}| 4 d {V t d|t9 | | te d| | |d }~ww xY w)Nr z Skipping malformed message: %sr- r r1 r. z Nats-Msg-Id)r zsubject=z message_id=z: .zKSplitting oversized NATS message: subject=%s message_id=%s size=%d parts=%dr z"Published to %s, stream=%s, seq=%sz~Dropping oversized NATS message: subject=%s message_id=%s parts=%d size=%d fragments=%s oversized_total=%d error=%s preview=%rc 3 $ K | ] \ }}}}|V d S rF r )rB r sizes r
rG z/NATSGatewayAPI.send_messages.<locals>.<genexpr>` s* >>]QaD>>>>>>r c g | ] \ }}}}|
S r r )rB fragr s r
rp z0NATSGatewayAPI.send_messages.<locals>.<listcomp>a s ;;;-$1a;;;r zagent-nats-sendingr z<NATS stream full, %d/%d messages published, %d re-queued: %szStream at capacity: ) publishedz,NATS publish failed after %d/%d messages: %sz Failed to publish messages: )5r8 r jetstreamr r JSONDecodeErrorUnicodeDecodeErrorr2 warningr4 r6 popNATS_SUBJECT_PREFIX collectionsdequepopleftr r publishr r r@ r
_JS_ERR_STREAM_FULLr8 _JS_ERR_MSG_TOO_LARGEr r rr rA hashlibsha1 hexdigest enumerater r streamseqr r r r r3 r~ r! r _reporter_gen_natsr r r r r4 r/ )r r r@ jsr msg_bytesr r r subjectpendingdroppedr dedup_idr r ackr base_keyindexrn child_keyr3 previews r
r
z NATSGatewayAPI.send_messages s $$&&&&&&&&& U ##%%B ( w
w
9 !Z 2 2FF ,.@A NN#CQGGG NI HHHH zz(++ %ff555 NI H-- 2V; &+ fjj 6 678 8%,__%6%6ND( "j . . 5 5 7 7G;C M}h 7 7G-!$&JJ #Wg %/ % % 1-@ )! )! )!%a 77 & z-@ @ @
'2%Cw %C %C3;%C %C?@%C %C'" '" ()!) !z-B B B %!1$!7!7!> $NN!)3w<<Q# O %HHHH $ I W(=(=(G(G(I(I ! ,5V+<+< > >KE4+3(=(=e(=(=I1:D . #NND)+< = = = = > # $ LL KK
!S)!T uW~~ @ # J G g 8@ L++q0++!"ABB 6 00A500+21:(Aq%LLB
<00G >>g>>>>>;;7;;; / " $4648V44* 2
!)11&**\2J2JKKKQ ow
w
r
NNNH
H
)
+*q**#
++-- NN>H
+2q22#
s !P AP B- B
P BCP E97P 9K BK
&P ,BK
P
KEP
S #AQ33
S ASS c K | j F | j d {V n# t $ r Y nw xY wd | _ d S # d | _ w xY wd S rF )r closer4 r s r
r/ zNATSGatewayAPI._close s 8
hnn&&&&&&&&&&
4 s! + A
8A 8A A
c > K | d {V d S rF )r/ r s r
r` zNATSGatewayAPI.close s, kkmmr )r r r r9 rF r r0 r r3 r. r r r staticmethodr% r8 rc r r r r
r/ r` r r r
r r s )L97O % % %
# # \#&# # #JYDue|1D,E Y$ Y Y Y Yv r r )Xr rG rM r r r urllib.errorr r1 nats.errorsnats.js.errorsr, errorsMaxPayloadErrorr rT r r ImportErrorr4 urllib.requestabcr r loggingr typingr r r defence360agent.api.serverr r r r defence360agent.contracts.configr "defence360agent.contracts.messagesr r defence360agent.internalsr 'defence360agent.internals.feature_flagsr r &defence360agent.internals.global_scoper defence360agent.internals.iaidr r 2defence360agent.internals.message_status_publisherr r! !defence360agent.utils.async_utilsr" defence360agent.utils.jsonr# r r2 r rS r1 r& r r) rH rA r6 rK rL r8 frozensetr^ _MAX_SPLIT_DEPTHrI rP r\ boolr` rf rd rb r r r r r r r r r
<module>rz s
KKKI ;6GN+MM I
y
# # # # # # # # 2 1 1 1 1 1 E E E E E E E E 2 2 2 2 2 2 5 4 4 4 4 4 N M M M M M M M : : : : : : 8 8 8 8 8 8 8 CEE SUU ! ! C t 3 4 * O O O O O) O O O i9-..
s
$ "I I I I I & & &8 ,< , ,t , , , ,^T 0!Y !4 ! ! ! !$ $ $ $ $c $ $ $448 48 48 48 48' 48 48 48n;I ;I ;I ;I ;I. ;I ;I ;I|{ { { { { { { { { { s +A
#A0/A0 defence360agent/api/server/__pycache__/send_message.cpython-311.pyc 0000644 0000000 0000000 00000104137 00000000000 022202 0 ustar
r_jb : d dl Z d dlZd dlZd dlZd dlZd dlZd dlZ d dlZd dl Zd dl
ZdZ ej j
Zej j j Zn)# e$ r! dZ G d de Z G d de ZY nw xY wd dlZd dlmZmZ d d lmZ d d
lmZ d dl Z d dl Z d d l m Z mZm Z m!Z!m"Z" d d l#m$Z$ d d
l%m&Z&m'Z' d dl(m)Z) d dl*m+Z+m,Z, d dl-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4 d dl5m6Z6 d dl7m8Z8 ee9 Z: e3 Z; e3 Z<d a=d a>de?fdZ@deAdeBddfdZCdZDdZE G d d e ZF eGd d h ZHd ZIdeJfd!ZKd"eAdeAfd#ZLdeMfd$ZNd% ZOd& ZPeIfd'eAfd(ZQd)eAfd*ZRd+eddfd,ZS G d- d.e e ZT G d/ d0eT ZU G d1 d2eU ZV G d3 d4 ZWdS )5 NTFc e Zd ZdS )_NATSMaxPayloadErrorN)__name__
__module__ __qualname__ \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/api/server/send_message.pyr r s r r c e Zd ZdZdS )
_NATSAPIErrorN)r r r err_coder r r
r r s r r )ABCabstractmethod) getLogger)Optional)APIAPIError
APITokenErrorFGWSendMessgeExceptionNATSSendMessageException)Core)
estimate_sizeMessage) delivery_ack) MESSAGE_LOSS_OBSERVABILITY_FLAG
is_enabled)g)IndependentAgentIDAPIIAIDTokenError)Gen publisher) AsyncIterate)ServerJSONEncoderreturnc t dc} a | S )z:Method-less drops since the last call, then reset (delta).r ) _method_missing_dropped_deltavalues r
pop_method_missing_droppedr) A s ,I!(E ( Lr messagesinkc
t dz
a t dz
at d|| d | d | d t | t dS )z*Count and log a message no sink can route. zkDropping message without a method: sink=%s message_id=%s plugin_id=%s timestamp=%s keys=%s dropped_total=%d
message_id plugin_id timestampN) _method_missing_dropped_totalr& loggererrorgetsorted)r* r+ s r
_drop_method_lessr6 H s{ "Q&!!Q&!
LL > L!! K K w% r i]' iF' c e Zd ZdZdS ) _StreamFullzDStream is at capacity: re-queue the rest, the connection is healthy.N)r r r __doc__r r r
r8 r8 d s NNNNr r8 scanidscan_id c P t | t r d | D S t }| D ]s}t |t r| | -t |t r1| d | D t|S )zrStrings a sibling map could be keyed on: a dict's own keys, or the
scalar values carried by a list's elements.c < h | ]}t |t |S r
isinstancestr).0keys r
<setcomp>z _element_ids.<locals>.<setcomp>v s' AAAJsC,@,@AAAAr c 3 D K | ]}t |t |V d S Nr? )rB r( s r
<genexpr>z _element_ids.<locals>.<genexpr>| sE z%7M7M r )r@ dictsetrA addupdatevalues) containeridselements r
_element_idsrP r s )T"" BAAyAAAA
%%C gs # # GGG
&
& JJ #*>>#3#3
Jr fieldsc ` d D fd D S )zSibling dicts keyed entirely by a field's elements, which have to follow
those records rather than be bisected away from them.c 4 i | ]\ }}|t | S r )rP rB namer( s r
<dictcomp>z _paired_maps.<locals>.<dictcomp> s&
G
G
Gu4 e$$
G
G
Gr c V i | ]$fd D %S )c h | ]=\ }}|k r2t |t r |rt | k ;|>S r )r@ rH rI )rB otherr( rN rU s r
rD z*_paired_maps.<locals>.<dictcomp>.<setcomp> sc
u}}5$'' E
c$i''
(''r items)rB rU rQ rN s @r
rV z _paired_maps.<locals>.<dictcomp> s_
&
r rZ )rQ rN s `@r
_paired_mapsr\ sT H
G
G
G
GC
r c b t | t ot | S rF )r@ rH _INDEX_KEYS
isdisjointr' s r
_carries_index_keyr` s( eT " " H;+A+A%+H+H'HHr c |dk rd S t | t rt | |dz
S t | t rt | |dz
S d S )Nr r- )r@ rH _split_largest_fieldlist_split_container)rO depths r
_split_elementrf sa zzt'4 8#GUQY777'4 4 333 4r c t t rt t dk r>t dz } fdd| D fd|d D gS sdS t d | }|dS fd|D S t dk r&t dz } d| |d gS sdS t d | }|dS d |D S ) zxBisect a list or dict, descending into a lone element so a single
oversized record can still be split within itself.r- c " i | ] }|| S r r rB rC r( s r
rV z$_split_container.<locals>.<dictcomp> 777SeCj777r Nc " i | ] }|| S r r rj s r
rV z$_split_container.<locals>.<dictcomp> rk r r c $ g | ] }d |i
S )r r )rB halfkeyss r
<listcomp>z$_split_container.<locals>.<listcomp> s! 222Da$222r c g | ]}|gS r r )rB rn s r
rp z$_split_container.<locals>.<listcomp> s % % %tTF % % %r )r@ rH rc lenrf )r( re midinnerro s ` @r
rd rd sJ %
3E{{ t99q==d))q.C7777D#J7777777DJ777
4 uT!W~u55 =42222E2222
5zzA~~%jjAodsd U344[)) t 58U + +E }t % %u % % %%r itemc
d | D
t
d
D fd
D }
fd}t ||d D ] }t
| | }| n dS g }|D ]b}t | i | ||i}
| D ]+} fd
| D || < ,| | c|S ) zBisect the heaviest payload field, while index-carrying fields and maps
paired with another field's records ride along instead of being split.c R i | ]$\ }}t |t t f !||%S r )r@ rc rH rT s r
rV z(_split_largest_field.<locals>.<dictcomp> sB D% edD\ * * e r c h | ] }|D ]}|
S r r )rB mapsrU s r
rD z'_split_largest_field.<locals>.<setcomp> s% CCC$dCCdCCCCr c @ g | ]\ }}|v t | |S r )r` )rB rU r( followerss r
rp z(_split_largest_field.<locals>.<listcomp> s@ D% y );E)B)B
r c r t | t fd| D z S )Nc 3 B K | ]}t | V d S rF )r )rB rY rQ s r
rG z7_split_largest_field.<locals>.weight.<locals>.<genexpr> s@ 1
1
-2M&- ( (1
1
1
1
1
1
r )r sum)rU rQ paireds r
weightz$_split_largest_field.<locals>.weight sR VD\**S 1
1
1
1
6<Tl1
1
1
.
.
r T)rC reverseNc $ i | ] \ }}|v ||
S r r )rB rC r( kepts r
rV z(_split_largest_field.<locals>.<dictcomp> s0 C$;; U ;;r )r[ r\ rL r5 rd rP append)ru re
candidatesr fieldhalvespartsrn partrU rQ r{ r r s @@@@r
rb rb s ::<< F
&
!
!FCC&--//CCCI !<<>> J
=== !&-77 E t E D!!$$$t$$5M D "(,"4"4"6"6 DJJ
T Lr loadedc d }t |t rEt | dk r2t | dz }i d|d| ii d||d igS t |t rt | dk r|d nd}t |t r2 t | }n# t $ r Y dS w xY w| fd|D S dS )zSplit an oversized message into smaller parts. Returns a list of parts,
or None when the message carries a single irreducible record.r[ r- rh Nr c " g | ] }i d |gi S rZ r )rB rn r s r
rp z$_split_oversized.<locals>.<listcomp> s+ CCCD/v/w//CCCr )r4 r@ rc rr rH rb RecursionError)r r[ rs singler s ` r
_split_oversizedr s!
JJw E%
3u::>>%jjAo ,v ,wdsd , , ,v ,wcdd , ,
$E400
NSZZ1__U1XX$F&$ D )&11FF 44
CCCCFCCC C 4s 9C
CCexc @ K t d| dS )a Downgrade nats-py internal errors to DEBUG.
Transient errors (ConnectionRefused, AuthorizationViolation) are
expected during agent restarts. Our code already logs a WARNING
with context, so the nats-py default ERROR + traceback is noise.
znats: %sN)r2 debug)r s r
_nats_error_cbr s" LLR r c R e Zd ZdZedefd ZdeddfdZdede ddfd Z
dS )
BaseSendMessageAPIz /api/v2/send-message/{method}r$ c
K d S rF r )selfmessage_methodheaders post_datas r
_send_requestz BaseSendMessageAPI._send_request s r resultNc d|vr"t d | |d dk r5t d | d d S )Nstatusz unexpected server response: {!r}okzserver error: {}msg)r formatr4 )r r s r
check_responsez!BaseSendMessageAPI.check_response sk 6 ! !=DDVLLMM M ( t # #-44VZZ5F5FGGHH H $ #r methodr c K t j d {V }n$# t $ r}t d| d }~ww xY wd|d}| ||| d {V }| | d S )NzIAID token error occurred zapplication/json)z Content-TypezX-Auth)r get_tokenr r r r )r r r tokener r s r
send_dataz BaseSendMessageAPI.send_data s B/9;;;;;;;;EE B B B @Q @ @AA A B /
))&'9EEEEEEEE F#####s
?:?) r r r URLr rH r r rA bytesr r r r
r r s
)C
^
IT Id I I I I
$c
$e
$
$
$
$
$
$
$r r c e Zd Zej ZddedefdZdeddfdZde e ddfd Z
d
e ddfd Z d Z
d
eddfdZdS )SendMessageAPINrpm_verbase_urlc z || _ || _ d| _ d | _ i | _ |r || _ d S | j | _ d S )N ) _executorr product_name server_idlicenser _BASE_URL)r r r executors r
__init__zSendMessageAPI.__init__+ sF ! + $DMMM NDMMMr r r$ c || _ d S rF )r )r r s r
set_product_namez SendMessageAPI.set_product_name6 s (r r c || _ d S rF )r )r r s r
set_server_idz SendMessageAPI.set_server_id9 s
"r r c || _ d S rF )r )r r s r
set_licensezSendMessageAPI.set_license< s
r c K t j | j | j | z ||d }| || j d {V S )Nr POST)datar r )r )urllibrequestRequestr r r
async_requestr )r r r r r s r
r z SendMessageAPI._send_request? st .(( MDHOO>O B B B )
''$.'IIIIIIIIIr r* c K | d st |d d S d|vrt j |d< d|vrt j j |d< |j | j |j | j | j
d}t j |t }| |j | d {V d S )Nr httpr0 r. )payloadr r. r rU )cls)r4 r6 timeuuiduuid4hexr r r. r r jsondumpsr# encoder r )r r* data2sendr s r
send_messagezSendMessageAPI.send_messageH s {{8$$ gv . . . F g % %#'9;;GK w & &$(JLL$4GL ! |!, %
Jy.?@@@GGII nnW^Y77777777777r )NN)r r r r DEFAULT_SOCKET_TIMEOUT_SOCKET_TIMEOUTrA r r r r rH r r r r r r r
r r ( s 1O + + +s + + + +)S )T ) ) ) )#x} # # # # # 4 D J J J8' 8d 8 8 8 8 8 8r r c F e Zd ZdefdZdeeeef ddfdZ dS )FileBasedGatewayAPIr$ c K |4 d {V t j t j | d {V }|d d | D dcd d d d {V S # 1 d {V swxY w Y d S )Nr c & i | ]\ }}|d k ||S r r )rB kvs r
rV z8FileBasedGatewayAPI._prepare_message.<locals>.<dictcomp>e s# JJJ$!QAMMAMMMr )r r )asyncio to_threadr loadsr[ )r r* semaphorer s r
_prepare_messagez$FileBasedGatewayAPI._prepare_message` s ",TZAAAAAAAAF *JJ&,,..JJJ s A A**
A47A4messagesNc K d}t j | fdt | 2 d {V }t j | d {V }|D ]N}i | di d| dd i}t j |t d Ot j t j
| d {V }t j dd }t j
|d
} | d d g}
t j |
t j j t j j t j j d
d {V } t% j | } | | d {V \ }
}t- j d r*t. dt3 | |
| | j dk r`t. d| t; t= d| |D ]:}t> j ! |d d ;d S )N c T K g | 3 d {V \ }} | "6 S rF )r )rB _r r r s r
rp z5FileBasedGatewayAPI.send_messages.<locals>.<listcomp>k sd
a
! !#y 1 1
s (r r r zagent-fgw-sendingstage I360_MESSAGE_GATEWAY_BIN_PATHz
/usr/libexec/zimunify-message-gatewayz send-manyz"--producer=i360-agent-non-resident)stdinstdoutstderr)inputDEBUGz Message sent to fgw: %s %s %sr zError sending message: r. )"r Semaphorer" gatherr4 r! report_reporter_gen_fgwr r r osgetenvpathjoincreate_subprocess_exec
subprocessPIPEbase64 b64encoder communicater r2 inforr
returncoder3 decoder rA r registryconfirm)r r max_threadstasksprepared_messagesr flatdumped_messages
bin_file_pathbin_filecommandprocessb64datar r r s ` @r
send_messagesz!FileBasedGatewayAPI.send_messagesh s %k22
,X 6 6
#*.%"8 8 8 8 8 8 8$ CKcggfb))K8SWWXr5J5JKKD '/B
!( 1 J)!
!
+_
7<<
/HII
0
6
$)%*%*
"?#9#9#;#;<< & 2 2 2 A AAAAAAA 5>> KK/X
" " LLD6==??DD E E E(?fmmoo??@@
% I IC ! ) )#f+//,*G*G H H H H I Ir )
r r r rH r rc tuplefloatr r
r r r
r r _ sg D 2IDue|1D,E 2I$ 2I 2I 2I 2I 2I 2Ir r c e Zd ZdZdZdZdZdZdZdZ d Z
de fd Z e
d
Zd Zd eeeef dd
fdZd Zd Zd
S )NATSGatewayAPIzPublishes messages to the embedded NATS server via localhost TCP.
Connects to nats://127.0.0.1:<port> with an auth token read from
a file written by the resident-agent on startup.
z imunify.api.i z /var/run/imunify360/nats.tokenz /var/run/imunify360/nats.addrr c > d | _ d| _ d| _ d| _ d S )Nr )_nc_last_connect_attempt_oversized_dropped_oversized_rejectedr s r
r zNATSGatewayAPI.__init__ s' %&""# #$ r r$ c $ | j dc}| _ |S )z=Oversized rejections since the last call, then reset (delta).r )r )r r( s r
pop_oversized_rejectedz%NATSGatewayAPI.pop_oversized_rejected s *.*BA't' r c t j dt j } t | 5 }| }ddd n # 1 swxY w Y |r|S n# t $ r Y nw xY wt t j dt t j
}d| S )zBRead NATS listen address from addr file, fall back to env/default.I360_NATS_ADDR_PATHNI360_NATS_PORTz
127.0.0.1:) r r r DEFAULT_ADDR_PATHopenreadstripOSErrorintrA DEFAULT_PORT) addr_pathfaddrports r
_read_addrzNATSGatewayAPI._read_addr s I !>#C
i
(Avvxx~~''
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
D I&N,G(H(H I I
#D"""s4 A3 'A# A3 #A''A3 *A'+A3 3
B ?B c K | j | j j rd S t st d t j }|| j z
}|| j k r t d| j |z
dd || _ | d {V | }t j d| j } t | 5 }| }d d d n # 1 swxY w Y t! j d| || j dt& d {V | _ t( d | d S # t, $ r}t d
| |d }~ww xY w) Nznats-py is not installedzNATS reconnect backoff (z.1fz s remaining)I360_NATS_TOKEN_PATHznats://r )r connect_timeoutmax_reconnect_attemptserror_cbzConnected to NATS at %szFailed to connect to NATS: )r is_connected _has_natsr r monotonicr MIN_RECONNECT_INTERVAL_closer% r r DEFAULT_TOKEN_PATHr r r natsconnectCONNECT_TIMEOUTr r2 r Exception)r now
since_lastr#
token_pathr" r r s r
_ensure_connectedz NATSGatewayAPI._ensure_connected s
8 DH$9 F G*+EFF Fn 455
3 3 3*P0:=OP P P
&)" kkmm Y 5t7NOO
j!!
)Q((
)
)
)
)
)
)
)
)
)
)
)
)
)
)
) !\ $ $ 4'(' DH
KK14 8 8 8 8 8 *1a11
s= E 'D8 E DE D AE
E?'E::E?r Nc K | d {V d} | j }|D ]\ }} t j | }nC# t j t f$ r*}t d| |dz
}Y d }~Wd }~ww xY w| d st |d |dz
}| d }| j |z } t j || d fg }
g } |
r|
\ } }
t j | }|
rd|
ind } | | || d {V }nY# t& t( f$ rD}t+ |t( r:|j t. k rt1 d | d
|
d | ||j t2 k r t5 | }|A| |
t9 | t; | |d d f Y d }~ |
p%t= j | }tC | D ](\ }}| d
| }||d< |
||f )t d| |
t9 | t9 | Y d }~d }~ww xY wtE j d r't # d| |j$ |j% |
| r| xj& dz
c_& tO tP r| xj) dz
c_) | d \ }}}}t * d| | d t9 | tW d | D d | D | j& || nTtY j- i |d|it\ d t^ j0 1 | d |dz
}d S # t0 $ rU}t d|t9 | t9 | |z
| te d| | |d }~wtf $ r^}| 4 d {V t d|t9 | | te d| | |d }~ww xY w)Nr z Skipping malformed message: %sr- r r1 r. z Nats-Msg-Id)r zsubject=z message_id=z: .zKSplitting oversized NATS message: subject=%s message_id=%s size=%d parts=%dr z"Published to %s, stream=%s, seq=%sz~Dropping oversized NATS message: subject=%s message_id=%s parts=%d size=%d fragments=%s oversized_total=%d error=%s preview=%rc 3 $ K | ] \ }}}}|V d S rF r )rB r sizes r
rG z/NATSGatewayAPI.send_messages.<locals>.<genexpr>` s* >>]QaD>>>>>>r c g | ] \ }}}}|
S r r )rB fragr s r
rp z0NATSGatewayAPI.send_messages.<locals>.<listcomp>a s ;;;-$1a;;;r zagent-nats-sendingr z<NATS stream full, %d/%d messages published, %d re-queued: %szStream at capacity: ) publishedz,NATS publish failed after %d/%d messages: %sz Failed to publish messages: )5r8 r jetstreamr r JSONDecodeErrorUnicodeDecodeErrorr2 warningr4 r6 popNATS_SUBJECT_PREFIX collectionsdequepopleftr r publishr r r@ r
_JS_ERR_STREAM_FULLr8 _JS_ERR_MSG_TOO_LARGEr r rr rA hashlibsha1 hexdigest enumerater r streamseqr r r r r3 r~ r! r _reporter_gen_natsr r r r r4 r/ )r r r@ jsr msg_bytesr r r subjectpendingdroppedr dedup_idr r ackr base_keyindexrn child_keyr3 previews r
r
z NATSGatewayAPI.send_messages s $$&&&&&&&&& U ##%%B ( w
w
9 !Z 2 2FF ,.@A NN#CQGGG NI HHHH zz(++ %ff555 NI H-- 2V; &+ fjj 6 678 8%,__%6%6ND( "j . . 5 5 7 7G;C M}h 7 7G-!$&JJ #Wg %/ % % 1-@ )! )! )!%a 77 & z-@ @ @
'2%Cw %C %C3;%C %C?@%C %C'" '" ()!) !z-B B B %!1$!7!7!> $NN!)3w<<Q# O %HHHH $ I W(=(=(G(G(I(I ! ,5V+<+< > >KE4+3(=(=e(=(=I1:D . #NND)+< = = = = > # $ LL KK
!S)!T uW~~ @ # J G g 8@ L++q0++!"ABB 6 00A500+21:(Aq%LLB
<00G >>g>>>>>;;7;;; / " $4648V44* 2
!)11&**\2J2JKKKQ ow
w
r
NNNH
H
)
+*q**#
++-- NN>H
+2q22#
s !P AP B- B
P BCP E97P 9K BK
&P ,BK
P
KEP
S #AQ33
S ASS c K | j F | j d {V n# t $ r Y nw xY wd | _ d S # d | _ w xY wd S rF )r closer4 r s r
r/ zNATSGatewayAPI._close s 8
hnn&&&&&&&&&&
4 s! + A
8A 8A A
c > K | d {V d S rF )r/ r s r
r` zNATSGatewayAPI.close s, kkmmr )r r r r9 rF r r0 r r3 r. r r r staticmethodr% r8 rc r r r r
r/ r` r r r
r r s )L97O % % %
# # \#&# # #JYDue|1D,E Y$ Y Y Y Yv r r )Xr rG rM r r r urllib.errorr r1 nats.errorsnats.js.errorsr, errorsMaxPayloadErrorr rT r r ImportErrorr4 urllib.requestabcr r loggingr typingr r r defence360agent.api.serverr r r r defence360agent.contracts.configr "defence360agent.contracts.messagesr r defence360agent.internalsr 'defence360agent.internals.feature_flagsr r &defence360agent.internals.global_scoper defence360agent.internals.iaidr r 2defence360agent.internals.message_status_publisherr r! !defence360agent.utils.async_utilsr" defence360agent.utils.jsonr# r r2 r rS r1 r& r r) rH rA r6 rK rL r8 frozensetr^ _MAX_SPLIT_DEPTHrI rP r\ boolr` rf rd rb r r r r r r r r r
<module>rz s
KKKI ;6GN+MM I
y
# # # # # # # # 2 1 1 1 1 1 E E E E E E E E 2 2 2 2 2 2 5 4 4 4 4 4 N M M M M M M M : : : : : : 8 8 8 8 8 8 8 CEE SUU ! ! C t 3 4 * O O O O O) O O O i9-..
s
$ "I I I I I & & &8 ,< , ,t , , , ,^T 0!Y !4 ! ! ! !$ $ $ $ $c $ $ $448 48 48 48 48' 48 48 48n;I ;I ;I ;I ;I. ;I ;I ;I|{ { { { { { { { { { s +A
#A0/A0 defence360agent/api/server/analyst_cleanup.py 0000644 0000000 0000000 00000017002 00000000000 016361 0 ustar import http.client
import json
import urllib.error
import urllib.request
import logging
from datetime import datetime, timedelta
from defence360agent.api.server import API
from defence360agent.contracts.config import ANTIVIRUS_MODE
from defence360agent.internals.iaid import (
IndependentAgentIDAPI,
IAIDTokenError,
)
from defence360agent.rpc_tools.utils import run_in_executor_decorator
from defence360agent.utils.support import parse_params
logger = logging.getLogger(__name__)
CACHE_TTL = timedelta(minutes=10)
NO_AGENT_TOKEN = "no_agent_token"
def _json_object(response):
try:
body = json.load(response)
except (ValueError, OSError, http.client.HTTPException) as e:
logger.warning("Cannot decode API response body: %s", e)
return {}
if isinstance(body, dict):
return body
logger.warning(
"API response body is %s, not an object", type(body).__name__
)
return {}
class AnalystCleanupAPI(API):
CLEANUP_ALLOWED_URL_TEMPLATE = (
"{base}/api/analyst-assisted-cleanup/is-allowed"
)
SHOW_MANY_URL_TEMPLATE = "{base}/api/analyst-assisted-cleanup/tickets"
IS_REGISTERED_URL_TEMPLATE = (
"{base}/api/analyst-assisted-cleanup/is-registered"
)
CREATE_TICKET_URL_TEMPLATE = (
"{base}/api/analyst-assisted-cleanup/create-ticket"
)
# Cache for the cleanup allowed check
_cache = {
"result": None,
"timestamp": datetime.min, # Initialize with minimum datetime
}
@classmethod
async def check_cleanup_allowed(cls):
"""Check if analyst cleanup is allowed for this installation"""
current_time = datetime.now()
if (
cls._cache["result"] is not None
and current_time - cls._cache["timestamp"] < CACHE_TTL
):
return cls._cache["result"]
try:
request = urllib.request.Request(
cls.CLEANUP_ALLOWED_URL_TEMPLATE.format(base=cls._BASE_URL),
headers={"X-Auth": await IndependentAgentIDAPI.get_token()},
method="GET",
)
except IAIDTokenError:
return False
else:
result = await cls._check_allowed(request)
cls._cache["result"] = result
cls._cache["timestamp"] = datetime.now()
return result
@classmethod
@run_in_executor_decorator
def _check_allowed(cls, request):
"""Execute the actual request in executor"""
try:
result = cls.request(request)
return result.get("result", False)
except Exception as e:
logger.error("Failed to check cleanup permission: %s", e)
# NOTE:
# If the API returns an error, the request should be allowed
# (to prevent extra sales trips due to API instability).
# Ref: https://cloudlinux.slite.com/app/docs/Fhb2ASESxb9111
return True
@classmethod
async def get_tickets(cls, ids: [str]) -> [dict]:
"""
Retrieve tickets from Zendesk API using the show_many endpoint
Args:
ids (list or str): List of ticket IDs or comma-separated string of IDs
Returns:
list: List of dictionaries with 'id', 'status', and 'updated_at' fields
"""
# Convert list of ids to comma-separated string if necessary
if isinstance(ids, list):
ids_str = ",".join(str(_id) for _id in ids)
else:
ids_str = str(ids)
# Construct URL for the show_many endpoint
url = cls.SHOW_MANY_URL_TEMPLATE.format(base=cls._BASE_URL)
params = {"ids": ids_str}
try:
request = urllib.request.Request(
parse_params(params, url),
headers={"X-Auth": await IndependentAgentIDAPI.get_token()},
method="GET",
)
except IAIDTokenError as e:
logger.error(f"Failed to get IAID token for tickets: {e}")
raise
return await cls._execute_get_tickets(request)
@classmethod
@run_in_executor_decorator
def _execute_get_tickets(cls, request):
"""Execute the actual get_tickets request in executor"""
simplified_tickets = []
try:
result = cls.request(request)
# Extract only the required fields from each ticket
for ticket in result.get("tickets", []):
simplified_tickets.append(
{
"id": ticket.get("id"),
"status": ticket.get("status"),
"updated_at": ticket.get("updated_at"),
}
)
return simplified_tickets
except Exception as e:
logger.error(f"Failed to get tickets: {e}")
finally:
return simplified_tickets
@classmethod
async def check_registered(cls, email):
"""Check if email is registered in Zendesk"""
try:
request = urllib.request.Request(
cls.IS_REGISTERED_URL_TEMPLATE.format(base=cls._BASE_URL),
headers={
"X-Auth": await IndependentAgentIDAPI.get_token(),
"Content-Type": "application/json",
},
data=json.dumps({"customer_email": email}).encode(),
method="POST",
)
except IAIDTokenError:
logger.error("Got IAIDTokenError")
return {}
else:
result = await cls._register_status(request)
return result
@classmethod
@run_in_executor_decorator
def _register_status(cls, request):
"""Execute the actual request in executor"""
try:
result = cls.request(request)
return result
except Exception as e:
logger.error("Failed to check email registration: %s", e)
return {}
@classmethod
async def create_ticket(cls, email, subject, description):
"""Ask the backend to open a support ticket.
Return an (HTTP status, response body) pair; the status is None when
the backend could not be reached at all.
"""
try:
token = await IndependentAgentIDAPI.get_token()
except IAIDTokenError:
return None, {"message": NO_AGENT_TOKEN}
request = urllib.request.Request(
cls.CREATE_TICKET_URL_TEMPLATE.format(base=cls._BASE_URL),
headers={
"X-Auth": token,
"Content-Type": "application/json",
},
data=json.dumps(
{
"email": email,
"subject": subject,
"description": description,
"product": (
"pr_imunify_av" if ANTIVIRUS_MODE else "pr_im360"
),
}
).encode(),
method="POST",
)
return await cls._send_create_ticket(request)
@classmethod
@run_in_executor_decorator
def _send_create_ticket(cls, request):
"""Execute the actual request in executor"""
try:
with urllib.request.urlopen(
request, timeout=cls._SOCKET_TIMEOUT
) as response:
return response.status, _json_object(response)
except urllib.error.HTTPError as e:
return e.code, _json_object(e) if e.fp is not None else {}
except Exception as e:
logger.warning("Failed to reach create-ticket endpoint: %s", e)
return None, {}
defence360agent/api/server/cleanup_revert.py 0000644 0000000 0000000 00000001461 00000000000 016217 0 ustar import logging
from urllib.parse import urljoin
from urllib.request import Request
from defence360agent.api.server import API, APIError
from defence360agent.internals.iaid import (
IndependentAgentIDAPI,
IAIDTokenError,
)
logger = logging.getLogger(__name__)
class CleanupRevertAPI(API):
URL = urljoin(API._BASE_URL, "/api/cleanup/revert")
@classmethod
async def paths(cls):
try:
token = await IndependentAgentIDAPI.get_token()
except IAIDTokenError:
return []
request = Request(cls.URL, headers={"X-Auth": token})
try:
result = await cls.async_request(request)
except APIError as exc:
logger.warning("Failed to fetch cleanup revert data: %s", exc)
return []
return result["paths"]
defence360agent/api/server/events.py 0000644 0000000 0000000 00000003511 00000000000 014503 0 ustar import urllib.request
import logging
import datetime
from defence360agent.api.server import API
from defence360agent.internals.iaid import IndependentAgentIDAPI
from defence360agent.rpc_tools.utils import run_in_executor_decorator
logger = logging.getLogger(__name__)
class EventsAPI(API):
ADVICES_API_URL_TEMPLATE = (
"{base}/api/dashboard/events?dashboard=false&"
"popup=true¬_snoozed_at={not_snoozed_at}"
)
NOTIFICATIONS_API_URL_TEMPLATE = (
"{base}/api/dashboard/v2/events?notification=1&enduser=true"
)
SMART_ADVICE_API_URL_TEMPLATE = (
"{base}/api/dashboard/v2/events?smartadvice=true"
)
@classmethod
@run_in_executor_decorator
def advices(cls):
request = urllib.request.Request(
cls.ADVICES_API_URL_TEMPLATE.format(
base=cls._BASE_URL,
not_snoozed_at=int(datetime.datetime.now().timestamp()),
),
method="GET",
)
result = cls.request(request)
return result["result"]
@classmethod
async def notification(cls):
request = urllib.request.Request(
cls.NOTIFICATIONS_API_URL_TEMPLATE.format(base=cls._BASE_URL),
method="GET",
headers={"X-Auth": await IndependentAgentIDAPI.get_token()},
)
return await cls._send_notifications(request)
@classmethod
async def smart_advices(cls):
request = urllib.request.Request(
cls.SMART_ADVICE_API_URL_TEMPLATE.format(base=cls._BASE_URL),
method="GET",
headers={"X-Auth": await IndependentAgentIDAPI.get_token()},
)
return cls.request(request)["result"]
@classmethod
@run_in_executor_decorator
def _send_notifications(cls, request):
result = cls.request(request)
return result["result"]
defence360agent/api/server/reputation.py 0000644 0000000 0000000 00000004361 00000000000 015375 0 ustar import json
import urllib.error
import urllib.request
import urllib.parse
import asyncio
from typing import List
import time
import logging
from defence360agent.utils import retry_on, split_for_chunk
from defence360agent.api.server import API, APIError
logger = logging.getLogger(__name__)
class ReputationAPI(API):
REQUEST_URL = "/api/reputation/check"
RESULT_URL = "/api/reputation/result"
# during stress tests 'Request Entity Too Large' error has been caught,
# in request size somewhere between 800000 and 900000 bytes
# max domain length - 255, 800000 / 255 = 3137
# 3000 is the nearest 'round' number
CHUNK_SIZE = 3000
WAIT_BEFORE_RETRY = 5
WAIT_FOR_RESULT = 1200
_SOCKET_TIMEOUT = 60
@classmethod
async def check(cls, domains: List[str]) -> List[dict]:
logger.info("DomainListRequest domains: %s", domains)
loop = asyncio.get_event_loop()
return await loop.run_in_executor(None, cls._check, domains)
@classmethod
def _check(cls, domains: List[str]) -> List[dict]:
result_list = []
for chunk in split_for_chunk(domains, cls.CHUNK_SIZE):
result = cls._check_chunk(chunk)
next_chunk = cls._get_result(result["result_id"])
result_list += next_chunk
return result_list
@classmethod
@retry_on(APIError, timeout=WAIT_FOR_RESULT)
def _check_chunk(cls, chunk) -> dict:
check_request = urllib.request.Request(
cls._BASE_URL + cls.REQUEST_URL,
method="POST",
headers={"Content-Type": "application/json"},
data=json.dumps(dict(domains=chunk)).encode(),
)
return cls.request(check_request)
@classmethod
@retry_on(APIError, timeout=WAIT_FOR_RESULT)
def _get_result(cls, result_id: str):
data = dict(result_id=result_id)
url = "{}?{}".format(
cls._BASE_URL + cls.RESULT_URL, urllib.parse.urlencode(data)
)
request = urllib.request.Request(url)
response = cls.request(request)
result = response["result"]
if result is None:
# time inside sync executor
time.sleep(cls.WAIT_BEFORE_RETRY)
raise APIError("Response not ready yet")
return result
defence360agent/api/server/send_message.py 0000644 0000000 0000000 00000061027 00000000000 015642 0 ustar import base64
import collections
import hashlib
import json
import os
import time
import urllib.error
try:
import nats
import nats.errors
import nats.js.errors
_has_nats = True
_NATSMaxPayloadError = nats.errors.MaxPayloadError
_NATSAPIError = nats.js.errors.APIError
except ImportError:
_has_nats = False
class _NATSMaxPayloadError(Exception):
pass
class _NATSAPIError(Exception):
err_code = None
import urllib.request
from abc import ABC, abstractmethod
from logging import getLogger
from typing import Optional
import asyncio
import uuid
from defence360agent.api.server import (
API,
APIError,
APITokenError,
FGWSendMessgeException,
NATSSendMessageException,
)
from defence360agent.contracts.config import Core
from defence360agent.contracts.messages import estimate_size, Message
from defence360agent.internals import delivery_ack
from defence360agent.internals.feature_flags import (
MESSAGE_LOSS_OBSERVABILITY_FLAG,
is_enabled,
)
from defence360agent.internals.global_scope import g
from defence360agent.internals.iaid import (
IndependentAgentIDAPI,
IAIDTokenError,
)
from defence360agent.internals.message_status_publisher import Gen, publisher
from defence360agent.utils.async_utils import AsyncIterate
from defence360agent.utils.json import ServerJSONEncoder
logger = getLogger(__name__)
_reporter_gen_fgw = Gen()
_reporter_gen_nats = Gen()
_method_missing_dropped_total = 0
_method_missing_dropped_delta = 0
def pop_method_missing_dropped() -> int:
"""Method-less drops since the last call, then reset (delta)."""
global _method_missing_dropped_delta
value, _method_missing_dropped_delta = _method_missing_dropped_delta, 0
return value
def _drop_method_less(message: dict, sink: str) -> None:
"""Count and log a message no sink can route."""
# Key names only, except plugin_id: it names the producer, not the payload.
global _method_missing_dropped_total, _method_missing_dropped_delta
_method_missing_dropped_total += 1
_method_missing_dropped_delta += 1
logger.error(
"Dropping message without a method: sink=%s message_id=%s"
" plugin_id=%s timestamp=%s keys=%s dropped_total=%d",
sink,
message.get("message_id"),
message.get("plugin_id"),
message.get("timestamp"),
sorted(message),
_method_missing_dropped_total,
)
# Returned for both "maximum messages exceeded" and "maximum bytes exceeded"
# once the stream is full; reaches the client only because the stream discards
# new rather than old messages.
_JS_ERR_STREAM_FULL = 10077
# The stream's own MaxMsgSize rejection, distinct from the client-side
# MaxPayloadError checked against the server's max_payload. Both caps are 10MB
# today, so this only fires if MaxMsgSize is lowered below max_payload.
_JS_ERR_MSG_TOO_LARGE = 10054
class _StreamFull(Exception):
"""Stream is at capacity: re-queue the rest, the connection is healthy."""
# Keys the receiving side indexes a fragment on. A field carrying one of them
# identifies the message instead of holding its payload: bisecting it strands
# fragments the store path cannot key, so it is copied into every fragment.
_INDEX_KEYS = frozenset({"scanid", "scan_id"})
# Single-element descents before a message is called irreducible: json.loads
# accepts nesting deeper than this mutual recursion can safely walk.
_MAX_SPLIT_DEPTH = 32
def _element_ids(container) -> set:
"""Strings a sibling map could be keyed on: a dict's own keys, or the
scalar values carried by a list's elements."""
if isinstance(container, dict):
return {key for key in container if isinstance(key, str)}
ids = set()
for element in container:
if isinstance(element, str):
ids.add(element)
elif isinstance(element, dict):
ids.update(
value for value in element.values() if isinstance(value, str)
)
return ids
def _paired_maps(fields: dict) -> dict:
"""Sibling dicts keyed entirely by a field's elements, which have to follow
those records rather than be bisected away from them."""
ids = {name: _element_ids(value) for name, value in fields.items()}
return {
name: {
other
for other, value in fields.items()
if other != name
and isinstance(value, dict)
and value
and set(value) <= ids[name]
}
for name in fields
}
def _carries_index_key(value) -> bool:
return isinstance(value, dict) and not _INDEX_KEYS.isdisjoint(value)
def _split_element(element, depth):
if depth <= 0:
return None
if isinstance(element, dict):
return _split_largest_field(element, depth - 1)
if isinstance(element, list):
return _split_container(element, depth - 1)
return None
def _split_container(value, depth):
"""Bisect a list or dict, descending into a lone element so a single
oversized record can still be split within itself."""
if isinstance(value, dict):
keys = list(value)
if len(keys) > 1:
mid = len(keys) // 2
return [
{key: value[key] for key in keys[:mid]},
{key: value[key] for key in keys[mid:]},
]
if not keys:
return None
inner = _split_element(value[keys[0]], depth)
if inner is None:
return None
return [{keys[0]: half} for half in inner]
if len(value) > 1:
mid = len(value) // 2
return [value[:mid], value[mid:]]
if not value:
return None
inner = _split_element(value[0], depth)
if inner is None:
return None
return [[half] for half in inner]
def _split_largest_field(item: dict, depth=_MAX_SPLIT_DEPTH):
"""Bisect the heaviest payload field, while index-carrying fields and maps
paired with another field's records ride along instead of being split."""
# ponytail: pairing is inferred from depth-1 scalars, not read from the
# producer's declared batch field, so a nested or renamed join key quietly
# degrades to duplicating records; byte-bound the producers to retire this.
fields = {
name: value
for name, value in item.items()
if isinstance(value, (list, dict))
}
paired = _paired_maps(fields)
followers = {name for maps in paired.values() for name in maps}
candidates = [
name
for name, value in fields.items()
if name not in followers and not _carries_index_key(value)
]
def weight(name):
return estimate_size(fields[name]) + sum(
estimate_size(fields[other]) for other in paired[name]
)
# Heaviest first, but fall through to the next candidate when the heaviest
# cannot be bisected: sorted() is stable, so a tie keeps insertion order
# and a re-split reproduces the same fragments and dedup ids.
for field in sorted(candidates, key=weight, reverse=True):
halves = _split_container(fields[field], depth)
if halves is not None:
break
else:
return None
parts = []
for half in halves:
kept = _element_ids(half)
part = {**item, field: half}
for name in paired[field]:
part[name] = {
key: value
for key, value in fields[name].items()
if key in kept
}
parts.append(part)
return parts
def _split_oversized(loaded: dict):
"""Split an oversized message into smaller parts. Returns a list of parts,
or None when the message carries a single irreducible record."""
items = loaded.get("items")
if isinstance(items, list) and len(items) > 1:
mid = len(items) // 2
return [
{**loaded, "items": items[:mid]},
{**loaded, "items": items[mid:]},
]
single = items[0] if isinstance(items, list) and len(items) == 1 else None
if isinstance(single, dict):
try:
halves = _split_largest_field(single)
except RecursionError:
# estimate_size walks the item too, and json.loads accepts nesting
# deeper than it can measure. Unsplittable beats re-queueing the
# batch forever on a message no depth cap of ours can save.
return None
if halves is not None:
return [{**loaded, "items": [half]} for half in halves]
return None
async def _nats_error_cb(ex: Exception) -> None:
"""Downgrade nats-py internal errors to DEBUG.
Transient errors (ConnectionRefused, AuthorizationViolation) are
expected during agent restarts. Our code already logs a WARNING
with context, so the nats-py default ERROR + traceback is noise.
"""
logger.debug("nats: %s", ex)
class BaseSendMessageAPI(API, ABC):
URL = "/api/v2/send-message/{method}"
@abstractmethod
async def _send_request(self, message_method, headers, post_data) -> dict:
pass # pragma: no cover
def check_response(self, result: dict) -> None:
if "status" not in result:
raise APIError("unexpected server response: {!r}".format(result))
if result["status"] != "ok":
raise APIError("server error: {}".format(result.get("msg")))
async def send_data(self, method: str, post_data: bytes) -> None:
try:
token = await IndependentAgentIDAPI.get_token()
except IAIDTokenError as e:
raise APITokenError(f"IAID token error occurred {e}")
headers = {
"Content-Type": "application/json",
"X-Auth": token,
}
result = await self._send_request(method, headers, post_data)
self.check_response(result)
class SendMessageAPI(BaseSendMessageAPI):
_SOCKET_TIMEOUT = Core.DEFAULT_SOCKET_TIMEOUT
def __init__(self, rpm_ver: str, base_url: str = None, executor=None):
self._executor = executor
self.rpm_ver = rpm_ver
self.product_name = ""
self.server_id = None # type: Optional[str]
self.license = {} # type: dict
if base_url:
self.base_url = base_url
else:
self.base_url = self._BASE_URL
def set_product_name(self, product_name: str) -> None:
self.product_name = product_name
def set_server_id(self, server_id: Optional[str]) -> None:
self.server_id = server_id
def set_license(self, license: dict) -> None:
self.license = license
async def _send_request(self, message_method, headers, post_data):
request = urllib.request.Request(
self.base_url + self.URL.format(method=message_method),
data=post_data,
headers=headers,
method="POST",
)
return await self.async_request(request, executor=self._executor)
async def send_message(self, message: Message) -> None:
# Return, don't raise: raising re-queues the entry at the backlog head.
if not message.get("method"):
_drop_method_less(message, "http")
return
# add message handling time if it does not exist, so that
# the server does not depend on the time it was received
if "timestamp" not in message:
message["timestamp"] = time.time()
if "message_id" not in message:
message["message_id"] = uuid.uuid4().hex
data2send = {
"payload": message.payload,
"rpm_ver": self.rpm_ver,
"message_id": message.message_id,
"server_id": self.server_id,
"name": self.product_name,
}
post_data = json.dumps(data2send, cls=ServerJSONEncoder).encode()
await self.send_data(message.method, post_data)
class FileBasedGatewayAPI(SendMessageAPI):
async def _prepare_message(self, message, semaphore) -> dict:
async with semaphore:
loaded = await asyncio.to_thread(json.loads, message)
return {
"method": loaded["method"],
"data": {k: v for k, v in loaded.items() if k != "method"},
}
async def send_messages(self, messages: list[tuple[float, bytes]]) -> None:
max_threads = 5
semaphore = asyncio.Semaphore(max_threads)
tasks = [
self._prepare_message(msg, semaphore)
async for _, msg in AsyncIterate(messages)
]
prepared_messages = await asyncio.gather(*tasks)
for msg in prepared_messages:
flat = {**msg.get("data", {}), "method": msg.get("method", "")}
publisher.report(
flat, _reporter_gen_fgw, stage="agent-fgw-sending"
)
dumped_messages = await asyncio.to_thread(
json.dumps, prepared_messages
)
bin_file_path = os.getenv(
"I360_MESSAGE_GATEWAY_BIN_PATH", "/usr/libexec/"
)
bin_file = os.path.join(bin_file_path, "imunify-message-gateway")
command = [
bin_file,
"send-many",
"--producer=i360-agent-non-resident",
]
process = await asyncio.create_subprocess_exec(
*command,
stdin=asyncio.subprocess.PIPE,
stdout=asyncio.subprocess.PIPE,
stderr=asyncio.subprocess.PIPE,
)
b64data = base64.b64encode(dumped_messages.encode())
stdout, stderr = await process.communicate(input=b64data)
if g.get("DEBUG"):
logger.info(
"Message sent to fgw: %s %s %s", len(messages), stdout, stderr
)
if process.returncode != 0:
logger.error(f"Error sending message: {stderr.decode()}")
raise FGWSendMessgeException(
str(f"Error sending message: {stderr.decode()}")
)
for msg in prepared_messages:
delivery_ack.registry.confirm(msg["data"].get("message_id"))
class NATSGatewayAPI:
"""Publishes messages to the embedded NATS server via localhost TCP.
Connects to nats://127.0.0.1:<port> with an auth token read from
a file written by the resident-agent on startup.
"""
NATS_SUBJECT_PREFIX = "imunify.api."
DEFAULT_PORT = 44222
DEFAULT_TOKEN_PATH = "/var/run/imunify360/nats.token"
DEFAULT_ADDR_PATH = "/var/run/imunify360/nats.addr"
CONNECT_TIMEOUT = 5
MIN_RECONNECT_INTERVAL = 5
def __init__(self):
self._nc = None
self._last_connect_attempt = 0
self._oversized_dropped = 0
self._oversized_rejected = 0
def pop_oversized_rejected(self) -> int:
"""Oversized rejections since the last call, then reset (delta)."""
value, self._oversized_rejected = self._oversized_rejected, 0
return value
@staticmethod
def _read_addr():
"""Read NATS listen address from addr file, fall back to env/default."""
addr_path = os.getenv(
"I360_NATS_ADDR_PATH", NATSGatewayAPI.DEFAULT_ADDR_PATH
)
try:
with open(addr_path) as f:
addr = f.read().strip()
if addr:
return addr
except OSError:
pass
# Fallback: env var / hardcoded default (for upgrades where
# the resident-agent hasn't written the addr file yet)
port = int(
os.getenv("I360_NATS_PORT", str(NATSGatewayAPI.DEFAULT_PORT))
)
return f"127.0.0.1:{port}"
async def _ensure_connected(self):
if self._nc is not None and self._nc.is_connected:
return
if not _has_nats:
raise NATSSendMessageException("nats-py is not installed")
now = time.monotonic()
since_last = now - self._last_connect_attempt
if since_last < self.MIN_RECONNECT_INTERVAL:
raise NATSSendMessageException(
"NATS reconnect backoff"
f" ({self.MIN_RECONNECT_INTERVAL - since_last:.1f}s remaining)"
)
self._last_connect_attempt = now
# Clean up stale connection before reconnecting
await self._close()
addr = self._read_addr()
token_path = os.getenv("I360_NATS_TOKEN_PATH", self.DEFAULT_TOKEN_PATH)
try:
with open(token_path) as f:
token = f.read().strip()
self._nc = await nats.connect(
f"nats://{addr}",
token=token,
connect_timeout=self.CONNECT_TIMEOUT,
max_reconnect_attempts=0,
error_cb=_nats_error_cb,
)
logger.info("Connected to NATS at %s", addr)
except Exception as e:
raise NATSSendMessageException(
f"Failed to connect to NATS: {e}"
) from e
async def send_messages(self, messages: list[tuple[float, bytes]]) -> None:
await self._ensure_connected()
published = 0
try:
js = self._nc.jetstream()
for _, msg_bytes in messages:
try:
loaded = json.loads(msg_bytes)
except (json.JSONDecodeError, UnicodeDecodeError) as e:
logger.warning("Skipping malformed message: %s", e)
published += 1 # count as handled, not re-queued
continue
if not loaded.get("method"):
_drop_method_less(loaded, "nats")
published += 1 # count as handled, not re-queued
continue
method = loaded.pop("method")
subject = self.NATS_SUBJECT_PREFIX + method
# (part, dedup_id) pairs. dedup_id pins each fragment's
# Nats-Msg-Id deterministically: when a message is split and a
# later fragment fails with a non-payload error, the wrapper
# re-queues the whole original; re-splitting reproduces the
# same fragments and ids, so JetStream de-duplicates the ones
# already delivered instead of duplicating them.
pending = collections.deque(
[(loaded, loaded.get("message_id"))]
)
# (id, size, error, preview) per irreducible part. str(e), not
# the exception: its traceback would pin this frame's payload
# and part until the message is done.
dropped = []
while pending:
part, dedup_id = pending.popleft()
payload = json.dumps(part).encode()
headers = {"Nats-Msg-Id": dedup_id} if dedup_id else None
try:
ack = await js.publish(
subject, payload, headers=headers
)
except (_NATSMaxPayloadError, _NATSAPIError) as e:
if isinstance(e, _NATSAPIError):
if e.err_code == _JS_ERR_STREAM_FULL:
# Abort the batch so this message and the rest
# are re-queued whole; already-published
# fragments carry deterministic ids and are
# de-duplicated on retry.
raise _StreamFull(
f"subject={subject}"
f" message_id={dedup_id}: {e}"
) from e
if e.err_code != _JS_ERR_MSG_TOO_LARGE:
raise
halves = _split_oversized(part)
if halves is None:
# A single record that alone exceeds the limit
# cannot be delivered over NATS. The other
# fragments of this message are still published;
# only this irreducible record is dropped (loudly,
# with a counter). It is intentionally counted as
# handled rather than re-queued, otherwise it would
# block the head of the queue forever.
dropped.append(
(dedup_id, len(payload), str(e), payload[:200])
)
continue
base_key = (
dedup_id or hashlib.sha1(payload).hexdigest()
)
for index, half in enumerate(halves):
child_key = f"{base_key}.{index}"
half["message_id"] = child_key
pending.append((half, child_key))
logger.warning(
"Splitting oversized NATS message: subject=%s"
" message_id=%s size=%d parts=%d",
subject,
dedup_id,
len(payload),
len(halves),
)
continue
if g.get("DEBUG"):
logger.debug(
"Published to %s, stream=%s, seq=%s",
subject,
ack.stream,
ack.seq,
)
# One drop and one status report per logical message, not per
# fragment: a split message's fragments share the parent's
# reporter id, and counting each recursive attempt inflates
# both the delivery-tracking cardinality and the drop metric.
# A message with any dropped fragment is not reported at all:
# it did not fully reach NATS, so tracking it as sent would
# overstate delivery.
if dropped:
self._oversized_dropped += 1
if is_enabled(MESSAGE_LOSS_OBSERVABILITY_FLAG):
self._oversized_rejected += 1
_, _, error, preview = dropped[0]
logger.error(
# size= is the bytes dropped across every part and is
# parsed by the rpm-test that guards this path; keep
# the field name if the format changes again.
"Dropping oversized NATS message: subject=%s"
" message_id=%s parts=%d size=%d fragments=%s"
" oversized_total=%d error=%s preview=%r",
subject,
loaded.get("message_id"),
len(dropped),
sum(size for _, size, _, _ in dropped),
[frag for frag, _, _, _ in dropped],
self._oversized_dropped,
error,
preview,
)
else:
publisher.report(
{**loaded, "method": method},
_reporter_gen_nats,
stage="agent-nats-sending",
)
delivery_ack.registry.confirm(loaded.get("message_id"))
published += 1
except _StreamFull as e:
# Keep the connection: it is healthy, and closing it would make
# recovery wait out MIN_RECONNECT_INTERVAL as well.
logger.warning(
"NATS stream full, %d/%d messages published, %d re-queued: %s",
published,
len(messages),
len(messages) - published,
e,
)
raise NATSSendMessageException(
f"Stream at capacity: {e}",
published=published,
) from e
except Exception as e:
await self._close()
logger.warning(
"NATS publish failed after %d/%d messages: %s",
published,
len(messages),
e,
)
raise NATSSendMessageException(
f"Failed to publish messages: {e}",
published=published,
) from e
async def _close(self):
if self._nc is not None:
try:
# close(), not drain(): drain PINGs the server we already
# consider broken, stalls the send path on the flush timeout,
# and on that timeout leaks the client with its read loop
# alive. Unacked messages are re-queued, so nothing is lost.
await self._nc.close()
except Exception:
pass
finally:
self._nc = None
async def close(self):
await self._close()
defence360agent/application/ 0000755 0000000 0000000 00000000000 00000000000 013051 5 ustar defence360agent/application/__init__.py 0000644 0000000 0000000 00000001336 00000000000 015165 0 ustar """This module conatins only global application class and object.
Please, do not import any other modules there. """
class Application:
"""Store settings for different parts of application.
SCHEMA_PATHS - additional paths to store RPC/CLI schemas
VALIDATOR - SchemaValidator object
MIDDLEWARE - dict with middleware to apply
MIDDLEWARE_EXCLUDE - dict with middleware that should be excluded
MODULES_WITH_MODELS - list of modules with models
MIGRATIONS_DIRS - list of dirs with migrations
"""
SCHEMA_PATHS = None
VALIDATOR = None
MIDDLEWARE = None
MIDDLEWARE_EXCLUDE = None
MODULES_WITH_MODELS = []
MIGRATIONS_DIRS = []
MIGRATIONS_ATTACHED_DBS = []
app = Application()
defence360agent/application/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 015261 5 ustar defence360agent/application/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002231 00000000000 022457 0 ustar
r_j 8 d Z G d d Z e ZdS )znThis module conatins only global application class and object.
Please, do not import any other modules there. c . e Zd ZdZdZdZdZdZg Zg Z g Z
dS ) Applicationaz Store settings for different parts of application.
SCHEMA_PATHS - additional paths to store RPC/CLI schemas
VALIDATOR - SchemaValidator object
MIDDLEWARE - dict with middleware to apply
MIDDLEWARE_EXCLUDE - dict with middleware that should be excluded
MODULES_WITH_MODELS - list of modules with models
MIGRATIONS_DIRS - list of dirs with migrations
N) __name__
__module__ __qualname____doc__ SCHEMA_PATHS VALIDATOR
MIDDLEWAREMIDDLEWARE_EXCLUDEMODULES_WITH_MODELSMIGRATIONS_DIRSMIGRATIONS_ATTACHED_DBS Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/application/__init__.pyr r sB LIJ O r r N)r r appr r r <module>r sH 3 3! ! ! ! ! ! ! !( kmmr defence360agent/application/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000002231 00000000000 021520 0 ustar
r_j 8 d Z G d d Z e ZdS )znThis module conatins only global application class and object.
Please, do not import any other modules there. c . e Zd ZdZdZdZdZdZg Zg Z g Z
dS ) Applicationaz Store settings for different parts of application.
SCHEMA_PATHS - additional paths to store RPC/CLI schemas
VALIDATOR - SchemaValidator object
MIDDLEWARE - dict with middleware to apply
MIDDLEWARE_EXCLUDE - dict with middleware that should be excluded
MODULES_WITH_MODELS - list of modules with models
MIGRATIONS_DIRS - list of dirs with migrations
N) __name__
__module__ __qualname____doc__ SCHEMA_PATHS VALIDATOR
MIDDLEWAREMIDDLEWARE_EXCLUDEMODULES_WITH_MODELSMIGRATIONS_DIRSMIGRATIONS_ATTACHED_DBS Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/application/__init__.pyr r sB LIJ O r r N)r r appr r r <module>r sH 3 3! ! ! ! ! ! ! !( kmmr defence360agent/application/__pycache__/determine_hosting_panel.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005723 00000000000 025617 0 ustar
r_j d Z ddlZddlmZ ddlmZ dZdZdZdZ ej
e Z d e
fd
Zd Zd Zd
Zd Zd ZdS )zg
Determines hosting panel.
This module has minimal dependencies and only imports required panel class.
N)
import_module)Pathz/usr/local/cpanel/cpanelz"/usr/local/directadmin/directadminz/usr/sbin/pleskz*/etc/sysconfig/imunify360/integration.conf root_modulec F t r&t | d }| S t r&t | d }| S t r&t | d }| S t r&t | d }| S | dk r&t | d }| S t | d }|
S )Nz .subsys.panels.generic.panelz.subsys.panels.plesk.panelz.subsys.panels.cpanel.panelz .subsys.panels.directadmin.paneldefence360agentz.subsys.panels.no_cp.panel) is_generic_panel_installedr GenericPanelis_plesk_installedPleskis_cpanel_installedcPanelis_directadmin_installed DirectAdminNoCPNoControlPanel)r modules h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/application/determine_hosting_panel.pyget_hosting_panelr s5 "## + K K KLL""$$$ + I I IJJ||~~
+ J J JKK}} ! # # < < <
!!### ) ) ) + I I IJJ{{}}
kEEE
F
FF " "" c * t t S N)_is_panel_installed CPANEL_FILE r r r r 3 s { + ++r c * t t S r )r DA_FILEr r r r r 7 w ' ''r c * t t S r )r GP_FILEr r r r r ; r r c * t t S r )r
PLESK_FILEr r r r
r
? s z * **r c D t | S r )r is_file)
panel_files r r r C s
# # % %%r )__doc__logging importlibr pathlibr r r r! r getLogger__name__loggerstrr r r r r
r r r r <module>r- s # # # # # # (
.
6 8 $ $ #3 # # # #D, , ,( ( (( ( (+ + +& & & & &r defence360agent/application/__pycache__/determine_hosting_panel.cpython-311.pyc 0000644 0000000 0000000 00000005723 00000000000 024660 0 ustar
r_j d Z ddlZddlmZ ddlmZ dZdZdZdZ ej
e Z d e
fd
Zd Zd Zd
Zd Zd ZdS )zg
Determines hosting panel.
This module has minimal dependencies and only imports required panel class.
N)
import_module)Pathz/usr/local/cpanel/cpanelz"/usr/local/directadmin/directadminz/usr/sbin/pleskz*/etc/sysconfig/imunify360/integration.conf root_modulec F t r&t | d }| S t r&t | d }| S t r&t | d }| S t r&t | d }| S | dk r&t | d }| S t | d }|
S )Nz .subsys.panels.generic.panelz.subsys.panels.plesk.panelz.subsys.panels.cpanel.panelz .subsys.panels.directadmin.paneldefence360agentz.subsys.panels.no_cp.panel) is_generic_panel_installedr GenericPanelis_plesk_installedPleskis_cpanel_installedcPanelis_directadmin_installed DirectAdminNoCPNoControlPanel)r modules h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/application/determine_hosting_panel.pyget_hosting_panelr s5 "## + K K KLL""$$$ + I I IJJ||~~
+ J J JKK}} ! # # < < <
!!### ) ) ) + I I IJJ{{}}
kEEE
F
FF " "" c * t t S N)_is_panel_installed CPANEL_FILE r r r r 3 s { + ++r c * t t S r )r DA_FILEr r r r r 7 w ' ''r c * t t S r )r GP_FILEr r r r r ; r r c * t t S r )r
PLESK_FILEr r r r
r
? s z * **r c D t | S r )r is_file)
panel_files r r r C s
# # % %%r )__doc__logging importlibr pathlibr r r r! r getLogger__name__loggerstrr r r r r
r r r r <module>r- s # # # # # # (
.
6 8 $ $ #3 # # # #D, , ,( ( (( ( (+ + +& & & & &r defence360agent/application/__pycache__/settings.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006106 00000000000 022565 0 ustar
r_j d Z ddlZddlmZ ddlmZ ddlmZ ddlm Z ddl
m Z ddl m
Z
dd lmZmZ dd
lmZ dd lmZ d d
lmZ defdZeeeddej dddf dZdS )z"Set settings of application object N)Path)files)tags)eula)g)simplification)SchemaValidatorvalidate_middleware)init_validator)update_wp_rules_on_sites )app
is_updatedc D K |rt j d {V d S d S )N)r update)indexr s Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/application/settings.pyupdate_eula_datar s< kmm Fc * t j d dk r dt _ |t
_ | ||| \ t
_ t
_ t
_ t
xj
t gz
c_
|rt
xj
|z
c_
t t j j } t
xj | dz gz
c_ |rt
xj |z
c_ |rt
xj |z
c_ | t% j |s`t$ j t$ j t. t$ j t$ j t2 d S d S )NDEBUGtrueT
migrations)osenvirongetr r r SCHEMA_PATHS VALIDATOR
MIDDLEWAREMIDDLEWARE_EXCLUDEMODULES_WITH_MODELSr r __file__resolveparentMIGRATIONS_DIRSMIGRATIONS_ATTACHED_DBSr configureIndexadd_hookEULAr WP_RULESr )
r
validator_clsvalidate_middleware_wrap schema_pathsmodels_modulesset_sentry_tagsmigration_dirsmigrations_attached_dbsresidentav_paths
r r' r' sg
z~~g &((#C<JN/ = =9CM3>3#9 // 2 >1 8nn$$&&-4GGl 233 . ~- ? ##'>>##O O G
UZ)9:::
U^-EFFFFFG Gr )__doc__r pathlibr defence360agentr defence360agent.applicationr defence360agent.contractsr &defence360agent.internals.global_scoper defence360agent.modelr "defence360agent.rpc_tools.validater r
!defence360agent.simple_rpc.schemar defence360agent.wordpress.pluginr r boolr fillr' r r <module>rC s> ( ( ! ! ! ! ! ! , , , , , , * * * * * * 4 4 4 4 4 4 0 0 0 0 0 0 = < < < < < E E E E E E d "! 0I
G G G G G Gr defence360agent/application/__pycache__/settings.cpython-311.pyc 0000644 0000000 0000000 00000006106 00000000000 021626 0 ustar
r_j d Z ddlZddlmZ ddlmZ ddlmZ ddlm Z ddl
m Z ddl m
Z
dd lmZmZ dd
lmZ dd lmZ d d
lmZ defdZeeeddej dddf dZdS )z"Set settings of application object N)Path)files)tags)eula)g)simplification)SchemaValidatorvalidate_middleware)init_validator)update_wp_rules_on_sites )app
is_updatedc D K |rt j d {V d S d S )N)r update)indexr s Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/application/settings.pyupdate_eula_datar s< kmm Fc * t j d dk r dt _ |t
_ | ||| \ t
_ t
_ t
_ t
xj
t gz
c_
|rt
xj
|z
c_
t t j j } t
xj | dz gz
c_ |rt
xj |z
c_ |rt
xj |z
c_ | t% j |s`t$ j t$ j t. t$ j t$ j t2 d S d S )NDEBUGtrueT
migrations)osenvirongetr r r SCHEMA_PATHS VALIDATOR
MIDDLEWAREMIDDLEWARE_EXCLUDEMODULES_WITH_MODELSr r __file__resolveparentMIGRATIONS_DIRSMIGRATIONS_ATTACHED_DBSr configureIndexadd_hookEULAr WP_RULESr )
r
validator_clsvalidate_middleware_wrap schema_pathsmodels_modulesset_sentry_tagsmigration_dirsmigrations_attached_dbsresidentav_paths
r r' r' sg
z~~g &((#C<JN/ = =9CM3>3#9 // 2 >1 8nn$$&&-4GGl 233 . ~- ? ##'>>##O O G
UZ)9:::
U^-EFFFFFG Gr )__doc__r pathlibr defence360agentr defence360agent.applicationr defence360agent.contractsr &defence360agent.internals.global_scoper defence360agent.modelr "defence360agent.rpc_tools.validater r
!defence360agent.simple_rpc.schemar defence360agent.wordpress.pluginr r boolr fillr' r r <module>rC s> ( ( ! ! ! ! ! ! , , , , , , * * * * * * 4 4 4 4 4 4 0 0 0 0 0 0 = < < < < < E E E E E E d "! 0I
G G G G G Gr defence360agent/application/__pycache__/tags.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000013616 00000000000 021667 0 ustar
r_jL d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl
m Z d dl m
Z
d dlmZ d dlmZmZ d d lmZ ej e Z ed
Zd Zd Zd
ZdddZ dS ) N)Path)sentry)Core)
LicenseCLN)IndependentAgentIDAPI)
hosting_panel)stub_unexpected_error is_root_user) IPEchoAPIz /var/imunify360/.sentry_tagsc r t t j t j d S N)SENTRY_TAGS_CACHE_PATH
write_textjsondumpsr _TAGS U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/application/tags.pydump_sentry_tagsr s( %%dj &>&>?????r c f t r t j t t
_ d S # t j t f$ r+} t
dt | Y d } ~ nd } ~ wt $ r Y nw xY wt d d S )Nz%Sentry cache file %s is malformed: %sF)dump)
r existsr loads read_textr r JSONDecodeErrorFileNotFoundErrorloggerwarningPermissionErrorfill)es r cached_fillr# s $$&&
:&<&F&F&H&HIIFL F$&78 NN7&
D es 5A B (!B
B B c d} d}dt fddt fdt fd } | }t j | |dk rt j | d S t j | d S )N PRIMARY_IDSCSF_COOPreturnc t j ddgdt j dS # t t j t j f$ r Y dS w xY w)Nz firewall-cmdz--state )timeoutstderrTF)
subprocess check_outputDEVNULLIOErrorCalledProcessErrorTimeoutExpiredr r r _is_firewalld_runningz3_set_additional_tags.<locals>._is_firewalld_running. sn # +!)
4 ) %
55 s #' !A A c t j ddgt j } n # t t j f$ r Y dS w xY wd| vod| vS )Nz
/usr/sbin/csfz--status)r+ Fs have been disableds/ You have an unresolved error when starting csf:)r, r- r. r r0 )outs r _is_csf_runningz-_set_additional_tags.<locals>._is_csf_running= ss ) *-j6H CC ":#@A 55 %S0
>c I
s "% ??c 8 rdS rdS dS )Ncsf firewalldiptablesr )r5 r2 s r _get_current_firewallz3_set_additional_tags.<locals>._get_current_firewallH s3 ? 5 " " ;zr r7 )boolr r set_firewall_type set_strategy)PRIMARY_IDS_STRATEGYCSF_COOP_STRATEGYr: fwr5 r2 s @@r _set_additional_tagsrA * s ("
4
T
B
R U{{ -..... 011111r Tr' c t d }t j t j t j t j t j t j t j t j t sd S t j
t j t j t! j t j t t& j t j | t j t/ | rt1 d S d S )Nc 2 t j j S r
)r HostingPanelNAMEr r r _get_hosting_panelz fill.<locals>._get_hosting_panelZ s )++00r )r r set_av_versionConfig
AV_VERSIONset_core_version CORE_VERSION set_versionVERSIONset_product_namer get_product_namer
set_server_id
get_server_idset_iaidr get_iaidset_ipr server_ipset_hosting_panel set_test_envrA r )r rF s r r! r! Y s7 1 1 1 &+,,,
F /000
v~&&&
J 7 9 9::: >>
133444
O)244555
M<' (;<<>>???
/ / 1 1222
r )T)r' N) r loggingr, pathlibr defence360agent.contractsr defence360agent.contracts.configr rH !defence360agent.contracts.licenser defence360agent.internals.iaidr defence360agent.subsys.panelsr defence360agent.utilsr r
defence360agent.utils.ipechor getLogger__name__r r r r# rA r! r r r <module>rc sB , , , , , , ; ; ; ; ; ; 8 8 8 8 8 8 @ @ @ @ @ @ 7 7 7 7 7 7 3 2 2 2 2 2 8 $ $ <== @ @ @
,2 ,2 ,2^ r defence360agent/application/__pycache__/tags.cpython-311.pyc 0000644 0000000 0000000 00000013616 00000000000 020730 0 ustar
r_jL d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl
m Z d dl m
Z
d dlmZ d dlmZmZ d d lmZ ej e Z ed
Zd Zd Zd
ZdddZ dS ) N)Path)sentry)Core)
LicenseCLN)IndependentAgentIDAPI)
hosting_panel)stub_unexpected_error is_root_user) IPEchoAPIz /var/imunify360/.sentry_tagsc r t t j t j d S N)SENTRY_TAGS_CACHE_PATH
write_textjsondumpsr _TAGS U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/application/tags.pydump_sentry_tagsr s( %%dj &>&>?????r c f t r t j t t
_ d S # t j t f$ r+} t
dt | Y d } ~ nd } ~ wt $ r Y nw xY wt d d S )Nz%Sentry cache file %s is malformed: %sF)dump)
r existsr loads read_textr r JSONDecodeErrorFileNotFoundErrorloggerwarningPermissionErrorfill)es r cached_fillr# s $$&&
:&<&F&F&H&HIIFL F$&78 NN7&
D es 5A B (!B
B B c d} d}dt fddt fdt fd } | }t j | |dk rt j | d S t j | d S )N PRIMARY_IDSCSF_COOPreturnc t j ddgdt j dS # t t j t j f$ r Y dS w xY w)Nz firewall-cmdz--state )timeoutstderrTF)
subprocess check_outputDEVNULLIOErrorCalledProcessErrorTimeoutExpiredr r r _is_firewalld_runningz3_set_additional_tags.<locals>._is_firewalld_running. sn # +!)
4 ) %
55 s #' !A A c t j ddgt j } n # t t j f$ r Y dS w xY wd| vod| vS )Nz
/usr/sbin/csfz--status)r+ Fs have been disableds/ You have an unresolved error when starting csf:)r, r- r. r r0 )outs r _is_csf_runningz-_set_additional_tags.<locals>._is_csf_running= ss ) *-j6H CC ":#@A 55 %S0
>c I
s "% ??c 8 rdS rdS dS )Ncsf firewalldiptablesr )r5 r2 s r _get_current_firewallz3_set_additional_tags.<locals>._get_current_firewallH s3 ? 5 " " ;zr r7 )boolr r set_firewall_type set_strategy)PRIMARY_IDS_STRATEGYCSF_COOP_STRATEGYr: fwr5 r2 s @@r _set_additional_tagsrA * s ("
4
T
B
R U{{ -..... 011111r Tr' c t d }t j t j t j t j t j t j t j t j t sd S t j
t j t j t! j t j t t& j t j | t j t/ | rt1 d S d S )Nc 2 t j j S r
)r HostingPanelNAMEr r r _get_hosting_panelz fill.<locals>._get_hosting_panelZ s )++00r )r r set_av_versionConfig
AV_VERSIONset_core_version CORE_VERSION set_versionVERSIONset_product_namer get_product_namer
set_server_id
get_server_idset_iaidr get_iaidset_ipr server_ipset_hosting_panel set_test_envrA r )r rF s r r! r! Y s7 1 1 1 &+,,,
F /000
v~&&&
J 7 9 9::: >>
133444
O)244555
M<' (;<<>>???
/ / 1 1222
r )T)r' N) r loggingr, pathlibr defence360agent.contractsr defence360agent.contracts.configr rH !defence360agent.contracts.licenser defence360agent.internals.iaidr defence360agent.subsys.panelsr defence360agent.utilsr r
defence360agent.utils.ipechor getLogger__name__r r r r# rA r! r r r <module>rc sB , , , , , , ; ; ; ; ; ; 8 8 8 8 8 8 @ @ @ @ @ @ 7 7 7 7 7 7 3 2 2 2 2 2 8 $ $ <== @ @ @
,2 ,2 ,2^ r defence360agent/application/determine_hosting_panel.py 0000644 0000000 0000000 00000004004 00000000000 020307 0 ustar """
Determines hosting panel.
This module has minimal dependencies and only imports required panel class.
"""
import logging
from importlib import import_module
from pathlib import Path
CPANEL_FILE = "/usr/local/cpanel/cpanel"
DA_FILE = "/usr/local/directadmin/directadmin"
PLESK_FILE = "/usr/sbin/plesk"
GP_FILE = "/etc/sysconfig/imunify360/integration.conf"
logger = logging.getLogger(__name__)
def get_hosting_panel(root_module: str): # pragma no cover
# note: keep the panel test order in sync with the deploy script,
# to avoid detecting conflicting panels in agent vs. the deploy script
if is_generic_panel_installed():
# Checking this panel first is convenient for development, since
# it allows you to turn any panel in the Generic Panel simply by
# creating `/etc/sysconfig/imunify360/integration.conf`.
module = import_module(f"{root_module}.subsys.panels.generic.panel")
return module.GenericPanel()
elif is_plesk_installed():
module = import_module(f"{root_module}.subsys.panels.plesk.panel")
return module.Plesk()
elif is_cpanel_installed():
module = import_module(f"{root_module}.subsys.panels.cpanel.panel")
return module.cPanel()
elif is_directadmin_installed():
module = import_module(
f"{root_module}.subsys.panels.directadmin.panel"
)
return module.DirectAdmin()
elif root_module == "defence360agent":
module = import_module(f"{root_module}.subsys.panels.no_cp.panel")
return module.NoCP()
module = import_module(f"{root_module}.subsys.panels.no_cp.panel")
return module.NoControlPanel()
def is_cpanel_installed():
return _is_panel_installed(CPANEL_FILE)
def is_directadmin_installed():
return _is_panel_installed(DA_FILE)
def is_generic_panel_installed():
return _is_panel_installed(GP_FILE)
def is_plesk_installed():
return _is_panel_installed(PLESK_FILE)
def _is_panel_installed(panel_file):
return Path(panel_file).is_file()
defence360agent/application/settings.py 0000644 0000000 0000000 00000003363 00000000000 015270 0 ustar """Set settings of application object"""
import os
from pathlib import Path
from defence360agent import files
from defence360agent.application import tags
from defence360agent.contracts import eula
from defence360agent.internals.global_scope import g
from defence360agent.model import simplification
from defence360agent.rpc_tools.validate import (
SchemaValidator,
validate_middleware,
)
from defence360agent.simple_rpc.schema import init_validator
from defence360agent.wordpress.plugin import update_wp_rules_on_sites
from . import app
async def update_eula_data(index, is_updated: bool):
if is_updated:
await eula.update()
def configure(
init_validator=init_validator,
validator_cls=SchemaValidator,
validate_middleware_wrap=validate_middleware,
schema_paths=None,
models_modules=None,
set_sentry_tags=tags.fill,
migration_dirs=None,
migrations_attached_dbs=None,
resident=False,
):
if os.environ.get("DEBUG") == "true":
g.DEBUG = True
app.SCHEMA_PATHS = schema_paths
app.VALIDATOR, app.MIDDLEWARE, app.MIDDLEWARE_EXCLUDE = init_validator(
validator_cls, validate_middleware_wrap, schema_paths
)
app.MODULES_WITH_MODELS += [simplification]
if models_modules:
app.MODULES_WITH_MODELS += models_modules
av_path = Path(__file__).resolve().parent.parent
app.MIGRATIONS_DIRS += [av_path / "migrations"]
if migration_dirs:
app.MIGRATIONS_DIRS += migration_dirs
if migrations_attached_dbs:
app.MIGRATIONS_ATTACHED_DBS += migrations_attached_dbs
set_sentry_tags()
files.configure()
if not resident:
files.Index.add_hook(files.EULA, update_eula_data)
files.Index.add_hook(files.WP_RULES, update_wp_rules_on_sites)
defence360agent/application/tags.py 0000644 0000000 0000000 00000006114 00000000000 014363 0 ustar import json
import logging
import subprocess
from pathlib import Path
from defence360agent.contracts import sentry
from defence360agent.contracts.config import Core as Config
from defence360agent.contracts.license import LicenseCLN
from defence360agent.internals.iaid import IndependentAgentIDAPI
from defence360agent.subsys.panels import hosting_panel
from defence360agent.utils import (
stub_unexpected_error,
is_root_user,
)
from defence360agent.utils.ipecho import IPEchoAPI
logger = logging.getLogger(__name__)
SENTRY_TAGS_CACHE_PATH = Path("/var/imunify360/.sentry_tags")
def dump_sentry_tags():
SENTRY_TAGS_CACHE_PATH.write_text(json.dumps(sentry._TAGS))
def cached_fill():
if SENTRY_TAGS_CACHE_PATH.exists():
try:
sentry._TAGS = json.loads(SENTRY_TAGS_CACHE_PATH.read_text())
return
except (json.JSONDecodeError, FileNotFoundError) as e:
logger.warning(
"Sentry cache file %s is malformed: %s",
SENTRY_TAGS_CACHE_PATH,
e,
)
except PermissionError:
pass
fill(dump=False)
def _set_additional_tags():
PRIMARY_IDS_STRATEGY = "PRIMARY_IDS"
CSF_COOP_STRATEGY = "CSF_COOP"
def _is_firewalld_running() -> bool:
try:
subprocess.check_output(
["firewall-cmd", "--state"],
timeout=5,
stderr=subprocess.DEVNULL,
)
return True
except (
IOError,
subprocess.CalledProcessError,
subprocess.TimeoutExpired,
):
return False
def _is_csf_running() -> bool:
try:
out = subprocess.check_output(
["/usr/sbin/csf", "--status"], stderr=subprocess.DEVNULL
)
except (FileNotFoundError, subprocess.CalledProcessError):
return False
return (b"have been disabled" not in out) and (
b"You have an unresolved error when starting csf:" not in out
)
@stub_unexpected_error
def _get_current_firewall():
if _is_csf_running():
return "csf"
if _is_firewalld_running():
return "firewalld"
return "iptables"
fw = _get_current_firewall()
sentry.set_firewall_type(fw)
if fw == "csf":
sentry.set_strategy(CSF_COOP_STRATEGY)
else:
sentry.set_strategy(PRIMARY_IDS_STRATEGY)
def fill(dump=True) -> None:
@stub_unexpected_error
def _get_hosting_panel():
return hosting_panel.HostingPanel().NAME
sentry.set_av_version(Config.AV_VERSION)
sentry.set_core_version(Config.CORE_VERSION)
sentry.set_version(Config.VERSION)
sentry.set_product_name(LicenseCLN.get_product_name())
if not is_root_user():
return
sentry.set_server_id(LicenseCLN.get_server_id())
sentry.set_iaid(IndependentAgentIDAPI.get_iaid())
sentry.set_ip(stub_unexpected_error(IPEchoAPI.server_ip)())
sentry.set_hosting_panel(_get_hosting_panel())
sentry.set_test_env()
_set_additional_tags()
if dump:
dump_sentry_tags()
defence360agent/contracts/ 0000755 0000000 0000000 00000000000 00000000000 012546 5 ustar defence360agent/contracts/__init__.py 0000644 0000000 0000000 00000000000 00000000000 014645 0 ustar defence360agent/contracts/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 014756 5 ustar defence360agent/contracts/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000304 00000000000 022153 0 ustar
r_j d S )N r W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/__init__.py<module>r s r defence360agent/contracts/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000304 00000000000 021214 0 ustar
r_j d S )N r W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/__init__.py<module>r s r defence360agent/contracts/__pycache__/config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000207144 00000000000 021674 0 ustar
`j|
U d Z ddlZddlZddlZddlmZ ddlmZmZ ddl m
Z
ddl m Z ddl
m
Z
mZ ddlmZ dd lmZ dd
lmZmZmZmZmZmZmZmZm Z m Z m Z dd l m Z dd l!m"Z"m#Z#m$Z$m%Z%m&Z& dd
l'm(Z) ddl*m+Z, ddl-m.Z.m/Z/m0Z0 e0j1 ddd Z2 ej3 e4 Z5 e0j6 d Z7dZ8dZ9 e0j1 dde2 Z:dZ; eej< 1 dd Z=d\ Z>Z?d\ Z@ZAZBZCd ZDd ZEd ZFd ZGd ZHd ZId ZJd ZKd ZLd!ZMd"ZNd"ZOd#ZPd$ZQd%ZRd&ZSd'\ ZTZUZVd(\ ZWZXZYd)ZZd*\ Z[Z\d+Z]ej< fd,e^d-e_d.ed/e_fd0Z`ej< fd,e^d-ead.ed/eafd1Zbd2 Zcd3 Zdd4 Ze dd5e^dz d/e ee^dz f fd6Zfd7 Zg G d8 d9 Zh G d: d; Zid<d=d>Zj ejk d"? d@ Zl ejk d"? dA ZmdBdCdDdd<dEdDdd<dEdFd<dGdFd<dGdHi dIiZn G dJ dKeo Zp G dL dM Zq G dN dOe Zr G dP dQere Zs G dR dSe e. Zt G dT dU Zu G dV dWeretX Zv G dY dZev Zw G d[ d\eretX Zx dd5ee e^e_f d]ee^ d/erfd^Zyd/eafd_Zz ej{ ev e&eqj| eReqj} ` a Z~ ej{ ev e&eqj eReqj ` a Z G db dcev Z G dd de Z G df dge Z G dh die Z G dj dke Z G dl dme Z G dn doe Z G dp dq Z G dr ds Z G dt du Z G dv dw Z G dx dy Z G dz d{ Z G d| d} Z G d~ d Z G d d Z G d d Z G d d Z G d d Z G d d Zd Z G d d Z G d d Z G d d Z e
dej Ze
e^ ed< G d d Z G d d Z G d dev Z G d d Z G d d Z G d d Z G d d Zd Z G d d Z G d deo Z G d d ZeyZ G d d Z G d de^e ZddCdFddGdDdd<eTeUeXeWe[eVe\eYeZg ddi dIiZ G d dev Z G d d Zd Z G d d Zd5e^d/eafdZd5e^d/e
fdZd5e^d/eafdZ G d d Z G d d ZdS )z5
All the config settings for defence360 in one place
N)abstractmethod) bisect_left bisect_right)
ContextVar)deepcopy)datetime timedelta)Enum)Path) AnyCallableDictListMappingOptionalProtocolSequenceTupleUnion
_ProtocolMeta) Validator)CachedConfigReader ConfigError ConfigReaderUserConfigReaderWriteOnlyConfigReader)config_cleanup) __version__) Singletondict_deep_updateimporterz
imav._versionr )modulenamedefaultim360z'/var/imunify360/myimunify-freemium.flag
MY_IMUNIFYzim360._versionz../.IM360_CONFIG_SCHEMA_PATHz4/opt/imunify360/venv/share/imunify360/config_schema/)notifycleanup)nonedayweekmonth i i FULLMINIMAL DENYALLOWa4 ############################################################################
# DO NOT MODIFY THIS FILE!!! #
# USE /etc/sysconfig/imunify360/imunify360.config.d/ TO OVERRIDE DEFAULTS #
############################################################################
a ############################################################################
# DO NOT MODIFY THIS FILE!!! #
# USE /etc/sysconfig/imunify360/imunify360.config.d/ TO OVERRIDE DEFAULTS #
# This is an example of default values only #
# Changing this file will have no effect #
############################################################################
)cpanelplesk directadmin)acronisr1soft
clusterlogicssample)
cloudlinuxcloudlinux_on_premisez./var/run/defence360agent/generic_sensor.sock.2varr$ envreturnc t || S # t $ r |cY S t $ r(}t d | |d }~ww xY w)Nz{}: integer required)intKeyError
ValueErrorformat)r> r$ r? es U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/config.pyint_from_envvarrH q su D3s8}} D D D/66s;;<<!CDs A A#AAc d}d} || }| }||v rdS ||v rdS t d | ||z # t $ r |cY S w xY w)N)truetyesy1)falsefnon0TFz{}: should be one of {})lowerrD rE rC )r> r$ r? TRUE_VALS
FALSE_VALSvals rG bool_from_envvarrX z s /I/J
#h iikk ) 4 * 5 % , ,S)j2H I I
s A A#"A#c t j t j t | S N)ospathjoindirname__file__relpaths rG
_self_rel2absrb s&
7<<117 ; ;; c t j t j t t
| S rZ )r[ r\ r] r^ rb
AGENT_CONFr` s rG conf_rel2absrf s.
7<<
j(A(ABBG L LLrc c t | d 5 }| cddd S # 1 swxY w Y dS # t $ r Y dS w xY w)z1Returns content for existing file, otherwise NonerN)openreadstripOSError)r\ rP s rG _slurp_filerm s
$__ $6688>>## $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ tts3 A &A A A A A
A
A A usernamec V t | }| | }|| | }|||fS t d| | t }|| | t
j fS )z
Choose action for config option by checking EndUser's Imunify360
config and Admin config. Admins config applies only if EndUser
didn't set the default action
rn Nz"Cannot read %s:%s from user config)
ConfigFileconfig_to_dictgetloggerdebugUserTypeROOT)sectionoptionrn user_config user_section
user_value root_configs rG choose_value_from_configr~ s h///>>@@K ??7++L !%%f--
! x' '
LL5wGGG ,,--//K w ' 66rc c J t j t S )zG
Just checks if this is server with MyImunify Freemium license
)r[ r\ existsFREEMIUM_FEATURE_FLAG rc rG is_mi_freemium_licenser s 7>>/ 0 00rc c e Zd ZddZd ZdS )
FromConfigNc > || _ || _ || _ d | _ d S rZ )rx ry _config_cls_config_instance)selfrx ry
config_clss rG __init__zFromConfig.__init__ s& % $ rc c | j 4| j t | _ n| | _ | j | j }| j
|| j S |S rZ )r r rq rr rx ry )r instanceowner
section_values rG __get__zFromConfig.__get__ sm ( '(2 %%(,(8(8(:(:% -<<>>t|L
; " - - rc NN)__name__
__module__ __qualname__r r r rc rG r r s7 % % % %
rc r c 8 e Zd Z ed ZedddZd ZdS ) FromFlagFile/var/imunify360.coercer$ c 0 || _ || _ || _ d S rZ )r# r r$ )r r# r r$ s rG r zFromFlagFile.__init__ s rc c | j | j z }| r.| | p| j S d S rZ )LOCATIONr# r r read_textr$ )r r r r\ s rG r zFromFlagFile.__get__ sP }ty( ;;== A;;t~~ / / ?4<@@ @ A Arc N)r r r r r boolr r r rc rG r r sV t%&&H'+S
A A A A Arc r Trootc | rdnd}i }t j t g D ]0}t ||d } | }t ||d 1|S )Nget_root_configget_non_root_configc i S rZ r r rc rG <lambda>z1_get_combined_validation_schema.<locals>.<lambda> s rc F)allow_overwrite)r! iter_modulesCONFIG_VALIDATORS_DIR_PATHgetattrr )r func_namecombined_schemar"
get_schemaschemas rG _get_combined_validation_schemar st %)D!!/DIO')C(DEE I I VY
;;
&%HHHHH rc )maxsizec t S rZ r r rc rG config_schema_rootr s * , ,,rc c " t d S )NFr r r rc rG config_schema_non_rootr s * 6 6 66rc CUSTOM_BILLINGdictstring)typer$ nullableboolean)r r$ ) upgrade_urlupgrade_url_360billing_notifications
ip_license)r r r$ c e Zd ZdS )ConfigValidationErrorN)r r r r rc rG r r s Drc r c e Zd ZdZesdez ndZeZeZ e
Z e j
dd ZdZdZdZd Zd
Zd Zd Zd Zd
Ze j ed ZdZ e j e e Z e j e e Z dZ dZ e j e d Z!dZ"dZ#dZ$dZ%dZ&esdndZ'dZ( e)d Z*dZ+d S ) Core
imunify360z%s agentzimunify antivirusIMUNIFY360_API_URLzhttps://api.imunify360.com
z.el7 z/var/imunify360/tmpzimunify360-merged.configz&imunify360-merged-nonprivileged.configzimunify360.configz/etc/imunify360rz /etc/sysconfig/imunify360i i zimunify360.config.dz.imunify360.backup_configz
hooks.yamlzcustom_billing.configz/var/imunify360/hookszimunify360-agentzimunify-antiviruszunified-access-logger.confz#/etc/sysconfig/imunify360/.go_agent< N),r r r PRODUCTANTIVIRUS_MODENAME
av_version
AV_VERSION core_version CORE_VERSION_versionVERSIONr[ environrs API_BASE_URLDEFAULT_SOCKET_TIMEOUTDIST
FILE_UMASKTMPDIRMERGED_CONFIG_FILE_NAME%MERGED_NONPRIVILEGED_CONFIG_FILE_NAMEUSER_CONFIG_FILE_NAMELOCAL_CONFIG_FILE_NAME
CONFIG_DIRr\ r] USER_CONFDIRGLOBAL_CONFDIRMERGED_CONFIG_FILE_PATH%MERGED_NONPRIVILEGED_CONFIG_FILE_PATH MERGED_CONFIG_FILE_PERMISSION+MERGED_NONPRIVILEGED_CONFIG_FILE_PERMISSIONLOCAL_CONFIG_FILE_PATH
CONFIG_D_NAMEBACKUP_CONFIGFILENAMEHOOKS_CONFIGFILENAME CUSTOM_BILLING_CONFIGFILENAMEINBOX_HOOKS_DIRSVC_NAME$UNIFIED_ACCESS_LOGGER_CONFIGFILENAMEr GO_FLAG_FILE%SIGNAL_HANDLER_MIGRATION_TIMEOUT_SECSr rc rG r r sV G'5 N: ;NDJ LG:>> : L DJ
"F 80 * 0 0"J7<<
M::L0N gll/ -/GLL=- -) %*!27/ W\\.:M N N)M 7'$;!-O #1I6I
,H(4=>>L,.)))rc r c e Zd Ze ddededefd Ze ddededed ed
edd f d Zedd
Z e dded
edefd Z
ede e defd Z
dede e defdZdede e dedd fdZd S )IConfigTF normalize
force_readr@ c t rZ NotImplementedErrorr r r s rG rr zIConfig.config_to_dict7
"!rc datavalidate overwritewithout_defaultsNc t rZ r r r r r r r s rG dict_to_configzIConfig.dict_to_config= s
"!rc c t rZ r r s rG r zIConfig.validateH !!rc configc t rZ r r r r s rG r zIConfig.normalizeL r rc timestampc t rZ r r r s rG modified_sincezIConfig.modified_sinceR r rc rx ry c |r;| |i | S d S rZ )rr rs )r rx ry s rG rs z IConfig.getV s@ F&&((,,Wb99==fEE Etrc valuec @ |r| |||ii d S d S rZ )r )r rx ry r s rG setz IConfig.set[ s7 < 65/ : ; ; ; ; ; < <rc TFTTFFr@ NF)r r r r r r rr r r r r r floatr strr rs r
r rc rG r r 6 s 9>" " "26"
" " " ^"
!&
" "" " "
"
"
" " " ^" " " " ^" 8=" " "15"
" " " ^"
" "D " " " ^"3
#
<3 <
<c <d < < < < < <rc r c e Zd ZU eed< dS ) IConfigFiler\ N)r r r r __annotations__r rc rG r r ` s
IIIIIrc r c e Zd ZdZdS )ProtocolSingletonze
Needed to avoid metaclass conflict when implementing protocols that are
also Singletons
N)r r r __doc__r rc rG r r d s rc r c e Zd Zd Zededefd Zededefd Z ededefd Z
dede defd Z d
S )
Normalizerc d | _ i | _ t | | _ | | j | _ d S rZ )_config_normalized_configConfigsValidatorget_validation_schema_schema _get_schema_without_defaults_schema_without_defaults)r validation_schemas rG r zNormalizer.__init__l sP *. (* '==
)-(I(I L)
)
%%%rc _dictr@ c D fd| D S )Nc x i | ]6\ }}|d v |t |t r | n|7S ))r$ default_setter)
isinstancer r ).0keyr clss rG
<dictcomp>z;Normalizer._get_schema_without_defaults.<locals>.<dictcomp>x s]
U777
%&&11%888777rc items)r) r" s ` rG r z'Normalizer._get_schema_without_defaultsv s8
$kkmm
rc r c i }| D ]W\ }}t |t r6| D ] \ }}||| |i |< !P|r|||< X|S rZ )r, r& r
setdefault)r
new_configrx optionsry r s rG remove_nullzNormalizer.remove_null s :<
& . . GW'4((
.%,]]__ K KMFE (EJ
--gr::6BK
. '.
7#rc c t | }| | }|j rt |j |t d| |S )NzCerberus returned None for )ConfigValidator
normalizederrorsr )r r validatorr4 s rG _normalize_with_schemaz!Normalizer._normalize_with_schema sa #F++ %.%9%9&%A%A
:' (899 9 '(Nf(N(NOO Orc r c |r| j n| j }|r+| | }| || S || j k r| j S | || }|| _ || _ | j S rZ )r r r1 r7 r r )r r r r r4 s rG r zNormalizer.normalize s -= OD ) )4< ?%%f--F..vv>> > T\ ! !* *00@@
", &&rc N)
r r r r classmethodr r r staticmethodr1 r7 r r r rc rG r r k s
T
[
G \ w 4 \
'
'4
'D
'
'
'
'
'
'rc r c
e Zd ZdZddddddddededeeeg ef f ded e d
e
f fd Z d Z d dede
fdZd de de
fdZ d dede de de de ddf dZd Zd Zd Zd ee de fd Z xZS )!Config NT)r\
config_readerr!
disclaimercached permissionsr\ r> r! r? r@ rA c t |s|sJ |rt nt }|p |||p| j | | _ | j j | _ |pt | _ t | j | _
d S )N)r? rA ) superr r r
DISCLAIMER_config_readerr\ r r! r _normalizer) r r\ r> r! r? r@ rA config_reader_cls __class__s rG r zConfig.__init__ s $}$$$28 J . .l +
/@/@ !4T_#0
0
0
', !2!H6H %d&<==rc c Z d | j j | j | j S )NzW<{classname}(config_reader={config_reader!r}, validation_schema={validation_schema!r})>) classnamer> r! )rE rH r rE r! r s rG __repr__zConfig.__repr__ s6
&n1 - " 4
rc Fr r@ c 8 | j || S rZ )rF r r s rG r zConfig.normalize s ))&2BCCCrc r c | j | }|r| | }t | S )zr
Converts config file to dict
:return dict: dictionary (key (section) / value (options))
)r )rE read_config_filer r )r r r r s rG rr zConfig.config_to_dict sD $555LL ,^^F++F rc r r r r r c r |r| |||| dS | |||| dS )a
Converts dict to config file
New options will be mixed in with old ones
unless overwrite is specified
:param dict data: dictionary (key (section) / value (options))
:param bool validate: indicates if we need validation
:param bool normalize: normalize config
:param overwrite: overwrite existing conf
:param without_defaults: do not fill defaults
:return: None
)r r r r N)_dict_to_config_overwrite_dict_to_configr s rG r zConfig.dict_to_config st (
* *!#!1
+
!#!1
!
rc c |r t || j |r| || }| j | d S Nr )r r r! r rE write_config_file)r r r r r s rG rP z Config._dict_to_config_overwrite sb D % %dD,B C C C K>>$9I>JJD --d33333rc c t | j }t || rW|r t || j |r| || }| j | d S d S rS ) r rE rN r r r r! r rU )r r r r r r s rG rQ zConfig._dict_to_config s $->>@@AA FD ) ) :
J ))&$2HIII
-= (
1 1& 9 9 9 9 9 : :rc c | j d }nB# t $ r5}d}t d|| t | |i |d}~ww xY w t || j dS # t $ r5}d}t d|| t | |i |d}~ww xY w)z/
:raises ConfigsValidatorError
F)
ignore_errorsz Error during config validationz%s: %sNz+Imunify360 config does not match the scheme)
rE rN r rt errorConfigsValidatorErrorr r r! r )r config_dictrF messages rG r zConfig.validate s @ ->> # ? KK @ @ @6G LL7A . . .'w88a ? @
@ % %k43I J J J J J$ @ @ @CG LL7A . . .'w88a ? @s,
A 0AA ! B
C
0B==Cr c 6 | j | S rZ )rE r r s rG r zConfig.modified_since( "11)<<<rc r r r )r r r rD r r r r r
r rB r rK r r rr r rP rQ r r r r
__classcell__rH s @rG r< r< s J &*CG > > > >
$ > !(2w;*?!?@
> > > > > > > > >.
D D DD D D D D
$
!&
! !! ! !
!
!
! ! ! !F4 4 4 : : :@ @ @(= =D = = = = = = = =rc r< ) metaclassc e Zd Z fdZ xZS )
UserConfigc || _ t j t j |t j }t |t || t d S )N)r\ r> r! ) rn r[ r\ r] r r r rC r r r )r rn r\ rH s rG r zUserConfig.__init__- sl
w|| x)C
*4:: 4
rc r r r r r_ r` s @rG rc rc , s8
rc rc c
e Zd Zdddddededef fdZ dd ed
ed efd Z dd
eded ededed df dZ ddZ
ddeded efdZ de e
d efdZ xZS ) SystemConfigN) local_config
merged_confignonpriv_merged_configrh ri rj c t |p
t | _ |p
t | _ |p
t
| _ d S rZ )rC r LocalConfig
_local_config MergedConfig_merged_configMergedNonPrivilegedConfig_nonpriv_merged_config)r rh ri rj rH s rG r zSystemConfig.__init__: sZ ) :[]] + =|~~ ! @%>%@%@
###rc TFr r r@ c : | j || S )Nr r )ro rr r s rG rr zSystemConfig.config_to_dictH s) "11 J 2
rc r r r r c D | j ||||| d S N)r r r r )rm r r s rG r zSystemConfig.dict_to_configO s=
)) - *
rc c j | j | j d S rZ )ro r rq r s rG r zSystemConfig.validate_ s2 $$&&& #,,.....rc r c : | j || S )N)r r )ro r r s rG r zSystemConfig.normalizec s* ",,,< -
rc r c 6 | j | S rZ )ro r r s rG r zSystemConfig.modified_sincej r^ rc r TTFTr
r )r r r r< r r r rr r r r r r r r r_ r` s @rG rg rg 9 sw $ $(,
&
:?
26
!%
/ / / /
9>
15
= =D = = = = = = = =rc rg r\ c | r%t | t st | S |rt | S t S )Nrp r\ )r& rB rc r< rg )rn r\ s rG config_file_factoryr| n sQ
8S11 8,,,,
4 ~~ rc c t t }|j D ]}| | r dS dS )NTF)Mergerget_layer_nameslayersr )r mergerlayers rG any_layer_modified_sincer z sS
F**,,
-
-F * * 44 5rc )r\ r? rA )r> c
e Zd ZdZej ddddddedeee g ef f de
f fdZ dd
ed e d e d
e de ddf fd
Z
xZS )rl zt
Config (/etc/sysconfig/imunify360/imunify360.config) should contain
options changed by a customer only
NFr\ r> r! r? r@ r> r! r? c T t ||||| d S )Nr rC r )r r\ r> r! r? r@ rH s rG r zLocalConfig.__init__ s? ' /!
rc Tr r r r r r@ c P t ||||| S ru )rC r )r r r r r r rH s rG r zLocalConfig.dict_to_config s5 ww%% - &
rc ry )r r r r r r r r r r
r r r r r_ r` s @rG rl rl s
(&*CG
$
!(2w;*?!?@
( !%
rc rl c e Zd Zej ej ej Z dZ
d dZ e d Z
d dZe defd ZdS )
BaseMergerz90-local.configFc < | _ fd|D _ d S )Nc v g | ]5}t t j j | 6S )r{ )r< r[ r\ r] DIR)r' r# r s rG
<listcomp>z'BaseMerger.__init__.<locals>.<listcomp> sC
:>F TXt44 5 5 5
rc )_include_defaultsr )r namesinclude_defaultss ` rG r zBaseMerger.__init__ s9 !1
BG
rc c t j | j r&t t j | j ng S rZ )r[ r\ isdirr sortedlistdirr) s rG r zBaseMerger.get_layer_names s6 .0gmmCG.D.DLvbj))***"Lrc c g }| j r>t t i d }| | |fd| j D z
}| | S )NFrT c > g | ]}| d S )Frs )rr )r' r r s rG r z.BaseMerger.configs_to_dict.<locals>.<listcomp> s<
5Z H H
rc )r r r r appendr _build_effective_config)r r layer_dict_listdefaultss ` rG configs_to_dictzBaseMerger.configs_to_dict s ! -!"455??U @ H
" "8 , , ,
++O<<<rc r c i }|D ]O}| D ]8\ }}|||vri ||< | D ]\ }}| ||| |< 9P|S rZ r+ )r) r effective
layer_dictrx r0 ry r s rG r z"BaseMerger._build_effective_config s %' ) ; ;J$.$4$4$6$6
;
; ? )++)+Ig&%,]]__ ; ;MFE (5: '*62;
; rc Nr )r r r r[ r\ r] r r r r LOCAL_CONFIG_NAMEr r9 r r listr r rc rG r r s
',,t*D,>
?
?C)
M M [M = = = = d [ rc r c $ e Zd Zdef fd Z xZS )
MutableMergerr c t || j }|d | }t |d d S NTr )r r rC r r r idxrH s rG r zMutableMerger.__init__ sE %!788dsd
66666rc r r r r r r_ r` s @rG r r sD 7h 7 7 7 7 7 7 7 7 7 7rc r c $ e Zd Zdef fd Z xZS )ImmutableMergerr c t || j }||d }t |d d S NFr )r r rC r r s rG r zImmutableMerger.__init__ sE 5$"899cdd
77777rc r r` s @rG r r sD 8h 8 8 8 8 8 8 8 8 8 8rc r c $ e Zd Zdef fd Z xZS )
NonBaseMergerr c N t |d d S r r r r rH s rG r zNonBaseMerger.__init__ s&
77777rc r r` s @rG r r sD 8h 8 8 8 8 8 8 8 8 8 8rc r c n e Zd ZddgddgdgdgdZ fdZed Zed
ed efd Z xZ
S )
r~ N user_override_proactive_defensenum_dayslimitenableenable_scan_modsec)PROACTIVE_DEFENCE PERMISSIONSINCIDENT_LOGGINGERROR_REPORTINGMALWARE_SCANNINGc N t |d d S r r r s rG r zMerger.__init__ s&
66666rc c | | }| }|j D ]I}t j |j s#t d|j d S J t | t t }| |d }|
| \ }}t |d t! |dd d S # t" t$ f$ r&}t d| Y d }~d S d }~ww xY w)NzGAborting merged config update: Config layer %s disappeared during mergeFrT )r )r r zConfig file is invalid! %s)r r r r[ r\ lexistsrt warningr r r r r _split_settingsrn r rp rZ r )r) r r[ r
normalizer priv_dict nonpriv_dictrF s rG update_merged_configzMerger.update_merged_config s S((**++ ,,.. ] E7??5:..
?J
% %k 2 2 2 $$677J$..e / K '*&9&9+&F&F #I| NN ) ))e ) D D D % ' ' 6 6 u
7
&'<= < < < NN7 ; ; ; ; ; ; ; ; ; <s D* *E!;E E!r[ r@ c t | }i }| j D ]T\ }}||vr
|t || ||< %|D ],}||| v r ||vri ||< || | || |< -U||fS )zSplit config into privileged and non-privileged parts.
Non-privileged config is a subset of privileged config - both contain
the same values for settings listed in NONPRIVILEGED_SETTINGS.
)r NONPRIVILEGED_SETTINGSr, )r) r[ r r rx r0 ry s rG r zMerger._split_settings> s [)) (* # : @ @ B B
GWk))(0W1E(F(F W%% % F W!555",6646L 18CG8L "9 W-f5 ,&&rc ) r r r r r r9 r r tupler r_ r` s @rG r~ r~ s ! -
!
&7 7 7 7 7 ) ) [)V '$ '5 ' ' ' [' ' ' ' 'rc r~ c , e Zd Zedd fd
Zd Z xZS )r3 T
allow_unknownpurge_readonlyc @ t j |||d| dS )z
Initialises ConfigValidator(Validator)
for more details on Validator params please check
https://docs.python-cerberus.org/en/stable/validation-rules.html
r Nr )r r r argskwargsrH s rG r zConfigValidator.__init__[ sB
')
rc c h | j di dd rdS |S )Nr& r FT)
root_documentrs )r r s rG (_normalize_coerce_user_override_pd_rulesz8ConfigValidator._normalize_coerce_user_override_pd_rulesn s7 ! !, 3 3 7 7% H H 4 rc )r r r r r r r_ r` s @rG r3 r3 Z sY %
& rc r3 c " e Zd Zdej z ZdS ) Packagingz /opt/imunify360/venv/share/%sN)r r r r r DATADIRr rc rG r r t s - <GGGrc r c e Zd ZdZdZdZdZdZ ede Z
e d e e
d Z e d
d Z e d e e
d Zd S )
SimpleRpci z(/var/run/defence360agent/simple_rpc.sockz1/var/run/defence360agent/non_root_simple_rpc.sockz.imunify360_token_{suffix} I360_SOCKET_ACTIVATION IMUNIFY360_INACTIVITY_TIMEOUT minutesI360_RPC_MAX_CONNECTIONSI360_RPC_READ_TIMEOUTN)r r r CLIENT_TIMEOUT SOCKET_PATHNON_ROOT_SOCKET_PATHTOKEN_FILE_TMPL
TOKEN_MASKrX r SOCKET_ACTIVATIONrH rB r
total_secondsINACTIVITY_TIMEOUTMAX_CONCURRENT_CONNECTIONS READ_TIMEOUTr rc rG r r x s N<KN2OJ(( ) ' IIa . . 0 011 "1 "C" " #? IIa . . 0 011 LLLrc r c p e Zd Zdej dej dZdej dZdej dej dZdS )Modelz/var//z.dbz
/proactive.dbz -resident.dbN)r r r r r PATHPROACTIVE_PATH
RESIDENT_PATHr rc rG r r sN "lllDLLL 9DD/3|||=NN04 dlllKMMMrc r c e Zd Z ed Z ed ZdZg ZdZ dS ) FilesUpdate r N)
r r r r r PERIODTIMEOUTSOCKET_TIMEOUTDISABLED DAYS_TO_KEEPr rc rG r r s_
Yr
"
"
"
0
0
2
2F i###1133G N
HLLLrc r c , e Zd ZdZdZed ZdS ) CountryInfoz2/var/imunify360/files/geo/v1/GeoLite2-Country.mmdbz>/var/imunify360/files/geo/v1/GeoLite2-Country-Locations-en.csvc , d | S )Nz2/var/imunify360/files/geo/v1/CountrySubnets-{}.txt)rE ) country_codes rG country_subnets_filez CountryInfo.country_subnets_file s CJJ
rc N)r r r DB LOCATIONS_DBr: r r rc rG r r s? =B I
\
rc r c j e Zd Z ej d edej z Z e dd Z
dS )SentryIMUNITY360_SENTRY_DSNz %s/sentryr r N) r r r r[ getenvrm r r DSNr ENABLEr rc rG r r sL
") [9;L-L!M!M C Z)8
4
4FFFrc r c e Zd ZdZdZdZdZdZ edd Z edd Z
edd Z edd Z edd
Z
edd Z edd Z edd
ZdZdZdZ edd Z edd Z edd Z edd Z edd Z edd Z edd Z edd Z edd Z edd Z e d Z edd Z d S )!Malwarei, r r r r max_targets_per_scan_type max_path_lenenable_scan_inotifyenable_scan_pure_ftpdsends_file_for_analysiscloud_assisted_scan
rapid_scancrontabsz$/var/imunify360/aibolit/scans.picklei z /var/imunify360/cleanup_storageMALWARE_CLEANUP trim_file_instead_of_removalrx ry keep_original_files_daysscan_modified_filesmax_signature_size_to_scanmax_cloudscan_size_to_scanmax_mrs_upload_file,rapid_scan_rescan_unchanging_files_frequency hyperscanMALWARE_DATABASE_SCANr enable_scan_cpaneldisable_cloudav
db_timeoutN)!r r r SCAN_CHECK_PERIODCONSECUTIVE_ERROR_LIMITINOTIFY_SCAN_PERIODCONFIG_CHECK_PERIODCONFLICTS_CHECK_PERIODr MAX_TARGETS_PER_SCAN_TYPE MAX_PATH_LENINOTIFY_ENABLED PURE_SCAN
SEND_FILESCLOUD_ASSISTED_SCAN
RAPID_SCANCRONTABS_SCAN_ENABLED
SCANS_PATHFILE_PREVIEW_BYTES_NUMCLEANUP_STORAGE CLEANUP_TRIM CLEANUP_KEEPSCAN_MODIFIED_FILESMAX_SIGNATURE_SIZE_TO_SCANMAX_CLOUDSCAN_SIZE_TO_SCANMAX_MRS_UPLOAD_FILE,RAPID_SCAN_RESCAN_UNCHANGING_FILES_FREQUENCY HYPERSCANDATABASE_SCAN_ENABLEDCPANEL_SCAN_ENABLEDr CLEANUP_DISABLE_CLOUDAVMDS_DB_TIMEOUTr rc rG r r s *
7! ! : 0.AAL j!35JKKO
-/FGGI .0IJJJ$*%79NOO . ==J &J'9: F F7J '7O :!- L :!) L %*"$
", 8" " ", 8" " %*%79NOO3=: J4 40
-{;;I &J'> I I$*%79MNN *l+< = = Z 7 FFNNNrc r c p e Zd ZdZ ed Z ed Z eded Z ed Z dS ) MalwareTunezc
Experimental and testing-only purpose settings
we don't want to expose to customers.
use_jsonno_check_known_hashesrapid_scan_basedir_overridez/homer no_auto_upgradeN)
r r r r r USE_JSON_REPORTNO_CHECK_KNOWN_HASHESr RAPID_SCAN_BASEDIR_OVERRIDENO_AUTO_UPGRADEr rc rG r= r= sj
#l:..O (L)@ A A".,%dG# # # #l#455OOOrc r= c e Zd ZeZeZeZeZdS )MalwareScanScheduleIntervalN)r r r NONEDAYWEEKMONTHr rc rG rG rG s" D
C D EEErc rG c e Zd ZdZdZdZ edd Z edd Z edd Z edd Z
d
S ) MalwareScanSchedulez8/usr/bin/imunify360-agent malware user scan --backgroundz!/etc/cron.d/imunify_scan_schedulezS# DO NOT EDIT. AUTOMATICALLY GENERATED.
0 {0} {1} * {2} root {cmd} >/dev/null 2>&1
MALWARE_SCAN_SCHEDULEintervalr hour day_of_week day_of_monthN) r r r CMD CRON_PATH CRON_STRINGr INTERVALHOUR DAY_OF_WEEK DAY_OF_MONTHr rc rG rM rM s
DC3IK
z' H :' D *' K :' LLLrc rM c e Zd Z edd Z edd Z edd Z edd Z edd Z edd Z edd Z
d
S ) MalwareScanIntensityMALWARE_SCAN_INTENSITYcpur ioram
user_scan_cpu user_scan_io
user_scan_ram resident_ramN) r r r r CPUIORAMUSER_CPUUSER_IOUSER_RAM RESIDENT_RAMr rc rG r[ r[ ( s
*( C
(
B *( C z( H j( G z( H :( LLLrc r[ c \ e Zd Z edd Z edd Z edd ZdS )FileBasedResourceLimitsRESOURCE_MANAGEMENT cpu_limitr io_limit ram_limitN)r r r r rd re rf r rc rG rl rl G sf
*% C
%
B *% CCCrc rl c ( e Zd Z edd ZdS )
KernelCare
KERNELCAREedfr N)r r r r EDFr rc rG rr rr V s*
* CCCrc rr c t j } | Rt j dt j dt j dt j di}| t j d S | S )Nr2 r. r r )
r r6 rG rH rK rJ rI rs rM rV )r freqs rG get_rapid_rescan_frequencyrx ] sU @E } ' ,a ' -q ' ,a ' +R
xx+4a888 Lrc c e Zd ZdZej ed Zej ed Zej edd Z ej edd Z
ej edd Z ej edd Z ej edd Z
d
S ) MalwareSignaturesz /var/imunify360/files/sigs/v1/rfxni360aibolitzai-bolit-hoster-full.dbr zmds-ai-bolit-hoster.dbz procu2.dbz
mds-procu2.dbN)r r r _dirr[ r\ r] RFXNr| AI_BOLIT_HOSTERAI_BOLIT_HYPERSCANMDS_AI_BOLIT_HOSTERPROCU_DB MDS_PROCU_DBr rc rG rz rz j s +D
7<<f % %D
7<<f % %Dgll44MNNO dI{CC ',, i1 w||D)[99H7<<i AALLLrc rz c J e Zd Z edd Z edd ZdZdZdS )LoggerLOGGERmax_log_file_sizer backup_counti i N)r r r r MAX_LOG_FILE_SIZE BACKUP_COUNT LOG_DIR_PERM
LOG_FILE_PERMr rc rG r r x sU "
" : L
LMMMrc r c e Zd ZdZdZdS )rv r non_rootN)r r r rw NON_ROOTr rc rG rv rv s DHHHrc rv caller_type)r$ c e Zd ZdZdZdS )UIRoleclientadminN)r r r CLIENTADMINr rc rG r r s
F EEErc r c e Zd ZdZdZdS )NoCPz /etc/imunify360/scripts/domainsr2 N)r r r
CLIENT_SCRIPTLATEST_VERSIONr rc rG r r s 5MNNNrc r c e Zd Z fdZ xZS )CustomBillingConfigc t j dt j }t |t d S )Nr r\ r! )r[ r\ r] r r rC r CONFIG_SCHEMA_CUSTOM_BILLING)r r\ rH s rG r z CustomBillingConfig.__init__ sS w|| ')K
)E
rc re r` s @rG r r s8
rc r c ~ e Zd Z edde Z edde Z edde Z edde ZdS )
CustomBillingr r rx ry r r r r N) r r r r r UPGRADE_URLUPGRADE_URL_360
NOTIFICATIONS
IP_LICENSEr rc rG r r s * & K
!j & O
J && M
& JJJrc r c e Zd Z edd Z edd Z edd Z edd Z edd Z edd Z edd Z
d
S ) PermissionsConfigr user_ignore_listr allow_malware_scan user_override_malware_actionsr *allow_local_malware_ignore_list_managementuse_plesk_service_plan allow_wp_waf_rules_managementN) r r r r USER_IGNORE_LISTALLOW_MALWARE_SCAN USER_OVERRIDE_MALWARE_ACTIONS USER_OVERRIDE_PROACTIVE_DEFENSE*ALLOW_LOCAL_MALWARE_IGNORE_LIST_MANAGEMENTUSE_PLESK_SERVICE_PLAN ALLOW_WP_WAF_RULES_MANAGEMENTr rc rG r r s !z ! $ # %/J &E% % %! '1j 0' ' '# 2< ;2 2 2. (Z ' %/J .% % %!!!rc r c B e Zd Z edd Z edd ZdS )MyImunifyConfigr& r r purchase_page_urlN)r r r r ENABLEDPURCHASE_PAGE_URLr rc rG r r sK j G #
" rc r c B e Zd Z edd Z edd ZdS )ControlPanelConfig
CONTROL_PANELsmart_advice_allowedr advice_email_notificationN)r r r r SMART_ADVICE_ALLOWEDADVICE_EMAIL_NOTIFICATIONr rc rG r r sL %: % !+
*! ! ! rc r c g d}t j t j t j t j t j t j d| | di dd d< fdfd|D }t ||j S ) N)
BACKUP_RESTOREr r r r r r& r rN WORDPRESS))rN rO )rN rP )rN rQ )rN rR )r default_action)r moder waf_enabledT)r r c @ t | i }t | i }i }| D ]?\ }}| | }| | |fd r|||< :|||< @|S )NT)r rs r, )
rx
admin_options user_optionsresulting_dictry admin_valuer|
admin_dict overridable user_dicts
rG normalize_sectionz0effective_user_config.<locals>.normalize_section! s !<!<==
gr : :;; #0#6#6#8#8 5 5 FK%))&11J& OOWf$5t<< ' *4v&&)4v&& rc c ( i | ]}| | S r r )r' rx r s rG r* z)effective_user_config.<locals>.<dictcomp>2 s4 07""7++ rc )r r r rr rs fm_config_cleanuprn ) admin_configrz allowed_sectionseffective_configr r r r s @@@@rG effective_user_configr s : : : : : <1 K4 ,,..J**,,I 1;R1 1 c- ,- " ;K -{/C D DDrc c : e Zd ZdxZ\ ZZZZZeeeefZ e
re neZ dS )
HookEvents)agentlicensezmalware-scanningzmalware-cleanupzmalware-detectedN) r r r IM360_EVENTSAGENTLICENSEr r MALWARE_DETECTED IMAV_EVENTSr EVENTSr rc rG r r 9 sS
L
K +
<[[ FFFrc r c 0 e Zd Zdeeef fdZd ZdS )rZ configs_to_errorsc || _ d S rZ )r )r r s rG r z ConfigsValidatorError.__init__Q s !2 rc c g }| j D ] \ }}| |d| d | S )Nz:
)r r, r r] )r r5 r rY s rG rK z ConfigsValidatorError.__repr__T s^ ! 3 9 9 ; ; 2 2MFE MMV0000 1 1 1 1yy rc N)r r r r r< r r rK r rc rG rZ rZ P sG 3$vs{*; 3 3 3 3! ! ! ! !rc rZ c e Zd ZdZed Zed Zeefdede ee
f ddfd Z e de e
e
f de
fd ZdS )
r z@A class that has methods to validate configs bypassing the cachec F t dS )zN
Validate merged config
:raises ConfigsValidatorError
N)rg r r s rG validate_system_configz'ConfigsValidator.validate_system_config^ s !!!!!rc c i }t t j D ]H} | # t $ r$}| |j Y d}~Ad}~ww xY w|rt | dS )zf
Validate all config layers, collect all errors
:raises ConfigsValidatorError
N)r~ r r r rZ updater )r) r r rF s rG validate_config_layersz'ConfigsValidator.validate_config_layersf s F 2 2 4 455< > >E
> (
>
>
>!(()<========
> ;'(9:: : ; ;s A
A4A//A4r[ r! r@ Nc | | }t | }| | st |j dS )z
Validate config represented by a dict
:param config_dict: config to validate
:param validation_schema: schema to validate config against
:raises ConfigValidationError
N)r r3 r r r5 )r) r[ r! r vs rG r zConfigsValidator.validatev sS **+<== F # #zz+&& 2'11 1 2 2rc c 8 t | r
| S | S rZ )callable)r! s rG r z&ConfigsValidator.get_validation_schema s* % & & '$$&& & rc )r r r r r9 r r r r r r
r r: r r r rc rG r r [ s JJ" " ["
;
; [
; 4F2 22 !x 02
2 2 2 [2" ! (!23! ! ! ! \! ! !rc r c ( e Zd Z edd ZdS )
AdminContactsADMIN_CONTACTS enable_icontact_notificationsr N)r r r r ENABLE_ICONTACT_NOTIFICATIONSr rc rG r r s- $.J .% % %!!!rc r c e Zd ZdZdZdZd ZdS )IContactMessageType MalwareFoundScanNotScheduledGenericc | j S rZ )r r s rG __str__zIContactMessageType.__str__ s
zrc N)r r r
MALWARE_FOUNDSCAN_NOT_SCHEDULEDGENERICr r rc rG r r s3 "M+G rc r
BACKUP_SYSTEMF)r r$ r allowed)enabled
backup_systemc f e Zd ZdZej dej e d fd
Z
xZ S ) BackupConfigaW # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
# DO NOT EDIT. AUTOMATICALLY GENERATED.
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#
# Direct modifications to this file WILL be lost upon subsequent
# regeneration of this configuration file.
#
# To have your modifications retained, you should use CLI command
# imunify360-agent backup-systems <init|disable> <backup-system>
# or activate/deactivate appropriate feature in UI.
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
r r c N t || d S )Nr r )r r\ r! rH s rG r zBackupConfig.__init__ s) d6GHHHHHrc ) r r r rD r[ r\ r] r r CONFIG_SCHEMA_BACKUP_SYSTEMr r_ r` s @rG r r sv J( W\\ ')C
6
I I I I I I I I I I Irc r c e Zd Z edde Z edde Z edd Z edd Ze d Z
d
S )
BackupRestorer r r r r cl_backup_allowedr cl_on_premise_backup_allowedc * t | j S rZ )_get_backend_system_BACKUP_SYSTEMr s rG r zBackupRestore.backup_system s "3#5666rc N) r r r r r r r CL_BACKUP_ALLOWED CL_ON_PREMISE_BACKUP_ALLOWEDr9 r r rc rG r r s j l G Z N
#
" $.: -$ $ $
7 7 [7 7 7rc r c t ddl m} | t t fv rt } n| dS | | d S )zo
Get backup module from its name
:param name: backup system name
:return: backup system module
r )backup_backendsNT)async_)restore_infectedr
CLOUDLINUXCLOUDLINUX_ON_PREMISEACRONISbackend)r# r s rG r
r
sQ 100000
1222
t " "4 " 5 55rc c e Zd ZdZdZdhZdS )
AcronisBackupzacronis-installer.log)i i i )iZ ix N)r r r LOG_NAMEPORTSRANGEr rc rG r r s! 'H E
NEEErc r c F t dd| \ }}t j o|S )zs
Checks is Agent should try restore malware file firts
and returns user that set this action in config
r try_restore_from_backup_first)r~ r r )rn try_restore_s rG should_try_autorestore_maliciousr" s/
. ;X NK 0[0rc c v t dd| \ }}t j t | z
}|S )Nr max_days_in_backup)days)r~ r nowr )rn max_daysr! untils rG "choose_use_backups_start_from_dater) s? *. KHa
LNNYH 5 5 5 5E Lrc c 0 t dd| \ }}|S )Nr generic_user_notificationsrp )r~ )rn should_sendr! s rG should_send_user_notificationsr- " s+ -$ NK
rc c e Zd Z edd Z edd Z edd Z edd Z edd ZdS ) Wordpressr security_plugin_enabledr waf_defaultai_bot_protectionai_bot_protection_presetN) r r r r SECURITY_PLUGIN_ENABLED WAF_ENABLED WAF_DEFAULTAI_BOT_PROTECTIONAI_BOT_PROTECTION_PRESETr rc rG r/ r/ + sw (j. *[-88K *[-88K"
;0CDD )z/ rc r/ c e Zd ZdZdZdZdZdS )
HackerTrapr zmalware_found_b64.listzmalware_standalone_b64.listz%/opt/imunify360/proactive/dangerlist/N)r r r r r SA_NAMEDIR_PDr rc rG r: r: 7 s"
C #D+G
4FFFrc r: rZ r )r functoolsloggingr[ abcr bisectr r contextvarsr copyr r r enumr
pathlibr typingr r
r r r r r r r r r cerberusr )defence360agent.contracts.config_providerr r r r r +defence360agent.feature_management.checkersr r defence360agent._versionr r defence360agent.utilsr r r! rs r getLoggerr rt r r r MY_IMUNIFY_KEYr re r r NOTIFYCLEANUPrH rI rJ rK DEFAULT_INTENSITY_CPUDEFAULT_INTENSITY_IODEFAULT_INTENSITY_RAM DEFAULT_INTENSITY_RESIDENT_RAM%DEFAULT_RESOURCE_MANAGEMENT_CPU_LIMIT$DEFAULT_RESOURCE_MANAGEMENT_IO_LIMIT%DEFAULT_RESOURCE_MANAGEMENT_RAM_LIMITMODSEC_RULESET_FULLMODSEC_RULESET_MINIMAL_DOS_DETECTOR_DEFAULT_LIMIT_DOS_DETECTOR_MIN_LIMIT_DOS_DETECTOR_MIN_INTERVALPORT_BLOCKING_MODE_DENYPORT_BLOCKING_MODE_ALLOWDO_NOT_MODIFY_DISCLAMERDEFAULT_CONFIG_DISCLAMERCPANELPLESK DIRECTADMINr R1SOFT
CLUSTERLOGICSSAMPLE_BACKENDr r GENERIC_SENSOR_SOCKET_PATHr rB rH r rX rb rf rm r~ r r r r lru_cacher r r Exceptionr r r r r r r< rc rg r| r partialr r rn r r rp rl r r r r r~ r3 r r r r r r r r= rG rM r[ rl rr rx rz r rv rw r r r r r r r r r r r rZ r rq r r r r r r
r r" r) r- r/ r: r rc rG <module>ri s , , , , , , , , " " " " " " ( ( ( ( ( ( ( ( A @ @ @ @ @ G G G G G G G G G G
X\
8 $ $$X_W---A 8< -
!TJNN"> &7 c4 !% () %'( $(+ % " ! " > {!E $I !
! M <>: D D Ds D D# D D D D -/J
")
(< < <M M M -17 7 "Tz7
3d
?7 7 7 7&1 1 1 ( A A A A A A A A -1 Q - - - Q 7 7 7
! !
/8D%I%I#,>>
! , I */ */ */ */ */ */ */ */Z'< '< '< '< '<h '< '< '<T '8
y ;' ;' ;' ;' ;' ;' ;' ;'|@= @= @= @= @=W 1 @= @= @= @=F
2= 2= 2= 2= 2=7&7 2= 2= 2= 2=l GK uS#X' 6>sm 4 !y
''
)*6 .I -
''
7*D %
%
%
%
%
& %
%
%
P( ( ( ( ( ( ( (V7 7 7 7 7J 7 7 78 8 8 8 8j 8 8 88 8 8 8 8J 8 8 8
\' \' \' \' \'Z \' \' \'~ i 4= = = = = = = = 4L L L L L L L L &
5 5 5 5 5 5 5 55G 5G 5G 5G 5G 5G 5G 5Gp 6 6 6 6 6 6 6 6 4 >
B B B B B B B B *z- O O O Z_ O O O
&
. < DE DE DEN= = = = = = = =.! ! ! ! !I ! ! !3! 3! 3! 3! 3! 3! 3! 3!l !
#t "
! )!"
, 1 <I I I I I6 I I I:7 7 7 7 7 7 7 7.6 6 6" 1s 1t 1 1 1 1 S T 5 5 5 5 5 5 5 5 5 5rc defence360agent/contracts/__pycache__/config.cpython-311.pyc 0000644 0000000 0000000 00000207144 00000000000 020735 0 ustar
`j|
U d Z ddlZddlZddlZddlmZ ddlmZmZ ddl m
Z
ddl m Z ddl
m
Z
mZ ddlmZ dd lmZ dd
lmZmZmZmZmZmZmZmZm Z m Z m Z dd l m Z dd l!m"Z"m#Z#m$Z$m%Z%m&Z& dd
l'm(Z) ddl*m+Z, ddl-m.Z.m/Z/m0Z0 e0j1 ddd Z2 ej3 e4 Z5 e0j6 d Z7dZ8dZ9 e0j1 dde2 Z:dZ; eej< 1 dd Z=d\ Z>Z?d\ Z@ZAZBZCd ZDd ZEd ZFd ZGd ZHd ZId ZJd ZKd ZLd!ZMd"ZNd"ZOd#ZPd$ZQd%ZRd&ZSd'\ ZTZUZVd(\ ZWZXZYd)ZZd*\ Z[Z\d+Z]ej< fd,e^d-e_d.ed/e_fd0Z`ej< fd,e^d-ead.ed/eafd1Zbd2 Zcd3 Zdd4 Ze dd5e^dz d/e ee^dz f fd6Zfd7 Zg G d8 d9 Zh G d: d; Zid<d=d>Zj ejk d"? d@ Zl ejk d"? dA ZmdBdCdDdd<dEdDdd<dEdFd<dGdFd<dGdHi dIiZn G dJ dKeo Zp G dL dM Zq G dN dOe Zr G dP dQere Zs G dR dSe e. Zt G dT dU Zu G dV dWeretX Zv G dY dZev Zw G d[ d\eretX Zx dd5ee e^e_f d]ee^ d/erfd^Zyd/eafd_Zz ej{ ev e&eqj| eReqj} ` a Z~ ej{ ev e&eqj eReqj ` a Z G db dcev Z G dd de Z G df dge Z G dh die Z G dj dke Z G dl dme Z G dn doe Z G dp dq Z G dr ds Z G dt du Z G dv dw Z G dx dy Z G dz d{ Z G d| d} Z G d~ d Z G d d Z G d d Z G d d Z G d d Z G d d Zd Z G d d Z G d d Z G d d Z e
dej Ze
e^ ed< G d d Z G d d Z G d dev Z G d d Z G d d Z G d d Z G d d Zd Z G d d Z G d deo Z G d d ZeyZ G d d Z G d de^e ZddCdFddGdDdd<eTeUeXeWe[eVe\eYeZg ddi dIiZ G d dev Z G d d Zd Z G d d Zd5e^d/eafdZd5e^d/e
fdZd5e^d/eafdZ G d d Z G d d ZdS )z5
All the config settings for defence360 in one place
N)abstractmethod) bisect_left bisect_right)
ContextVar)deepcopy)datetime timedelta)Enum)Path) AnyCallableDictListMappingOptionalProtocolSequenceTupleUnion
_ProtocolMeta) Validator)CachedConfigReader ConfigError ConfigReaderUserConfigReaderWriteOnlyConfigReader)config_cleanup) __version__) Singletondict_deep_updateimporterz
imav._versionr )modulenamedefaultim360z'/var/imunify360/myimunify-freemium.flag
MY_IMUNIFYzim360._versionz../.IM360_CONFIG_SCHEMA_PATHz4/opt/imunify360/venv/share/imunify360/config_schema/)notifycleanup)nonedayweekmonth i i FULLMINIMAL DENYALLOWa4 ############################################################################
# DO NOT MODIFY THIS FILE!!! #
# USE /etc/sysconfig/imunify360/imunify360.config.d/ TO OVERRIDE DEFAULTS #
############################################################################
a ############################################################################
# DO NOT MODIFY THIS FILE!!! #
# USE /etc/sysconfig/imunify360/imunify360.config.d/ TO OVERRIDE DEFAULTS #
# This is an example of default values only #
# Changing this file will have no effect #
############################################################################
)cpanelplesk directadmin)acronisr1soft
clusterlogicssample)
cloudlinuxcloudlinux_on_premisez./var/run/defence360agent/generic_sensor.sock.2varr$ envreturnc t || S # t $ r |cY S t $ r(}t d | |d }~ww xY w)Nz{}: integer required)intKeyError
ValueErrorformat)r> r$ r? es U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/config.pyint_from_envvarrH q su D3s8}} D D D/66s;;<<!CDs A A#AAc d}d} || }| }||v rdS ||v rdS t d | ||z # t $ r |cY S w xY w)N)truetyesy1)falsefnon0TFz{}: should be one of {})lowerrD rE rC )r> r$ r? TRUE_VALS
FALSE_VALSvals rG bool_from_envvarrX z s /I/J
#h iikk ) 4 * 5 % , ,S)j2H I I
s A A#"A#c t j t j t | S N)ospathjoindirname__file__relpaths rG
_self_rel2absrb s&
7<<117 ; ;; c t j t j t t
| S rZ )r[ r\ r] r^ rb
AGENT_CONFr` s rG conf_rel2absrf s.
7<<
j(A(ABBG L LLrc c t | d 5 }| cddd S # 1 swxY w Y dS # t $ r Y dS w xY w)z1Returns content for existing file, otherwise NonerN)openreadstripOSError)r\ rP s rG _slurp_filerm s
$__ $6688>>## $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ tts3 A &A A A A A
A
A A usernamec V t | }| | }|| | }|||fS t d| | t }|| | t
j fS )z
Choose action for config option by checking EndUser's Imunify360
config and Admin config. Admins config applies only if EndUser
didn't set the default action
rn Nz"Cannot read %s:%s from user config)
ConfigFileconfig_to_dictgetloggerdebugUserTypeROOT)sectionoptionrn user_config user_section
user_value root_configs rG choose_value_from_configr~ s h///>>@@K ??7++L !%%f--
! x' '
LL5wGGG ,,--//K w ' 66rc c J t j t S )zG
Just checks if this is server with MyImunify Freemium license
)r[ r\ existsFREEMIUM_FEATURE_FLAG rc rG is_mi_freemium_licenser s 7>>/ 0 00rc c e Zd ZddZd ZdS )
FromConfigNc > || _ || _ || _ d | _ d S rZ )rx ry _config_cls_config_instance)selfrx ry
config_clss rG __init__zFromConfig.__init__ s& % $ rc c | j 4| j t | _ n| | _ | j | j }| j
|| j S |S rZ )r r rq rr rx ry )r instanceowner
section_values rG __get__zFromConfig.__get__ sm ( '(2 %%(,(8(8(:(:% -<<>>t|L
; " - - rc NN)__name__
__module__ __qualname__r r r rc rG r r s7 % % % %
rc r c 8 e Zd Z ed ZedddZd ZdS ) FromFlagFile/var/imunify360.coercer$ c 0 || _ || _ || _ d S rZ )r# r r$ )r r# r r$ s rG r zFromFlagFile.__init__ s rc c | j | j z }| r.| | p| j S d S rZ )LOCATIONr# r r read_textr$ )r r r r\ s rG r zFromFlagFile.__get__ sP }ty( ;;== A;;t~~ / / ?4<@@ @ A Arc N)r r r r r boolr r r rc rG r r sV t%&&H'+S
A A A A Arc r Trootc | rdnd}i }t j t g D ]0}t ||d } | }t ||d 1|S )Nget_root_configget_non_root_configc i S rZ r r rc rG <lambda>z1_get_combined_validation_schema.<locals>.<lambda> s rc F)allow_overwrite)r! iter_modulesCONFIG_VALIDATORS_DIR_PATHgetattrr )r func_namecombined_schemar"
get_schemaschemas rG _get_combined_validation_schemar st %)D!!/DIO')C(DEE I I VY
;;
&%HHHHH rc )maxsizec t S rZ r r rc rG config_schema_rootr s * , ,,rc c " t d S )NFr r r rc rG config_schema_non_rootr s * 6 6 66rc CUSTOM_BILLINGdictstring)typer$ nullableboolean)r r$ ) upgrade_urlupgrade_url_360billing_notifications
ip_license)r r r$ c e Zd ZdS )ConfigValidationErrorN)r r r r rc rG r r s Drc r c e Zd ZdZesdez ndZeZeZ e
Z e j
dd ZdZdZdZd Zd
Zd Zd Zd Zd
Ze j ed ZdZ e j e e Z e j e e Z dZ dZ e j e d Z!dZ"dZ#dZ$dZ%dZ&esdndZ'dZ( e)d Z*dZ+d S ) Core
imunify360z%s agentzimunify antivirusIMUNIFY360_API_URLzhttps://api.imunify360.com
z.el7 z/var/imunify360/tmpzimunify360-merged.configz&imunify360-merged-nonprivileged.configzimunify360.configz/etc/imunify360rz /etc/sysconfig/imunify360i i zimunify360.config.dz.imunify360.backup_configz
hooks.yamlzcustom_billing.configz/var/imunify360/hookszimunify360-agentzimunify-antiviruszunified-access-logger.confz#/etc/sysconfig/imunify360/.go_agent< N),r r r PRODUCTANTIVIRUS_MODENAME
av_version
AV_VERSION core_version CORE_VERSION_versionVERSIONr[ environrs API_BASE_URLDEFAULT_SOCKET_TIMEOUTDIST
FILE_UMASKTMPDIRMERGED_CONFIG_FILE_NAME%MERGED_NONPRIVILEGED_CONFIG_FILE_NAMEUSER_CONFIG_FILE_NAMELOCAL_CONFIG_FILE_NAME
CONFIG_DIRr\ r] USER_CONFDIRGLOBAL_CONFDIRMERGED_CONFIG_FILE_PATH%MERGED_NONPRIVILEGED_CONFIG_FILE_PATH MERGED_CONFIG_FILE_PERMISSION+MERGED_NONPRIVILEGED_CONFIG_FILE_PERMISSIONLOCAL_CONFIG_FILE_PATH
CONFIG_D_NAMEBACKUP_CONFIGFILENAMEHOOKS_CONFIGFILENAME CUSTOM_BILLING_CONFIGFILENAMEINBOX_HOOKS_DIRSVC_NAME$UNIFIED_ACCESS_LOGGER_CONFIGFILENAMEr GO_FLAG_FILE%SIGNAL_HANDLER_MIGRATION_TIMEOUT_SECSr rc rG r r sV G'5 N: ;NDJ LG:>> : L DJ
"F 80 * 0 0"J7<<
M::L0N gll/ -/GLL=- -) %*!27/ W\\.:M N N)M 7'$;!-O #1I6I
,H(4=>>L,.)))rc r c e Zd Ze ddededefd Ze ddededed ed
edd f d Zedd
Z e dded
edefd Z
ede e defd Z
dede e defdZdede e dedd fdZd S )IConfigTF normalize
force_readr@ c t rZ NotImplementedErrorr r r s rG rr zIConfig.config_to_dict7
"!rc datavalidate overwritewithout_defaultsNc t rZ r r r r r r r s rG dict_to_configzIConfig.dict_to_config= s
"!rc c t rZ r r s rG r zIConfig.validateH !!rc configc t rZ r r r r s rG r zIConfig.normalizeL r rc timestampc t rZ r r r s rG modified_sincezIConfig.modified_sinceR r rc rx ry c |r;| |i | S d S rZ )rr rs )r rx ry s rG rs z IConfig.getV s@ F&&((,,Wb99==fEE Etrc valuec @ |r| |||ii d S d S rZ )r )r rx ry r s rG setz IConfig.set[ s7 < 65/ : ; ; ; ; ; < <rc TFTTFFr@ NF)r r r r r r rr r r r r r floatr strr rs r
r rc rG r r 6 s 9>" " "26"
" " " ^"
!&
" "" " "
"
"
" " " ^" " " " ^" 8=" " "15"
" " " ^"
" "D " " " ^"3
#
<3 <
<c <d < < < < < <rc r c e Zd ZU eed< dS ) IConfigFiler\ N)r r r r __annotations__r rc rG r r ` s
IIIIIrc r c e Zd ZdZdS )ProtocolSingletonze
Needed to avoid metaclass conflict when implementing protocols that are
also Singletons
N)r r r __doc__r rc rG r r d s rc r c e Zd Zd Zededefd Zededefd Z ededefd Z
dede defd Z d
S )
Normalizerc d | _ i | _ t | | _ | | j | _ d S rZ )_config_normalized_configConfigsValidatorget_validation_schema_schema _get_schema_without_defaults_schema_without_defaults)r validation_schemas rG r zNormalizer.__init__l sP *. (* '==
)-(I(I L)
)
%%%rc _dictr@ c D fd| D S )Nc x i | ]6\ }}|d v |t |t r | n|7S ))r$ default_setter)
isinstancer r ).0keyr clss rG
<dictcomp>z;Normalizer._get_schema_without_defaults.<locals>.<dictcomp>x s]
U777
%&&11%888777rc items)r) r" s ` rG r z'Normalizer._get_schema_without_defaultsv s8
$kkmm
rc r c i }| D ]W\ }}t |t r6| D ] \ }}||| |i |< !P|r|||< X|S rZ )r, r& r
setdefault)r
new_configrx optionsry r s rG remove_nullzNormalizer.remove_null s :<
& . . GW'4((
.%,]]__ K KMFE (EJ
--gr::6BK
. '.
7#rc c t | }| | }|j rt |j |t d| |S )NzCerberus returned None for )ConfigValidator
normalizederrorsr )r r validatorr4 s rG _normalize_with_schemaz!Normalizer._normalize_with_schema sa #F++ %.%9%9&%A%A
:' (899 9 '(Nf(N(NOO Orc r c |r| j n| j }|r+| | }| || S || j k r| j S | || }|| _ || _ | j S rZ )r r r1 r7 r r )r r r r r4 s rG r zNormalizer.normalize s -= OD ) )4< ?%%f--F..vv>> > T\ ! !* *00@@
", &&rc N)
r r r r classmethodr r r staticmethodr1 r7 r r r rc rG r r k s
T
[
G \ w 4 \
'
'4
'D
'
'
'
'
'
'rc r c
e Zd ZdZddddddddededeeeg ef f ded e d
e
f fd Z d Z d dede
fdZd de de
fdZ d dede de de de ddf dZd Zd Zd Zd ee de fd Z xZS )!Config NT)r\
config_readerr!
disclaimercached permissionsr\ r> r! r? r@ rA c t |s|sJ |rt nt }|p |||p| j | | _ | j j | _ |pt | _ t | j | _
d S )N)r? rA ) superr r r
DISCLAIMER_config_readerr\ r r! r _normalizer) r r\ r> r! r? r@ rA config_reader_cls __class__s rG r zConfig.__init__ s $}$$$28 J . .l +
/@/@ !4T_#0
0
0
', !2!H6H %d&<==rc c Z d | j j | j | j S )NzW<{classname}(config_reader={config_reader!r}, validation_schema={validation_schema!r})>) classnamer> r! )rE rH r rE r! r s rG __repr__zConfig.__repr__ s6
&n1 - " 4
rc Fr r@ c 8 | j || S rZ )rF r r s rG r zConfig.normalize s ))&2BCCCrc r c | j | }|r| | }t | S )zr
Converts config file to dict
:return dict: dictionary (key (section) / value (options))
)r )rE read_config_filer r )r r r r s rG rr zConfig.config_to_dict sD $555LL ,^^F++F rc r r r r r c r |r| |||| dS | |||| dS )a
Converts dict to config file
New options will be mixed in with old ones
unless overwrite is specified
:param dict data: dictionary (key (section) / value (options))
:param bool validate: indicates if we need validation
:param bool normalize: normalize config
:param overwrite: overwrite existing conf
:param without_defaults: do not fill defaults
:return: None
)r r r r N)_dict_to_config_overwrite_dict_to_configr s rG r zConfig.dict_to_config st (
* *!#!1
+
!#!1
!
rc c |r t || j |r| || }| j | d S Nr )r r r! r rE write_config_file)r r r r r s rG rP z Config._dict_to_config_overwrite sb D % %dD,B C C C K>>$9I>JJD --d33333rc c t | j }t || rW|r t || j |r| || }| j | d S d S rS ) r rE rN r r r r! r rU )r r r r r r s rG rQ zConfig._dict_to_config s $->>@@AA FD ) ) :
J ))&$2HIII
-= (
1 1& 9 9 9 9 9 : :rc c | j d }nB# t $ r5}d}t d|| t | |i |d}~ww xY w t || j dS # t $ r5}d}t d|| t | |i |d}~ww xY w)z/
:raises ConfigsValidatorError
F)
ignore_errorsz Error during config validationz%s: %sNz+Imunify360 config does not match the scheme)
rE rN r rt errorConfigsValidatorErrorr r r! r )r config_dictrF messages rG r zConfig.validate s @ ->> # ? KK @ @ @6G LL7A . . .'w88a ? @
@ % %k43I J J J J J$ @ @ @CG LL7A . . .'w88a ? @s,
A 0AA ! B
C
0B==Cr c 6 | j | S rZ )rE r r s rG r zConfig.modified_since( "11)<<<rc r r r )r r r rD r r r r r
r rB r rK r r rr r rP rQ r r r r
__classcell__rH s @rG r< r< s J &*CG > > > >
$ > !(2w;*?!?@
> > > > > > > > >.
D D DD D D D D
$
!&
! !! ! !
!
!
! ! ! !F4 4 4 : : :@ @ @(= =D = = = = = = = =rc r< ) metaclassc e Zd Z fdZ xZS )
UserConfigc || _ t j t j |t j }t |t || t d S )N)r\ r> r! ) rn r[ r\ r] r r r rC r r r )r rn r\ rH s rG r zUserConfig.__init__- sl
w|| x)C
*4:: 4
rc r r r r r_ r` s @rG rc rc , s8
rc rc c
e Zd Zdddddededef fdZ dd ed
ed efd Z dd
eded ededed df dZ ddZ
ddeded efdZ de e
d efdZ xZS ) SystemConfigN) local_config
merged_confignonpriv_merged_configrh ri rj c t |p
t | _ |p
t | _ |p
t
| _ d S rZ )rC r LocalConfig
_local_config MergedConfig_merged_configMergedNonPrivilegedConfig_nonpriv_merged_config)r rh ri rj rH s rG r zSystemConfig.__init__: sZ ) :[]] + =|~~ ! @%>%@%@
###rc TFr r r@ c : | j || S )Nr r )ro rr r s rG rr zSystemConfig.config_to_dictH s) "11 J 2
rc r r r r c D | j ||||| d S N)r r r r )rm r r s rG r zSystemConfig.dict_to_configO s=
)) - *
rc c j | j | j d S rZ )ro r rq r s rG r zSystemConfig.validate_ s2 $$&&& #,,.....rc r c : | j || S )N)r r )ro r r s rG r zSystemConfig.normalizec s* ",,,< -
rc r c 6 | j | S rZ )ro r r s rG r zSystemConfig.modified_sincej r^ rc r TTFTr
r )r r r r< r r r rr r r r r r r r r_ r` s @rG rg rg 9 sw $ $(,
&
:?
26
!%
/ / / /
9>
15
= =D = = = = = = = =rc rg r\ c | r%t | t st | S |rt | S t S )Nrp r\ )r& rB rc r< rg )rn r\ s rG config_file_factoryr| n sQ
8S11 8,,,,
4 ~~ rc c t t }|j D ]}| | r dS dS )NTF)Mergerget_layer_nameslayersr )r mergerlayers rG any_layer_modified_sincer z sS
F**,,
-
-F * * 44 5rc )r\ r? rA )r> c
e Zd ZdZej ddddddedeee g ef f de
f fdZ dd
ed e d e d
e de ddf fd
Z
xZS )rl zt
Config (/etc/sysconfig/imunify360/imunify360.config) should contain
options changed by a customer only
NFr\ r> r! r? r@ r> r! r? c T t ||||| d S )Nr rC r )r r\ r> r! r? r@ rH s rG r zLocalConfig.__init__ s? ' /!
rc Tr r r r r r@ c P t ||||| S ru )rC r )r r r r r r rH s rG r zLocalConfig.dict_to_config s5 ww%% - &
rc ry )r r r r r r r r r r
r r r r r_ r` s @rG rl rl s
(&*CG
$
!(2w;*?!?@
( !%
rc rl c e Zd Zej ej ej Z dZ
d dZ e d Z
d dZe defd ZdS )
BaseMergerz90-local.configFc < | _ fd|D _ d S )Nc v g | ]5}t t j j | 6S )r{ )r< r[ r\ r] DIR)r' r# r s rG
<listcomp>z'BaseMerger.__init__.<locals>.<listcomp> sC
:>F TXt44 5 5 5
rc )_include_defaultsr )r namesinclude_defaultss ` rG r zBaseMerger.__init__ s9 !1
BG
rc c t j | j r&t t j | j ng S rZ )r[ r\ isdirr sortedlistdirr) s rG r zBaseMerger.get_layer_names s6 .0gmmCG.D.DLvbj))***"Lrc c g }| j r>t t i d }| | |fd| j D z
}| | S )NFrT c > g | ]}| d S )Frs )rr )r' r r s rG r z.BaseMerger.configs_to_dict.<locals>.<listcomp> s<
5Z H H
rc )r r r r appendr _build_effective_config)r r layer_dict_listdefaultss ` rG configs_to_dictzBaseMerger.configs_to_dict s ! -!"455??U @ H
" "8 , , ,
++O<<<rc r c i }|D ]O}| D ]8\ }}|||vri ||< | D ]\ }}| ||| |< 9P|S rZ r+ )r) r effective
layer_dictrx r0 ry r s rG r z"BaseMerger._build_effective_config s %' ) ; ;J$.$4$4$6$6
;
; ? )++)+Ig&%,]]__ ; ;MFE (5: '*62;
; rc Nr )r r r r[ r\ r] r r r r LOCAL_CONFIG_NAMEr r9 r r listr r rc rG r r s
',,t*D,>
?
?C)
M M [M = = = = d [ rc r c $ e Zd Zdef fd Z xZS )
MutableMergerr c t || j }|d | }t |d d S NTr )r r rC r r r idxrH s rG r zMutableMerger.__init__ sE %!788dsd
66666rc r r r r r r_ r` s @rG r r sD 7h 7 7 7 7 7 7 7 7 7 7rc r c $ e Zd Zdef fd Z xZS )ImmutableMergerr c t || j }||d }t |d d S NFr )r r rC r r s rG r zImmutableMerger.__init__ sE 5$"899cdd
77777rc r r` s @rG r r sD 8h 8 8 8 8 8 8 8 8 8 8rc r c $ e Zd Zdef fd Z xZS )
NonBaseMergerr c N t |d d S r r r r rH s rG r zNonBaseMerger.__init__ s&
77777rc r r` s @rG r r sD 8h 8 8 8 8 8 8 8 8 8 8rc r c n e Zd ZddgddgdgdgdZ fdZed Zed
ed efd Z xZ
S )
r~ N user_override_proactive_defensenum_dayslimitenableenable_scan_modsec)PROACTIVE_DEFENCE PERMISSIONSINCIDENT_LOGGINGERROR_REPORTINGMALWARE_SCANNINGc N t |d d S r r r s rG r zMerger.__init__ s&
66666rc c | | }| }|j D ]I}t j |j s#t d|j d S J t | t t }| |d }|
| \ }}t |d t! |dd d S # t" t$ f$ r&}t d| Y d }~d S d }~ww xY w)NzGAborting merged config update: Config layer %s disappeared during mergeFrT )r )r r zConfig file is invalid! %s)r r r r[ r\ lexistsrt warningr r r r r _split_settingsrn r rp rZ r )r) r r[ r
normalizer priv_dict nonpriv_dictrF s rG update_merged_configzMerger.update_merged_config s S((**++ ,,.. ] E7??5:..
?J
% %k 2 2 2 $$677J$..e / K '*&9&9+&F&F #I| NN ) ))e ) D D D % ' ' 6 6 u
7
&'<= < < < NN7 ; ; ; ; ; ; ; ; ; <s D* *E!;E E!r[ r@ c t | }i }| j D ]T\ }}||vr
|t || ||< %|D ],}||| v r ||vri ||< || | || |< -U||fS )zSplit config into privileged and non-privileged parts.
Non-privileged config is a subset of privileged config - both contain
the same values for settings listed in NONPRIVILEGED_SETTINGS.
)r NONPRIVILEGED_SETTINGSr, )r) r[ r r rx r0 ry s rG r zMerger._split_settings> s [)) (* # : @ @ B B
GWk))(0W1E(F(F W%% % F W!555",6646L 18CG8L "9 W-f5 ,&&rc ) r r r r r r9 r r tupler r_ r` s @rG r~ r~ s ! -
!
&7 7 7 7 7 ) ) [)V '$ '5 ' ' ' [' ' ' ' 'rc r~ c , e Zd Zedd fd
Zd Z xZS )r3 T
allow_unknownpurge_readonlyc @ t j |||d| dS )z
Initialises ConfigValidator(Validator)
for more details on Validator params please check
https://docs.python-cerberus.org/en/stable/validation-rules.html
r Nr )r r r argskwargsrH s rG r zConfigValidator.__init__[ sB
')
rc c h | j di dd rdS |S )Nr& r FT)
root_documentrs )r r s rG (_normalize_coerce_user_override_pd_rulesz8ConfigValidator._normalize_coerce_user_override_pd_rulesn s7 ! !, 3 3 7 7% H H 4 rc )r r r r r r r_ r` s @rG r3 r3 Z sY %
& rc r3 c " e Zd Zdej z ZdS ) Packagingz /opt/imunify360/venv/share/%sN)r r r r r DATADIRr rc rG r r t s - <GGGrc r c e Zd ZdZdZdZdZdZ ede Z
e d e e
d Z e d
d Z e d e e
d Zd S )
SimpleRpci z(/var/run/defence360agent/simple_rpc.sockz1/var/run/defence360agent/non_root_simple_rpc.sockz.imunify360_token_{suffix} I360_SOCKET_ACTIVATION IMUNIFY360_INACTIVITY_TIMEOUT minutesI360_RPC_MAX_CONNECTIONSI360_RPC_READ_TIMEOUTN)r r r CLIENT_TIMEOUT SOCKET_PATHNON_ROOT_SOCKET_PATHTOKEN_FILE_TMPL
TOKEN_MASKrX r SOCKET_ACTIVATIONrH rB r
total_secondsINACTIVITY_TIMEOUTMAX_CONCURRENT_CONNECTIONS READ_TIMEOUTr rc rG r r x s N<KN2OJ(( ) ' IIa . . 0 011 "1 "C" " #? IIa . . 0 011 LLLrc r c p e Zd Zdej dej dZdej dZdej dej dZdS )Modelz/var//z.dbz
/proactive.dbz -resident.dbN)r r r r r PATHPROACTIVE_PATH
RESIDENT_PATHr rc rG r r sN "lllDLLL 9DD/3|||=NN04 dlllKMMMrc r c e Zd Z ed Z ed ZdZg ZdZ dS ) FilesUpdate r N)
r r r r r PERIODTIMEOUTSOCKET_TIMEOUTDISABLED DAYS_TO_KEEPr rc rG r r s_
Yr
"
"
"
0
0
2
2F i###1133G N
HLLLrc r c , e Zd ZdZdZed ZdS ) CountryInfoz2/var/imunify360/files/geo/v1/GeoLite2-Country.mmdbz>/var/imunify360/files/geo/v1/GeoLite2-Country-Locations-en.csvc , d | S )Nz2/var/imunify360/files/geo/v1/CountrySubnets-{}.txt)rE ) country_codes rG country_subnets_filez CountryInfo.country_subnets_file s CJJ
rc N)r r r DB LOCATIONS_DBr: r r rc rG r r s? =B I
\
rc r c j e Zd Z ej d edej z Z e dd Z
dS )SentryIMUNITY360_SENTRY_DSNz %s/sentryr r N) r r r r[ getenvrm r r DSNr ENABLEr rc rG r r sL
") [9;L-L!M!M C Z)8
4
4FFFrc r c e Zd ZdZdZdZdZdZ edd Z edd Z
edd Z edd Z edd
Z
edd Z edd Z edd
ZdZdZdZ edd Z edd Z edd Z edd Z edd Z edd Z edd Z edd Z edd Z edd Z e d Z edd Z d S )!Malwarei, r r r r max_targets_per_scan_type max_path_lenenable_scan_inotifyenable_scan_pure_ftpdsends_file_for_analysiscloud_assisted_scan
rapid_scancrontabsz$/var/imunify360/aibolit/scans.picklei z /var/imunify360/cleanup_storageMALWARE_CLEANUP trim_file_instead_of_removalrx ry keep_original_files_daysscan_modified_filesmax_signature_size_to_scanmax_cloudscan_size_to_scanmax_mrs_upload_file,rapid_scan_rescan_unchanging_files_frequency hyperscanMALWARE_DATABASE_SCANr enable_scan_cpaneldisable_cloudav
db_timeoutN)!r r r SCAN_CHECK_PERIODCONSECUTIVE_ERROR_LIMITINOTIFY_SCAN_PERIODCONFIG_CHECK_PERIODCONFLICTS_CHECK_PERIODr MAX_TARGETS_PER_SCAN_TYPE MAX_PATH_LENINOTIFY_ENABLED PURE_SCAN
SEND_FILESCLOUD_ASSISTED_SCAN
RAPID_SCANCRONTABS_SCAN_ENABLED
SCANS_PATHFILE_PREVIEW_BYTES_NUMCLEANUP_STORAGE CLEANUP_TRIM CLEANUP_KEEPSCAN_MODIFIED_FILESMAX_SIGNATURE_SIZE_TO_SCANMAX_CLOUDSCAN_SIZE_TO_SCANMAX_MRS_UPLOAD_FILE,RAPID_SCAN_RESCAN_UNCHANGING_FILES_FREQUENCY HYPERSCANDATABASE_SCAN_ENABLEDCPANEL_SCAN_ENABLEDr CLEANUP_DISABLE_CLOUDAVMDS_DB_TIMEOUTr rc rG r r s *
7! ! : 0.AAL j!35JKKO
-/FGGI .0IJJJ$*%79NOO . ==J &J'9: F F7J '7O :!- L :!) L %*"$
", 8" " ", 8" " %*%79NOO3=: J4 40
-{;;I &J'> I I$*%79MNN *l+< = = Z 7 FFNNNrc r c p e Zd ZdZ ed Z ed Z eded Z ed Z dS ) MalwareTunezc
Experimental and testing-only purpose settings
we don't want to expose to customers.
use_jsonno_check_known_hashesrapid_scan_basedir_overridez/homer no_auto_upgradeN)
r r r r r USE_JSON_REPORTNO_CHECK_KNOWN_HASHESr RAPID_SCAN_BASEDIR_OVERRIDENO_AUTO_UPGRADEr rc rG r= r= sj
#l:..O (L)@ A A".,%dG# # # #l#455OOOrc r= c e Zd ZeZeZeZeZdS )MalwareScanScheduleIntervalN)r r r NONEDAYWEEKMONTHr rc rG rG rG s" D
C D EEErc rG c e Zd ZdZdZdZ edd Z edd Z edd Z edd Z
d
S ) MalwareScanSchedulez8/usr/bin/imunify360-agent malware user scan --backgroundz!/etc/cron.d/imunify_scan_schedulezS# DO NOT EDIT. AUTOMATICALLY GENERATED.
0 {0} {1} * {2} root {cmd} >/dev/null 2>&1
MALWARE_SCAN_SCHEDULEintervalr hour day_of_week day_of_monthN) r r r CMD CRON_PATH CRON_STRINGr INTERVALHOUR DAY_OF_WEEK DAY_OF_MONTHr rc rG rM rM s
DC3IK
z' H :' D *' K :' LLLrc rM c e Zd Z edd Z edd Z edd Z edd Z edd Z edd Z edd Z
d
S ) MalwareScanIntensityMALWARE_SCAN_INTENSITYcpur ioram
user_scan_cpu user_scan_io
user_scan_ram resident_ramN) r r r r CPUIORAMUSER_CPUUSER_IOUSER_RAM RESIDENT_RAMr rc rG r[ r[ ( s
*( C
(
B *( C z( H j( G z( H :( LLLrc r[ c \ e Zd Z edd Z edd Z edd ZdS )FileBasedResourceLimitsRESOURCE_MANAGEMENT cpu_limitr io_limit ram_limitN)r r r r rd re rf r rc rG rl rl G sf
*% C
%
B *% CCCrc rl c ( e Zd Z edd ZdS )
KernelCare
KERNELCAREedfr N)r r r r EDFr rc rG rr rr V s*
* CCCrc rr c t j } | Rt j dt j dt j dt j di}| t j d S | S )Nr2 r. r r )
r r6 rG rH rK rJ rI rs rM rV )r freqs rG get_rapid_rescan_frequencyrx ] sU @E } ' ,a ' -q ' ,a ' +R
xx+4a888 Lrc c e Zd ZdZej ed Zej ed Zej edd Z ej edd Z
ej edd Z ej edd Z ej edd Z
d
S ) MalwareSignaturesz /var/imunify360/files/sigs/v1/rfxni360aibolitzai-bolit-hoster-full.dbr zmds-ai-bolit-hoster.dbz procu2.dbz
mds-procu2.dbN)r r r _dirr[ r\ r] RFXNr| AI_BOLIT_HOSTERAI_BOLIT_HYPERSCANMDS_AI_BOLIT_HOSTERPROCU_DB MDS_PROCU_DBr rc rG rz rz j s +D
7<<f % %D
7<<f % %Dgll44MNNO dI{CC ',, i1 w||D)[99H7<<i AALLLrc rz c J e Zd Z edd Z edd ZdZdZdS )LoggerLOGGERmax_log_file_sizer backup_counti i N)r r r r MAX_LOG_FILE_SIZE BACKUP_COUNT LOG_DIR_PERM
LOG_FILE_PERMr rc rG r r x sU "
" : L
LMMMrc r c e Zd ZdZdZdS )rv r non_rootN)r r r rw NON_ROOTr rc rG rv rv s DHHHrc rv caller_type)r$ c e Zd ZdZdZdS )UIRoleclientadminN)r r r CLIENTADMINr rc rG r r s
F EEErc r c e Zd ZdZdZdS )NoCPz /etc/imunify360/scripts/domainsr2 N)r r r
CLIENT_SCRIPTLATEST_VERSIONr rc rG r r s 5MNNNrc r c e Zd Z fdZ xZS )CustomBillingConfigc t j dt j }t |t d S )Nr r\ r! )r[ r\ r] r r rC r CONFIG_SCHEMA_CUSTOM_BILLING)r r\ rH s rG r z CustomBillingConfig.__init__ sS w|| ')K
)E
rc re r` s @rG r r s8
rc r c ~ e Zd Z edde Z edde Z edde Z edde ZdS )
CustomBillingr r rx ry r r r r N) r r r r r UPGRADE_URLUPGRADE_URL_360
NOTIFICATIONS
IP_LICENSEr rc rG r r s * & K
!j & O
J && M
& JJJrc r c e Zd Z edd Z edd Z edd Z edd Z edd Z edd Z edd Z
d
S ) PermissionsConfigr user_ignore_listr allow_malware_scan user_override_malware_actionsr *allow_local_malware_ignore_list_managementuse_plesk_service_plan allow_wp_waf_rules_managementN) r r r r USER_IGNORE_LISTALLOW_MALWARE_SCAN USER_OVERRIDE_MALWARE_ACTIONS USER_OVERRIDE_PROACTIVE_DEFENSE*ALLOW_LOCAL_MALWARE_IGNORE_LIST_MANAGEMENTUSE_PLESK_SERVICE_PLAN ALLOW_WP_WAF_RULES_MANAGEMENTr rc rG r r s !z ! $ # %/J &E% % %! '1j 0' ' '# 2< ;2 2 2. (Z ' %/J .% % %!!!rc r c B e Zd Z edd Z edd ZdS )MyImunifyConfigr& r r purchase_page_urlN)r r r r ENABLEDPURCHASE_PAGE_URLr rc rG r r sK j G #
" rc r c B e Zd Z edd Z edd ZdS )ControlPanelConfig
CONTROL_PANELsmart_advice_allowedr advice_email_notificationN)r r r r SMART_ADVICE_ALLOWEDADVICE_EMAIL_NOTIFICATIONr rc rG r r sL %: % !+
*! ! ! rc r c g d}t j t j t j t j t j t j d| | di dd d< fdfd|D }t ||j S ) N)
BACKUP_RESTOREr r r r r r& r rN WORDPRESS))rN rO )rN rP )rN rQ )rN rR )r default_action)r moder waf_enabledT)r r c @ t | i }t | i }i }| D ]?\ }}| | }| | |fd r|||< :|||< @|S )NT)r rs r, )
rx
admin_options user_optionsresulting_dictry admin_valuer|
admin_dict overridable user_dicts
rG normalize_sectionz0effective_user_config.<locals>.normalize_section! s !<!<==
gr : :;; #0#6#6#8#8 5 5 FK%))&11J& OOWf$5t<< ' *4v&&)4v&& rc c ( i | ]}| | S r r )r' rx r s rG r* z)effective_user_config.<locals>.<dictcomp>2 s4 07""7++ rc )r r r rr rs fm_config_cleanuprn ) admin_configrz allowed_sectionseffective_configr r r r s @@@@rG effective_user_configr s : : : : : <1 K4 ,,..J**,,I 1;R1 1 c- ,- " ;K -{/C D DDrc c : e Zd ZdxZ\ ZZZZZeeeefZ e
re neZ dS )
HookEvents)agentlicensezmalware-scanningzmalware-cleanupzmalware-detectedN) r r r IM360_EVENTSAGENTLICENSEr r MALWARE_DETECTED IMAV_EVENTSr EVENTSr rc rG r r 9 sS
L
K +
<[[ FFFrc r c 0 e Zd Zdeeef fdZd ZdS )rZ configs_to_errorsc || _ d S rZ )r )r r s rG r z ConfigsValidatorError.__init__Q s !2 rc c g }| j D ] \ }}| |d| d | S )Nz:
)r r, r r] )r r5 r rY s rG rK z ConfigsValidatorError.__repr__T s^ ! 3 9 9 ; ; 2 2MFE MMV0000 1 1 1 1yy rc N)r r r r r< r r rK r rc rG rZ rZ P sG 3$vs{*; 3 3 3 3! ! ! ! !rc rZ c e Zd ZdZed Zed Zeefdede ee
f ddfd Z e de e
e
f de
fd ZdS )
r z@A class that has methods to validate configs bypassing the cachec F t dS )zN
Validate merged config
:raises ConfigsValidatorError
N)rg r r s rG validate_system_configz'ConfigsValidator.validate_system_config^ s !!!!!rc c i }t t j D ]H} | # t $ r$}| |j Y d}~Ad}~ww xY w|rt | dS )zf
Validate all config layers, collect all errors
:raises ConfigsValidatorError
N)r~ r r r rZ updater )r) r r rF s rG validate_config_layersz'ConfigsValidator.validate_config_layersf s F 2 2 4 455< > >E
> (
>
>
>!(()<========
> ;'(9:: : ; ;s A
A4A//A4r[ r! r@ Nc | | }t | }| | st |j dS )z
Validate config represented by a dict
:param config_dict: config to validate
:param validation_schema: schema to validate config against
:raises ConfigValidationError
N)r r3 r r r5 )r) r[ r! r vs rG r zConfigsValidator.validatev sS **+<== F # #zz+&& 2'11 1 2 2rc c 8 t | r
| S | S rZ )callable)r! s rG r z&ConfigsValidator.get_validation_schema s* % & & '$$&& & rc )r r r r r9 r r r r r r
r r: r r r rc rG r r [ s JJ" " ["
;
; [
; 4F2 22 !x 02
2 2 2 [2" ! (!23! ! ! ! \! ! !rc r c ( e Zd Z edd ZdS )
AdminContactsADMIN_CONTACTS enable_icontact_notificationsr N)r r r r ENABLE_ICONTACT_NOTIFICATIONSr rc rG r r s- $.J .% % %!!!rc r c e Zd ZdZdZdZd ZdS )IContactMessageType MalwareFoundScanNotScheduledGenericc | j S rZ )r r s rG __str__zIContactMessageType.__str__ s
zrc N)r r r
MALWARE_FOUNDSCAN_NOT_SCHEDULEDGENERICr r rc rG r r s3 "M+G rc r
BACKUP_SYSTEMF)r r$ r allowed)enabled
backup_systemc f e Zd ZdZej dej e d fd
Z
xZ S ) BackupConfigaW # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
# DO NOT EDIT. AUTOMATICALLY GENERATED.
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#
# Direct modifications to this file WILL be lost upon subsequent
# regeneration of this configuration file.
#
# To have your modifications retained, you should use CLI command
# imunify360-agent backup-systems <init|disable> <backup-system>
# or activate/deactivate appropriate feature in UI.
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
r r c N t || d S )Nr r )r r\ r! rH s rG r zBackupConfig.__init__ s) d6GHHHHHrc ) r r r rD r[ r\ r] r r CONFIG_SCHEMA_BACKUP_SYSTEMr r_ r` s @rG r r sv J( W\\ ')C
6
I I I I I I I I I I Irc r c e Zd Z edde Z edde Z edd Z edd Ze d Z
d
S )
BackupRestorer r r r r cl_backup_allowedr cl_on_premise_backup_allowedc * t | j S rZ )_get_backend_system_BACKUP_SYSTEMr s rG r zBackupRestore.backup_system s "3#5666rc N) r r r r r r r CL_BACKUP_ALLOWED CL_ON_PREMISE_BACKUP_ALLOWEDr9 r r rc rG r r s j l G Z N
#
" $.: -$ $ $
7 7 [7 7 7rc r c t ddl m} | t t fv rt } n| dS | | d S )zo
Get backup module from its name
:param name: backup system name
:return: backup system module
r )backup_backendsNT)async_)restore_infectedr
CLOUDLINUXCLOUDLINUX_ON_PREMISEACRONISbackend)r# r s rG r
r
sQ 100000
1222
t " "4 " 5 55rc c e Zd ZdZdZdhZdS )
AcronisBackupzacronis-installer.log)i i i )iZ ix N)r r r LOG_NAMEPORTSRANGEr rc rG r r s! 'H E
NEEErc r c F t dd| \ }}t j o|S )zs
Checks is Agent should try restore malware file firts
and returns user that set this action in config
r try_restore_from_backup_first)r~ r r )rn try_restore_s rG should_try_autorestore_maliciousr" s/
. ;X NK 0[0rc c v t dd| \ }}t j t | z
}|S )Nr max_days_in_backup)days)r~ r nowr )rn max_daysr! untils rG "choose_use_backups_start_from_dater) s? *. KHa
LNNYH 5 5 5 5E Lrc c 0 t dd| \ }}|S )Nr generic_user_notificationsrp )r~ )rn should_sendr! s rG should_send_user_notificationsr- " s+ -$ NK
rc c e Zd Z edd Z edd Z edd Z edd Z edd ZdS ) Wordpressr security_plugin_enabledr waf_defaultai_bot_protectionai_bot_protection_presetN) r r r r SECURITY_PLUGIN_ENABLED WAF_ENABLED WAF_DEFAULTAI_BOT_PROTECTIONAI_BOT_PROTECTION_PRESETr rc rG r/ r/ + sw (j. *[-88K *[-88K"
;0CDD )z/ rc r/ c e Zd ZdZdZdZdZdS )
HackerTrapr zmalware_found_b64.listzmalware_standalone_b64.listz%/opt/imunify360/proactive/dangerlist/N)r r r r r SA_NAMEDIR_PDr rc rG r: r: 7 s"
C #D+G
4FFFrc r: rZ r )r functoolsloggingr[ abcr bisectr r contextvarsr copyr r r enumr
pathlibr typingr r
r r r r r r r r r cerberusr )defence360agent.contracts.config_providerr r r r r +defence360agent.feature_management.checkersr r defence360agent._versionr r defence360agent.utilsr r r! rs r getLoggerr rt r r r MY_IMUNIFY_KEYr re r r NOTIFYCLEANUPrH rI rJ rK DEFAULT_INTENSITY_CPUDEFAULT_INTENSITY_IODEFAULT_INTENSITY_RAM DEFAULT_INTENSITY_RESIDENT_RAM%DEFAULT_RESOURCE_MANAGEMENT_CPU_LIMIT$DEFAULT_RESOURCE_MANAGEMENT_IO_LIMIT%DEFAULT_RESOURCE_MANAGEMENT_RAM_LIMITMODSEC_RULESET_FULLMODSEC_RULESET_MINIMAL_DOS_DETECTOR_DEFAULT_LIMIT_DOS_DETECTOR_MIN_LIMIT_DOS_DETECTOR_MIN_INTERVALPORT_BLOCKING_MODE_DENYPORT_BLOCKING_MODE_ALLOWDO_NOT_MODIFY_DISCLAMERDEFAULT_CONFIG_DISCLAMERCPANELPLESK DIRECTADMINr R1SOFT
CLUSTERLOGICSSAMPLE_BACKENDr r GENERIC_SENSOR_SOCKET_PATHr rB rH r rX rb rf rm r~ r r r r lru_cacher r r Exceptionr r r r r r r< rc rg r| r partialr r rn r r rp rl r r r r r~ r3 r r r r r r r r= rG rM r[ rl rr rx rz r rv rw r r r r r r r r r r r rZ r rq r r r r r r
r r" r) r- r/ r: r rc rG <module>ri s , , , , , , , , " " " " " " ( ( ( ( ( ( ( ( A @ @ @ @ @ G G G G G G G G G G
X\
8 $ $$X_W---A 8< -
!TJNN"> &7 c4 !% () %'( $(+ % " ! " > {!E $I !
! M <>: D D Ds D D# D D D D -/J
")
(< < <M M M -17 7 "Tz7
3d
?7 7 7 7&1 1 1 ( A A A A A A A A -1 Q - - - Q 7 7 7
! !
/8D%I%I#,>>
! , I */ */ */ */ */ */ */ */Z'< '< '< '< '<h '< '< '<T '8
y ;' ;' ;' ;' ;' ;' ;' ;'|@= @= @= @= @=W 1 @= @= @= @=F
2= 2= 2= 2= 2=7&7 2= 2= 2= 2=l GK uS#X' 6>sm 4 !y
''
)*6 .I -
''
7*D %
%
%
%
%
& %
%
%
P( ( ( ( ( ( ( (V7 7 7 7 7J 7 7 78 8 8 8 8j 8 8 88 8 8 8 8J 8 8 8
\' \' \' \' \'Z \' \' \'~ i 4= = = = = = = = 4L L L L L L L L &
5 5 5 5 5 5 5 55G 5G 5G 5G 5G 5G 5G 5Gp 6 6 6 6 6 6 6 6 4 >
B B B B B B B B *z- O O O Z_ O O O
&
. < DE DE DEN= = = = = = = =.! ! ! ! !I ! ! !3! 3! 3! 3! 3! 3! 3! 3!l !
#t "
! )!"
, 1 <I I I I I6 I I I:7 7 7 7 7 7 7 7.6 6 6" 1s 1t 1 1 1 1 S T 5 5 5 5 5 5 5 5 5 5rc defence360agent/contracts/__pycache__/config_provider.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000053426 00000000000 023610 0 ustar
r_j6 d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm Z d dl
m Z m Z m
Z
d dlZd dlZd dlmZ d dlmZ ej e ZdZ G d d
e
Z G d d e Z G d
d Zde e de e fdZ de de fdZ de de de fdZ G d d Z G d d e Z! G d d e! Z" G d d e! Z#dS )! N)abstractmethod)suppress)dedent)MappingOptionalProtocol)atomic_rewrite)open_dir_no_symlinksi c ~ e Zd Ze d dedefd Zededdfd Zed
ee defd Z
dS )
IConfigProviderFT
force_read
ignore_errorsc t NNotImplementedError)selfr
r s ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/config_provider.pyread_config_filez IConfigProvider.read_config_file s
"! configreturnNc t r r )r r s r write_config_filez!IConfigProvider.write_config_file !!r timestampc t r r r r s r modified_sincez IConfigProvider.modified_since! r r FT) __name__
__module__ __qualname__r boolr r r r floatr r r r r s >B" " "7;" " " ^"
" "D " " " ^" " "D " " " ^" " "r r c e Zd ZdS ) ConfigErrorN)r! r" r# r& r r r( r( & s Dr r( c e Zd ZdZd Zd ZdS ) JsonMessagezPretty-print given *obj* as JSON.
To be used for logging. Example:
logging.info("object: %s", JsonMessage(obj))
c || _ d S r )_obj)r objs r __init__zJsonMessage.__init__3 s
r c 8 t j | j d S )NT) sort_keys)jsondumpsr, r s r __str__zJsonMessage.__str__6 s z$)t4444r N)r! r" r# __doc__r. r4 r& r r r* r* * s< 5 5 5 5 5r r* prev_sectionsectionc ^ pi pi z
} z
} fd|D fd|D fd z D dS )z*Return difference between config sections.c " i | ] }|| S r& r& ).0vr6 s r
<dictcomp>z diff_section.<locals>.<dictcomp>A s
;
;
;Qa a
;
;
;r c " i | ] }|| S r& r& )r: r; r7 s r r< z diff_section.<locals>.<dictcomp>B s
4
4
4a
4
4
4r c V i | ]%}| | k || | f&S r& r& )r: r; r6 r7 s r r< z diff_section.<locals>.<dictcomp>D sE
A'!*,,
Q,,,,r )-+?keys)r6 r7 removed_settingsadded_settingss `` r diff_sectionrF : s %2LmG#((**W\\^^; \\^^l&7&7&9&99N
;
;
;
;*:
;
;
;
4
4
4
4^
4
4
4
"''))GLLNN:
r prev_confconfc # b K z
} fd|D V z
}fd|D V fd z D V dS )z,Compare *prev_conf* with the current *conf*.c " i | ] }|| S r& r& )r: r7 rG s r r< z diff_config.<locals>.<dictcomp>O s
G
G
G77Ig&
G
G
Gr c " i | ] }|| S r& r& )r: r7 rH s r r< z diff_config.<locals>.<dictcomp>Q s
@
@
@g7DM
@
@
@r c n i | ]1}| | k |t | | 2S r& )rF )r: r7 rH rG s r r< z diff_config.<locals>.<dictcomp>S sL W g . . i 0$w-@@ . . .r NrB )rG rH removed_sectionsadded_sectionss `` r diff_configrO L s ~~''$))++5
G
G
G
G6F
G
G
GGGGYY[[9>>#3#33N
@
@
@
@
@
@
@@@@ !((499;;6 r main_conf base_confr c t || \ }}}i }| D ]\ }}|| v r|||< || v r| |i || d | |i d || d D |S )a
Return dict derived from *main_conf* excluding parts
that are equal in *base_conf*.
For example,
>>> base_conf = {
"SECTION1": {"OPTION1": "default", "OPTION2": "default"},
"SECTION2": {"OPTION1": "default"}
}
>>> main_conf = {
"SECTION1": {"OPTION1": "value", "OPTION2": "default"},
"SECTION2": {"OPTION1": "default"}
}
>>>
>>> exclude_equals(main_conf=main_conf, base_conf=base_conf)
{'SECTION1': {'OPTION1': 'value'}}
>>>
r@ c & i | ]\ }}||d S ) r& )r: kr; s r r< z"exclude_equals.<locals>.<dictcomp>t s" CCCTQAaDCCCr rA )rO itemsrC
setdefaultupdate)rP rQ _addedchangedresultr7 values r exclude_equalsr^ Z s $ $Iy99Aug
F#//++ ejjll " " #F7O gllnn $ $ gr * * 1 1''2B32G H H H gr * * 1 1CCWW%5c%:%@%@%B%BCCC
Mr c e Zd ZdZddZd Zd Z dd ed
ed efd Z d
e
d efdZ d Z d Z
d e
fdZd e
fdZdee d efdZdS ) ConfigReaderzM
ConfigFile file for settings page.
Location config file is PATH
Nc 0 || _ || _ || _ d S r )path
disclaimer permissions)r rc rd re s r r. zConfigReader.__init__ s $&r c N d | j j | j S )Nz<{classname}({path})>) classnamerc )format __class__r# rc r3 s r __repr__zConfigReader.__repr__ s+ &--n1 .
r c d| j S )NzConfigReader at )rc r3 s r r4 zConfigReader.__str__ s -$)---r FTr
r r c 2 t j | j t k rt d | j }t |d 5 }t d| | }ddd n # 1 swxY w Y n/# t $ r}t d |d}~wt $ r i cY S w xY w | | S # t $ r*}t | |ri cY d}~S |d}~ww xY w)zCRead config file into memory.
Raises ConfigError.
zConfig file is too largerzReading config file %sNz Unable to decode config file)
osrc getsize_MAX_CONFIG_SIZEr( openloggerinforeadUnicodeDecodeErrorFileNotFoundErrorload_config_bodyerror)r r
r filename config_filetextes r r z ConfigReader.read_config_file su
wty)),<<<!"<===yHh$$
* 4h???"''))
*
*
*
*
*
*
*
*
*
*
*
*
*
*
* " E E E <==1 D III ((.. . LLOOO
G sf AB 0B B BB BB
C 'B77C C
C" "
D, D DDDr{ c
t j | }n+# t j $ r}t d| d |d }~ww xY w|i S t |t
s(t d | j | |S )Nz.Imunify360 config is not valid YAML document ()z;Imunify360 config is invalid or empty: path={!r}, text={!r})yaml safe_load YAMLErrorr(
isinstancedictrh rc )r r{ r r| s r rw z ConfigReader.load_config_body s ^D))FF~ EEEE
>I&$'' ))/ 4)@)@
s ?:?c d S r r& r3 s r
_pre_writezConfigReader._pre_write r c d S r r& r3 s r _post_writezConfigReader._post_write r r c d}| j r |t | j z
}|dz
}|t j |d z
}|S )Nra
F)default_flow_style)rd r r dumpr r config_texts r _serialize_configz ConfigReader._serialize_config sN ? 6$/22 2K 4 KtyEBBBB r c | | | }t | j |d| j | |S )NF)backupre )r r r rc re r r s r r z ConfigReader.write_config_file sd ,,V44 I{5d>N
r r c dS )NTr& r s r r zConfigReader.modified_since s tr ra Nr )r! r" r# r5 r. rj r4 r$ r r strrw r r r r r r% r r& r r r` r` y s#
' ' ' '
. . . ?C 7;
4S T &
3 3 D r r` c b e Zd Zd fd Zd Z ddedef fd
Zdd Zd ee d
efd
Z
xZ S )CachedConfigReaderra Nc t || d | _ d | _ i | _ || _ d S r )superr. mtimesize_configre r rc rd re ri s r r. zCachedConfigReader.__init__ s@
z***&*
%) &r c f d | j j | j | j | j S )Nz9{classname} <'{path}', modified at {mtime}, {size} bytes>)rg rc r r )rh ri r# rc r r r3 s r r4 zCachedConfigReader.__str__ s7 G N N .5YjY
O
r FTr
r c H | | j s|r| j } t | | _ | j Wt t
|| j }t | r&t j d| gt t | R n]# t $ rP}t j | t d| t | j |s|Y d}~nd}~ww xY w| | j S )z(Update config if config file is modified)r Nz-%s modified: removed=%s, added=%s, changed=%sz*%s is invalid, using previous settings: %s)r r r r r listrO anyrr rs mapr* r(
sentry_sdkcapture_exceptionwarning_refresh_stat_cache)r r
r prev_configdiffsrx ri s r r z#CachedConfigReader.read_config_file sW tz * * 'j ' ,K
$ww 7 7"/ 8 :) [$,!G!G H HE5zz K !e 4 4
,U333@ --
% K
*
$ $ & & &|s 'B, ,
D6ADDr c t j | j }|j | _ |j | _ dS # t $ r d| _ d| _ Y dS w xY w)z-Sync cached mtime/size with the file on disk. N)rn statrc st_mtimer st_sizer rv )r r s r r z&CachedConfigReader._refresh_stat_cache s] 749%%D DJ DIII DJDIIII s 15 AAr c |d} t j | j }|j |j }}n# t
$ r d\ }}Y nw xY w||k p
|| j k S )zWhether the config has updated since *timestamp*.
(as defined by its last modification time and size)
:param timestamp: None means that the file has never been read before
Nr )r r )rn r rc r r rv r )r r r r r s r r z!CachedConfigReader.modified_since sz I <749%%D !%
t|gHH ! ) ) ) ( Hggg ) )#;w$)';;s . A A r r )r N) r! r" r# r. r4 r$ r r r r% r
__classcell__ri s @r r r s ' ' ' ' ' '
?C! ! ! 7;! ! ! ! ! ! F < <D < < < < < < < <r r c 0 e Zd Zd fd Zd Z fdZ xZS )WriteOnlyConfigReaderra Nc v t ||| | d S r )r r. r r s r r. z WriteOnlyConfigReader.__init__& s9
z;777
"""""r c | j S r )r )r rY __s r r z&WriteOnlyConfigReader.read_config_file. s
|r c t | }| | | _ | |S r )r r rw r r )r r r ri s r r z'WriteOnlyConfigReader.write_config_file1 sG gg//77 ,,[99 """r r )r! r" r# r. r r r r s @r r r % se # # # # # # r r c P e Zd ZdZdZdZ fdZd Zdede defd Z
de fd
Z xZ S ) UserConfigReaderaw Per-user config reader that resists TOCTOU symlink attacks.
The user-specific subdirectory ``<USER_CONFDIR>/<username>/`` and the
config file inside it must end up owned by ``root:<user-gid>`` with
modes ``0750`` / ``0640``. Earlier revisions performed the
``mkdir`` -> ``chown`` -> ``chmod`` sequence on path strings, which
left a TOCTOU window: between the directory existing and the
metadata syscalls, a swap to a symlink could redirect the chown to
an arbitrary inode. See DEF-41586 / CLOS-3965 for context.
The hardened path opens the parent ``USER_CONFDIR`` once with
``O_NOFOLLOW`` at every component, then performs every subsequent
operation (``mkdir``/``chown``/``chmod``/atomic write) relative to
that fd or to a fresh ``O_NOFOLLOW`` fd of the user subdir. No
user-controlled path string is dereferenced more than once.
i i c X t | || _ d S r )r r. username)r rc r ri s r r. zUserConfigReader.__init__M s&
r c d| j S )NzConfig of user )r r3 s r r4 zUserConfigReader.__str__Q s 0 000r parent_fdnamer c t t 5 t j || j | ddd n # 1 swxY w Y t j |t j t j z t j z | S )a Return an O_NOFOLLOW fd for ``name`` inside *parent_fd*.
Creates the directory first if it does not already exist. The
``O_NOFOLLOW`` flag guarantees that, if a symlink appears in the
slot at any time after this call returns, every subsequent
``fchown``/``fchmod``/atomic-rewrite bound to the returned fd
operates on the originally opened inode.
)modedir_fdNr ) r FileExistsErrorrn mkdirDIR_PERMISSIONSrq O_RDONLY O_DIRECTORY
O_NOFOLLOW)r r r s r _open_user_subdirz"UserConfigReader._open_user_subdirT s o
&
& H H HT 4Y G G G G H H H H H H H H H H H H H H Hw K". (2= 8
s >AAc t j | j j }t j | j \ }}t j | \ }}t | } | || } t j |d| t j
|| j | | } t || dd|| j | t j |t j t j z | }
t j |
d| t j
|
| j t j |
n# t j |
w xY w t j | n# t j | w xY w t j | n# t j | w xY w| S )Nr F)r uidgidre r r )pwdgetpwnamr pw_gidrn rc splitr
r chownfchmodr r r FILE_PERMISSIONSrq r r close) r r r confdirbasename userconfdirr r user_fdr file_fds r r z"UserConfigReader.write_config_filee s l4=))0 GMM$) 4 4 "
g 6 6 X )55 * ,,YAAG&
" !S))) '4#7888 " 4 4V < < $ 5" ' K"-/"
&HWa---Igt'<===HW%%%%BHW%%%%%!!!!!!!!! HY BHY s= 8G BF 0E# F #E99F =G F((G G)
r! r" r# r5 r r r. r4 intr r r r r s @r r r 8 s " O ! ! ! ! !1 1 1
3
c
c
"63 6 6 6 6 6 6 6 6r r )$r1 loggingrn r abcr
contextlibr textwrapr typingr r r r r defence360agent.utilsr defence360agent.utils.fd_opsr
getLoggerr! rr rp r Exceptionr( r* r rF rO r^ r` r r r r& r r <module>r s
. . . . . . . . . . 0 0 0 0 0 0 = = = = = = 8 $ $
"
"
"
"
"h
"
"
" )
5
5
5
5
5
5
5
5 x~ $ 4 t $ 4 >X X X X X X X XvN< N< N< N< N< N< N< N<b . &c c c c c) c c c c cr defence360agent/contracts/__pycache__/config_provider.cpython-311.pyc 0000644 0000000 0000000 00000053426 00000000000 022651 0 ustar
r_j6 d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm Z d dl
m Z m Z m
Z
d dlZd dlZd dlmZ d dlmZ ej e ZdZ G d d
e
Z G d d e Z G d
d Zde e de e fdZ de de fdZ de de de fdZ G d d Z G d d e Z! G d d e! Z" G d d e! Z#dS )! N)abstractmethod)suppress)dedent)MappingOptionalProtocol)atomic_rewrite)open_dir_no_symlinksi c ~ e Zd Ze d dedefd Zededdfd Zed
ee defd Z
dS )
IConfigProviderFT
force_read
ignore_errorsc t NNotImplementedError)selfr
r s ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/config_provider.pyread_config_filez IConfigProvider.read_config_file s
"! configreturnNc t r r )r r s r write_config_filez!IConfigProvider.write_config_file !!r timestampc t r r r r s r modified_sincez IConfigProvider.modified_since! r r FT) __name__
__module__ __qualname__r boolr r r r floatr r r r r s >B" " "7;" " " ^"
" "D " " " ^" " "D " " " ^" " "r r c e Zd ZdS ) ConfigErrorN)r! r" r# r& r r r( r( & s Dr r( c e Zd ZdZd Zd ZdS ) JsonMessagezPretty-print given *obj* as JSON.
To be used for logging. Example:
logging.info("object: %s", JsonMessage(obj))
c || _ d S r )_obj)r objs r __init__zJsonMessage.__init__3 s
r c 8 t j | j d S )NT) sort_keys)jsondumpsr, r s r __str__zJsonMessage.__str__6 s z$)t4444r N)r! r" r# __doc__r. r4 r& r r r* r* * s< 5 5 5 5 5r r* prev_sectionsectionc ^ pi pi z
} z
} fd|D fd|D fd z D dS )z*Return difference between config sections.c " i | ] }|| S r& r& ).0vr6 s r
<dictcomp>z diff_section.<locals>.<dictcomp>A s
;
;
;Qa a
;
;
;r c " i | ] }|| S r& r& )r: r; r7 s r r< z diff_section.<locals>.<dictcomp>B s
4
4
4a
4
4
4r c V i | ]%}| | k || | f&S r& r& )r: r; r6 r7 s r r< z diff_section.<locals>.<dictcomp>D sE
A'!*,,
Q,,,,r )-+?keys)r6 r7 removed_settingsadded_settingss `` r diff_sectionrF : s %2LmG#((**W\\^^; \\^^l&7&7&9&99N
;
;
;
;*:
;
;
;
4
4
4
4^
4
4
4
"''))GLLNN:
r prev_confconfc # b K z
} fd|D V z
}fd|D V fd z D V dS )z,Compare *prev_conf* with the current *conf*.c " i | ] }|| S r& r& )r: r7 rG s r r< z diff_config.<locals>.<dictcomp>O s
G
G
G77Ig&
G
G
Gr c " i | ] }|| S r& r& )r: r7 rH s r r< z diff_config.<locals>.<dictcomp>Q s
@
@
@g7DM
@
@
@r c n i | ]1}| | k |t | | 2S r& )rF )r: r7 rH rG s r r< z diff_config.<locals>.<dictcomp>S sL W g . . i 0$w-@@ . . .r NrB )rG rH removed_sectionsadded_sectionss `` r diff_configrO L s ~~''$))++5
G
G
G
G6F
G
G
GGGGYY[[9>>#3#33N
@
@
@
@
@
@
@@@@ !((499;;6 r main_conf base_confr c t || \ }}}i }| D ]\ }}|| v r|||< || v r| |i || d | |i d || d D |S )a
Return dict derived from *main_conf* excluding parts
that are equal in *base_conf*.
For example,
>>> base_conf = {
"SECTION1": {"OPTION1": "default", "OPTION2": "default"},
"SECTION2": {"OPTION1": "default"}
}
>>> main_conf = {
"SECTION1": {"OPTION1": "value", "OPTION2": "default"},
"SECTION2": {"OPTION1": "default"}
}
>>>
>>> exclude_equals(main_conf=main_conf, base_conf=base_conf)
{'SECTION1': {'OPTION1': 'value'}}
>>>
r@ c & i | ]\ }}||d S ) r& )r: kr; s r r< z"exclude_equals.<locals>.<dictcomp>t s" CCCTQAaDCCCr rA )rO itemsrC
setdefaultupdate)rP rQ _addedchangedresultr7 values r exclude_equalsr^ Z s $ $Iy99Aug
F#//++ ejjll " " #F7O gllnn $ $ gr * * 1 1''2B32G H H H gr * * 1 1CCWW%5c%:%@%@%B%BCCC
Mr c e Zd ZdZddZd Zd Z dd ed
ed efd Z d
e
d efdZ d Z d Z
d e
fdZd e
fdZdee d efdZdS ) ConfigReaderzM
ConfigFile file for settings page.
Location config file is PATH
Nc 0 || _ || _ || _ d S r )path
disclaimer permissions)r rc rd re s r r. zConfigReader.__init__ s $&r c N d | j j | j S )Nz<{classname}({path})>) classnamerc )format __class__r# rc r3 s r __repr__zConfigReader.__repr__ s+ &--n1 .
r c d| j S )NzConfigReader at )rc r3 s r r4 zConfigReader.__str__ s -$)---r FTr
r r c 2 t j | j t k rt d | j }t |d 5 }t d| | }ddd n # 1 swxY w Y n/# t $ r}t d |d}~wt $ r i cY S w xY w | | S # t $ r*}t | |ri cY d}~S |d}~ww xY w)zCRead config file into memory.
Raises ConfigError.
zConfig file is too largerzReading config file %sNz Unable to decode config file)
osrc getsize_MAX_CONFIG_SIZEr( openloggerinforeadUnicodeDecodeErrorFileNotFoundErrorload_config_bodyerror)r r
r filename config_filetextes r r z ConfigReader.read_config_file su
wty)),<<<!"<===yHh$$
* 4h???"''))
*
*
*
*
*
*
*
*
*
*
*
*
*
*
* " E E E <==1 D III ((.. . LLOOO
G sf AB 0B B BB BB
C 'B77C C
C" "
D, D DDDr{ c
t j | }n+# t j $ r}t d| d |d }~ww xY w|i S t |t
s(t d | j | |S )Nz.Imunify360 config is not valid YAML document ()z;Imunify360 config is invalid or empty: path={!r}, text={!r})yaml safe_load YAMLErrorr(
isinstancedictrh rc )r r{ r r| s r rw z ConfigReader.load_config_body s ^D))FF~ EEEE
>I&$'' ))/ 4)@)@
s ?:?c d S r r& r3 s r
_pre_writezConfigReader._pre_write r c d S r r& r3 s r _post_writezConfigReader._post_write r r c d}| j r |t | j z
}|dz
}|t j |d z
}|S )Nra
F)default_flow_style)rd r r dumpr r config_texts r _serialize_configz ConfigReader._serialize_config sN ? 6$/22 2K 4 KtyEBBBB r c | | | }t | j |d| j | |S )NF)backupre )r r r rc re r r s r r z ConfigReader.write_config_file sd ,,V44 I{5d>N
r r c dS )NTr& r s r r zConfigReader.modified_since s tr ra Nr )r! r" r# r5 r. rj r4 r$ r r strrw r r r r r r% r r& r r r` r` y s#
' ' ' '
. . . ?C 7;
4S T &
3 3 D r r` c b e Zd Zd fd Zd Z ddedef fd
Zdd Zd ee d
efd
Z
xZ S )CachedConfigReaderra Nc t || d | _ d | _ i | _ || _ d S r )superr. mtimesize_configre r rc rd re ri s r r. zCachedConfigReader.__init__ s@
z***&*
%) &r c f d | j j | j | j | j S )Nz9{classname} <'{path}', modified at {mtime}, {size} bytes>)rg rc r r )rh ri r# rc r r r3 s r r4 zCachedConfigReader.__str__ s7 G N N .5YjY
O
r FTr
r c H | | j s|r| j } t | | _ | j Wt t
|| j }t | r&t j d| gt t | R n]# t $ rP}t j | t d| t | j |s|Y d}~nd}~ww xY w| | j S )z(Update config if config file is modified)r Nz-%s modified: removed=%s, added=%s, changed=%sz*%s is invalid, using previous settings: %s)r r r r r listrO anyrr rs mapr* r(
sentry_sdkcapture_exceptionwarning_refresh_stat_cache)r r
r prev_configdiffsrx ri s r r z#CachedConfigReader.read_config_file sW tz * * 'j ' ,K
$ww 7 7"/ 8 :) [$,!G!G H HE5zz K !e 4 4
,U333@ --
% K
*
$ $ & & &|s 'B, ,
D6ADDr c t j | j }|j | _ |j | _ dS # t $ r d| _ d| _ Y dS w xY w)z-Sync cached mtime/size with the file on disk. N)rn statrc st_mtimer st_sizer rv )r r s r r z&CachedConfigReader._refresh_stat_cache s] 749%%D DJ DIII DJDIIII s 15 AAr c |d} t j | j }|j |j }}n# t
$ r d\ }}Y nw xY w||k p
|| j k S )zWhether the config has updated since *timestamp*.
(as defined by its last modification time and size)
:param timestamp: None means that the file has never been read before
Nr )r r )rn r rc r r rv r )r r r r r s r r z!CachedConfigReader.modified_since sz I <749%%D !%
t|gHH ! ) ) ) ( Hggg ) )#;w$)';;s . A A r r )r N) r! r" r# r. r4 r$ r r r r% r
__classcell__ri s @r r r s ' ' ' ' ' '
?C! ! ! 7;! ! ! ! ! ! F < <D < < < < < < < <r r c 0 e Zd Zd fd Zd Z fdZ xZS )WriteOnlyConfigReaderra Nc v t ||| | d S r )r r. r r s r r. z WriteOnlyConfigReader.__init__& s9
z;777
"""""r c | j S r )r )r rY __s r r z&WriteOnlyConfigReader.read_config_file. s
|r c t | }| | | _ | |S r )r r rw r r )r r r ri s r r z'WriteOnlyConfigReader.write_config_file1 sG gg//77 ,,[99 """r r )r! r" r# r. r r r r s @r r r % se # # # # # # r r c P e Zd ZdZdZdZ fdZd Zdede defd Z
de fd
Z xZ S ) UserConfigReaderaw Per-user config reader that resists TOCTOU symlink attacks.
The user-specific subdirectory ``<USER_CONFDIR>/<username>/`` and the
config file inside it must end up owned by ``root:<user-gid>`` with
modes ``0750`` / ``0640``. Earlier revisions performed the
``mkdir`` -> ``chown`` -> ``chmod`` sequence on path strings, which
left a TOCTOU window: between the directory existing and the
metadata syscalls, a swap to a symlink could redirect the chown to
an arbitrary inode. See DEF-41586 / CLOS-3965 for context.
The hardened path opens the parent ``USER_CONFDIR`` once with
``O_NOFOLLOW`` at every component, then performs every subsequent
operation (``mkdir``/``chown``/``chmod``/atomic write) relative to
that fd or to a fresh ``O_NOFOLLOW`` fd of the user subdir. No
user-controlled path string is dereferenced more than once.
i i c X t | || _ d S r )r r. username)r rc r ri s r r. zUserConfigReader.__init__M s&
r c d| j S )NzConfig of user )r r3 s r r4 zUserConfigReader.__str__Q s 0 000r parent_fdnamer c t t 5 t j || j | ddd n # 1 swxY w Y t j |t j t j z t j z | S )a Return an O_NOFOLLOW fd for ``name`` inside *parent_fd*.
Creates the directory first if it does not already exist. The
``O_NOFOLLOW`` flag guarantees that, if a symlink appears in the
slot at any time after this call returns, every subsequent
``fchown``/``fchmod``/atomic-rewrite bound to the returned fd
operates on the originally opened inode.
)modedir_fdNr ) r FileExistsErrorrn mkdirDIR_PERMISSIONSrq O_RDONLY O_DIRECTORY
O_NOFOLLOW)r r r s r _open_user_subdirz"UserConfigReader._open_user_subdirT s o
&
& H H HT 4Y G G G G H H H H H H H H H H H H H H Hw K". (2= 8
s >AAc t j | j j }t j | j \ }}t j | \ }}t | } | || } t j |d| t j
|| j | | } t || dd|| j | t j |t j t j z | }
t j |
d| t j
|
| j t j |
n# t j |
w xY w t j | n# t j | w xY w t j | n# t j | w xY w| S )Nr F)r uidgidre r r )pwdgetpwnamr pw_gidrn rc splitr
r chownfchmodr r r FILE_PERMISSIONSrq r r close) r r r confdirbasename userconfdirr r user_fdr file_fds r r z"UserConfigReader.write_config_filee s l4=))0 GMM$) 4 4 "
g 6 6 X )55 * ,,YAAG&
" !S))) '4#7888 " 4 4V < < $ 5" ' K"-/"
&HWa---Igt'<===HW%%%%BHW%%%%%!!!!!!!!! HY BHY s= 8G BF 0E# F #E99F =G F((G G)
r! r" r# r5 r r r. r4 intr r r r r s @r r r 8 s " O ! ! ! ! !1 1 1
3
c
c
"63 6 6 6 6 6 6 6 6r r )$r1 loggingrn r abcr
contextlibr textwrapr typingr r r r r defence360agent.utilsr defence360agent.utils.fd_opsr
getLoggerr! rr rp r Exceptionr( r* r rF rO r^ r` r r r r& r r <module>r s
. . . . . . . . . . 0 0 0 0 0 0 = = = = = = 8 $ $
"
"
"
"
"h
"
"
" )
5
5
5
5
5
5
5
5 x~ $ 4 t $ 4 >X X X X X X X XvN< N< N< N< N< N< N< N<b . &c c c c c) c c c c cr defence360agent/contracts/__pycache__/eula.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007311 00000000000 021347 0 ustar
r_j d dl Z d dlZd dlmZ d dlmZ d dlmZ d dl m
Z
m Z dZ erdndZ
d Zd
Zdd ed ee d
efdZded
efdZd
efdZddZddZd
efdZd
efdZd
efdZdS ) N)Optional)files)ANTIVIRUS_MODE)Eularun_in_executorz
message{}.txtz-av z
eula{}.txtz
updated{}.txtpatherrorsreturnc t | | 5 }| cd d d S # 1 swxY w Y d S )Nr
)openreadstrip)r r
fs S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/eula.py _readfiler s
d6 " " " avvxx~~ s &AA A templatec t j t j t j | t S N) osr joinr Index
files_pathEULAformat_SUFFIX)r s r _get_pathr s=
7<<
uz**HOOG,D,D c h K t t j t j d{V S )z9Return True if latest EULA was accepted, False otherwise.N)r asyncioget_event_loopr is_accepted r r r# r# s4 !7!9!94;KLL L L L L L LLr c l K t t j t j d{V dS )z
Accepts EULA.N)r r! r" r acceptr$ r r r& r& s9
'022DK
@
@@@@@@@@@@r c Z K t t j d d{V dS )z$Updates latest EULA date from files.c D t j t S )N)updated)r
get_or_creater) r$ r r <lambda>zupdate.<locals>.<lambda>( s $*<WYY*O*O*O r N)r r! r" r$ r r updater, % sR
"O"O r c H t t t d S )z Return main text of the EULA.ignorer
)r r _TEXT_TEMPLATEr$ r r textr0 , s Y~..x @ @ @@r c D t t t S )z)Return a message inviting to accept EULA.)r r _MESSAGE_TEMPLATEr$ r r messager3 1 Y 011 2 22r c D t t t S )z Return last EULA's update time.)r r _UPDATED_TEMPLATEr$ r r r) r) 6 r4 r r )r N)r! os.pathr typingr defence360agentr defence360agent.contracts.configr $defence360agent.model.simplificationr r r2 r r/ r6 strr r boolr# r& r, r0 r3 r) r$ r r <module>r> s ! ! ! ! ! ! ; ; ; ; ; ; F F F F F F F F $ !
)%%r # C # #
M4 M M M M
A A A A
Ac A A A A
3 3 3 3 3
3 3 3 3 3 3 3r defence360agent/contracts/__pycache__/eula.cpython-311.pyc 0000644 0000000 0000000 00000007311 00000000000 020410 0 ustar
r_j d dl Z d dlZd dlmZ d dlmZ d dlmZ d dl m
Z
m Z dZ erdndZ
d Zd
Zdd ed ee d
efdZded
efdZd
efdZddZddZd
efdZd
efdZd
efdZdS ) N)Optional)files)ANTIVIRUS_MODE)Eularun_in_executorz
message{}.txtz-av z
eula{}.txtz
updated{}.txtpatherrorsreturnc t | | 5 }| cd d d S # 1 swxY w Y d S )Nr
)openreadstrip)r r
fs S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/eula.py _readfiler s
d6 " " " avvxx~~ s &AA A templatec t j t j t j | t S N) osr joinr Index
files_pathEULAformat_SUFFIX)r s r _get_pathr s=
7<<
uz**HOOG,D,D c h K t t j t j d{V S )z9Return True if latest EULA was accepted, False otherwise.N)r asyncioget_event_loopr is_accepted r r r# r# s4 !7!9!94;KLL L L L L L LLr c l K t t j t j d{V dS )z
Accepts EULA.N)r r! r" r acceptr$ r r r& r& s9
'022DK
@
@@@@@@@@@@r c Z K t t j d d{V dS )z$Updates latest EULA date from files.c D t j t S )N)updated)r
get_or_creater) r$ r r <lambda>zupdate.<locals>.<lambda>( s $*<WYY*O*O*O r N)r r! r" r$ r r updater, % sR
"O"O r c H t t t d S )z Return main text of the EULA.ignorer
)r r _TEXT_TEMPLATEr$ r r textr0 , s Y~..x @ @ @@r c D t t t S )z)Return a message inviting to accept EULA.)r r _MESSAGE_TEMPLATEr$ r r messager3 1 Y 011 2 22r c D t t t S )z Return last EULA's update time.)r r _UPDATED_TEMPLATEr$ r r r) r) 6 r4 r r )r N)r! os.pathr typingr defence360agentr defence360agent.contracts.configr $defence360agent.model.simplificationr r r2 r r/ r6 strr r boolr# r& r, r0 r3 r) r$ r r <module>r> s ! ! ! ! ! ! ; ; ; ; ; ; F F F F F F F F $ !
)%%r # C # #
M4 M M M M
A A A A
Ac A A A A
3 3 3 3 3
3 3 3 3 3 3 3r defence360agent/contracts/__pycache__/hook_events.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000011777 00000000000 022760 0 ustar
r_j d dl mZ d dlmZ d\ ZZ G d de Z G d de Z G d d e Z G d
d e Z G d d
e Z
G d de Z G d d Z dS ) )
HookEvents)Message)startedfinishedc e Zd ZdZdZd ZdS )_HookEventBaseNc | d | D }| j j dt | dS )Nc & i | ]\ }}|d k ||S )DUMP ).0kvs Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/hook_events.py
<dictcomp>z+_HookEventBase.__repr__.<locals>.<dictcomp> s# AAATQQ&[[Aq[[[ ())items __class__ __qualname__repr)selffiltereds r __repr__z_HookEventBase.__repr__
s? AATZZ\\AAA.-AAXAAAAr )__name__
__module__r eventsubtyper r r r r r s2 EGB B B B Br r c e Zd Zej ZdS )_AgentN)r r r r AGENTr r r r r! r! s EEEr r! c e Zd Zej ZdS )_LicenseN)r r r r LICENSEr r r r r$ r$ s EEEr r$ c e Zd Zej ZdS )_MalwareScanningN)r r r r MALWARE_SCANNINGr r r r r' r' 'EEEr r' c e Zd Zej ZdS )_MalwareDetectedN)r r r r MALWARE_DETECTEDr r r r r+ r+ r) r r+ c e Zd Zej ZdS )_MalwareCleanupN)r r r r MALWARE_CLEANUPr r r r r. r. " s &EEEr r. c & e Zd Z G d de Z G d de Z G d de Z G d de Z G d d
e Z G d d e
Z G d
de
Z G d de
Z G d de Z G d de ZdS ) HookEventc e Zd ZeZdS )HookEvent.AgentStartedNr r r STARTEDr r r r AgentStartedr3 ' r r6 c e Zd ZdZdS )HookEvent.AgentMisconfig misconfigNr r r r r r r AgentMisconfigr9 * s r r< c e Zd ZdZdS )HookEvent.LicenseExpiredexpiredNr; r r r LicenseExpiredr> - r r@ c e Zd ZdZdS )HookEvent.LicenseExpiringexpiringNr; r r r LicenseExpiringrC 0 r rE c e Zd ZdZdS )HookEvent.LicenseRenewedrenewedNr; r r r LicenseRenewedrH 3 rA r rJ c e Zd ZeZdS ) HookEvent.MalwareScanningStartedNr4 r r r MalwareScanningStartedrL 6 r7 r rM c e Zd ZeZdS )!HookEvent.MalwareScanningFinishedNr r r FINISHEDr r r r MalwareScanningFinishedrO 9 r rR c e Zd ZdZdS )!HookEvent.MalwareDetectedCriticalcriticalNr; r r r MalwareDetectedCriticalrU < rF r rW c e Zd ZeZdS ) HookEvent.MalwareCleanupStartedNr4 r r r MalwareCleanupStartedrY ? r7 r rZ c e Zd ZeZdS ) HookEvent.MalwareCleanupFinishedNrP r r r MalwareCleanupFinishedr\ B rS r r] N)r r r r! r6 r< r$ r@ rE rJ r' rM rR r+ rW r. rZ r] r r r r1 r1 & s v ( !1 "2 "2 r r1 N)
defence360agent.contracts.configr "defence360agent.contracts.messagesr r5 rQ r r! r$ r' r+ r. r1 r r r <module>r` sk 8 7 7 7 7 7 6 6 6 6 6 6) B B B B BW B B B ^ ~ ( ( ( ( (~ ( ( (( ( ( ( (~ ( ( (' ' ' ' 'n ' ' ' r defence360agent/contracts/__pycache__/hook_events.cpython-311.pyc 0000644 0000000 0000000 00000011777 00000000000 022021 0 ustar
r_j d dl mZ d dlmZ d\ ZZ G d de Z G d de Z G d d e Z G d
d e Z G d d
e Z
G d de Z G d d Z dS ) )
HookEvents)Message)startedfinishedc e Zd ZdZdZd ZdS )_HookEventBaseNc | d | D }| j j dt | dS )Nc & i | ]\ }}|d k ||S )DUMP ).0kvs Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/hook_events.py
<dictcomp>z+_HookEventBase.__repr__.<locals>.<dictcomp> s# AAATQQ&[[Aq[[[ ())items __class__ __qualname__repr)selffiltereds r __repr__z_HookEventBase.__repr__
s? AATZZ\\AAA.-AAXAAAAr )__name__
__module__r eventsubtyper r r r r r s2 EGB B B B Br r c e Zd Zej ZdS )_AgentN)r r r r AGENTr r r r r! r! s EEEr r! c e Zd Zej ZdS )_LicenseN)r r r r LICENSEr r r r r$ r$ s EEEr r$ c e Zd Zej ZdS )_MalwareScanningN)r r r r MALWARE_SCANNINGr r r r r' r' 'EEEr r' c e Zd Zej ZdS )_MalwareDetectedN)r r r r MALWARE_DETECTEDr r r r r+ r+ r) r r+ c e Zd Zej ZdS )_MalwareCleanupN)r r r r MALWARE_CLEANUPr r r r r. r. " s &EEEr r. c & e Zd Z G d de Z G d de Z G d de Z G d de Z G d d
e Z G d d e
Z G d
de
Z G d de
Z G d de Z G d de ZdS ) HookEventc e Zd ZeZdS )HookEvent.AgentStartedNr r r STARTEDr r r r AgentStartedr3 ' r r6 c e Zd ZdZdS )HookEvent.AgentMisconfig misconfigNr r r r r r r AgentMisconfigr9 * s r r< c e Zd ZdZdS )HookEvent.LicenseExpiredexpiredNr; r r r LicenseExpiredr> - r r@ c e Zd ZdZdS )HookEvent.LicenseExpiringexpiringNr; r r r LicenseExpiringrC 0 r rE c e Zd ZdZdS )HookEvent.LicenseRenewedrenewedNr; r r r LicenseRenewedrH 3 rA r rJ c e Zd ZeZdS ) HookEvent.MalwareScanningStartedNr4 r r r MalwareScanningStartedrL 6 r7 r rM c e Zd ZeZdS )!HookEvent.MalwareScanningFinishedNr r r FINISHEDr r r r MalwareScanningFinishedrO 9 r rR c e Zd ZdZdS )!HookEvent.MalwareDetectedCriticalcriticalNr; r r r MalwareDetectedCriticalrU < rF r rW c e Zd ZeZdS ) HookEvent.MalwareCleanupStartedNr4 r r r MalwareCleanupStartedrY ? r7 r rZ c e Zd ZeZdS ) HookEvent.MalwareCleanupFinishedNrP r r r MalwareCleanupFinishedr\ B rS r r] N)r r r r! r6 r< r$ r@ rE rJ r' rM rR r+ rW r. rZ r] r r r r1 r1 & s v ( !1 "2 "2 r r1 N)
defence360agent.contracts.configr "defence360agent.contracts.messagesr r5 rQ r r! r$ r' r+ r. r1 r r r <module>r` sk 8 7 7 7 7 7 6 6 6 6 6 6) B B B B BW B B B ^ ~ ( ( ( ( (~ ( ( (( ( ( ( (~ ( ( (' ' ' ' 'n ' ' ' r defence360agent/contracts/__pycache__/hooks.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000021673 00000000000 021553 0 ustar
r_j d dl Z d dlZd dlmZmZ d dlmZ d dlmZ G d d Z G d de Z
G d d
e Z dS ) N)ConfigCore) ConfigReader)antivirus_modec e Zd Zed Zedd Zedd Zed Zed Zed Z ed Z
ed
Z ed Z edd
Z
edd Zedd ZdS )Schemac d| i dS )Ndict)typeschemadefault )datas T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/hooks.pyr
z Schema.dict
s
Nc $ dddi| rd| ini dg dS )Nlistr stringregexFr r nullabler
r )r s r list_of_stringszSchema.list_of_strings s? ',4GU##"
r Tc B | rdnd}t | S )Nz^.+@(.+\.)+.+|default$z^.+@(.+\.)+.+$)r r )default_enabledr s r list_of_emailszSchema.list_of_emails s. *9 O % %>O %%e,,,r c ddt dddiS )Nperiodinteger )r coerceminr
)intr r r r z
Schema.period% s'
!
r c d| dS )Nr )r r r r s r r z
Schema.string0 s
r c ddddiS )NenabledbooleanF)r r
r r r r r& zSchema.enabled7 s!
!
r c dt i t dt i| rt ni iS )NADMIN admin_emails)r r
r& r r r s r adminz Schema.admin@ sn
V[[ nn&&"F$9$9$;$; +18v}}b
r c dt i t dt d i| rt ni iS )NSCRIPTscriptsz^\/.+$)r r
r& r r r+ s r scriptz
Schema.scriptL sp
fkk nn&& v 5 5i @ @ +18v}}b
r c dt i t | rt ni iS )NUSER)r r
r& r r+ s r userz Schema.userX sQ
FKK nn&&*08v}}b
r Fc l t i t | S Nr+ )r r
r0 r+ s r
target_scriptzSchema.target_scriptc s3 {{
--v-..
r c t i t | t | S r5 r r
r, r0 r+ s r target_admin_and_scriptz Schema.target_admin_and_scriptk sI {{
,,f,--
--v-..
r c t i t | t | S r5 r8 r+ s r
target_allzSchema.target_allt sK {{
,,f,--
--v-..
r )N)T)F)__name__
__module__ __qualname__ staticmethodr
r r r r r& r, r0 r3 r6 r9 r; r r r r r so
\
\
- - - \-
\
\
\
\
\
\
\
\
\
r r c e Zd ZdZd ZdS )HooksConfigReader_imunifyc t j | j d t j | j dt j | j j d S )Ni r )oschmodpathchowngrpgetgrnam
GROUP_NAMEgr_gid)selfs r _post_writez HooksConfigReader._post_write sA
E"""
As|DO < < CDDDDDr N)r< r= r> rJ rM r r r rA rA s- JE E E E Er rA c t e Zd Zej ej ej f fd Z d Z
d Z xZ S ) HooksConfigc
t j rt t d dd ddt d d dt t d t t d d dg d
t t d t t d t t t t t d i d
nt t t t t t t d i d}t
||t | d S )NF)r r T)r r
r r$ )default_emailsnotify_from_emaillocaler )usernameemailsrS r r+ )REALTIME_MALWARE_FOUNDUSER_SCAN_MALWARE_FOUNDSCRIPT_BLOCKEDUSER_SCAN_STARTEDCUSTOM_SCAN_STARTEDUSER_SCAN_FINISHEDCUSTOM_SCAN_FINISHEDCUSTOM_SCAN_MALWARE_FOUND)r, usersrulesr
)rW rY rZ r[ r\ r] )r_ r
)rF validation_schema
config_reader) r disabledr r
r r r9 r; r6 super__init__rA )rL rF r` __class__s r rd zHooksConfig.__init__ s` d &];
*0*?*?,1 +@ + + %-'+(,. .
#)---">">
# $kk(.
u
(E(E&,&;&;&=&=&,mmTm&B&B !% ! # : :$ : G G393D3D3F3F*0*H*H#' +I + + .4-A-A-C-C/5/C/C/E/E.4.B.B.D.D060D0D0F0F " : : < < $ Y-
-
-
` 393G3G3I3I-3-A-A-C-C/5/C/C/E/E.4.B.B.D.D060D0D0F0F5;5I5I5K5K
a | /+D11
r c Z | }| dd |S Nr^ )config_to_dictpoprL r s r getzHooksConfig.get s, ""$$ $ r c \ | dd | | d S rg )ri dict_to_configrj s r updatezHooksConfig.update s0 $ D!!!!!r )
r< r= r> rD rF joinr GLOBAL_CONFDIRHOOKS_CONFIGFILENAMErd rk rn
__classcell__)re s @r rO rO s{ 7<< 3T5NOOE
E
E
E
E
E
N
" " " " " " "r rO ) rH rD defence360agent.contracts.configr r )defence360agent.contracts.config_providerr defence360agent.utilsr r rA rO r r r <module>rv s
9 9 9 9 9 9 9 9 B B B B B B 0 0 0 0 0 0s
s
s
s
s
s
s
s
lE E E E E E E EO" O" O" O" O"& O" O" O" O" O"r defence360agent/contracts/__pycache__/hooks.cpython-311.pyc 0000644 0000000 0000000 00000021673 00000000000 020614 0 ustar
r_j d dl Z d dlZd dlmZmZ d dlmZ d dlmZ G d d Z G d de Z
G d d
e Z dS ) N)ConfigCore) ConfigReader)antivirus_modec e Zd Zed Zedd Zedd Zed Zed Zed Z ed Z
ed
Z ed Z edd
Z
edd Zedd ZdS )Schemac d| i dS )Ndict)typeschemadefault )datas T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/hooks.pyr
z Schema.dict
s
Nc $ dddi| rd| ini dg dS )Nlistr stringregexFr r nullabler
r )r s r list_of_stringszSchema.list_of_strings s? ',4GU##"
r Tc B | rdnd}t | S )Nz^.+@(.+\.)+.+|default$z^.+@(.+\.)+.+$)r r )default_enabledr s r list_of_emailszSchema.list_of_emails s. *9 O % %>O %%e,,,r c ddt dddiS )Nperiodinteger )r coerceminr
)intr r r r z
Schema.period% s'
!
r c d| dS )Nr )r r r r s r r z
Schema.string0 s
r c ddddiS )NenabledbooleanF)r r
r r r r r& zSchema.enabled7 s!
!
r c dt i t dt i| rt ni iS )NADMIN admin_emails)r r
r& r r r s r adminz Schema.admin@ sn
V[[ nn&&"F$9$9$;$; +18v}}b
r c dt i t dt d i| rt ni iS )NSCRIPTscriptsz^\/.+$)r r
r& r r r+ s r scriptz
Schema.scriptL sp
fkk nn&& v 5 5i @ @ +18v}}b
r c dt i t | rt ni iS )NUSER)r r
r& r r+ s r userz Schema.userX sQ
FKK nn&&*08v}}b
r Fc l t i t | S Nr+ )r r
r0 r+ s r
target_scriptzSchema.target_scriptc s3 {{
--v-..
r c t i t | t | S r5 r r
r, r0 r+ s r target_admin_and_scriptz Schema.target_admin_and_scriptk sI {{
,,f,--
--v-..
r c t i t | t | S r5 r8 r+ s r
target_allzSchema.target_allt sK {{
,,f,--
--v-..
r )N)T)F)__name__
__module__ __qualname__ staticmethodr
r r r r r& r, r0 r3 r6 r9 r; r r r r r so
\
\
- - - \-
\
\
\
\
\
\
\
\
\
r r c e Zd ZdZd ZdS )HooksConfigReader_imunifyc t j | j d t j | j dt j | j j d S )Ni r )oschmodpathchowngrpgetgrnam
GROUP_NAMEgr_gid)selfs r _post_writez HooksConfigReader._post_write sA
E"""
As|DO < < CDDDDDr N)r< r= r> rJ rM r r r rA rA s- JE E E E Er rA c t e Zd Zej ej ej f fd Z d Z
d Z xZ S ) HooksConfigc
t j rt t d dd ddt d d dt t d t t d d dg d
t t d t t d t t t t t d i d
nt t t t t t t d i d}t
||t | d S )NF)r r T)r r
r r$ )default_emailsnotify_from_emaillocaler )usernameemailsrS r r+ )REALTIME_MALWARE_FOUNDUSER_SCAN_MALWARE_FOUNDSCRIPT_BLOCKEDUSER_SCAN_STARTEDCUSTOM_SCAN_STARTEDUSER_SCAN_FINISHEDCUSTOM_SCAN_FINISHEDCUSTOM_SCAN_MALWARE_FOUND)r, usersrulesr
)rW rY rZ r[ r\ r] )r_ r
)rF validation_schema
config_reader) r disabledr r
r r r9 r; r6 super__init__rA )rL rF r` __class__s r rd zHooksConfig.__init__ s` d &];
*0*?*?,1 +@ + + %-'+(,. .
#)---">">
# $kk(.
u
(E(E&,&;&;&=&=&,mmTm&B&B !% ! # : :$ : G G393D3D3F3F*0*H*H#' +I + + .4-A-A-C-C/5/C/C/E/E.4.B.B.D.D060D0D0F0F " : : < < $ Y-
-
-
` 393G3G3I3I-3-A-A-C-C/5/C/C/E/E.4.B.B.D.D060D0D0F0F5;5I5I5K5K
a | /+D11
r c Z | }| dd |S Nr^ )config_to_dictpoprL r s r getzHooksConfig.get s, ""$$ $ r c \ | dd | | d S rg )ri dict_to_configrj s r updatezHooksConfig.update s0 $ D!!!!!r )
r< r= r> rD rF joinr GLOBAL_CONFDIRHOOKS_CONFIGFILENAMErd rk rn
__classcell__)re s @r rO rO s{ 7<< 3T5NOOE
E
E
E
E
E
N
" " " " " " "r rO ) rH rD defence360agent.contracts.configr r )defence360agent.contracts.config_providerr defence360agent.utilsr r rA rO r r r <module>rv s
9 9 9 9 9 9 9 9 B B B B B B 0 0 0 0 0 0s
s
s
s
s
s
s
s
lE E E E E E E EO" O" O" O" O"& O" O" O" O" O"r defence360agent/contracts/__pycache__/license.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000077074 00000000000 022060 0 ustar
r_jCc d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z d dlm Z d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZmZmZm Z m Z d d l m Z d d l m!Z! d d
l"m#Z# d dl$m%Z%m&Z& d dl'm(Z(m)Z) d dl*m+Z+m,Z, d dl-m.Z. dZ/dZ0 e dd Z1 ed xZ23 s* ed xZ23 s ed Z2 e)e(e j4 e j5 Z6 e)e(e j4 e j5 Z7 G d de8 Z9 G d d Z:d Z;d e<d e=fd!Z>dS )" N)suppress)JSONDecodeError)Path)TimeoutExpired)Optional)OperationalError)is_cpanel_installed)sentry)ANTIVIRUS_MODECore
CustomBillingint_from_envvarlogger) HookEvent)g)get_plesk_upgrade_urls)retry_on timed_cache)HOUR
rate_limit)APIError IPEchoAPI)IP IMUNIFYAVi&IMUNIFY360_CACHE_LICENSE_TOKEN_TIMEOUTiX z /opt/alt/openssl11/bin/opensslz /opt/alt/openssl/bin/opensslz/usr/bin/openssl)periodon_dropc e Zd ZdZdS ) LicenseErrorz9Used to communicate that some function requires a licenseN)__name__
__module__ __qualname____doc__ V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/license.pyr r @ s CCCCr% r c . e Zd ZdZdZeedZdZdZdZdZ dZ
d Z d
Z d Z
g d Zi Zd
Ze eed dedededeeeee f fd Zed8de defd Z edeeee f deee ef fd Z ed Z e e e!j" e# d de$fd Z%edee fd Z&ed Z'ed Z(ed! Z)edefd" Z*ed9d# Z+ed9d$efd% Z,ed& Z-ed' Z.ed( Z/ed) Z0ed* Z1ed+ Z2ed,ee dee fd- Z3ed. Z4ed/ Z5ed0 Z6edefd1 Z7edefd2 Z8edefd3 Z9edefd4 Z:edefd5 Z;ed6 Z<edefd7 Z=d
S ):
LicenseCLN)idstatusgrouplimittoken_created_utctoken_expire_utc)r) r* r, r- r. group_id permissions) z!/usr/share/imunify360/cln-pub.key)z)/usr/share/imunify360/alt-license-pub.keyz /var/imunify360/license.jsonz!/var/imunify360/license-free.jsonz9https://cln.cloudlinux.com/console/purchase/ImunifyAvPlusz8https://www.cloudlinux.com/upgrade-imunify-{user_count}/z6../../../scripts14/purchase_imunifyavplus_init_IMUNIFYz3../../../scripts14/purchase_imunify360_init_IMUNIFY)r1 Nr2 ) max_tries pubkey_pathcontent signaturereturnc $ g }d}t j d 5 }| | | t ddd| d|j g} t
j |t j t j |d }|j d
k rd}nb|
d |j d |j d
|j n4# t $ r'}|
d|j Y d}~nd}~ww xY wddd n # 1 swxY w Y ||pdfS )zVerify that `content` is correctly signed with public key from file
`pubkey_path` with resulting `signature`. Returns a tuple with (success, error_list).
FT)deletedgstz-sha512z-verifyz
-signature )stdoutstderrinputtimeoutr z1Signature verification failed - openssl returned z
. stdout: z
, stderr: z openssl command failed: missing N)tempfileNamedTemporaryFilewriteflush OPENSSL_BINname
subprocessrunPIPE
returncodeappendr> r? FileNotFoundErrorfilename) r6 r7 r8 errorsresultsig_filecmdpes r& _verify_signaturez LicenseCLN._verify_signaturev s
(
5
5
5 NN9 % % % NN
C
N%?%?! <1$$ !FFMMB,-LB B#$8B B78xB B
%
O
O
O
M M MNNNNNNNN
O) @ v~%%s; =D-C<D
C2 C-(D-C22DDDr1 versionc g }| j | D ]}|| }t |t rE| d d | D d|| d || t
| d | S )N c 3 * K | ]\ }}| d | V dS )=Nr$ ).0subkeysubvalues r& <genexpr>z2LicenseCLN._get_signature_input.<locals>.<genexpr> sH ,FH "..H.. r% null)VERIFY_FIELDS_MAP
isinstancedictrL joinitemsstrencode)clslicenserV partskeyvalues r& _get_signature_inputz LicenseCLN._get_signature_input s (1 ) )CCLE%&&
) GG 05
V$$$$ SZZ((((wwu~~$$&&&r% signature_listc F
g
fd}|D ]y\ }}t j | } || }n# t $ r Y >w xY w | j || r|dfc S j D ]} |||| r|dfc c S z
D ]} t
j d| dS )zc
Verify signatures in license
:return: signature, is_alternative, version
c V j | i |\ }}|r | |S N)rU extend)argskwargssuccessrO
all_errorsrg s r& verify_and_collect_errorsz=LicenseCLN._find_signature.<locals>.verify_and_collect_errors s? 3c 3T DV D DOGV
*!!&)))Nr% )rV FTz%sNF)base64 b64decoderl KeyError _PUBKEY_FILE_ALTERNATIVE_PUBKEY_FILESr warning) rg
license_tokenrm rv signrV r8 r7
alt_pubkeyerrorru s ` @r& _find_signaturezLicenseCLN._find_signature s6 !#
, & &MD' (..I
22!7 3
)()97INN
#U{""" ! ;
&
&
,,Z)LL & :%%%%%&
& ( (E N4 ' ' ' '{s ?
A A c i } t | 5 }t j | }t |t s%t j d| |cddd S | |d | dg D \ }}| d }|rD| ||dfg \ }} |%t d |
dd n(d|v r$|
d t d | t d
|cddd S ||d < ||d < |cddd S # 1 swxY w Y n# t $ r t j
d
Y npt $ r }
t j d|
Y d}
~
nMd}
~
wt t" t$ t& j t* f$ r }
t j d|
Y d}
~
nd}
~
ww xY w|S )z
Load license token from file and verify signature
If signature verification successful, put
first valid signature to 'sign' field of license
token
:return: license token
z2Failed to load license. Expected JSON object, got Nc g | ]}|d fS r1 r$ )r[ r s r&
<listcomp>z*LicenseCLN._load_token.<locals>.<listcomp> s, q r%
signatures signature_v2r2 z%Failed to verify license signature v2r0 zdLicense missing signature_v2 but contained permissions; stripped (possible tampering or stale token)z"Failed to verify license signaturer is_alternativez'Failed to load license: not registered?zFailed to load license: %s)openjsonloadra rb r r r getthrottled_log_errorpopthrottled_log_no_v2rM infor r} OSErrorrz UnicodeDecodeErrorbinasciiError TypeError) rg pathdefaultfr~ r8 r v2_sign_sign_rT s r& _load_tokenzLicenseCLN._load_token s ; :d )
%q $ !
!-66 #LL(=+ #)
% )
% )
% )
% )
% )
% )
% )
% -0,?,?! $1$5$5lB$G$G - -) > (++N;; " 2 2%! ~ HE1 }+ C &))->>>"m33!%%m444'' $'(LMMM"K)
% )
% )
% )
% )
% )
% )
% )
%N )2
f%2@
./$S)
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
%V ! C C C KA B B B B B < < <
N7 ; ; ; ; ; ; ; ; N
: : :
L5q 9 9 9 9 9 9 9 9 : sf E AE E "C E. E ; E E EE EE G,? G,F""+G,
G''G,)seconds)maxsizec i }t r| j | j gn| j g}|D ] }| | }|r|c S |S )z
Get available license.
In Antivirus mode, if main license is unavailable, return free license
:return: license token
)r
_LICENSE_FILE_FREE_LICENSE_FILEr )rg lic_token
license_fileslfs r& get_tokenzLicenseCLN.get_token& sr
%S
6 7 7#$
! !B++I
!
!r% c P | d S )z$
:return: server id
r) r r rg s r&
get_server_idzLicenseCLN.get_server_id= s
}}""4(((r% c D t | S )z1
:return: bool: if we have token
)boolr r s r&
is_registeredzLicenseCLN.is_registeredD s
CMMOO$$$r% c b t o(| o| S )ze
:return: Return true only if we have valid ImunifyAV+ or
Imunify360 license
)r is_validis_freer s r& is_valid_av_pluszLicenseCLN.is_valid_av_plusK s' H#,,..H#++--6GHr% c N t sdS | t k S rw )r r
AV_DEFAULT_IDr s r& r zLicenseCLN.is_freeS s& 5 ""m33r% c < t sdS | S )zCCloud-assisted cleanup is a paid feature (Imunify360 / ImunifyAV+).T)r r r s r& !is_cloud_assisted_cleanup_allowedz,LicenseCLN.is_cloud_assisted_cleanup_allowedY s# 4##%%%r% c R |p| }|sdS t rF| dd d o |d t j k S |d dv o6|d t j k o| j du p| j |d k S ) zLicense check based on license token
return True - if license token is valid for this server
return False - if license token is invalid
Fr* rX okr. r ok-trialNr, )r r r
startswithtime users_countrg tokens r& r zLicenseCLN.is_valid` s ( 5 (B''22488 =,-<
(O 1 1
O()TY[[8
O D(MCOuW~,M
r%
permissionc |p| }|sdS || di x}v o || dk S )zLicense check for a specific permission based on a license token
return True - if license token has a given permission for this server
return False - if license token does not have permission
Fr0 ENABLEDr )rg r r perms r& has_permissionzLicenseCLN.has_permissionw sW ( 5
599]B#?#??4 @
.Z I-
r% c ~ | }|s | d |d |d< | j dz }t j t j z t j z }d}t t 5 t j | ddd n # 1 swxY w Y t j
t j ||| d 5 }t j
|| ddd n # 1 swxY w Y t j |dd t j || j | j t% j | t% j | | || dS # t0 $ r Y dS w xY w)
zb
Write new license token to file
:param token: new token
:return:
r, Nsaved_user_limitz.tmpi wroot_imunify)userr+ )r r r osO_WRONLYO_CREATO_EXCLr rM unlinkfdopenr r dumpshutilchownrename cache_clearr
set_server_idr set_product_nameget_product_name
renew_hookr )rg r old_token temp_fileflagsmoder s r& updatezLicenseCLN.update s MMOO 7UYYw / / ;(-gE$ %%. bj(294
'
(
( ! ! Ii ! ! ! ! ! ! ! ! ! ! ! ! ! ! !
Yrwy%66
<
< IeQ YV:>>>>
)S .///
!!### S . . 0 0111 4 4 6 6777 NN9e , , , , , DD s6 =B B"%B"C44C8;C8F. .
F<;F<c g d} d }| }t fd|D }|r=t j || }ddlm} t j || d d S d S ) N)license_expire_utcr* r, r) r c h g | ].} | | k /S r$ r )r[ elemr r s r& r z)LicenseCLN.renew_hook.<locals>.<listcomp> s4 O O OUYYt__
d 3 3
3 O O Or% )exp_timerh r )
execute_hooksT)return_exceptions) r fill_license_typeanyr LicenseRenewed defence360agent.hooks.executer asynciogather) rg r r important_keysr license_type conditionlicense_updatedr s `` r& r zLicenseCLN.renew_hook s HHH99 122,,U33 O O O O O O O O
' 6!< O
D C C C C C N
o..$
r% c 6 t t 5 t j | j ddd n # 1 swxY w Y | j t j d t j |
dS )zY
Delete license token along with old-style license data
:return:
N) r rM r r r r r r
r r r r s r& r; zLicenseCLN.delete s '
(
( ) ) Ic' ( ( ( ) ) ) ) ) ) ) ) ) ) ) ) ) ) )
!!### T""" 4 4 6 677777s
;??c d | d }ddddd}| | S )Nr*
imunify360imunify360Trial imunifyAV
imunifyAVPlus)r r ok-avok-avpr )rg r r license_type_to_products r& r z LicenseCLN.fill_license_type sB yy** ) % #
#
'**<888r% c P | | S rp )r r r s r& get_license_typezLicenseCLN.get_license_type s $$S]]__555r% c | }| dd d rdS dS )Nr) rX zip-TF)r r lowerr r s r& is_ip_license_typez LicenseCLN.is_ip_license_type sI
99T2 $ $ & & 1 1% 8 8 4ur% url_templatec < |s|S | j }t j dd }|d}n| j D ] }||k r|} n
d}| dt | }| d| }| dt ||nd }|S ) a& Format upgrade URL template with available parameters.
Args:
url_template: URL template string that may contain
{user_count}, {iaid}, and {users} placeholders
Returns:
Formatted URL with placeholders replaced with actual values
iaidrX Nr1 unlimitedz {user_count}z{iaid}z{users})r r r VERSION_THRESHOLDSreplacere )rg r nr
user_count thresholds r& format_upgrade_urlz LicenseCLN.format_upgrade_url s OuVR
9JJ 3
)
) >>!*JE " )
#++NC
OOLL #++Hd;; #++ s
11155
r% c 6 |dk rdS |dk rdS |dk rdS dS )z1Get recommended license tier based on user count.r1 z Single userr3 zUp to 30 usersr4 zUp to 250 userszUnlimited usersr$ )rg r s r& _get_license_tier_recommendationz+LicenseCLN._get_license_tier_recommendation s: ?? =
2
##
3
$$$$r% c b | dS | | }|dk rdnd}d| d| d| d S )
z<Format enhanced message when user count exceeds saved limit.NzWARNING: License is invalid for current server. Unable to determine user count; please check KB article: https://cloudlinux.zendesk.com/hc/en-us/articles/r1 r usersz9WARNING: License is invalid for current server. Detected u → purchase the "z=" Imunify360 license. Pricing: https://imunify360.com/pricing)r )rg r tier_name user_words r& _format_license_exceeded_messagez+LicenseCLN._format_license_exceeded_message
sv D
88DD (AooFF7
6"
6
6%.
6
6 &
6
6
6
r% c 6 | }| d dv }| dd }t rt j rt j sd }t r|r|sd}|r| | dd | d | d | j || | d }t sW| d
B| j ;| j | d
k r | | j |d< ndd i}d |d < d |d
< t rdg}| d r|D ]}||d v rd |d< |r+t j
ot j d up
t j d u|d< t }|
t j p#|d p| d p| j |d < |
t j p |d p|d p
t |d
< |sd |d< n t s| d d |d< | rd|d< | |d< |S )Nr* r messagezYou've got a license for the advanced security product Imunify360. Please, uninstall ImunifyAV and replace it with the Imunify360 providing comprehensive security for your server. Here are the steps for upgrade: https://docs.imunify360.com/installation/r r r, r) )r*
expiration
user_limitr) r r r r F upgrade_urlupgrade_url_360z user limits
ip_licensebuy_urlupgrade_license_url redirect_urlTdemoeligible_for_imunify_patch)r r r r
UPGRADE_URL
NOTIFICATIONSr r r r
IP_LICENSEUPGRADE_URL_360r r AV_PLUS_BUY_URLupgrade_url_defaultis_demo is_eligible_for_imunify_patch)rg r key_360r r ignored_messagesmsg
plesk_urlss r& license_infozLicenseCLN.license_info! s
))H%%);;))It,, ) "/
G g g <
% ,,.. #ii(<a @ @ #ii 0 0iioo !o" # 5 5e < < D #
II 011=O/Oeii0B&C&CCC"%"F"FO# #Y e$D "]"&
xx ""
/+ / /Cd9o--*.Y
%2%= &!-T9 A$4D@ \" 011J&&}'@AA ' i('99]++' &
&&}'DEE ) 34) i() '((
" # B#'D B#(99]D#A#AD ;;== DL
- - / /
(
r% c * | j d uo
| j dk S )Nr1 )r r s r& is_vpszLicenseCLN.is_vps~ s d*Cs!/CCr% c d g}d g}t r4| | j | | j t j |v o
t j |v S rp )r rL CPANEL_UPGRADE_URLCPANEL_UPGRADE_URL_360r
r r )rg upgrade_urlsupgrade_urls_360s r& is_custom_reseller_configuredz(LicenseCLN.is_custom_reseller_configured sw -1F 15 @ 6 7 7 7 # #C$> ? ? ?
% 5
B -1AA
r% c | | o(| o| S rp )r* r r0 r s r& r# z(LicenseCLN.is_eligible_for_imunify_patch s;
JJLL
8
855777
r% c t s t j S | dd }|dk rdS |dv rdS t j d| dS ) Nr* rX r z
imunify.av)r r r z imunify.av+zUnknown license %szUnknown license)r r NAMEr r r r )rg license_statuss r& r zLicenseCLN.get_product_name si 9 ,,Xr:: W $ $ <
;
;
; = L-~ > > >$$r% c @ t j d S )Nz/var/imunify360/demo)r r isfiler s r& r" zLicenseCLN.is_demo s w~~ 4555r% c h | }| dd t k S )Nr, r )r r UNLIMITED_USERS_COUNTr s r& is_unlimitedzLicenseCLN.is_unlimited s)
yy!$$(===r% c | j | j d S | j D ]*}| j |k r | j | c S +| j d S )Nr1 )r r )r IM360_BUY_URL_TEMPLATEformatr )rg r s r& get_im360_buy_urlz LicenseCLN.get_im360_buy_url s ? "-444BB B / O OI)++188I8NNNNN ,)00K0HHHr% r rp )>r r! r" VERIFY_FIELDS_V1VERIFY_FIELDS_V2r` r{ r| r r r r; r, r- r _tokenr staticmethodr r re bytestupler r listrU classmethodintrl r r r datetime timedelta _CACHE_LICENSE_TOKEN_TIMEOUTrb r r r r r r r r r r r; r r r r r r r( r* r0 r# r r" r9 r= r$ r% r& r( r( D s*
7L! 3M<C C A > &
FK
Xn***)&)&#()&5:)& tXd3i(( ))& )& )& +* \)&V ' 'C ' ' ' ' ['" %,0sCx ,A% x}d" #% % % [%N F F [FP [#?@@@! $ [& )hsm ) ) ) [) % % [% I I [I 4 4 [4
&$ & & & [&
[
,
[
[ B [$ 8 8 [ 8 9 9 [9 6 6 [6 [ hsm
[ D % % [ %
[
& Z Z [Zx Dt D D D [D
d
[
d
[
% % % % [ % 6 6 6 6 [6 > > [> I# I I I [I I Ir% r( c B t j } t j dd }t rt
j t j k rt | s t j S d}d} t j }t j
| r|}nt j d| n,# t $ r }t j d| Y d }~nd }~ww xY w| dk rd| }nd| }||z S t d | z d
| t' | z z S ) Nr rX z<https://store.cpanel.net/index.php?rp=/store/partner-addons/zJServer IP is IPv6 (%s), cPanel Store requires IPv4. Omitting IP parameter.zFailed to get server IP: %sr1 z/imunify360-for-cpanel-solo&customfield%5B55%5D=z imunify360&customfield%5B375%5D=z?iaid=z&users=)r( r r r r r
r r, _eligible_for_new_upgrade_linksr- r server_ipr is_valid_ipv4_addrr r r r} r= r )r r base_urlrL iprT suffixs r& r! r! sq A 5 D +!
%)F F F /t44 5 4 4
K
=$&&B $R((
-
= = = N8! < < < < < < < < =
66M)MM
F D CCF& $$&&
4//
A--$q''
! "s *?B* *
C4CCr r9 c t j d| t | dk rt j d dS t | d d }n%# t
$ r t j d Y dS w xY wd}||k S )Nz,checking if iaid: %s is eligible for upgrader z(receive empty iaid, fallback to old linkF z%iaid is not hex, fallback to old link )r debuglenr} rF
ValueError)r
hex_buckethex_mids r& rK rK s
L?FFF
4yyA~~ABBBua"%%
>???uu G s A A98A9)?r rx r rG r r r rH rB r
contextlibr r pathlibr r typingr peeweer 3defence360agent.application.determine_hosting_panelr defence360agent.contractsr
defence360agent.contracts.configr r r
r r %defence360agent.contracts.hook_eventsr &defence360agent.internals.global_scoper 0defence360agent.subsys.panels.plesk.upgrade_urlsr defence360agent.utilsr r defence360agent.utils.commonr r defence360agent.utils.ipechor r defence360agent.utils.validater r r8 rI rF existsr} r r r Exceptionr r( r! re r rK r$ r% r& <module>ri s_
% % % % % % # # # # # # - , , , , , < ; ; ; ; ; 4 4 4 4 4 4 8 7 7 7 7 7 7 7 9 9 9 9 9 9 9 9 < < < < < < < < - - - - - -
" /, t <=== EEGG / 4 >?? ?K G G I I /d-.. EjjfnEEE
L FjjfnEEE
L
D D D D D9 D D Dt I t I t I t I t I t I t I t In5 5 5p
#
$
r% defence360agent/contracts/__pycache__/license.cpython-311.pyc 0000644 0000000 0000000 00000077074 00000000000 021121 0 ustar
r_jCc d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z d dlm Z d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZmZmZm Z m Z d d l m Z d d l m!Z! d d
l"m#Z# d dl$m%Z%m&Z& d dl'm(Z(m)Z) d dl*m+Z+m,Z, d dl-m.Z. dZ/dZ0 e dd Z1 ed xZ23 s* ed xZ23 s ed Z2 e)e(e j4 e j5 Z6 e)e(e j4 e j5 Z7 G d de8 Z9 G d d Z:d Z;d e<d e=fd!Z>dS )" N)suppress)JSONDecodeError)Path)TimeoutExpired)Optional)OperationalError)is_cpanel_installed)sentry)ANTIVIRUS_MODECore
CustomBillingint_from_envvarlogger) HookEvent)g)get_plesk_upgrade_urls)retry_on timed_cache)HOUR
rate_limit)APIError IPEchoAPI)IP IMUNIFYAVi&IMUNIFY360_CACHE_LICENSE_TOKEN_TIMEOUTiX z /opt/alt/openssl11/bin/opensslz /opt/alt/openssl/bin/opensslz/usr/bin/openssl)periodon_dropc e Zd ZdZdS ) LicenseErrorz9Used to communicate that some function requires a licenseN)__name__
__module__ __qualname____doc__ V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/license.pyr r @ s CCCCr% r c . e Zd ZdZdZeedZdZdZdZdZ dZ
d Z d
Z d Z
g d Zi Zd
Ze eed dedededeeeee f fd Zed8de defd Z edeeee f deee ef fd Z ed Z e e e!j" e# d de$fd Z%edee fd Z&ed Z'ed Z(ed! Z)edefd" Z*ed9d# Z+ed9d$efd% Z,ed& Z-ed' Z.ed( Z/ed) Z0ed* Z1ed+ Z2ed,ee dee fd- Z3ed. Z4ed/ Z5ed0 Z6edefd1 Z7edefd2 Z8edefd3 Z9edefd4 Z:edefd5 Z;ed6 Z<edefd7 Z=d
S ):
LicenseCLN)idstatusgrouplimittoken_created_utctoken_expire_utc)r) r* r, r- r. group_id permissions) z!/usr/share/imunify360/cln-pub.key)z)/usr/share/imunify360/alt-license-pub.keyz /var/imunify360/license.jsonz!/var/imunify360/license-free.jsonz9https://cln.cloudlinux.com/console/purchase/ImunifyAvPlusz8https://www.cloudlinux.com/upgrade-imunify-{user_count}/z6../../../scripts14/purchase_imunifyavplus_init_IMUNIFYz3../../../scripts14/purchase_imunify360_init_IMUNIFY)r1 Nr2 ) max_tries pubkey_pathcontent signaturereturnc $ g }d}t j d 5 }| | | t ddd| d|j g} t
j |t j t j |d }|j d
k rd}nb|
d |j d |j d
|j n4# t $ r'}|
d|j Y d}~nd}~ww xY wddd n # 1 swxY w Y ||pdfS )zVerify that `content` is correctly signed with public key from file
`pubkey_path` with resulting `signature`. Returns a tuple with (success, error_list).
FT)deletedgstz-sha512z-verifyz
-signature )stdoutstderrinputtimeoutr z1Signature verification failed - openssl returned z
. stdout: z
, stderr: z openssl command failed: missing N)tempfileNamedTemporaryFilewriteflush OPENSSL_BINname
subprocessrunPIPE
returncodeappendr> r? FileNotFoundErrorfilename) r6 r7 r8 errorsresultsig_filecmdpes r& _verify_signaturez LicenseCLN._verify_signaturev s
(
5
5
5 NN9 % % % NN
C
N%?%?! <1$$ !FFMMB,-LB B#$8B B78xB B
%
O
O
O
M M MNNNNNNNN
O) @ v~%%s; =D-C<D
C2 C-(D-C22DDDr1 versionc g }| j | D ]}|| }t |t rE| d d | D d|| d || t
| d | S )N c 3 * K | ]\ }}| d | V dS )=Nr$ ).0subkeysubvalues r& <genexpr>z2LicenseCLN._get_signature_input.<locals>.<genexpr> sH ,FH "..H.. r% null)VERIFY_FIELDS_MAP
isinstancedictrL joinitemsstrencode)clslicenserV partskeyvalues r& _get_signature_inputz LicenseCLN._get_signature_input s (1 ) )CCLE%&&
) GG 05
V$$$$ SZZ((((wwu~~$$&&&r% signature_listc F
g
fd}|D ]y\ }}t j | } || }n# t $ r Y >w xY w | j || r|dfc S j D ]} |||| r|dfc c S z
D ]} t
j d| dS )zc
Verify signatures in license
:return: signature, is_alternative, version
c V j | i |\ }}|r | |S N)rU extend)argskwargssuccessrO
all_errorsrg s r& verify_and_collect_errorsz=LicenseCLN._find_signature.<locals>.verify_and_collect_errors s? 3c 3T DV D DOGV
*!!&)))Nr% )rV FTz%sNF)base64 b64decoderl KeyError _PUBKEY_FILE_ALTERNATIVE_PUBKEY_FILESr warning) rg
license_tokenrm rv signrV r8 r7
alt_pubkeyerrorru s ` @r& _find_signaturezLicenseCLN._find_signature s6 !#
, & &MD' (..I
22!7 3
)()97INN
#U{""" ! ;
&
&
,,Z)LL & :%%%%%&
& ( (E N4 ' ' ' '{s ?
A A c i } t | 5 }t j | }t |t s%t j d| |cddd S | |d | dg D \ }}| d }|rD| ||dfg \ }} |%t d |
dd n(d|v r$|
d t d | t d
|cddd S ||d < ||d < |cddd S # 1 swxY w Y n# t $ r t j
d
Y npt $ r }
t j d|
Y d}
~
nMd}
~
wt t" t$ t& j t* f$ r }
t j d|
Y d}
~
nd}
~
ww xY w|S )z
Load license token from file and verify signature
If signature verification successful, put
first valid signature to 'sign' field of license
token
:return: license token
z2Failed to load license. Expected JSON object, got Nc g | ]}|d fS r1 r$ )r[ r s r&
<listcomp>z*LicenseCLN._load_token.<locals>.<listcomp> s, q r%
signatures signature_v2r2 z%Failed to verify license signature v2r0 zdLicense missing signature_v2 but contained permissions; stripped (possible tampering or stale token)z"Failed to verify license signaturer is_alternativez'Failed to load license: not registered?zFailed to load license: %s)openjsonloadra rb r r r getthrottled_log_errorpopthrottled_log_no_v2rM infor r} OSErrorrz UnicodeDecodeErrorbinasciiError TypeError) rg pathdefaultfr~ r8 r v2_sign_sign_rT s r& _load_tokenzLicenseCLN._load_token s ; :d )
%q $ !
!-66 #LL(=+ #)
% )
% )
% )
% )
% )
% )
% )
% -0,?,?! $1$5$5lB$G$G - -) > (++N;; " 2 2%! ~ HE1 }+ C &))->>>"m33!%%m444'' $'(LMMM"K)
% )
% )
% )
% )
% )
% )
% )
%N )2
f%2@
./$S)
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
%V ! C C C KA B B B B B < < <
N7 ; ; ; ; ; ; ; ; N
: : :
L5q 9 9 9 9 9 9 9 9 : sf E AE E "C E. E ; E E EE EE G,? G,F""+G,
G''G,)seconds)maxsizec i }t r| j | j gn| j g}|D ] }| | }|r|c S |S )z
Get available license.
In Antivirus mode, if main license is unavailable, return free license
:return: license token
)r
_LICENSE_FILE_FREE_LICENSE_FILEr )rg lic_token
license_fileslfs r& get_tokenzLicenseCLN.get_token& sr
%S
6 7 7#$
! !B++I
!
!r% c P | d S )z$
:return: server id
r) r r rg s r&
get_server_idzLicenseCLN.get_server_id= s
}}""4(((r% c D t | S )z1
:return: bool: if we have token
)boolr r s r&
is_registeredzLicenseCLN.is_registeredD s
CMMOO$$$r% c b t o(| o| S )ze
:return: Return true only if we have valid ImunifyAV+ or
Imunify360 license
)r is_validis_freer s r& is_valid_av_pluszLicenseCLN.is_valid_av_plusK s' H#,,..H#++--6GHr% c N t sdS | t k S rw )r r
AV_DEFAULT_IDr s r& r zLicenseCLN.is_freeS s& 5 ""m33r% c < t sdS | S )zCCloud-assisted cleanup is a paid feature (Imunify360 / ImunifyAV+).T)r r r s r& !is_cloud_assisted_cleanup_allowedz,LicenseCLN.is_cloud_assisted_cleanup_allowedY s# 4##%%%r% c R |p| }|sdS t rF| dd d o |d t j k S |d dv o6|d t j k o| j du p| j |d k S ) zLicense check based on license token
return True - if license token is valid for this server
return False - if license token is invalid
Fr* rX okr. r ok-trialNr, )r r r
startswithtime users_countrg tokens r& r zLicenseCLN.is_valid` s ( 5 (B''22488 =,-<
(O 1 1
O()TY[[8
O D(MCOuW~,M
r%
permissionc |p| }|sdS || di x}v o || dk S )zLicense check for a specific permission based on a license token
return True - if license token has a given permission for this server
return False - if license token does not have permission
Fr0 ENABLEDr )rg r r perms r& has_permissionzLicenseCLN.has_permissionw sW ( 5
599]B#?#??4 @
.Z I-
r% c ~ | }|s | d |d |d< | j dz }t j t j z t j z }d}t t 5 t j | ddd n # 1 swxY w Y t j
t j ||| d 5 }t j
|| ddd n # 1 swxY w Y t j |dd t j || j | j t% j | t% j | | || dS # t0 $ r Y dS w xY w)
zb
Write new license token to file
:param token: new token
:return:
r, Nsaved_user_limitz.tmpi wroot_imunify)userr+ )r r r osO_WRONLYO_CREATO_EXCLr rM unlinkfdopenr r dumpshutilchownrename cache_clearr
set_server_idr set_product_nameget_product_name
renew_hookr )rg r old_token temp_fileflagsmoder s r& updatezLicenseCLN.update s MMOO 7UYYw / / ;(-gE$ %%. bj(294
'
(
( ! ! Ii ! ! ! ! ! ! ! ! ! ! ! ! ! ! !
Yrwy%66
<
< IeQ YV:>>>>
)S .///
!!### S . . 0 0111 4 4 6 6777 NN9e , , , , , DD s6 =B B"%B"C44C8;C8F. .
F<;F<c g d} d }| }t fd|D }|r=t j || }ddlm} t j || d d S d S ) N)license_expire_utcr* r, r) r c h g | ].} | | k /S r$ r )r[ elemr r s r& r z)LicenseCLN.renew_hook.<locals>.<listcomp> s4 O O OUYYt__
d 3 3
3 O O Or% )exp_timerh r )
execute_hooksT)return_exceptions) r fill_license_typeanyr LicenseRenewed defence360agent.hooks.executer asynciogather) rg r r important_keysr license_type conditionlicense_updatedr s `` r& r zLicenseCLN.renew_hook s HHH99 122,,U33 O O O O O O O O
' 6!< O
D C C C C C N
o..$
r% c 6 t t 5 t j | j ddd n # 1 swxY w Y | j t j d t j |
dS )zY
Delete license token along with old-style license data
:return:
N) r rM r r r r r r
r r r r s r& r; zLicenseCLN.delete s '
(
( ) ) Ic' ( ( ( ) ) ) ) ) ) ) ) ) ) ) ) ) ) )
!!### T""" 4 4 6 677777s
;??c d | d }ddddd}| | S )Nr*
imunify360imunify360Trial imunifyAV
imunifyAVPlus)r r ok-avok-avpr )rg r r license_type_to_products r& r z LicenseCLN.fill_license_type sB yy** ) % #
#
'**<888r% c P | | S rp )r r r s r& get_license_typezLicenseCLN.get_license_type s $$S]]__555r% c | }| dd d rdS dS )Nr) rX zip-TF)r r lowerr r s r& is_ip_license_typez LicenseCLN.is_ip_license_type sI
99T2 $ $ & & 1 1% 8 8 4ur% url_templatec < |s|S | j }t j dd }|d}n| j D ] }||k r|} n
d}| dt | }| d| }| dt ||nd }|S ) a& Format upgrade URL template with available parameters.
Args:
url_template: URL template string that may contain
{user_count}, {iaid}, and {users} placeholders
Returns:
Formatted URL with placeholders replaced with actual values
iaidrX Nr1 unlimitedz {user_count}z{iaid}z{users})r r r VERSION_THRESHOLDSreplacere )rg r nr
user_count thresholds r& format_upgrade_urlz LicenseCLN.format_upgrade_url s OuVR
9JJ 3
)
) >>!*JE " )
#++NC
OOLL #++Hd;; #++ s
11155
r% c 6 |dk rdS |dk rdS |dk rdS dS )z1Get recommended license tier based on user count.r1 z Single userr3 zUp to 30 usersr4 zUp to 250 userszUnlimited usersr$ )rg r s r& _get_license_tier_recommendationz+LicenseCLN._get_license_tier_recommendation s: ?? =
2
##
3
$$$$r% c b | dS | | }|dk rdnd}d| d| d| d S )
z<Format enhanced message when user count exceeds saved limit.NzWARNING: License is invalid for current server. Unable to determine user count; please check KB article: https://cloudlinux.zendesk.com/hc/en-us/articles/r1 r usersz9WARNING: License is invalid for current server. Detected u → purchase the "z=" Imunify360 license. Pricing: https://imunify360.com/pricing)r )rg r tier_name user_words r& _format_license_exceeded_messagez+LicenseCLN._format_license_exceeded_message
sv D
88DD (AooFF7
6"
6
6%.
6
6 &
6
6
6
r% c 6 | }| d dv }| dd }t rt j rt j sd }t r|r|sd}|r| | dd | d | d | j || | d }t sW| d
B| j ;| j | d
k r | | j |d< ndd i}d |d < d |d
< t rdg}| d r|D ]}||d v rd |d< |r+t j
ot j d up
t j d u|d< t }|
t j p#|d p| d p| j |d < |
t j p |d p|d p
t |d
< |sd |d< n t s| d d |d< | rd|d< | |d< |S )Nr* r messagezYou've got a license for the advanced security product Imunify360. Please, uninstall ImunifyAV and replace it with the Imunify360 providing comprehensive security for your server. Here are the steps for upgrade: https://docs.imunify360.com/installation/r r r, r) )r*
expiration
user_limitr) r r r r F upgrade_urlupgrade_url_360z user limits
ip_licensebuy_urlupgrade_license_url redirect_urlTdemoeligible_for_imunify_patch)r r r r
UPGRADE_URL
NOTIFICATIONSr r r r
IP_LICENSEUPGRADE_URL_360r r AV_PLUS_BUY_URLupgrade_url_defaultis_demo is_eligible_for_imunify_patch)rg r key_360r r ignored_messagesmsg
plesk_urlss r& license_infozLicenseCLN.license_info! s
))H%%);;))It,, ) "/
G g g <
% ,,.. #ii(<a @ @ #ii 0 0iioo !o" # 5 5e < < D #
II 011=O/Oeii0B&C&CCC"%"F"FO# #Y e$D "]"&
xx ""
/+ / /Cd9o--*.Y
%2%= &!-T9 A$4D@ \" 011J&&}'@AA ' i('99]++' &
&&}'DEE ) 34) i() '((
" # B#'D B#(99]D#A#AD ;;== DL
- - / /
(
r% c * | j d uo
| j dk S )Nr1 )r r s r& is_vpszLicenseCLN.is_vps~ s d*Cs!/CCr% c d g}d g}t r4| | j | | j t j |v o
t j |v S rp )r rL CPANEL_UPGRADE_URLCPANEL_UPGRADE_URL_360r
r r )rg upgrade_urlsupgrade_urls_360s r& is_custom_reseller_configuredz(LicenseCLN.is_custom_reseller_configured sw -1F 15 @ 6 7 7 7 # #C$> ? ? ?
% 5
B -1AA
r% c | | o(| o| S rp )r* r r0 r s r& r# z(LicenseCLN.is_eligible_for_imunify_patch s;
JJLL
8
855777
r% c t s t j S | dd }|dk rdS |dv rdS t j d| dS ) Nr* rX r z
imunify.av)r r r z imunify.av+zUnknown license %szUnknown license)r r NAMEr r r r )rg license_statuss r& r zLicenseCLN.get_product_name si 9 ,,Xr:: W $ $ <
;
;
; = L-~ > > >$$r% c @ t j d S )Nz/var/imunify360/demo)r r isfiler s r& r" zLicenseCLN.is_demo s w~~ 4555r% c h | }| dd t k S )Nr, r )r r UNLIMITED_USERS_COUNTr s r& is_unlimitedzLicenseCLN.is_unlimited s)
yy!$$(===r% c | j | j d S | j D ]*}| j |k r | j | c S +| j d S )Nr1 )r r )r IM360_BUY_URL_TEMPLATEformatr )rg r s r& get_im360_buy_urlz LicenseCLN.get_im360_buy_url s ? "-444BB B / O OI)++188I8NNNNN ,)00K0HHHr% r rp )>r r! r" VERIFY_FIELDS_V1VERIFY_FIELDS_V2r` r{ r| r r r r; r, r- r _tokenr staticmethodr r re bytestupler r listrU classmethodintrl r r r datetime timedelta _CACHE_LICENSE_TOKEN_TIMEOUTrb r r r r r r r r r r r; r r r r r r r( r* r0 r# r r" r9 r= r$ r% r& r( r( D s*
7L! 3M<C C A > &
FK
Xn***)&)&#()&5:)& tXd3i(( ))& )& )& +* \)&V ' 'C ' ' ' ' ['" %,0sCx ,A% x}d" #% % % [%N F F [FP [#?@@@! $ [& )hsm ) ) ) [) % % [% I I [I 4 4 [4
&$ & & & [&
[
,
[
[ B [$ 8 8 [ 8 9 9 [9 6 6 [6 [ hsm
[ D % % [ %
[
& Z Z [Zx Dt D D D [D
d
[
d
[
% % % % [ % 6 6 6 6 [6 > > [> I# I I I [I I Ir% r( c B t j } t j dd }t rt
j t j k rt | s t j S d}d} t j }t j
| r|}nt j d| n,# t $ r }t j d| Y d }~nd }~ww xY w| dk rd| }nd| }||z S t d | z d
| t' | z z S ) Nr rX z<https://store.cpanel.net/index.php?rp=/store/partner-addons/zJServer IP is IPv6 (%s), cPanel Store requires IPv4. Omitting IP parameter.zFailed to get server IP: %sr1 z/imunify360-for-cpanel-solo&customfield%5B55%5D=z imunify360&customfield%5B375%5D=z?iaid=z&users=)r( r r r r r
r r, _eligible_for_new_upgrade_linksr- r server_ipr is_valid_ipv4_addrr r r r} r= r )r r base_urlrL iprT suffixs r& r! r! sq A 5 D +!
%)F F F /t44 5 4 4
K
=$&&B $R((
-
= = = N8! < < < < < < < < =
66M)MM
F D CCF& $$&&
4//
A--$q''
! "s *?B* *
C4CCr r9 c t j d| t | dk rt j d dS t | d d }n%# t
$ r t j d Y dS w xY wd}||k S )Nz,checking if iaid: %s is eligible for upgrader z(receive empty iaid, fallback to old linkF z%iaid is not hex, fallback to old link )r debuglenr} rF
ValueError)r
hex_buckethex_mids r& rK rK s
L?FFF
4yyA~~ABBBua"%%
>???uu G s A A98A9)?r rx r rG r r r rH rB r
contextlibr r pathlibr r typingr peeweer 3defence360agent.application.determine_hosting_panelr defence360agent.contractsr
defence360agent.contracts.configr r r
r r %defence360agent.contracts.hook_eventsr &defence360agent.internals.global_scoper 0defence360agent.subsys.panels.plesk.upgrade_urlsr defence360agent.utilsr r defence360agent.utils.commonr r defence360agent.utils.ipechor r defence360agent.utils.validater r r8 rI rF existsr} r r r Exceptionr r( r! re r rK r$ r% r& <module>ri s_
% % % % % % # # # # # # - , , , , , < ; ; ; ; ; 4 4 4 4 4 4 8 7 7 7 7 7 7 7 9 9 9 9 9 9 9 9 < < < < < < < < - - - - - -
" /, t <=== EEGG / 4 >?? ?K G G I I /d-.. EjjfnEEE
L FjjfnEEE
L
D D D D D9 D D Dt I t I t I t I t I t I t I t In5 5 5p
#
$
r% defence360agent/contracts/__pycache__/messages.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000101435 00000000000 022232 0 ustar
r_jE d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ G d de
Z G d d Z G d d
Z
G d d Z e Z G d
de Z G d de
Z G d de
Z G d de
Z G d dee
Z G d de Z G d d Z G d d e Z G d d e Z G d d e Z G d! d"ee Z G d# d$ee Z G d% d&e Z G d' d(ee Z G d) d*ee Z G d+ d,ee Z G d- d.e Z! G d/ d0ee Z" G d1 d2e Z# G d3 d4e
Z$ G d5 d6e Z% G d7 d8ee Z& G d9 d:ee Z' G d; d<ee Z( G d= d>e Z) G d? d@e Z* G dA dBee Z+dCe,dDe-dEe,fdFZ.dGe-dHe-fdIZ/ G dJ dKee Z0 e-ej1 2 dLdM Z3dEe-fdNZ4dEe-fdOZ5 G dP dQ Z6 G dR dSeeee6 Z7 G dT dUe Z8 G dV dWe Z9 G dX dYeee6 Z: G dZ d[e Z; G d\ d]ee Z< G d^ d_ee Z= G d` daee Z> G db dcee Z?dS )d N)Enum)List)Corec e Zd ZdS )MessageNotFoundErrorN__name__
__module__ __qualname__ W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/messages.pyr r
Dr
r c e Zd ZdZd Zd ZdS )UnknownMessagez&
Used as stub for MessageType
c t d )NzMessage class is not found.)r selfs r __init__zUnknownMessage.__init__ s "#@AAAr
c dS )NUnknownr )r names r __getattr__zUnknownMessage.__getattr__ s yr
N)r r
r __doc__r r r r
r r r s? B B B r
r c 8 e Zd Zg Z fdZed Z xZS )MessageTc n t j di | | j | d S )Nr )super__init_subclass__ _subclassesappend)clskwargs __class__s r r zMessageT.__init_subclass__ s< !!++F+++ s#####r
c * t | j S N)tupler r" s r get_subclasseszMessageT.get_subclasses! s S_%%%r
)r r
r r r classmethodr)
__classcell__r$ s @r r r sX K$ $ $ $ $ & & [& & & & &r
r c e Zd ZdZd ZdS ) _MessageTypea
Used to get specific message class. For example,
>>> _MessageType().ConfigUpdate
<class 'defence360agent.contracts.messages.ConfigUpdate'>
>>> _MessageType().NotExistMessage
<class 'defence360agent.contracts.messages.UnknownMessage'>
>>>
c f t D ]}|j |k r|c S t S r& )Messager) r r )r r subclss r r z_MessageType.__getattr__0 s> ,,.. F$&&
' r
N)r r
r r r r r
r r. r. & s- r
r. c e Zd ZdZdZdS ) ReportTargetapiconnN)r r
r APIPERSISTENT_CONNECTIONr r
r r3 r3 ; s
C "r
r3 c < e Zd ZdZej Zedefd Z dS )
ReportablezD
Mixin class for messages that should be sent to the server
methodc d | D ]}|t |d k r|c S dS )ao
Return a subclass with the same DEFAULT_METHOD as *method*.
It can be used to detect report target from message method.
NOTE: it is not guaranteed that the class with the *method* is unique,
in this case the first subclass found is returned, but
it is tested that all such subclasses have the same TARGET.
DEFAULT_METHODN)__subclasses__getattr)r" r: subclasss r get_subclass_with_methodz#Reportable.get_subclass_with_methodG sH **,, H+;<<<< =tr
N)
r r
r r r3 r7 TARGETr* strr@ r r
r r9 r9 @ sM
/F c [ r
r9 c . e Zd ZdZedefd ZdS )Receivedz
Mixin class for messages received from the server.
These messages are created in the client360 plugin when receiving a
request from imunify360.cloudlinux.com.
actionc | D ],}t |dg pt |d g}||v r|c S -t d | )NRECEIVED_ACTIONSr< z*Message class is not found for "{}" action)r= r> r format)r" rE r? received_actionss r get_subclass_with_actionz!Received.get_subclass_with_action^ s **,, H &x1CR H H "233M ))) *" 8 ? ? G G
r
N)r r
r r r* rB rJ r r
r rD rD V sE
c
[
r
rD c ^ e Zd ZdZedd Zedefd Zedd ZdS )LockableNreturnc K | j t j | _ | j d {V d S r& )_lockasyncioLockacquirer( s r rR zLockable.acquiren sG 9 CIi !!!!!!!!!!!r
c F | j d uo| j S r& )rO lockedr( s r rT zLockable.lockedt s" y$;)9)9););;r
c J | j | j d S d S r& )rO releaser( s r rV zLockable.releasex s, 9 I ! r
rM N) r r
r rO r* rR boolrT rV r r
r rL rL k s~ E" " " ["
<t < < < [< [ r
rL c ` e Zd ZdZdZdZdZdZdZd fd Z e
d
Z d Z d Z
d
Z xZS )r0 zj
Base class for messages to be passed as
a parameter to plugins.MessageSink.process_message()
< d i@ rM Nc j | j r
| j | d< t t | j |i | d S )Nr: )r< r r0 r )r argsr# r$ s r r zMessage.__init__ sB 1 ! 0DN%gt %t6v66666r
c > d | D S )Nc & i | ]\ }}|d k ||S )r: r .0kvs r
<dictcomp>z#Message.payload.<locals>.<dictcomp> s# ???Ah 1 r
itemsr s r payloadzMessage.payload s ?? ????r
c X | | S # t $ r}t | |d}~ww xY w)z
Called when an attribute lookup has not found the attribute
in the usual places
A shortcut to access an item from dict
N)KeyErrorAttributeError)r r excs r r zMessage.__getattr__ s@ 0: 0 0 0 &&C / 0s
)$)c fd D }d j j | S )a Render for logs: collections with more than _FOLD_LIST_THRESHOLD
items are collapsed to a count and strings longer than
_SHORTEN_STR_THRESHOLD are shortened, recursively through nested
payloads, so a single message cannot flood the log.c P i | ]"\ }}|t |j j #S
fold_limit str_limit)_fold_repr_value_FOLD_LIST_THRESHOLD_SHORTEN_STR_THRESHOLD)rc rd re r s r rf z$Message.__repr__.<locals>.<dictcomp> sP
1
4 5
r
{}({}))rh rH r$ r )r
folded_msgs ` r __repr__zMessage.__repr__ sP
t~ :JGGGr
c * | S r& )ry r s r __str__zMessage.__str__ s }} r
rW )r r
r r r< PRIORITYPROCESSING_TIME_THRESHOLDru rv r propertyri r ry r{ r+ r, s @r r0 r0 ~ s NH " 7 7 7 7 7 7
@ @ X@
0
0
0
H
H
H r
r0 c 4 e Zd Z fdZed Z xZS ) MessageListc L t | d S )Nlist)r r )r msg_listr$ s r r zMessageList.__init__ s$
h'''''r
c | j S r& r r s r ri zMessageList.payload s
yr
)r r
r r r~ ri r+ r, s @r r r sS ( ( ( ( ( X r
r c e Zd ZdZdefdZdS )ShortenReprListMixinz
Do not flood console.log with large sequences
The method collapses messages that are a list.
Instead of showing all the elements of the message,
their number will be displayed.
r c d | j j d t | dg S )Nrw <{} item(s)>rh )rH r$ r lengetr s r ry z ShortenReprListMixin.__repr__ sG N ' ! !#dhhw&;&;"<"< = =
r
N)r r
r r dictry r r
r r r s9
t
r
r c " e Zd ZdZeZdefdZdS )
AccumulatablezMessages of this class will be grouped into a list of LIST_CLASS
message instance by Accumulate plugin. Messages whose do_accumulate()
call returns False will not be added to list.rM c dS )zAReturn True if this message is worth collecting, False otherwise.Tr r s r
do_accumulatezAccumulatable.do_accumulate s tr
N)r r
r r r
LIST_CLASSrX r r r
r r r s@ 5 5 Jt r
r c e Zd ZdS )ServerConnectedNr r r
r r r r r
r c e Zd ZdS )ServerReconnectedNr r r
r r r r r
r c * e Zd ZdZdZdZ fdZ xZS )Pingzr
Will send this message on connected, reconnected events
to provide central server with agent version
PINGr c f t t j | d< d S )Nversion)r r
CoreConfigVERSION)r r$ s r r z
Ping.__init__ s)
$,Yr
)r r
r r r< r| r r+ r, s @r r r sN
NH- - - - - - - - -r
r c & e Zd ZdZdZ fdZ xZS )Ackzd
Notify Server that a persistent message with *seq_number* has been
received by Agent.
ACKc ` t j di | t | | d< d S )N)per_seq_metar )r r r )r
seq_numberr# r$ s r r z Ack.__init__ s8 ""6""" Z000W
r
)r r
r r r< r r+ r, s @r r r sI N1 1 1 1 1 1 1 1 1r
r c e Zd ZdZdZdS )NoopzG
Sending NOOP to the agent to track the message in agent logs.
NOOPNr r
r r r< r r
r r r s NNNr
r c * e Zd ZdZdZej Zd ZdS ) ServerConfigz.
Information about server environment
SERVER_CONFIGc @ d | j j S Nz{}()rH r$ r r s r ry zServerConfig.__repr__ }}T^ 8999r
N r r
r r r< r3 r6 rA ry r r
r r r s< %N
F: : : : :r
r c e Zd ZdZej ZdS )WpSecurityPluginStatsWP_SECURITY_PLUGIN_STATSN)r r
r r< r3 r6 rA r r
r r r s /N
FFFr
r c * e Zd ZdZdZej Zd ZdS )
DomainListz*
Information about server domains
DOMAIN_LISTc @ d | j j S r r r s r ry zDomainList.__repr__ r r
Nr r r
r r r s< #N
F: : : : :r
r c e Zd ZdZd Zd ZdS ) FilesUpdatedz/
To consume products of files.update()
c || d< || d< dS )z\
:param files_type: files.Type
:param files_index: files.LocalIndex
files_type files_indexNr )r r r s r r zFilesUpdated.__init__( s (\ )]r
c \ d | j j | d | d S )z?
Do not flood console.log with large sequences
z+{}({{'files_type':'{}', 'files_index':{}}})r r r r s r ry zFilesUpdated.__repr__1 s4 =CC N '
r
N)r r
r r r ry r r
r r r # s< * * *
r
r c e Zd ZdZdZdS ) UpdateFilesz9
Update files by getting message from the server
UPDATENr r r
r r r < s NNNr
r c e Zd ZdZdS ) ConfigUpdate
CONFIG_UPDATENr r
r r< r r
r r r D $NNNr
r c e Zd ZdZdS )Rejectz
Kinda message filtering facility.
Raised in order to stop message processing through plugins.
Takes reason of reject as argument.
N)r r
r r r r
r r r H s Dr
r c e Zd ZdZdS )HealthHEALTHNr r r
r r r R s NNNr
r c e Zd ZdZdS )
CommandInvokeCOMMAND_INVOKENr r r
r r r V %NNNr
r c e Zd ZdZdS )
ScanFailed SCAN_FAILEDNr r r
r r r Z s "NNNr
r c e Zd ZdZdS )
CleanupFailedCLEANUP_FAILEDNr r r
r r r ^ r r
r c e Zd ZdZdZdS )RestoreFromBackupTaskz5
Creates a task to restore files from backup
MALWARE_RESTORE_FROM_BACKUPNr r r
r r r b s 3NNNr
r c B e Zd ZdZh dZededededefd Z dS ) cPanelEvent PANEL_EVENT> planexcludenew_pkg
imunify360_avimunify360_proactiveusernamehooktsfieldsc fd| D }|dk r%d|v r!d|v r |d |d k r |d |d< ||||d S )Nc v i | ]5\ }}| j v | |6S r )lowerALLOWED_FIELDS)rc rd re r" s r rf z/cPanelEvent.from_hook_event.<locals>.<dictcomp>x sG
1wwyyC ...
GGIIq...r
Modifyusernewuser old_username)r r data timestamprg )r" r r r r r s ` r from_hook_eventzcPanelEvent.from_hook_eventt s
H & V##v&"333#)&>D s $
r
N)
r r
r r< r r* rB floatr r r r
r r r j sj "N N
"%
+0
:>
[
r
r c e Zd ZdZdS ) IContactSent
ICONTACT_SENTNr r r
r r r r r
r slimitrM c |dk sJ t | |k r$| d|dz dz
d| | dz dz d n| S )z1Shorten *s* string if its length exceeds *limit*. N z...)r )r r s r _shorten_strr sf 19999 q66E>>
uzA~
991eVq[1_%6%6#7999
r
rr rs c . t | t rt | S t | t rVt | k r"d t | S fd| D S t | t t t t f rZt | k r"d t | S t | fd| D S | S )Nr c < i | ]\ }}|t | S rp rt )rc rd re rr rs s r rf z$_fold_repr_value.<locals>.<dictcomp> s?
1
jINNN
r
c 3 < K | ]}t | V dS )rq Nr )rc re rr rs s r <genexpr>z#_fold_repr_value.<locals>.<genexpr> sF
Q: K K K
r
)
isinstancerB r r r rH rh r r' set frozensettype)valuerr rs s ``r rt rt s/ % .E9---%
u::
" "!((U44 4
%$sI677
u::
" "!((U44 4tE{{
Lr
c e Zd ZdZdZdS )
BackupInfoz(Information about enabled backup backend BACKUP_INFONr r r
r r r s 22"NNNr
r IMUNIFY360_MAX_MESSAGE_SIZEi c ddl m} t t j | | S # t t f$ r1 t t | cY S w xY w)Nr )ServerJSONEncoderr( ) defence360agent.utils.jsonr r jsondumpsencode TypeError
ValueErrorrepr)objr s r serialized_sizer s <<<<<<'4:c'8999@@BBCCC z " ' ' '499##%%&&&&&'s 4= ?A?>A?c 6 | dS t | t rdS t | t r-t dt t | dz S t | t rdS t | t
r| rR| r>t | dz | d z | d z S t t j | S t | t t f r dt d
| D z S t | t r.dt d | D z S t# | S ) ul Upper bound on obj's JSON byte size as sent on the wire (ensure_ascii),
biased to never undercount. Far cheaper than a full ``serialized_size`` per
call on big scans: JSON-native values are measured structurally without
building the encoded string, and printable-ASCII strings (the common path
for file paths/snippets) are counted with C-level ``str`` ops. Non-native
values (peewee Models, IPs, ...) fall back to the exact ``serialized_size``
— their ``repr`` would wildly undercount the ServerJSONEncoder output. The
transport keeps a split-on-overflow net for the rare drift this leaves.Nr r r "\c 3 : K | ]}t | d z V dS r N
estimate_size)rc re s r r z estimate_size.<locals>.<genexpr> s/ 99}Q''!+999999r
c 3 K | ]P\ }}t t |t r|nt | d z t | z d z V QdS r )r r rB rb s r r z estimate_size.<locals>.<genexpr> s
1
z!S 1 1=!!s1vv > >
A
r
)r rX intmaxr rB r isascii isprintablecountr
r r r' sumr rh r )r s r r r s {q#t q#s *2s3s88}}q()))#u r#s $ ;;== CS__ . . Cs88a<#))C..0399T??B B4:c??####e}%% :399S9999999#t
3
3 r
c e Zd ZdZdZdZdZedefd Z ede
e fd Z ede
defd Zedefd Zed
Zede
e fd ZdS )
Splittablez
A message list could be split into multiple batches.
The split is possible for a list itself along with internal resources.
NrM c t S r& )MAX_MESSAGE_SIZEr( s r _max_message_sizez Splittable._max_message_size s r
messagesc # J K | j r| j r}|D ]x}| | j x}|V #t | }| || D ]/}| }||| j < || }|V 0ydS t
| E d{V dS )z
Split messages' internal lists of things into batches.
A field that is meant to split is defined by `BATCH_FIELD`.
N) BATCH_FIELD
BATCH_SIZEr r _size_bounded_batchescopyiter)r" r( messagerh
message_classbatchr new_messages r _split_itemszSplittable._split_items s ? &s~ &#
*
* $[[ 9 99EB!MMMM$(MMM!$!:!:5'!J!J * * &||~~05S_-&3mD&9&9 ))))) *
*
* H~~ % % % % % % % % %r
is_dictc D t |r|d |d in| S )zSerialized byte cost of one BATCH_FIELD unit. Subclasses override
to also count data paired with the unit in sibling fields of the
message (e.g. a per-hit cleanup result), so those bytes are not
excluded from the byte budget.r r r )r" unitr4 r/ s r
_unit_sizezSplittable._unit_size s) 7 Dd1gtAw / /EEEr
c t | S )zSubclasses override when the list class drops part of the message
before sending, so the budget counts only the bytes that go out.r )r" r/ s r
_message_sizezSplittable._message_size s W%%%r
c #
K | }t |t
r!t | n|}
fd}g }d}|D ]g}| |
| } |r2|| z |k st
| | j k r || V g d}}| | || z
}h|r || V dS dS )zPack `items` into batches bounded by both the byte budget and the
`BATCH_SIZE` count. A single element larger than the budget is emitted
alone rather than dropped.c D rt | nt | S r& )r r )bufferr4 s r buildz/Splittable._size_bounded_batches.<locals>.build% s #*<4<<<V <r
r N) r' r r r rh r7 r r+ r! ) r" rh r/ budgetunitsr= r< sizer6 unit_sizer4 s @r r, z Splittable._size_bounded_batches s"
&&(( UD))'.9U[[]]###E = = = = = DtWg>>I
%y 6))S[[CN-J-JeFmm### !1 MM$ I DD %-- r
c # P K | j pt | }| }g }d}| | D ]W}| | }|r$||z |k st | |k r|V g d}}| | ||z
}X|r|V d S d S )Nr ) LIST_SIZEr r' r3 r9 r! )r" r( list_sizer> r< r@ r/ message_sizes r batchedzSplittable.batched6 s M2S]] &&((''11 ! !G ,,W55L
%|#f,,F y0H0H !1 MM' " " " L DD LLLLL r
)r r
r r rC r+ r* r* r r' r r r3 rX r7 r9 r, rF r r
r r$ r$ s"
IJK # [ &D $7 & & & [&& Ft F F F F [F &s & & & [&
[ 2 tM 2 [ r
r$ c e Zd ZdZdS )
MDSReportList
MDS_SCAN_LISTNr r r
r rH rH I r r
rH c e Zd ZeZdS ) MDSReportN)r r
r rH r r r
r rK rK M s JJJr
rK c e Zd ZdZdZdS )EnsureServiceStatez-Ensure the service has the appropriate statusENSURE_SERVICE_STATENr r r
r rM rM Q s 77+NNNr
rM c e Zd ZdZdZdS )SensorWordpressIncidentListzAggregated incident list
INCIDENT_LISTNr r r
r rP rP W s ""$NNNr
rP c e Zd ZdZdS )WordpressPluginActionWP_SECURITY_PLUGIN_ACTIONNr r r
r rS rS ] s 0NNNr
rS c * e Zd ZdZdZej Zd ZdS )WordpressPluginTelemetryzX
Information about telemetry event related to Imunify Security WordPress plugin
WP_SECURITY_PLUGIN_EVENTc @ d | j j S r r r s r ry z!WordpressPluginTelemetry.__repr__i r r
Nr r r
r rV rV a s< 0N
F: : : : :r
rV c e Zd ZdZdZdS )WPRuleDisabledz#WordPress protection rule disabled.
RULE_DISABLEDNr r r
r rZ rZ m s --$NNNr
rZ c e Zd ZdZdZdS )
WPRuleEnabledz%WordPress protection rule re-enabled. RULE_ENABLEDNr r r
r r] r] s s //#NNNr
r] c e Zd ZdZdS )GeneralMetricsGENERAL_METRICSNr r r
r r` r` y s &NNNr
r` )@rP r
osenumr typingr defence360agent.contracts.configr r Exceptionr r r r. MessageTyper3 r9 rD rL r r0 r r r r r r r r r r r r r r r r r r r r r r rB r r rt r environr r& r r r$ rH rK rM rP rS rV rZ r] r` r r
r <module>ri s' ? ? ? ? ? ? 9 & & & & & & & & $ lnn # # # # #4 # # #
,
x
* x &4 4 4 4 4 dH 4 4 4 n '
G g
- - - - -7J - - - 1 1 1 1 1': 1 1 1 7 : : : : :7J : : : GZ
: : : : :* : : :
7
2 '8 % % % % %7 % % % Y W & & & & &GZ & & &# # # # #* # # #& & & & &GZ & & &3 3 3 3 3G 3 3 3"
"
"
"
"
' "
"
"
J% % % % %7J % % %C 3 3 (# # # # #* # # # 3JNN0+>>
'C ' ' ' ' # D[ [ [ [ [ [ [ [|% % % % %(':z % % %
, , , , , , , , % % % % %+z: % % % 1 1 1 1 1G 1 1 1 : : : : :w
: : :% % % % %Wj % % % $ $ $ $ $GZ $ $ $ ' ' ' ' '[* ' ' ' ' 'r
defence360agent/contracts/__pycache__/messages.cpython-311.pyc 0000644 0000000 0000000 00000101435 00000000000 021273 0 ustar
r_jE d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ G d de
Z G d d Z G d d
Z
G d d Z e Z G d
de Z G d de
Z G d de
Z G d de
Z G d dee
Z G d de Z G d d Z G d d e Z G d d e Z G d d e Z G d! d"ee Z G d# d$ee Z G d% d&e Z G d' d(ee Z G d) d*ee Z G d+ d,ee Z G d- d.e Z! G d/ d0ee Z" G d1 d2e Z# G d3 d4e
Z$ G d5 d6e Z% G d7 d8ee Z& G d9 d:ee Z' G d; d<ee Z( G d= d>e Z) G d? d@e Z* G dA dBee Z+dCe,dDe-dEe,fdFZ.dGe-dHe-fdIZ/ G dJ dKee Z0 e-ej1 2 dLdM Z3dEe-fdNZ4dEe-fdOZ5 G dP dQ Z6 G dR dSeeee6 Z7 G dT dUe Z8 G dV dWe Z9 G dX dYeee6 Z: G dZ d[e Z; G d\ d]ee Z< G d^ d_ee Z= G d` daee Z> G db dcee Z?dS )d N)Enum)List)Corec e Zd ZdS )MessageNotFoundErrorN__name__
__module__ __qualname__ W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/messages.pyr r
Dr
r c e Zd ZdZd Zd ZdS )UnknownMessagez&
Used as stub for MessageType
c t d )NzMessage class is not found.)r selfs r __init__zUnknownMessage.__init__ s "#@AAAr
c dS )NUnknownr )r names r __getattr__zUnknownMessage.__getattr__ s yr
N)r r
r __doc__r r r r
r r r s? B B B r
r c 8 e Zd Zg Z fdZed Z xZS )MessageTc n t j di | | j | d S )Nr )super__init_subclass__ _subclassesappend)clskwargs __class__s r r zMessageT.__init_subclass__ s< !!++F+++ s#####r
c * t | j S N)tupler r" s r get_subclasseszMessageT.get_subclasses! s S_%%%r
)r r
r r r classmethodr)
__classcell__r$ s @r r r sX K$ $ $ $ $ & & [& & & & &r
r c e Zd ZdZd ZdS ) _MessageTypea
Used to get specific message class. For example,
>>> _MessageType().ConfigUpdate
<class 'defence360agent.contracts.messages.ConfigUpdate'>
>>> _MessageType().NotExistMessage
<class 'defence360agent.contracts.messages.UnknownMessage'>
>>>
c f t D ]}|j |k r|c S t S r& )Messager) r r )r r subclss r r z_MessageType.__getattr__0 s> ,,.. F$&&
' r
N)r r
r r r r r
r r. r. & s- r
r. c e Zd ZdZdZdS ) ReportTargetapiconnN)r r
r APIPERSISTENT_CONNECTIONr r
r r3 r3 ; s
C "r
r3 c < e Zd ZdZej Zedefd Z dS )
ReportablezD
Mixin class for messages that should be sent to the server
methodc d | D ]}|t |d k r|c S dS )ao
Return a subclass with the same DEFAULT_METHOD as *method*.
It can be used to detect report target from message method.
NOTE: it is not guaranteed that the class with the *method* is unique,
in this case the first subclass found is returned, but
it is tested that all such subclasses have the same TARGET.
DEFAULT_METHODN)__subclasses__getattr)r" r: subclasss r get_subclass_with_methodz#Reportable.get_subclass_with_methodG sH **,, H+;<<<< =tr
N)
r r
r r r3 r7 TARGETr* strr@ r r
r r9 r9 @ sM
/F c [ r
r9 c . e Zd ZdZedefd ZdS )Receivedz
Mixin class for messages received from the server.
These messages are created in the client360 plugin when receiving a
request from imunify360.cloudlinux.com.
actionc | D ],}t |dg pt |d g}||v r|c S -t d | )NRECEIVED_ACTIONSr< z*Message class is not found for "{}" action)r= r> r format)r" rE r? received_actionss r get_subclass_with_actionz!Received.get_subclass_with_action^ s **,, H &x1CR H H "233M ))) *" 8 ? ? G G
r
N)r r
r r r* rB rJ r r
r rD rD V sE
c
[
r
rD c ^ e Zd ZdZedd Zedefd Zedd ZdS )LockableNreturnc K | j t j | _ | j d {V d S r& )_lockasyncioLockacquirer( s r rR zLockable.acquiren sG 9 CIi !!!!!!!!!!!r
c F | j d uo| j S r& )rO lockedr( s r rT zLockable.lockedt s" y$;)9)9););;r
c J | j | j d S d S r& )rO releaser( s r rV zLockable.releasex s, 9 I ! r
rM N) r r
r rO r* rR boolrT rV r r
r rL rL k s~ E" " " ["
<t < < < [< [ r
rL c ` e Zd ZdZdZdZdZdZdZd fd Z e
d
Z d Z d Z
d
Z xZS )r0 zj
Base class for messages to be passed as
a parameter to plugins.MessageSink.process_message()
< d i@ rM Nc j | j r
| j | d< t t | j |i | d S )Nr: )r< r r0 r )r argsr# r$ s r r zMessage.__init__ sB 1 ! 0DN%gt %t6v66666r
c > d | D S )Nc & i | ]\ }}|d k ||S )r: r .0kvs r
<dictcomp>z#Message.payload.<locals>.<dictcomp> s# ???Ah 1 r
itemsr s r payloadzMessage.payload s ?? ????r
c X | | S # t $ r}t | |d}~ww xY w)z
Called when an attribute lookup has not found the attribute
in the usual places
A shortcut to access an item from dict
N)KeyErrorAttributeError)r r excs r r zMessage.__getattr__ s@ 0: 0 0 0 &&C / 0s
)$)c fd D }d j j | S )a Render for logs: collections with more than _FOLD_LIST_THRESHOLD
items are collapsed to a count and strings longer than
_SHORTEN_STR_THRESHOLD are shortened, recursively through nested
payloads, so a single message cannot flood the log.c P i | ]"\ }}|t |j j #S
fold_limit str_limit)_fold_repr_value_FOLD_LIST_THRESHOLD_SHORTEN_STR_THRESHOLD)rc rd re r s r rf z$Message.__repr__.<locals>.<dictcomp> sP
1
4 5
r
{}({}))rh rH r$ r )r
folded_msgs ` r __repr__zMessage.__repr__ sP
t~ :JGGGr
c * | S r& )ry r s r __str__zMessage.__str__ s }} r
rW )r r
r r r< PRIORITYPROCESSING_TIME_THRESHOLDru rv r propertyri r ry r{ r+ r, s @r r0 r0 ~ s NH " 7 7 7 7 7 7
@ @ X@
0
0
0
H
H
H r
r0 c 4 e Zd Z fdZed Z xZS ) MessageListc L t | d S )Nlist)r r )r msg_listr$ s r r zMessageList.__init__ s$
h'''''r
c | j S r& r r s r ri zMessageList.payload s
yr
)r r
r r r~ ri r+ r, s @r r r sS ( ( ( ( ( X r
r c e Zd ZdZdefdZdS )ShortenReprListMixinz
Do not flood console.log with large sequences
The method collapses messages that are a list.
Instead of showing all the elements of the message,
their number will be displayed.
r c d | j j d t | dg S )Nrw <{} item(s)>rh )rH r$ r lengetr s r ry z ShortenReprListMixin.__repr__ sG N ' ! !#dhhw&;&;"<"< = =
r
N)r r
r r dictry r r
r r r s9
t
r
r c " e Zd ZdZeZdefdZdS )
AccumulatablezMessages of this class will be grouped into a list of LIST_CLASS
message instance by Accumulate plugin. Messages whose do_accumulate()
call returns False will not be added to list.rM c dS )zAReturn True if this message is worth collecting, False otherwise.Tr r s r
do_accumulatezAccumulatable.do_accumulate s tr
N)r r
r r r
LIST_CLASSrX r r r
r r r s@ 5 5 Jt r
r c e Zd ZdS )ServerConnectedNr r r
r r r r r
r c e Zd ZdS )ServerReconnectedNr r r
r r r r r
r c * e Zd ZdZdZdZ fdZ xZS )Pingzr
Will send this message on connected, reconnected events
to provide central server with agent version
PINGr c f t t j | d< d S )Nversion)r r
CoreConfigVERSION)r r$ s r r z
Ping.__init__ s)
$,Yr
)r r
r r r< r| r r+ r, s @r r r sN
NH- - - - - - - - -r
r c & e Zd ZdZdZ fdZ xZS )Ackzd
Notify Server that a persistent message with *seq_number* has been
received by Agent.
ACKc ` t j di | t | | d< d S )N)per_seq_metar )r r r )r
seq_numberr# r$ s r r z Ack.__init__ s8 ""6""" Z000W
r
)r r
r r r< r r+ r, s @r r r sI N1 1 1 1 1 1 1 1 1r
r c e Zd ZdZdZdS )NoopzG
Sending NOOP to the agent to track the message in agent logs.
NOOPNr r
r r r< r r
r r r s NNNr
r c * e Zd ZdZdZej Zd ZdS ) ServerConfigz.
Information about server environment
SERVER_CONFIGc @ d | j j S Nz{}()rH r$ r r s r ry zServerConfig.__repr__ }}T^ 8999r
N r r
r r r< r3 r6 rA ry r r
r r r s< %N
F: : : : :r
r c e Zd ZdZej ZdS )WpSecurityPluginStatsWP_SECURITY_PLUGIN_STATSN)r r
r r< r3 r6 rA r r
r r r s /N
FFFr
r c * e Zd ZdZdZej Zd ZdS )
DomainListz*
Information about server domains
DOMAIN_LISTc @ d | j j S r r r s r ry zDomainList.__repr__ r r
Nr r r
r r r s< #N
F: : : : :r
r c e Zd ZdZd Zd ZdS ) FilesUpdatedz/
To consume products of files.update()
c || d< || d< dS )z\
:param files_type: files.Type
:param files_index: files.LocalIndex
files_type files_indexNr )r r r s r r zFilesUpdated.__init__( s (\ )]r
c \ d | j j | d | d S )z?
Do not flood console.log with large sequences
z+{}({{'files_type':'{}', 'files_index':{}}})r r r r s r ry zFilesUpdated.__repr__1 s4 =CC N '
r
N)r r
r r r ry r r
r r r # s< * * *
r
r c e Zd ZdZdZdS ) UpdateFilesz9
Update files by getting message from the server
UPDATENr r r
r r r < s NNNr
r c e Zd ZdZdS ) ConfigUpdate
CONFIG_UPDATENr r
r r< r r
r r r D $NNNr
r c e Zd ZdZdS )Rejectz
Kinda message filtering facility.
Raised in order to stop message processing through plugins.
Takes reason of reject as argument.
N)r r
r r r r
r r r H s Dr
r c e Zd ZdZdS )HealthHEALTHNr r r
r r r R s NNNr
r c e Zd ZdZdS )
CommandInvokeCOMMAND_INVOKENr r r
r r r V %NNNr
r c e Zd ZdZdS )
ScanFailed SCAN_FAILEDNr r r
r r r Z s "NNNr
r c e Zd ZdZdS )
CleanupFailedCLEANUP_FAILEDNr r r
r r r ^ r r
r c e Zd ZdZdZdS )RestoreFromBackupTaskz5
Creates a task to restore files from backup
MALWARE_RESTORE_FROM_BACKUPNr r r
r r r b s 3NNNr
r c B e Zd ZdZh dZededededefd Z dS ) cPanelEvent PANEL_EVENT> planexcludenew_pkg
imunify360_avimunify360_proactiveusernamehooktsfieldsc fd| D }|dk r%d|v r!d|v r |d |d k r |d |d< ||||d S )Nc v i | ]5\ }}| j v | |6S r )lowerALLOWED_FIELDS)rc rd re r" s r rf z/cPanelEvent.from_hook_event.<locals>.<dictcomp>x sG
1wwyyC ...
GGIIq...r
Modifyusernewuser old_username)r r data timestamprg )r" r r r r r s ` r from_hook_eventzcPanelEvent.from_hook_eventt s
H & V##v&"333#)&>D s $
r
N)
r r
r r< r r* rB floatr r r r
r r r j sj "N N
"%
+0
:>
[
r
r c e Zd ZdZdS ) IContactSent
ICONTACT_SENTNr r r
r r r r r
r slimitrM c |dk sJ t | |k r$| d|dz dz
d| | dz dz d n| S )z1Shorten *s* string if its length exceeds *limit*. N z...)r )r r s r _shorten_strr sf 19999 q66E>>
uzA~
991eVq[1_%6%6#7999
r
rr rs c . t | t rt | S t | t rVt | k r"d t | S fd| D S t | t t t t f rZt | k r"d t | S t | fd| D S | S )Nr c < i | ]\ }}|t | S rp rt )rc rd re rr rs s r rf z$_fold_repr_value.<locals>.<dictcomp> s?
1
jINNN
r
c 3 < K | ]}t | V dS )rq Nr )rc re rr rs s r <genexpr>z#_fold_repr_value.<locals>.<genexpr> sF
Q: K K K
r
)
isinstancerB r r r rH rh r r' set frozensettype)valuerr rs s ``r rt rt s/ % .E9---%
u::
" "!((U44 4
%$sI677
u::
" "!((U44 4tE{{
Lr
c e Zd ZdZdZdS )
BackupInfoz(Information about enabled backup backend BACKUP_INFONr r r
r r r s 22"NNNr
r IMUNIFY360_MAX_MESSAGE_SIZEi c ddl m} t t j | | S # t t f$ r1 t t | cY S w xY w)Nr )ServerJSONEncoderr( ) defence360agent.utils.jsonr r jsondumpsencode TypeError
ValueErrorrepr)objr s r serialized_sizer s <<<<<<'4:c'8999@@BBCCC z " ' ' '499##%%&&&&&'s 4= ?A?>A?c 6 | dS t | t rdS t | t r-t dt t | dz S t | t rdS t | t
r| rR| r>t | dz | d z | d z S t t j | S t | t t f r dt d
| D z S t | t r.dt d | D z S t# | S ) ul Upper bound on obj's JSON byte size as sent on the wire (ensure_ascii),
biased to never undercount. Far cheaper than a full ``serialized_size`` per
call on big scans: JSON-native values are measured structurally without
building the encoded string, and printable-ASCII strings (the common path
for file paths/snippets) are counted with C-level ``str`` ops. Non-native
values (peewee Models, IPs, ...) fall back to the exact ``serialized_size``
— their ``repr`` would wildly undercount the ServerJSONEncoder output. The
transport keeps a split-on-overflow net for the rare drift this leaves.Nr r r "\c 3 : K | ]}t | d z V dS r N
estimate_size)rc re s r r z estimate_size.<locals>.<genexpr> s/ 99}Q''!+999999r
c 3 K | ]P\ }}t t |t r|nt | d z t | z d z V QdS r )r r rB rb s r r z estimate_size.<locals>.<genexpr> s
1
z!S 1 1=!!s1vv > >
A
r
)r rX intmaxr rB r isascii isprintablecountr
r r r' sumr rh r )r s r r r s {q#t q#s *2s3s88}}q()))#u r#s $ ;;== CS__ . . Cs88a<#))C..0399T??B B4:c??####e}%% :399S9999999#t
3
3 r
c e Zd ZdZdZdZdZedefd Z ede
e fd Z ede
defd Zedefd Zed
Zede
e fd ZdS )
Splittablez
A message list could be split into multiple batches.
The split is possible for a list itself along with internal resources.
NrM c t S r& )MAX_MESSAGE_SIZEr( s r _max_message_sizez Splittable._max_message_size s r
messagesc # J K | j r| j r}|D ]x}| | j x}|V #t | }| || D ]/}| }||| j < || }|V 0ydS t
| E d{V dS )z
Split messages' internal lists of things into batches.
A field that is meant to split is defined by `BATCH_FIELD`.
N) BATCH_FIELD
BATCH_SIZEr r _size_bounded_batchescopyiter)r" r( messagerh
message_classbatchr new_messages r _split_itemszSplittable._split_items s ? &s~ &#
*
* $[[ 9 99EB!MMMM$(MMM!$!:!:5'!J!J * * &||~~05S_-&3mD&9&9 ))))) *
*
* H~~ % % % % % % % % %r
is_dictc D t |r|d |d in| S )zSerialized byte cost of one BATCH_FIELD unit. Subclasses override
to also count data paired with the unit in sibling fields of the
message (e.g. a per-hit cleanup result), so those bytes are not
excluded from the byte budget.r r r )r" unitr4 r/ s r
_unit_sizezSplittable._unit_size s) 7 Dd1gtAw / /EEEr
c t | S )zSubclasses override when the list class drops part of the message
before sending, so the budget counts only the bytes that go out.r )r" r/ s r
_message_sizezSplittable._message_size s W%%%r
c #
K | }t |t
r!t | n|}
fd}g }d}|D ]g}| |
| } |r2|| z |k st
| | j k r || V g d}}| | || z
}h|r || V dS dS )zPack `items` into batches bounded by both the byte budget and the
`BATCH_SIZE` count. A single element larger than the budget is emitted
alone rather than dropped.c D rt | nt | S r& )r r )bufferr4 s r buildz/Splittable._size_bounded_batches.<locals>.build% s #*<4<<<V <r
r N) r' r r r rh r7 r r+ r! ) r" rh r/ budgetunitsr= r< sizer6 unit_sizer4 s @r r, z Splittable._size_bounded_batches s"
&&(( UD))'.9U[[]]###E = = = = = DtWg>>I
%y 6))S[[CN-J-JeFmm### !1 MM$ I DD %-- r
c # P K | j pt | }| }g }d}| | D ]W}| | }|r$||z |k st | |k r|V g d}}| | ||z
}X|r|V d S d S )Nr ) LIST_SIZEr r' r3 r9 r! )r" r( list_sizer> r< r@ r/ message_sizes r batchedzSplittable.batched6 s M2S]] &&((''11 ! !G ,,W55L
%|#f,,F y0H0H !1 MM' " " " L DD LLLLL r
)r r
r r rC r+ r* r* r r' r r r3 rX r7 r9 r, rF r r
r r$ r$ s"
IJK # [ &D $7 & & & [&& Ft F F F F [F &s & & & [&
[ 2 tM 2 [ r
r$ c e Zd ZdZdS )
MDSReportList
MDS_SCAN_LISTNr r r
r rH rH I r r
rH c e Zd ZeZdS ) MDSReportN)r r
r rH r r r
r rK rK M s JJJr
rK c e Zd ZdZdZdS )EnsureServiceStatez-Ensure the service has the appropriate statusENSURE_SERVICE_STATENr r r
r rM rM Q s 77+NNNr
rM c e Zd ZdZdZdS )SensorWordpressIncidentListzAggregated incident list
INCIDENT_LISTNr r r
r rP rP W s ""$NNNr
rP c e Zd ZdZdS )WordpressPluginActionWP_SECURITY_PLUGIN_ACTIONNr r r
r rS rS ] s 0NNNr
rS c * e Zd ZdZdZej Zd ZdS )WordpressPluginTelemetryzX
Information about telemetry event related to Imunify Security WordPress plugin
WP_SECURITY_PLUGIN_EVENTc @ d | j j S r r r s r ry z!WordpressPluginTelemetry.__repr__i r r
Nr r r
r rV rV a s< 0N
F: : : : :r
rV c e Zd ZdZdZdS )WPRuleDisabledz#WordPress protection rule disabled.
RULE_DISABLEDNr r r
r rZ rZ m s --$NNNr
rZ c e Zd ZdZdZdS )
WPRuleEnabledz%WordPress protection rule re-enabled. RULE_ENABLEDNr r r
r r] r] s s //#NNNr
r] c e Zd ZdZdS )GeneralMetricsGENERAL_METRICSNr r r
r r` r` y s &NNNr
r` )@rP r
osenumr typingr defence360agent.contracts.configr r Exceptionr r r r. MessageTyper3 r9 rD rL r r0 r r r r r r r r r r r r r r r r r r r r r r rB r r rt r environr r& r r r$ rH rK rM rP rS rV rZ r] r` r r
r <module>ri s' ? ? ? ? ? ? 9 & & & & & & & & $ lnn # # # # #4 # # #
,
x
* x &4 4 4 4 4 dH 4 4 4 n '
G g
- - - - -7J - - - 1 1 1 1 1': 1 1 1 7 : : : : :7J : : : GZ
: : : : :* : : :
7
2 '8 % % % % %7 % % % Y W & & & & &GZ & & &# # # # #* # # #& & & & &GZ & & &3 3 3 3 3G 3 3 3"
"
"
"
"
' "
"
"
J% % % % %7J % % %C 3 3 (# # # # #* # # # 3JNN0+>>
'C ' ' ' ' # D[ [ [ [ [ [ [ [|% % % % %(':z % % %
, , , , , , , , % % % % %+z: % % % 1 1 1 1 1G 1 1 1 : : : : :w
: : :% % % % %Wj % % % $ $ $ $ $GZ $ $ $ ' ' ' ' '[* ' ' ' ' 'r
defence360agent/contracts/__pycache__/myimunify_id.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000023625 00000000000 023131 0 ustar
r_j l d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZm Z d dl
m Z d dl m
Z
d dlmZmZ d dlmZ d dlmZ d Zd
Zd Z ed Z G d
de Zde de de e fdZ dee fdZ dee e f fdZ de de fdZ!de dede fdZ"dede fdZ#de de fdZ$de defd Z%dS ) N)Path)DictListOptional)logger)instance) MyImunifyupdate_users_protection) HostingPanel) safe_fileopsz
.myimunify_idzE# DO NOT EDIT
# This file contains MyImunify id unique to this user
0123456789abcdefc e Zd ZdZdS )MyImunifyIdErrorz5Exception representing issues related to MyImunify idN)__name__
__module__ __qualname____doc__ [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/myimunify_id.pyr r s ????r r user
protectionreturnc K t j | \ }}| t | |g| d{V t j d|| t
| d{V }n# t $ r Y dS w xY w|S )z5Save subscription type to the DB and generate id filer Nz(Applied setting MyImunify=%s for user %s)r
get_or_createsaver
r info_get_or_generate_idr )sinkr r myimunify_ myimunify_ids r add_myimunify_userr% s
*555LIq
NN
!$
;
;;;;;;;;
K:JMMM 0 6 6666666 tt s A4 4
BBc N K g } t d{V }t d{V }t j 5 t
| D ]\ }}t j | \ }}|
| |i dd |||j | |i dd d ddd n # 1 swxY w Y | S )zP
Get a list of MyImunify users, their subscription types and unique ids
Nr email locale)r' usernamer$ r r) )
r get_user_details_myimunify_user_to_idr db transactionsorteditemsr r appendgetr )users user_detailsmyimunify_user_to_idr
myimunify_uidrecordr# s r get_myimunify_usersr8 . s~
E% 88::::::::L!6!8!8888888 " " #)*>*D*D*F*F#G#G
D-!/T:::IFA LL ) - -dB 7 7 ; ;GR H H $$1"("3 * . .tR 8 8 < <Xr J J
Ls B0DD !D c & K i } t d{V D ]e} t | d{V | |< # t $ r Y (t j $ r-}t
j d|t | Y d}~^d}~ww xY w| S )z+Get a list of users and their MyImunify idsNz+Unable to generate id for user=%s, error=%s) r get_usersr r r UnsafeFileOperationr warningstr)
user_to_idr es r r, r, E s J"nn..00000000
%8%>%> > > > > > >Jt H/ N=tSVV
HHHH
s A
BB!#B Bc K t | d{V } t | S # t t f$ r1 t j j }t || d{V cY S w xY w)z
Read MyImunify id if exists and valid, or generate a new one and write into the file.
Malformed files are regenerated.
N)_get_myimunify_id_file_read_idFileNotFoundErrorr uuiduuid1hex _write_id)r id_filer$ s r r r W s
+400000000G6 / 0 6 6 6z||' |W555555555556s ( ?A*)A*r$ rH c K t | z dz } t j t | | d{V n/# t $ r"}t j d| t |d}~ww xY w| S )zWrite MyImunify id to file
Nz1Unable to write myimunify_id in user home dir: %s)_BANNERr
write_textr= OSErrorr r< r )r$ rH textr? s r rG rG d s \ !D (D&%c'llD9999999999 & & &JANNN A%& s (:
A& A!!A&c t j t | t j t j z }n # t
$ r t $ r t w xY w t j t j
| j st t j |d }|
d }n# t $ r t w xY w t j | n# t j | w xY wt! | S )an Read and validate MyImunify id from file. Raises MyImunifyIdError if malformed.
Opens with O_RDONLY | O_NONBLOCK and verifies via fstat() that the
fd refers to a regular file before reading. This eliminates the
TOCTOU window between a path-level type check and the actual read
(e.g. an attacker replacing the file with a FIFO between the two).
i zutf-8)osopenr= O_RDONLY
O_NONBLOCKrC rM r statS_ISREGfstatst_modereaddecodeUnicodeDecodeErrorclose _parse_id)rH fddatarN s r rB rB o s
WS\\2; #>
?
?
|BHRLL 011 #" "wr4 {{7##
T??s( 9< A A B9 8C$ 9C C$ $C:rN c * d}| D ]r}| }|s| d r/|t t | t
k st
d |D st |}s|t |S )z`Read line by line: skip comments (#). First non-comment line must be valid id; nothing after it.N#c 3 ( K | ]
}|t v V d S )N)_HEX).0cs r <genexpr>z _parse_id.<locals>.<genexpr> s& '='=aT '='='='='='=r )
splitlinesstrip
startswithr len_ID_LENall)rN id_lineliness r r\ r\ s G!!
JJLL << " " q66W C'='=1'='='=$=$= " " Nr c K t j | }t |j t z } t j t | n# t $ r |j
s t j d| t t j t | d{V n/# t $ r"}t j d| t |d}~ww xY wY nXt $ r t j d| t w xY w# t $ r"}t j d| t |d}~ww xY w|S )z<Get a file with MyImunify id and create it if does not existzNo such user homedir: %sNz/Unable to put myimunify_id in user home dir: %sz Cannot access identity file: %szNo such user: %s)pwdgetpwnamr pw_dirMYIMUNIFY_ID_FILE_NAMEr ensure_regular_filer= rC parentexistsr r< r touchrM KeyError)r user_pwdrH r? s r rA rA s #<%%
x''*@@ # ,S\\ : : : :
.
.
.>((**
' 94@@@&&
."(W 6666666666
.
.
.Eq 'A-
. 76 # # # N<g F F F" " #% & & &)4000 A%&* NsL D !A ?D'B?>D?
C+ C&&C++D0&D
E# E E)&rP rp rT rD pathlibr typingr r r %defence360agent.contracts.permissionsr defence360agent.modelr defence360agent.myimunify.modelr r
+defence360agent.subsys.panels.hosting_panelr defence360agent.utilsr rs rK rj frozensetrb Exceptionr r= boolr% r8 r, r rG rB r\ rA r r r <module>r s@
' ' ' ' ' ' ' ' ' ' 8 8 8 8 8 8 * * * * * * N N N N N N N N D D D D D D . . . . . .( O
y#$$@ @ @ @ @y @ @ @!%
c] &4: .T#s(^ $
6C
6C
6
6
6
6# d s 4C C &s t r defence360agent/contracts/__pycache__/myimunify_id.cpython-311.pyc 0000644 0000000 0000000 00000023625 00000000000 022172 0 ustar
r_j l d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZm Z d dl
m Z d dl m
Z
d dlmZmZ d dlmZ d dlmZ d Zd
Zd Z ed Z G d
de Zde de de e fdZ dee fdZ dee e f fdZ de de fdZ!de dede fdZ"dede fdZ#de de fdZ$de defd Z%dS ) N)Path)DictListOptional)logger)instance) MyImunifyupdate_users_protection) HostingPanel) safe_fileopsz
.myimunify_idzE# DO NOT EDIT
# This file contains MyImunify id unique to this user
0123456789abcdefc e Zd ZdZdS )MyImunifyIdErrorz5Exception representing issues related to MyImunify idN)__name__
__module__ __qualname____doc__ [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/myimunify_id.pyr r s ????r r user
protectionreturnc K t j | \ }}| t | |g| d{V t j d|| t
| d{V }n# t $ r Y dS w xY w|S )z5Save subscription type to the DB and generate id filer Nz(Applied setting MyImunify=%s for user %s)r
get_or_createsaver
r info_get_or_generate_idr )sinkr r myimunify_ myimunify_ids r add_myimunify_userr% s
*555LIq
NN
!$
;
;;;;;;;;
K:JMMM 0 6 6666666 tt s A4 4
BBc N K g } t d{V }t d{V }t j 5 t
| D ]\ }}t j | \ }}|
| |i dd |||j | |i dd d ddd n # 1 swxY w Y | S )zP
Get a list of MyImunify users, their subscription types and unique ids
Nr email locale)r' usernamer$ r r) )
r get_user_details_myimunify_user_to_idr db transactionsorteditemsr r appendgetr )users user_detailsmyimunify_user_to_idr
myimunify_uidrecordr# s r get_myimunify_usersr8 . s~
E% 88::::::::L!6!8!8888888 " " #)*>*D*D*F*F#G#G
D-!/T:::IFA LL ) - -dB 7 7 ; ;GR H H $$1"("3 * . .tR 8 8 < <Xr J J
Ls B0DD !D c & K i } t d{V D ]e} t | d{V | |< # t $ r Y (t j $ r-}t
j d|t | Y d}~^d}~ww xY w| S )z+Get a list of users and their MyImunify idsNz+Unable to generate id for user=%s, error=%s) r get_usersr r r UnsafeFileOperationr warningstr)
user_to_idr es r r, r, E s J"nn..00000000
%8%>%> > > > > > >Jt H/ N=tSVV
HHHH
s A
BB!#B Bc K t | d{V } t | S # t t f$ r1 t j j }t || d{V cY S w xY w)z
Read MyImunify id if exists and valid, or generate a new one and write into the file.
Malformed files are regenerated.
N)_get_myimunify_id_file_read_idFileNotFoundErrorr uuiduuid1hex _write_id)r id_filer$ s r r r W s
+400000000G6 / 0 6 6 6z||' |W555555555556s ( ?A*)A*r$ rH c K t | z dz } t j t | | d{V n/# t $ r"}t j d| t |d}~ww xY w| S )zWrite MyImunify id to file
Nz1Unable to write myimunify_id in user home dir: %s)_BANNERr
write_textr= OSErrorr r< r )r$ rH textr? s r rG rG d s \ !D (D&%c'llD9999999999 & & &JANNN A%& s (:
A& A!!A&c t j t | t j t j z }n # t
$ r t $ r t w xY w t j t j
| j st t j |d }|
d }n# t $ r t w xY w t j | n# t j | w xY wt! | S )an Read and validate MyImunify id from file. Raises MyImunifyIdError if malformed.
Opens with O_RDONLY | O_NONBLOCK and verifies via fstat() that the
fd refers to a regular file before reading. This eliminates the
TOCTOU window between a path-level type check and the actual read
(e.g. an attacker replacing the file with a FIFO between the two).
i zutf-8)osopenr= O_RDONLY
O_NONBLOCKrC rM r statS_ISREGfstatst_modereaddecodeUnicodeDecodeErrorclose _parse_id)rH fddatarN s r rB rB o s
WS\\2; #>
?
?
|BHRLL 011 #" "wr4 {{7##
T??s( 9< A A B9 8C$ 9C C$ $C:rN c * d}| D ]r}| }|s| d r/|t t | t
k st
d |D st |}s|t |S )z`Read line by line: skip comments (#). First non-comment line must be valid id; nothing after it.N#c 3 ( K | ]
}|t v V d S )N)_HEX).0cs r <genexpr>z _parse_id.<locals>.<genexpr> s& '='=aT '='='='='='=r )
splitlinesstrip
startswithr len_ID_LENall)rN id_lineliness r r\ r\ s G!!
JJLL << " " q66W C'='=1'='='=$=$= " " Nr c K t j | }t |j t z } t j t | n# t $ r |j
s t j d| t t j t | d{V n/# t $ r"}t j d| t |d}~ww xY wY nXt $ r t j d| t w xY w# t $ r"}t j d| t |d}~ww xY w|S )z<Get a file with MyImunify id and create it if does not existzNo such user homedir: %sNz/Unable to put myimunify_id in user home dir: %sz Cannot access identity file: %szNo such user: %s)pwdgetpwnamr pw_dirMYIMUNIFY_ID_FILE_NAMEr ensure_regular_filer= rC parentexistsr r< r touchrM KeyError)r user_pwdrH r? s r rA rA s #<%%
x''*@@ # ,S\\ : : : :
.
.
.>((**
' 94@@@&&
."(W 6666666666
.
.
.Eq 'A-
. 76 # # # N<g F F F" " #% & & &)4000 A%&* NsL D !A ?D'B?>D?
C+ C&&C++D0&D
E# E E)&rP rp rT rD pathlibr typingr r r %defence360agent.contracts.permissionsr defence360agent.modelr defence360agent.myimunify.modelr r
+defence360agent.subsys.panels.hosting_panelr defence360agent.utilsr rs rK rj frozensetrb Exceptionr r= boolr% r8 r, r rG rB r\ rA r r r <module>r s@
' ' ' ' ' ' ' ' ' ' 8 8 8 8 8 8 * * * * * * N N N N N N N N D D D D D D . . . . . .( O
y#$$@ @ @ @ @y @ @ @!%
c] &4: .T#s(^ $
6C
6C
6
6
6
6# d s 4C C &s t r defence360agent/contracts/__pycache__/permissions.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000023074 00000000000 023000 0 ustar
r_j J d dl Z d dlmZ d dlmZ d dlmZ d dlmZm Z m
Z
d dl m Z d dl
mZmZ d dlmZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lmZ n
# e $ r dZY nw xY w e j e Z dxZ \
Z!Z"Z#Z$Z%Z&Z'Z(Z)Z*Z+Z,Z- ed Z.de/fdZ0d*dee1 de/fdZ2d*dee1 de/fdZ3d*dee1 de/fdZ4d*dee1 fdZ5d*dee1 de/fdZ6 d*dee1 de/fdZ7d*dee1 fdZ8d*dee1 fdZ9 ej: dd d Z; ej: d d d! Z< d*de1dz de/fd"Z=d*dee1 fd#Z>d*dee1 fd$Z?d*dee1 fd%Z@d*dee1 fd&ZAe!e3e"e4e#e5e$e6e%e7e&e8e'e9e(e;e)e=e*e>e+e?e,e@e-eAi
ZBde/fd'ZCd+d(ZDdeEe1 fd)ZFdS ), N)iscoroutinefunction)Path)Optional)MyImunifyConfigPermissionsConfig Wordpress)
LicenseCLN) AV_REPORTFULL)FeatureManagementPerms) MyImunify) HostingPanel)Plesk)importer)ImunifyPatchSubscriptionAPI)
zmalware_scanner.viewzmalware_scanner.cleanz3malware_scanner.clean_requires_myimunify_protectionz malware_scanner.on_demand.scanz1malware_scanner.on_demand.scan_without_rate_limitz malware_scanner.ignore_list.editz*malware_scanner.config.default_action.editz%malware_scanner.imunify_patch.enabledz2malware_scanner.imunify_patch.eligible_to_purchasezproactive_defense.viewz"proactive_defense.config.mode.editzwordpress.waf.editzwordpress.waf.rules.editz/etc/sysconfig/imunify360returnc \ t j t j k o t j S N)r NAMEr r USE_PLESK_SERVICE_PLAN Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/permissions.py is_plesk_service_plan_enabledr = s# uz) 5 4r userc * t j | S r )r
get_protectionr s r myimunify_protection_enabledr D s #D ) ))r c X | dS t j | j t t fv S NT)r get_permavr
r r s r ms_viewr$ H s2 |t ! *4 0 0 3 8 r c t j st j sdS | dS t rdS t j | j t k S )NFT)r is_freeis_validr r r" r# r r s r ms_cleanr( R s^ :#6#8#8 u |t$&& t ! *4 0 0 3t ;;r c V t j rt | S t | S r )r ENABLEDr r( r s r &ms_clean_requires_myimunify_protectionr+ ` s' 2+D111 D>>r c ^ | dS t j rdS t rdS t j S r! )r r* r r ALLOW_MALWARE_SCANr s r ms_on_demand_scanr. f s8 |t t$&& t //r c P t j rt | S t j S r )r r* r r r- r s r $ms_on_demand_scan_without_rate_limitr0 u s& 2+D111 //r c > | dS t j rdS t j S NTF)r r* r USER_IGNORE_LISTr s r ms_ignore_list_editr4 ~ s% |t u --r c > | dS t j rdS t j S r2 )r r* r USER_OVERRIDE_MALWARE_ACTIONSr s r ms_config_default_action_editr7 s' |t u ::r zimav.contracts.permissionsis_imunify_patch_enabledc dS NFr _s r <lambda>r= e r )modulenamedefaultz.imav.malwarelib.api.imunify_patch_subscription has_imunify_patch_subscriptionsc dS r: r r; s r r= r= r> r c K t "t j pt | S t j p,t | p t j d {V j S r )r r is_eligible_for_imunify_patchrB get_purchase_eligibilityeligibler s r %ms_imunify_patch_eligible_to_purchaserH sz #* 4 6 6
5.t44
022 *4 0 0 .FHH H H H H H H
r c N | dS t j | j t k S r! )r r" proactiver r s r pd_viewrK s% |t ! *4 0 0 :d BBr c > | dS t j rdS t j S r2 )r r* r USER_OVERRIDE_PROACTIVE_DEFENSEr s r pd_config_mode_editrN s% |t u <<r c | | dS t j sdS t t j S # t $ r Y dS w xY wr2 )r SECURITY_PLUGIN_ENABLEDbool WAF_ENABLEDKeyErrorr s r wp_waf_editrT sT |t , uI)*** tts -
;;c ` | dS t t j S # t $ r Y dS w xY wr! )rQ r ALLOW_WP_WAF_RULES_MANAGEMENTrS r s r wp_waf_rules_editrW sE |t%CDDD tts
--c K t | }|dS t | r || d {V S || S r: )HAS_PERMISSIONgetr
permissionr funcs r has_permissionr^ sa j ) )D |u4 T$ZZ 4::r c K t | }|t d t | r" || d {V st d d S || st d d S )Nz$notifications.generalPermissionError)rY rZ PermissionErrorr r[ s r check_permissionra s j ) )D | DEEE4 JT$ZZ J!"HII I J J tDzz J!"HII I J Jr c : K fdt D d {V S )Nc D K g | ]}t | d {V |S r )r^ ).0r\ r s r
<listcomp>z$permissions_list.<locals>.<listcomp> sO
D11 1 1 1 1 1 1 r ) PERMISSIONSr s `r permissions_listrg sP % r r )r N)Gloggingasyncio.coroutinesr pathlibr typingr defence360agent.contracts.configr r r !defence360agent.contracts.licenser ,defence360agent.feature_management.constantsr
r (defence360agent.feature_management.modelr defence360agent.myimunify.modelr
+defence360agent.subsys.panels.hosting_panelr #defence360agent.subsys.panels.pleskr defence360agent.utilsr .imav.malwarelib.api.imunify_patch_subscriptionr ImportError getLogger__name__loggerrf MS_VIEWMS_CLEAN&MS_CLEAN_REQUIRES_MYIMUNIFY_PROTECTIONMS_ON_DEMAND_SCAN$MS_ON_DEMAND_SCAN_WITHOUT_RATE_LIMITMS_IGNORE_LIST_EDIT MS_CONFIG_DEFAULT_ACTION_EDITMS_IMUNIFY_PATCH_ENABLED%MS_IMUNIFY_PATCH_ELIGIBLE_TO_PURCHASEPD_VIEWPD_CONFIG_MODE_EDIT WP_WAF_EDITWP_WAF_RULES_EDITGLOBAL_CONFDIRrQ r strr r$ r( r+ r. r0 r4 r7 rZ ms_imunify_patch_enabledrB rH rK rN rT rW rY r^ ra listrg r r r <module>r s 2 2 2 2 2 2
9 8 8 8 8 8 H H H H H H H H K K K K K K 5 5 5 5 5 5 D D D D D D 5 5 5 5 5 5 * * * * * *' ' ' '"& '
8 $ $ *(! ) " 122t * *x} * * * * * (3- 4 < <8C= <D < < < < # 0 0HSM 0T 0 0 0 0 0 0
3-0 0 0 0 0. .hsm . . . . ; ;
; ; ; ; (8< ' # O #/(, ; * O# # #
* "C C(3- C C C C= =hsm = = = = hsm HSM W h*.((*N,!#@ 6)+P W,( &d J J J JDI s A A A defence360agent/contracts/__pycache__/permissions.cpython-311.pyc 0000644 0000000 0000000 00000023074 00000000000 022041 0 ustar
r_j J d dl Z d dlmZ d dlmZ d dlmZ d dlmZm Z m
Z
d dl m Z d dl
mZmZ d dlmZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lmZ n
# e $ r dZY nw xY w e j e Z dxZ \
Z!Z"Z#Z$Z%Z&Z'Z(Z)Z*Z+Z,Z- ed Z.de/fdZ0d*dee1 de/fdZ2d*dee1 de/fdZ3d*dee1 de/fdZ4d*dee1 fdZ5d*dee1 de/fdZ6 d*dee1 de/fdZ7d*dee1 fdZ8d*dee1 fdZ9 ej: dd d Z; ej: d d d! Z< d*de1dz de/fd"Z=d*dee1 fd#Z>d*dee1 fd$Z?d*dee1 fd%Z@d*dee1 fd&ZAe!e3e"e4e#e5e$e6e%e7e&e8e'e9e(e;e)e=e*e>e+e?e,e@e-eAi
ZBde/fd'ZCd+d(ZDdeEe1 fd)ZFdS ), N)iscoroutinefunction)Path)Optional)MyImunifyConfigPermissionsConfig Wordpress)
LicenseCLN) AV_REPORTFULL)FeatureManagementPerms) MyImunify) HostingPanel)Plesk)importer)ImunifyPatchSubscriptionAPI)
zmalware_scanner.viewzmalware_scanner.cleanz3malware_scanner.clean_requires_myimunify_protectionz malware_scanner.on_demand.scanz1malware_scanner.on_demand.scan_without_rate_limitz malware_scanner.ignore_list.editz*malware_scanner.config.default_action.editz%malware_scanner.imunify_patch.enabledz2malware_scanner.imunify_patch.eligible_to_purchasezproactive_defense.viewz"proactive_defense.config.mode.editzwordpress.waf.editzwordpress.waf.rules.editz/etc/sysconfig/imunify360returnc \ t j t j k o t j S N)r NAMEr r USE_PLESK_SERVICE_PLAN Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/permissions.py is_plesk_service_plan_enabledr = s# uz) 5 4r userc * t j | S r )r
get_protectionr s r myimunify_protection_enabledr D s #D ) ))r c X | dS t j | j t t fv S NT)r get_permavr
r r s r ms_viewr$ H s2 |t ! *4 0 0 3 8 r c t j st j sdS | dS t rdS t j | j t k S )NFT)r is_freeis_validr r r" r# r r s r ms_cleanr( R s^ :#6#8#8 u |t$&& t ! *4 0 0 3t ;;r c V t j rt | S t | S r )r ENABLEDr r( r s r &ms_clean_requires_myimunify_protectionr+ ` s' 2+D111 D>>r c ^ | dS t j rdS t rdS t j S r! )r r* r r ALLOW_MALWARE_SCANr s r ms_on_demand_scanr. f s8 |t t$&& t //r c P t j rt | S t j S r )r r* r r r- r s r $ms_on_demand_scan_without_rate_limitr0 u s& 2+D111 //r c > | dS t j rdS t j S NTF)r r* r USER_IGNORE_LISTr s r ms_ignore_list_editr4 ~ s% |t u --r c > | dS t j rdS t j S r2 )r r* r USER_OVERRIDE_MALWARE_ACTIONSr s r ms_config_default_action_editr7 s' |t u ::r zimav.contracts.permissionsis_imunify_patch_enabledc dS NFr _s r <lambda>r= e r )modulenamedefaultz.imav.malwarelib.api.imunify_patch_subscription has_imunify_patch_subscriptionsc dS r: r r; s r r= r= r> r c K t "t j pt | S t j p,t | p t j d {V j S r )r r is_eligible_for_imunify_patchrB get_purchase_eligibilityeligibler s r %ms_imunify_patch_eligible_to_purchaserH sz #* 4 6 6
5.t44
022 *4 0 0 .FHH H H H H H H
r c N | dS t j | j t k S r! )r r" proactiver r s r pd_viewrK s% |t ! *4 0 0 :d BBr c > | dS t j rdS t j S r2 )r r* r USER_OVERRIDE_PROACTIVE_DEFENSEr s r pd_config_mode_editrN s% |t u <<r c | | dS t j sdS t t j S # t $ r Y dS w xY wr2 )r SECURITY_PLUGIN_ENABLEDbool WAF_ENABLEDKeyErrorr s r wp_waf_editrT sT |t , uI)*** tts -
;;c ` | dS t t j S # t $ r Y dS w xY wr! )rQ r ALLOW_WP_WAF_RULES_MANAGEMENTrS r s r wp_waf_rules_editrW sE |t%CDDD tts
--c K t | }|dS t | r || d {V S || S r: )HAS_PERMISSIONgetr
permissionr funcs r has_permissionr^ sa j ) )D |u4 T$ZZ 4::r c K t | }|t d t | r" || d {V st d d S || st d d S )Nz$notifications.generalPermissionError)rY rZ PermissionErrorr r[ s r check_permissionra s j ) )D | DEEE4 JT$ZZ J!"HII I J J tDzz J!"HII I J Jr c : K fdt D d {V S )Nc D K g | ]}t | d {V |S r )r^ ).0r\ r s r
<listcomp>z$permissions_list.<locals>.<listcomp> sO
D11 1 1 1 1 1 1 r ) PERMISSIONSr s `r permissions_listrg sP % r r )r N)Gloggingasyncio.coroutinesr pathlibr typingr defence360agent.contracts.configr r r !defence360agent.contracts.licenser ,defence360agent.feature_management.constantsr
r (defence360agent.feature_management.modelr defence360agent.myimunify.modelr
+defence360agent.subsys.panels.hosting_panelr #defence360agent.subsys.panels.pleskr defence360agent.utilsr .imav.malwarelib.api.imunify_patch_subscriptionr ImportError getLogger__name__loggerrf MS_VIEWMS_CLEAN&MS_CLEAN_REQUIRES_MYIMUNIFY_PROTECTIONMS_ON_DEMAND_SCAN$MS_ON_DEMAND_SCAN_WITHOUT_RATE_LIMITMS_IGNORE_LIST_EDIT MS_CONFIG_DEFAULT_ACTION_EDITMS_IMUNIFY_PATCH_ENABLED%MS_IMUNIFY_PATCH_ELIGIBLE_TO_PURCHASEPD_VIEWPD_CONFIG_MODE_EDIT WP_WAF_EDITWP_WAF_RULES_EDITGLOBAL_CONFDIRrQ r strr r$ r( r+ r. r0 r4 r7 rZ ms_imunify_patch_enabledrB rH rK rN rT rW rY r^ ra listrg r r r <module>r s 2 2 2 2 2 2
9 8 8 8 8 8 H H H H H H H H K K K K K K 5 5 5 5 5 5 D D D D D D 5 5 5 5 5 5 * * * * * *' ' ' '"& '
8 $ $ *(! ) " 122t * *x} * * * * * (3- 4 < <8C= <D < < < < # 0 0HSM 0T 0 0 0 0 0 0
3-0 0 0 0 0. .hsm . . . . ; ;
; ; ; ; (8< ' # O #/(, ; * O# # #
* "C C(3- C C C C= =hsm = = = = hsm HSM W h*.((*N,!#@ 6)+P W,( &d J J J JDI s A A A defence360agent/contracts/__pycache__/plugins.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000032103 00000000000 022077 0 ustar
r_j p d dl Z d dlZd dlZd dlZd dlmZmZmZ d dlm Z d dl
m Z m Z d dl
mZmZ d dlmZ ej e Z G d de Z G d d
ee Z G d d ee Z G d
dee Z G d d Z G d deee ZdddZ e Z d Z d Z dS ) N)ABCABCMetaabstractmethod)suppress) lru_cachewraps)Message MessageType)Scopec Z e Zd Zej ZdZdZg Z fdZ e
d Z d Z d Z
xZS )
BasePlugind Tc n t j di | | j | d S )N )super__init_subclass__ _subclassesappend)clskwargs __class__s V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/plugins.pyr z BasePlugin.__init_subclass__ s< !!++F+++ s##### c $ d | j D S )Nc : g | ]}t j | |S r )inspect
isabstract).0plugins r
<listcomp>z1BasePlugin.get_active_plugins.<locals>.<listcomp> s9
%f--
r )r )r s r get_active_pluginsz BasePlugin.get_active_plugins s%
/
r c
K dS )aZ Shutdown plugin's subsystems, cancel running tasks,
clean iptables (if plugin is protector).
It should be safe to assume that it is called after
corresponding create_source if applicable.
It is called only from the shutdown task that runs at most once,
meaning shutdown() is never called twice.
Nr selfs r shutdownzBasePlugin.shutdown" s
r c 8 | j j d| j j S )N.)r
__module____name__r# s r __repr__zBasePlugin.__repr__/ s .333T^5L5LMMr )r) r( __qualname__r AV_IM360SCOPESHUTDOWN_PRIORITYAVAILABLE_ON_FREEMIUMr r classmethodr! r% r*
__classcell__)r s @r r
r
s NE K$ $ $ $ $
[
N N N N N N Nr r
c $ e Zd Zed ZdS )
MessageSourcec
K dS zThis method is a coroutine.Nr r$ loopsinks r
create_sourcezMessageSource.create_source4
r N)r) r( r+ r r9 r r r r3 r3 3 s- * * ^* * *r r3 c . e Zd ZdZd Zed ZdS )Sensorz+
Sensor is alias to MessageSource.
c > K | || d{V S r5 )
create_sensorr6 s r r9 zSensor.create_source> s. ''d333333333r c
K dS r5 r r6 s r r> zSensor.create_sensorB r: r N)r) r( r+ __doc__r9 r r> r r r r< r< 9 sH 4 4 4 * * ^* * *r r< c < e Zd ZdZdZdZd Zd Zed Z dS )LogStreamReaderNi c \ K || _ || _ d | _ | j sd S dddd| j f| _ t j | j t j t j t j d| j d d {V | _
| | | j
j
d S )Nz
/usr/bin/tailz
--follow=namez-n0z--retryr )stdinstdoutstderrbufsizelimit)_loop_sink_cmd source_fileasynciocreate_subprocess_exec
subprocessDEVNULLPIPE_LIMIT_child_process create_task_infinite_read_and_proceedrE r6 s r r> z LogStreamReader.create_sensorO s
F
%,$B
Y $ ? %+
%
%
%
+ +D,?,F G G
r c p K | j | j d c}| _ t d| t t 5 | j d d d n # 1 swxY w Y | j d {V }t d|| d S d S )Nz Terminating child process [%s]z,Terminated child process [%s] with code [%d])rK loggerdebugr ProcessLookupErrorrS killwait)r$ cmdrcs r r% zLogStreamReader.shutdownn s 9 !YNC LL93 ? ? ? ,--
+
+#((***
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ *//11111111B LL>R
! s A..A25A2c K t N)NotImplementedError)r$
stream_readers r rU z*LogStreamReader._infinite_read_and_proceed} s !!r )
r) r( r+ rL rR rK r> r% r rU r r r rB rB G s^ K F D
>
" " ^" " "r rB ) metaclassc > e Zd Z ed d Zd ZdS )BaseMessageProcessor )maxsizec g }t | D ]\}| d rt | | }t | r%t |d r| | ]|S )N_ _decorated_for_process_message)dir
startswithgetattrcallablehasattrr )r$ rvattr_strfuncs r _message_processorsz(BaseMessageProcessor._message_processors s
D H""3''
4**D~~
'6# #
$ r c K t d|| | D ],} || d {V }t |t r|c S -d S )Nz Dispatching %r through %r...)rW rX rr
isinstancer )r$ messagecororesults r process_messagez$BaseMessageProcessor.process_message s 3WdCCC,,.. D 4==((((((F&'**
r N)r) r( r+ r rr rx r r r rd rd sJ Yq
r rd c L e Zd Z G d d Zej Zed ZdS ) MessageSinkc V e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z e Z
d Zd Zd
ZdZdZdZdZdS )MessageSink.ProcessingOrder
( 2 7 < F P Q Z r x i N)r) r( r+ PRE_PROCESS_MESSAGELFDIGNORE_MESSAGEUNBLOCK_FROM_SUBNETCHECK_IP_IN_GRAYLISTGRAYLIST_TIMEOUTGRAYLIST_DB_FIXUPIMPORT_EXPORT_WBLIST
ML_PREDICTIONDEFAULTIPSET_PROTECTORWEBSHIELD_PROTECTORWHITELIST_UNBLOCKEDSYNCLIST_UPDATE POST_ACTION
EVENT_HOOK
ICONTACT_SENTPOST_PROCESS_MESSAGEr r r ProcessingOrderr| ss ! !
!
" r r c
K d S r_ r )r$ r7 s r create_sinkzMessageSink.create_sink s r N)r) r( r+ r r PROCESSING_ORDERr r r r r rz rz sa "# "# "# "# "# "# "# "#J '.
^
r rz )
async_lockc fd}|S )a
@expect decorator for MessageSink.dosmth(message) async methods.
MessageSink method will be called by MessageSink.process_message()
if message_type and expect_fields match the message ones.
@expect's can be stacked together and decision whether to call decorated
coro is made by evaluating stacked @expect's with logical OR:
@expect(MessageType.SensorAlert) # -- OR --
@expect(MessageType.SensorIncident, plugin_id='ossec')
def protect(message): ...
c t dd d r#t d t fd } |_ |S )Nr) rh z{coro} is not publicrv c 2 K
fd}d fd | rىdu r d {V | d {V }du rBt t j r( r nV# t $ rI}t t j r( r |d }~ww xY w|S r | d {V S d S )Nc ~ t o,t fd D S )Nc 3 P K | ] \ }} | |k V !d S r_ )get)r kvru s r <genexpr>zMexpect.<locals>.decorate.<locals>.decorated.<locals>.match.<locals>.<genexpr> sO A A,0AqGKKNNa'A A A A A Ar )rt allitems)
expect_fieldsru message_types r matchz:expect.<locals>.decorate.<locals>.decorated.<locals>.match s_ !'<88 S A A A A4A4G4G4I4IA A A > > r c " t | d S )Nri )rn r s r
is_stackedz?expect.<locals>.decorate.<locals>.decorated.<locals>.is_stacked s t%EFFFr c > | r | j S | S r_ )ri )rv r terminals r r z=expect.<locals>.decorate.<locals>.decorated.<locals>.terminal s. :d## I#8D$GHHH r TF)acquirert r
Lockablelockedrelease Exception) r$ ru r rw excr r r rv r r s ` @@r decoratedz+expect.<locals>.decorate.<locals>.decorated s
G
G
G
uww
%%!//+++++++++*#188D>>$#@#@ @ @ @ @ @ @F #e++ &w 0D E E , #NN , , , ))) ! "7K,@AA* #NN , ,* ))) I
z$
1 !T$ 0 000000004s B" "
C5,AC00C5)rl rk TypeErrorformatr ri )rv r r r r s ` r decoratezexpect.<locals>.decorate s 4R ( ( 3 3C 8 8 F 2 9 9t 9 D DEE E t& & & & & & &
& P 48 0r r )r r r r s ``` r expectr s0 . . . . . . .` Or c : t | | S )zlRegister class as a plugin.
>>> @thisguy
>>> class ConcreteSink (MessageSink):
>>> ...
)_plugin_registryadd) pluginclss r thisguyr
s ### r c t S )z*Enumerate classobj for registered plugins.)r r r r theseguysr s r )!rM r loggingrO abcr r r
contextlibr functoolsr r "defence360agent.contracts.messagesr r
defence360agent.utilsr getLoggerr) rW objectr
r3 r< rB rd rz r setr r r r r r <module>r s , , , , , , , , , , & & & & & & & & C C C C C C C C ' ' ' ' ' ' 8 $ $!N !N !N !N !N !N !N !NH* * * * *J * * * * * * * *]C * * * 8" 8" 8" 8" 8"f 8" 8" 8" 8"v ,*
*
*
*
*
* 2C *
*
*
Z &* ? ? ? ? ?D 355 r defence360agent/contracts/__pycache__/plugins.cpython-311.pyc 0000644 0000000 0000000 00000032103 00000000000 021140 0 ustar
r_j p d dl Z d dlZd dlZd dlZd dlmZmZmZ d dlm Z d dl
m Z m Z d dl
mZmZ d dlmZ ej e Z G d de Z G d d
ee Z G d d ee Z G d
dee Z G d d Z G d deee ZdddZ e Z d Z d Z dS ) N)ABCABCMetaabstractmethod)suppress) lru_cachewraps)Message MessageType)Scopec Z e Zd Zej ZdZdZg Z fdZ e
d Z d Z d Z
xZS )
BasePlugind Tc n t j di | | j | d S )N )super__init_subclass__ _subclassesappend)clskwargs __class__s V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/plugins.pyr z BasePlugin.__init_subclass__ s< !!++F+++ s##### c $ d | j D S )Nc : g | ]}t j | |S r )inspect
isabstract).0plugins r
<listcomp>z1BasePlugin.get_active_plugins.<locals>.<listcomp> s9
%f--
r )r )r s r get_active_pluginsz BasePlugin.get_active_plugins s%
/
r c
K dS )aZ Shutdown plugin's subsystems, cancel running tasks,
clean iptables (if plugin is protector).
It should be safe to assume that it is called after
corresponding create_source if applicable.
It is called only from the shutdown task that runs at most once,
meaning shutdown() is never called twice.
Nr selfs r shutdownzBasePlugin.shutdown" s
r c 8 | j j d| j j S )N.)r
__module____name__r# s r __repr__zBasePlugin.__repr__/ s .333T^5L5LMMr )r) r( __qualname__r AV_IM360SCOPESHUTDOWN_PRIORITYAVAILABLE_ON_FREEMIUMr r classmethodr! r% r*
__classcell__)r s @r r
r
s NE K$ $ $ $ $
[
N N N N N N Nr r
c $ e Zd Zed ZdS )
MessageSourcec
K dS zThis method is a coroutine.Nr r$ loopsinks r
create_sourcezMessageSource.create_source4
r N)r) r( r+ r r9 r r r r3 r3 3 s- * * ^* * *r r3 c . e Zd ZdZd Zed ZdS )Sensorz+
Sensor is alias to MessageSource.
c > K | || d{V S r5 )
create_sensorr6 s r r9 zSensor.create_source> s. ''d333333333r c
K dS r5 r r6 s r r> zSensor.create_sensorB r: r N)r) r( r+ __doc__r9 r r> r r r r< r< 9 sH 4 4 4 * * ^* * *r r< c < e Zd ZdZdZdZd Zd Zed Z dS )LogStreamReaderNi c \ K || _ || _ d | _ | j sd S dddd| j f| _ t j | j t j t j t j d| j d d {V | _
| | | j
j
d S )Nz
/usr/bin/tailz
--follow=namez-n0z--retryr )stdinstdoutstderrbufsizelimit)_loop_sink_cmd source_fileasynciocreate_subprocess_exec
subprocessDEVNULLPIPE_LIMIT_child_process create_task_infinite_read_and_proceedrE r6 s r r> z LogStreamReader.create_sensorO s
F
%,$B
Y $ ? %+
%
%
%
+ +D,?,F G G
r c p K | j | j d c}| _ t d| t t 5 | j d d d n # 1 swxY w Y | j d {V }t d|| d S d S )Nz Terminating child process [%s]z,Terminated child process [%s] with code [%d])rK loggerdebugr ProcessLookupErrorrS killwait)r$ cmdrcs r r% zLogStreamReader.shutdownn s 9 !YNC LL93 ? ? ? ,--
+
+#((***
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ *//11111111B LL>R
! s A..A25A2c K t N)NotImplementedError)r$
stream_readers r rU z*LogStreamReader._infinite_read_and_proceed} s !!r )
r) r( r+ rL rR rK r> r% r rU r r r rB rB G s^ K F D
>
" " ^" " "r rB ) metaclassc > e Zd Z ed d Zd ZdS )BaseMessageProcessor )maxsizec g }t | D ]\}| d rt | | }t | r%t |d r| | ]|S )N_ _decorated_for_process_message)dir
startswithgetattrcallablehasattrr )r$ rvattr_strfuncs r _message_processorsz(BaseMessageProcessor._message_processors s
D H""3''
4**D~~
'6# #
$ r c K t d|| | D ],} || d {V }t |t r|c S -d S )Nz Dispatching %r through %r...)rW rX rr
isinstancer )r$ messagecororesults r process_messagez$BaseMessageProcessor.process_message s 3WdCCC,,.. D 4==((((((F&'**
r N)r) r( r+ r rr rx r r r rd rd sJ Yq
r rd c L e Zd Z G d d Zej Zed ZdS ) MessageSinkc V e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z e Z
d Zd Zd
ZdZdZdZdZdS )MessageSink.ProcessingOrder
( 2 7 < F P Q Z r x i N)r) r( r+ PRE_PROCESS_MESSAGELFDIGNORE_MESSAGEUNBLOCK_FROM_SUBNETCHECK_IP_IN_GRAYLISTGRAYLIST_TIMEOUTGRAYLIST_DB_FIXUPIMPORT_EXPORT_WBLIST
ML_PREDICTIONDEFAULTIPSET_PROTECTORWEBSHIELD_PROTECTORWHITELIST_UNBLOCKEDSYNCLIST_UPDATE POST_ACTION
EVENT_HOOK
ICONTACT_SENTPOST_PROCESS_MESSAGEr r r ProcessingOrderr| ss ! !
!
" r r c
K d S r_ r )r$ r7 s r create_sinkzMessageSink.create_sink s r N)r) r( r+ r r PROCESSING_ORDERr r r r r rz rz sa "# "# "# "# "# "# "# "#J '.
^
r rz )
async_lockc fd}|S )a
@expect decorator for MessageSink.dosmth(message) async methods.
MessageSink method will be called by MessageSink.process_message()
if message_type and expect_fields match the message ones.
@expect's can be stacked together and decision whether to call decorated
coro is made by evaluating stacked @expect's with logical OR:
@expect(MessageType.SensorAlert) # -- OR --
@expect(MessageType.SensorIncident, plugin_id='ossec')
def protect(message): ...
c t dd d r#t d t fd } |_ |S )Nr) rh z{coro} is not publicrv c 2 K
fd}d fd | rىdu r d {V | d {V }du rBt t j r( r nV# t $ rI}t t j r( r |d }~ww xY w|S r | d {V S d S )Nc ~ t o,t fd D S )Nc 3 P K | ] \ }} | |k V !d S r_ )get)r kvru s r <genexpr>zMexpect.<locals>.decorate.<locals>.decorated.<locals>.match.<locals>.<genexpr> sO A A,0AqGKKNNa'A A A A A Ar )rt allitems)
expect_fieldsru message_types r matchz:expect.<locals>.decorate.<locals>.decorated.<locals>.match s_ !'<88 S A A A A4A4G4G4I4IA A A > > r c " t | d S )Nri )rn r s r
is_stackedz?expect.<locals>.decorate.<locals>.decorated.<locals>.is_stacked s t%EFFFr c > | r | j S | S r_ )ri )rv r terminals r r z=expect.<locals>.decorate.<locals>.decorated.<locals>.terminal s. :d## I#8D$GHHH r TF)acquirert r
Lockablelockedrelease Exception) r$ ru r rw excr r r rv r r s ` @@r decoratedz+expect.<locals>.decorate.<locals>.decorated s
G
G
G
uww
%%!//+++++++++*#188D>>$#@#@ @ @ @ @ @ @F #e++ &w 0D E E , #NN , , , ))) ! "7K,@AA* #NN , ,* ))) I
z$
1 !T$ 0 000000004s B" "
C5,AC00C5)rl rk TypeErrorformatr ri )rv r r r r s ` r decoratezexpect.<locals>.decorate s 4R ( ( 3 3C 8 8 F 2 9 9t 9 D DEE E t& & & & & & &
& P 48 0r r )r r r r s ``` r expectr s0 . . . . . . .` Or c : t | | S )zlRegister class as a plugin.
>>> @thisguy
>>> class ConcreteSink (MessageSink):
>>> ...
)_plugin_registryadd) pluginclss r thisguyr
s ### r c t S )z*Enumerate classobj for registered plugins.)r r r r theseguysr s r )!rM r loggingrO abcr r r
contextlibr functoolsr r "defence360agent.contracts.messagesr r
defence360agent.utilsr getLoggerr) rW objectr
r3 r< rB rd rz r setr r r r r r <module>r s , , , , , , , , , , & & & & & & & & C C C C C C C C ' ' ' ' ' ' 8 $ $!N !N !N !N !N !N !N !NH* * * * *J * * * * * * * *]C * * * 8" 8" 8" 8" 8"f 8" 8" 8" 8"v ,*
*
*
*
*
* 2C *
*
*
Z &* ? ? ? ? ?D 355 r defence360agent/contracts/__pycache__/sentry.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000013661 00000000000 021752 0 ustar
r_j\ J d dl mZ d dlmZmZmZ d dlmZ d dlm Z d Z
e d Z e d Z da
d Zd
ed dfd Zd
ed dfdZded dfdZded dfdZded dfdZdedz d dfdZdedz d dfdZded dfdZded dfdZded dfd Zd efd Zd ed efd Z d!d Z dS )" )Path)DEVNULLCalledProcessError check_output)Any)stub_unexpected_errorc t | t }n# t t f$ r Y d S w xY w| dd S )N)stderrzutf-8ignore)errors)r r FileNotFoundErrorr decodestrip)cmdouts U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/sentry.py_run_cmdr sg 3w/// 1 2 tt ::gh: / / 5 5 7 77s ..c t dg } | r| S t dg }|r|S t g d }|r|S dS )Nzsystemd-detect-virtz virt-what) dmidecodez-szsystem-manufacturerzfail to detect)r ) systemd_virt virt_whatdemicodes r _get_virtualization_typer se 2 344L + ''I BBBCCH c B dd l } | j dz S )Nr i )psutilvirtual_memorytotal)r s r _get_total_ramr # s% MMM " " (E 11r Nc t jddlm} i dd dd dd d t | j dd dd d t d
d d d d t
d
d dd dd dd dd dd a t S )Nr
OsReleaseInfo
av_version core_versionversion
os_detailsip
hosting_panel total_ramfirewallstrategyvirtualization server_idiaidname
test_build_idtest_build_job_idtest_parent_build_id)_TAGSdefence360agent.utilsr" r pretty_namer r r! s r _tagsr6 - s }777777
$
D
t
J/
0IJJLL
$
T
))
6 8 8
D
D
T
#D!
$ Lr r* returnc ( | t d< d S )Nr* r6 )r* s r set_firewall_typer: G "EGGJr panelc ( | t d< d S )Nr( r9 )r< s r set_hosting_panelr> K s $EGGO r r+ c ( | t d< d S )Nr+ r9 )r+ s r set_strategyr@ O r; r r' c ( | t d< d S )Nr' r9 )r' s r set_iprB S s EGGDMMMr productc ( | t d< d S )Nr/ r9 )rC s r set_product_namerE W s EGGFOOOr idc ( | t d< d S )Nr- r9 )rF s r
set_server_idrH [ s EGGKr r. c ( | t d< d S )Nr. r9 )r. s r set_iaidrJ _ s EGGFOOOr r% c ( | t d< d S )Nr% r9 r% s r set_versionrM c s EGGIr c ( | t d< d S )Nr# r9 rL s r set_av_versionrO g s #EGGLr c ( | t d< d S )Nr$ r9 rL s r set_core_versionrQ k s %EGGNr c B t S N)r6 copy r r tagsrV o s 77<<>>r r/ c * t | S rS r9 )r/ s r tagrX s s 774=r c , t d dft d dft d dffD ]`\ } }| rG | t |< P# t
$ r Y \w xY wadS )z2Set tags for sentry events about test environment.z /var/imunify360/TEST_BUILD_IDr0 z!/var/imunify360/TEST_BUILD_JOB_IDr1 z$/var/imunify360/TEST_PARENT_BUILD_IDr2 N)r exists read_textr r6 Exception) file_namerX s r set_test_envr^ w s
0 1 1
4 5 5
7 8 8 "
3
( 2 2 4 4 : : < <
s
5B
BB)r7 N) pathlibr
subprocessr r r typingr r4 r r r r r3 r6 strr: r> r@ rB rE rH rJ rM rO rQ dictrV rX r^ rU r r <module>rd so @ @ @ @ @ @ @ @ @ @ 8 7 7 7 7 78 8 8
2 2 2
4# # # # # #%S %T % % % %#3 #4 # # # #s t c d cDj T 3: $ ! ! ! ! ! !$C $D $ $ $ $&c &d & & & &d c c r defence360agent/contracts/__pycache__/sentry.cpython-311.pyc 0000644 0000000 0000000 00000013661 00000000000 021013 0 ustar
r_j\ J d dl mZ d dlmZmZmZ d dlmZ d dlm Z d Z
e d Z e d Z da
d Zd
ed dfd Zd
ed dfdZded dfdZded dfdZded dfdZdedz d dfdZdedz d dfdZded dfdZded dfdZded dfd Zd efd Zd ed efd Z d!d Z dS )" )Path)DEVNULLCalledProcessError check_output)Any)stub_unexpected_errorc t | t }n# t t f$ r Y d S w xY w| dd S )N)stderrzutf-8ignore)errors)r r FileNotFoundErrorr decodestrip)cmdouts U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/sentry.py_run_cmdr sg 3w/// 1 2 tt ::gh: / / 5 5 7 77s ..c t dg } | r| S t dg }|r|S t g d }|r|S dS )Nzsystemd-detect-virtz virt-what) dmidecodez-szsystem-manufacturerzfail to detect)r ) systemd_virt virt_whatdemicodes r _get_virtualization_typer se 2 344L + ''I BBBCCH c B dd l } | j dz S )Nr i )psutilvirtual_memorytotal)r s r _get_total_ramr # s% MMM " " (E 11r Nc t jddlm} i dd dd dd d t | j dd dd d t d
d d d d t
d
d dd dd dd dd dd a t S )Nr
OsReleaseInfo
av_version core_versionversion
os_detailsip
hosting_panel total_ramfirewallstrategyvirtualization server_idiaidname
test_build_idtest_build_job_idtest_parent_build_id)_TAGSdefence360agent.utilsr" r pretty_namer r r! s r _tagsr6 - s }777777
$
D
t
J/
0IJJLL
$
T
))
6 8 8
D
D
T
#D!
$ Lr r* returnc ( | t d< d S )Nr* r6 )r* s r set_firewall_typer: G "EGGJr panelc ( | t d< d S )Nr( r9 )r< s r set_hosting_panelr> K s $EGGO r r+ c ( | t d< d S )Nr+ r9 )r+ s r set_strategyr@ O r; r r' c ( | t d< d S )Nr' r9 )r' s r set_iprB S s EGGDMMMr productc ( | t d< d S )Nr/ r9 )rC s r set_product_namerE W s EGGFOOOr idc ( | t d< d S )Nr- r9 )rF s r
set_server_idrH [ s EGGKr r. c ( | t d< d S )Nr. r9 )r. s r set_iaidrJ _ s EGGFOOOr r% c ( | t d< d S )Nr% r9 r% s r set_versionrM c s EGGIr c ( | t d< d S )Nr# r9 rL s r set_av_versionrO g s #EGGLr c ( | t d< d S )Nr$ r9 rL s r set_core_versionrQ k s %EGGNr c B t S N)r6 copy r r tagsrV o s 77<<>>r r/ c * t | S rS r9 )r/ s r tagrX s s 774=r c , t d dft d dft d dffD ]`\ } }| rG | t |< P# t
$ r Y \w xY wadS )z2Set tags for sentry events about test environment.z /var/imunify360/TEST_BUILD_IDr0 z!/var/imunify360/TEST_BUILD_JOB_IDr1 z$/var/imunify360/TEST_PARENT_BUILD_IDr2 N)r exists read_textr r6 Exception) file_namerX s r set_test_envr^ w s
0 1 1
4 5 5
7 8 8 "
3
( 2 2 4 4 : : < <
s
5B
BB)r7 N) pathlibr
subprocessr r r typingr r4 r r r r r3 r6 strr: r> r@ rB rE rH rJ rM rO rQ dictrV rX r^ rU r r <module>rd so @ @ @ @ @ @ @ @ @ @ 8 7 7 7 7 78 8 8
2 2 2
4# # # # # #%S %T % % % %#3 #4 # # # #s t c d cDj T 3: $ ! ! ! ! ! !$C $D $ $ $ $&c &d & & & &d c c r defence360agent/contracts/config.py 0000644 0000000 0000000 00000140174 00000000000 014374 0 ustar """
All the config settings for defence360 in one place
"""
import functools
import logging
import os
from abc import abstractmethod
from bisect import bisect_left, bisect_right
from contextvars import ContextVar
from copy import deepcopy
from datetime import datetime, timedelta
from enum import Enum
from pathlib import Path
from typing import (
Any,
Callable,
Dict,
List,
Mapping,
Optional,
Protocol,
Sequence,
Tuple,
Union,
_ProtocolMeta,
)
from cerberus import Validator
from defence360agent.contracts.config_provider import (
CachedConfigReader,
ConfigError,
ConfigReader,
UserConfigReader,
WriteOnlyConfigReader,
)
from defence360agent.feature_management.checkers import (
config_cleanup as fm_config_cleanup,
)
from defence360agent._version import __version__ as core_version
from defence360agent.utils import Singleton, dict_deep_update, importer
av_version = importer.get(
module="imav._version", name="__version__", default=None
)
logger = logging.getLogger(__name__)
ANTIVIRUS_MODE = not importer.exists("im360")
# feature flag for those clients who want to test Myimunify
FREEMIUM_FEATURE_FLAG = "/var/imunify360/myimunify-freemium.flag"
MY_IMUNIFY_KEY = "MY_IMUNIFY"
_version = importer.get(
module="im360._version", name="__version__", default=av_version
)
AGENT_CONF = "../."
CONFIG_VALIDATORS_DIR_PATH = Path(
os.environ.get(
"IM360_CONFIG_SCHEMA_PATH",
"/opt/imunify360/venv/share/imunify360/config_schema/",
)
)
# TODO: remove after av-7.16.0 release
NOTIFY, CLEANUP = "notify", "cleanup"
NONE, DAY, WEEK, MONTH = "none", "day", "week", "month"
DEFAULT_INTENSITY_CPU = 2
DEFAULT_INTENSITY_IO = 2
DEFAULT_INTENSITY_RAM = 2048
DEFAULT_INTENSITY_RESIDENT_RAM = 2048
DEFAULT_RESOURCE_MANAGEMENT_CPU_LIMIT = 2
DEFAULT_RESOURCE_MANAGEMENT_IO_LIMIT = 2
DEFAULT_RESOURCE_MANAGEMENT_RAM_LIMIT = 500
MODSEC_RULESET_FULL = "FULL"
MODSEC_RULESET_MINIMAL = "MINIMAL"
_DOS_DETECTOR_DEFAULT_LIMIT = 250
_DOS_DETECTOR_MIN_LIMIT = 1
_DOS_DETECTOR_MIN_INTERVAL = 1
PORT_BLOCKING_MODE_DENY = "DENY"
PORT_BLOCKING_MODE_ALLOW = "ALLOW"
DO_NOT_MODIFY_DISCLAMER = """\
############################################################################
# DO NOT MODIFY THIS FILE!!! #
# USE /etc/sysconfig/imunify360/imunify360.config.d/ TO OVERRIDE DEFAULTS #
############################################################################
"""
DEFAULT_CONFIG_DISCLAMER = """\
############################################################################
# DO NOT MODIFY THIS FILE!!! #
# USE /etc/sysconfig/imunify360/imunify360.config.d/ TO OVERRIDE DEFAULTS #
# This is an example of default values only #
# Changing this file will have no effect #
############################################################################
"""
CPANEL, PLESK, DIRECTADMIN = "cpanel", "plesk", "directadmin"
ACRONIS, R1SOFT, CLUSTERLOGICS = "acronis", "r1soft", "clusterlogics"
SAMPLE_BACKEND = "sample"
CLOUDLINUX, CLOUDLINUX_ON_PREMISE = "cloudlinux", "cloudlinux_on_premise"
GENERIC_SENSOR_SOCKET_PATH = "/var/run/defence360agent/generic_sensor.sock.2"
def int_from_envvar(var: str, default: int, env: Mapping = os.environ) -> int:
try:
return int(env[var])
except KeyError:
return default
except ValueError as e:
raise ValueError("{}: integer required".format(var)) from e
def bool_from_envvar(
var: str, default: bool, env: Mapping = os.environ
) -> bool:
TRUE_VALS = ("true", "t", "yes", "y", "1")
FALSE_VALS = ("false", "f", "no", "n", "0")
try:
val = env[var]
except KeyError:
return default
else:
val = val.lower()
if val in TRUE_VALS:
return True
if val in FALSE_VALS:
return False
raise ValueError(
"{}: should be one of {}".format(var, TRUE_VALS + FALSE_VALS)
)
def _self_rel2abs(relpath):
return os.path.join(os.path.dirname(__file__), relpath)
def conf_rel2abs(relpath):
return os.path.join(os.path.dirname(_self_rel2abs(AGENT_CONF)), relpath)
def _slurp_file(path):
"""Returns content for existing file, otherwise None"""
try:
with open(path, "r") as f:
return f.read().strip()
except OSError:
return None
def choose_value_from_config(
section, option, username: str | None = None
) -> Tuple[Any, str | None]:
"""
Choose action for config option by checking EndUser's Imunify360
config and Admin config. Admins config applies only if EndUser
didn't set the default action
"""
user_config = ConfigFile(username=username).config_to_dict()
user_section = user_config.get(section)
if user_section is not None:
user_value = user_section.get(option)
if user_value is not None:
return user_value, username
logger.debug("Cannot read %s:%s from user config", section, option)
root_config = ConfigFile().config_to_dict()
return root_config[section][option], UserType.ROOT
def is_mi_freemium_license():
"""
Just checks if this is server with MyImunify Freemium license
"""
return os.path.exists(FREEMIUM_FEATURE_FLAG)
class FromConfig:
def __init__(self, section, option=None, config_cls=None):
self.section = section
self.option = option
self._config_cls = config_cls
self._config_instance = None
def __get__(self, instance, owner):
if self._config_instance is None:
if self._config_cls is None:
self._config_instance = ConfigFile()
else:
self._config_instance = self._config_cls()
section_value = self._config_instance.config_to_dict()[self.section]
if self.option is not None:
return section_value[self.option]
return section_value
class FromFlagFile:
LOCATION = Path("/var/imunify360")
def __init__(self, name, *, coerce=bool, default=...):
self.name = name
self.coerce = coerce
self.default = default
def __get__(self, instance, owner):
path = self.LOCATION / self.name
if path.exists():
return self.coerce(path.read_text() or self.default)
def _get_combined_validation_schema(*, root=True):
func_name = "get_root_config" if root else "get_non_root_config"
combined_schema = {}
for module in importer.iter_modules([CONFIG_VALIDATORS_DIR_PATH]):
get_schema = getattr(module, func_name, lambda: {})
schema = get_schema()
dict_deep_update(combined_schema, schema, allow_overwrite=False)
return combined_schema
@functools.lru_cache(maxsize=1)
def config_schema_root():
return _get_combined_validation_schema()
@functools.lru_cache(maxsize=1)
def config_schema_non_root():
return _get_combined_validation_schema(root=False)
CONFIG_SCHEMA_CUSTOM_BILLING = {
"CUSTOM_BILLING": {
"type": "dict",
"schema": {
"upgrade_url": {
"type": "string",
"default": None,
"nullable": True,
},
"upgrade_url_360": {
"type": "string",
"default": None,
"nullable": True,
},
"billing_notifications": {"type": "boolean", "default": True},
"ip_license": {"type": "boolean", "default": True},
},
"default": {},
}
}
class ConfigValidationError(Exception):
pass
class Core:
PRODUCT = "imunify360"
NAME = "%s agent" % PRODUCT if not ANTIVIRUS_MODE else "imunify antivirus"
AV_VERSION = av_version
CORE_VERSION = core_version
VERSION = _version # AV or IM360
API_BASE_URL = os.environ.get(
"IMUNIFY360_API_URL", "https://api.imunify360.com"
)
DEFAULT_SOCKET_TIMEOUT = 10
DIST = ".el7"
FILE_UMASK = 0o007
TMPDIR = "/var/imunify360/tmp"
MERGED_CONFIG_FILE_NAME = "imunify360-merged.config"
MERGED_NONPRIVILEGED_CONFIG_FILE_NAME = (
"imunify360-merged-nonprivileged.config"
)
USER_CONFIG_FILE_NAME = "imunify360.config"
LOCAL_CONFIG_FILE_NAME = "imunify360.config"
CONFIG_DIR = "/etc/imunify360"
USER_CONFDIR = os.path.join(CONFIG_DIR, "user_config")
GLOBAL_CONFDIR = "/etc/sysconfig/imunify360"
MERGED_CONFIG_FILE_PATH = os.path.join(
GLOBAL_CONFDIR, MERGED_CONFIG_FILE_NAME
)
MERGED_NONPRIVILEGED_CONFIG_FILE_PATH = os.path.join(
GLOBAL_CONFDIR, MERGED_NONPRIVILEGED_CONFIG_FILE_NAME
)
MERGED_CONFIG_FILE_PERMISSION = 0o640
MERGED_NONPRIVILEGED_CONFIG_FILE_PERMISSION = 0o644
LOCAL_CONFIG_FILE_PATH = os.path.join(GLOBAL_CONFDIR, "imunify360.config")
CONFIG_D_NAME = "imunify360.config.d"
BACKUP_CONFIGFILENAME = ".imunify360.backup_config"
HOOKS_CONFIGFILENAME = "hooks.yaml"
CUSTOM_BILLING_CONFIGFILENAME = "custom_billing.config"
INBOX_HOOKS_DIR = "/var/imunify360/hooks"
SVC_NAME = (
"imunify360-agent" if not ANTIVIRUS_MODE else "imunify-antivirus"
)
UNIFIED_ACCESS_LOGGER_CONFIGFILENAME = "unified-access-logger.conf"
GO_FLAG_FILE = Path("/etc/sysconfig/imunify360/.go_agent")
SIGNAL_HANDLER_MIGRATION_TIMEOUT_SECS = 60
class IConfig(Protocol):
@abstractmethod
def config_to_dict(
self, normalize: bool = True, force_read: bool = False
) -> dict:
raise NotImplementedError
@abstractmethod
def dict_to_config(
self,
data: Mapping,
validate: bool = True,
normalize: bool = True,
overwrite: bool = False,
without_defaults: bool = False,
) -> None:
raise NotImplementedError
@abstractmethod
def validate(self) -> None:
raise NotImplementedError
@abstractmethod
def normalize(
self, config: Mapping, without_defaults: bool = False
) -> dict:
raise NotImplementedError
@abstractmethod
def modified_since(self, timestamp: Optional[float]) -> bool:
raise NotImplementedError
def get(self, section: str, option: Optional[str]) -> Any:
if option:
return self.config_to_dict().get(section, {}).get(option)
return None
def set(self, section: str, option: Optional[str], value: Any) -> None:
if option:
self.dict_to_config({section: {option: value}})
class IConfigFile(IConfig, Protocol):
path: str
class ProtocolSingleton(_ProtocolMeta, Singleton):
"""
Needed to avoid metaclass conflict when implementing protocols that are
also Singletons
"""
class Normalizer:
def __init__(self, validation_schema):
self._config: Optional[Mapping] = None
self._normalized_config: dict = {}
self._schema = ConfigsValidator.get_validation_schema(
validation_schema
)
self._schema_without_defaults = self._get_schema_without_defaults(
self._schema
)
@classmethod
def _get_schema_without_defaults(cls, _dict: Mapping) -> dict:
return {
key: cls._get_schema_without_defaults(value)
if isinstance(value, dict)
else value
for key, value in _dict.items()
if key not in ["default", "default_setter"]
}
@staticmethod
def remove_null(config: Mapping) -> dict:
new_config: Dict[str, Union[dict, List[Tuple]]] = {}
for section, options in config.items():
# We only support dict for option removal
if isinstance(options, dict):
for option, value in options.items():
if value is not None:
new_config.setdefault(section, {})[option] = value
elif options:
# Let cerberus coerce this to dict
# and leave the None's as is
new_config[section] = options
return new_config
@staticmethod
def _normalize_with_schema(config: Mapping, schema) -> dict:
validator = ConfigValidator(schema)
normalized: Optional[dict] = validator.normalized(config)
if validator.errors:
raise ConfigValidationError(validator.errors)
if normalized is None:
raise ConfigValidationError(f"Cerberus returned None for {config}")
return normalized
def normalize(self, config: Mapping, without_defaults: bool) -> dict:
schema = (
self._schema_without_defaults if without_defaults else self._schema
)
if without_defaults:
config = self.remove_null(config)
return self._normalize_with_schema(config, schema)
# Utilize cache
if config == self._config:
return self._normalized_config
normalized = self._normalize_with_schema(config, schema)
self._config = config
self._normalized_config = normalized
return self._normalized_config
class Config(IConfig, metaclass=ProtocolSingleton):
DISCLAIMER = ""
def __init__(
self,
*,
# FIXME: allow pathlib.Path
path: str = None,
config_reader: ConfigReader = None,
validation_schema: Union[Mapping, Callable[[], Mapping]] = None,
disclaimer: str = None,
cached: bool = True,
permissions: int = None,
):
super().__init__()
assert path or config_reader
config_reader_cls = CachedConfigReader if cached else ConfigReader
self._config_reader = config_reader or config_reader_cls(
path,
disclaimer=disclaimer or self.DISCLAIMER,
permissions=permissions,
)
self.path = self._config_reader.path
self.validation_schema = validation_schema or config_schema_root
self._normalizer = Normalizer(self.validation_schema)
def __repr__(self):
return (
"<{classname}(config_reader={config_reader!r},"
" validation_schema={validation_schema!r})"
">"
).format(
classname=self.__class__.__qualname__,
config_reader=self._config_reader,
validation_schema=self.validation_schema,
)
def normalize(self, config: Mapping, without_defaults=False) -> dict:
return self._normalizer.normalize(config, without_defaults)
def config_to_dict(self, normalize=True, force_read: bool = False) -> dict:
"""
Converts config file to dict
:return dict: dictionary (key (section) / value (options))
"""
config = self._config_reader.read_config_file(force_read=force_read)
if normalize:
config = self.normalize(config)
return deepcopy(config)
def dict_to_config(
self,
data: Mapping,
validate: bool = True,
normalize: bool = True,
overwrite: bool = False,
without_defaults: bool = False,
) -> None:
"""
Converts dict to config file
New options will be mixed in with old ones
unless overwrite is specified
:param dict data: dictionary (key (section) / value (options))
:param bool validate: indicates if we need validation
:param bool normalize: normalize config
:param overwrite: overwrite existing conf
:param without_defaults: do not fill defaults
:return: None
"""
if overwrite:
self._dict_to_config_overwrite(
data=data,
validate=validate,
normalize=normalize,
without_defaults=without_defaults,
)
else:
self._dict_to_config(
data=data,
validate=validate,
normalize=normalize,
without_defaults=without_defaults,
)
def _dict_to_config_overwrite(
self, data, validate, normalize, without_defaults
):
if validate:
ConfigsValidator.validate(data, self.validation_schema)
if normalize:
data = self.normalize(data, without_defaults=without_defaults)
self._config_reader.write_config_file(data)
def _dict_to_config(self, data, validate, normalize, without_defaults):
config = deepcopy(self._config_reader.read_config_file())
if dict_deep_update(config, data):
if validate:
ConfigsValidator.validate(config, self.validation_schema)
if normalize:
config = self.normalize(
config, without_defaults=without_defaults
)
self._config_reader.write_config_file(config)
def validate(self):
"""
:raises ConfigsValidatorError
"""
try:
config_dict = self._config_reader.read_config_file(
ignore_errors=False
)
except ConfigError as e:
message = "Error during config validation"
logger.error("%s: %s", message, e)
raise ConfigsValidatorError({self: message}) from e
try:
ConfigsValidator.validate(config_dict, self.validation_schema)
except ConfigValidationError as e:
message = "Imunify360 config does not match the scheme"
logger.error("%s: %s", message, e)
raise ConfigsValidatorError({self: message}) from e
def modified_since(self, timestamp: Optional[float]) -> bool:
return self._config_reader.modified_since(timestamp)
class UserConfig(Config):
def __init__(self, *, username):
self.username = username
path = os.path.join(
Core.USER_CONFDIR, username, Core.USER_CONFIG_FILE_NAME
)
super().__init__(
path=path,
config_reader=UserConfigReader(path, username),
validation_schema=config_schema_non_root,
)
class SystemConfig(IConfig, metaclass=ProtocolSingleton):
def __init__(
self,
*,
local_config: Config = None,
merged_config: Config = None,
nonpriv_merged_config: Config = None,
):
super().__init__()
self._local_config = local_config or LocalConfig()
self._merged_config = merged_config or MergedConfig()
self._nonpriv_merged_config = (
nonpriv_merged_config or MergedNonPrivilegedConfig()
)
def config_to_dict(
self, normalize: bool = True, force_read: bool = False
) -> dict:
return self._merged_config.config_to_dict(
normalize=normalize, force_read=force_read
)
def dict_to_config(
self,
data: Mapping,
validate: bool = True,
normalize: bool = True,
overwrite: bool = False,
without_defaults: bool = True,
) -> None:
self._local_config.dict_to_config(
data,
validate=validate,
normalize=normalize,
overwrite=overwrite,
without_defaults=without_defaults,
)
def validate(self) -> None:
self._merged_config.validate()
self._nonpriv_merged_config.validate()
def normalize(
self, config: Mapping, without_defaults: bool = False
) -> dict:
return self._merged_config.normalize(
config=config, without_defaults=without_defaults
)
def modified_since(self, timestamp: Optional[float]) -> bool:
return self._merged_config.modified_since(timestamp)
def config_file_factory(
username: Optional[Union[str, int]] = None, path: Optional[str] = None
) -> IConfig:
if username and not isinstance(username, int):
return UserConfig(username=username)
elif path:
return Config(path=path)
else:
return SystemConfig()
# TODO: move all layer related functions to another module
def any_layer_modified_since(timestamp) -> bool:
merger = Merger(Merger.get_layer_names())
for layer in merger.layers:
if layer.modified_since(timestamp):
return True
return False
MergedConfig = functools.partial(
Config,
config_reader=WriteOnlyConfigReader(
path=Core.MERGED_CONFIG_FILE_PATH,
disclaimer=DO_NOT_MODIFY_DISCLAMER,
permissions=Core.MERGED_CONFIG_FILE_PERMISSION,
),
)
MergedNonPrivilegedConfig = functools.partial(
Config,
config_reader=WriteOnlyConfigReader(
path=Core.MERGED_NONPRIVILEGED_CONFIG_FILE_PATH,
disclaimer=DO_NOT_MODIFY_DISCLAMER,
permissions=Core.MERGED_NONPRIVILEGED_CONFIG_FILE_PERMISSION,
),
)
class LocalConfig(Config):
"""
Config (/etc/sysconfig/imunify360/imunify360.config) should contain
options changed by a customer only
"""
def __init__(
self,
*,
path=Core.LOCAL_CONFIG_FILE_PATH, # overrides the parent default value
config_reader: ConfigReader = None,
validation_schema: Union[Mapping, Callable[[], Mapping]] = None,
disclaimer: str = None,
cached=False, # overrides the parent default value
):
super().__init__(
path=path,
config_reader=config_reader,
validation_schema=validation_schema,
disclaimer=disclaimer,
cached=cached,
)
def dict_to_config(
self,
data: Mapping,
validate: bool = True,
normalize: bool = True,
overwrite: bool = False,
without_defaults: bool = True, # overrides the parent default value
) -> None:
return super().dict_to_config(
data,
validate=validate,
normalize=normalize,
overwrite=overwrite,
without_defaults=without_defaults,
)
class BaseMerger:
DIR = os.path.join(Core.GLOBAL_CONFDIR, Core.CONFIG_D_NAME)
LOCAL_CONFIG_NAME = "90-local.config"
def __init__(self, names, include_defaults=False):
self._include_defaults = include_defaults
self.layers = [
Config(path=os.path.join(self.DIR, name)) for name in names
]
@classmethod
def get_layer_names(cls):
return sorted(os.listdir(cls.DIR)) if os.path.isdir(cls.DIR) else []
def configs_to_dict(self, force_read=False):
layer_dict_list = []
if self._include_defaults:
defaults = Normalizer(config_schema_root).normalize(
{}, without_defaults=False
)
layer_dict_list.append(defaults)
layer_dict_list += [
layer.config_to_dict(normalize=False, force_read=force_read)
for layer in self.layers
]
return self._build_effective_config(layer_dict_list)
@classmethod
def _build_effective_config(cls, layer_dict_list: list):
effective: Dict[str, dict] = {}
for layer_dict in layer_dict_list:
for section, options in layer_dict.items():
if options is None:
continue
if section not in effective:
effective[section] = {}
for option, value in options.items():
if value is not None:
effective[section][option] = value
return effective
class MutableMerger(BaseMerger):
def __init__(self, names: Sequence):
idx = bisect_left(names, self.LOCAL_CONFIG_NAME)
names = names[:idx]
super().__init__(names, include_defaults=True)
class ImmutableMerger(BaseMerger):
def __init__(self, names: Sequence):
idx = bisect_right(names, self.LOCAL_CONFIG_NAME)
names = names[idx:]
super().__init__(names, include_defaults=False)
class NonBaseMerger(BaseMerger):
def __init__(self, names: Sequence):
super().__init__(names, include_defaults=False)
class Merger(BaseMerger):
NONPRIVILEGED_SETTINGS = {
"PROACTIVE_DEFENCE": None, # entire section
"PERMISSIONS": [
"user_override_proactive_defense",
],
"INCIDENT_LOGGING": [
"num_days",
"limit",
],
"ERROR_REPORTING": [
"enable",
],
# modsec_scan_wrapper.sh reads this before invoking real malware
# scanning; surfacing it here lets us lock down the privileged file.
"MALWARE_SCANNING": [
"enable_scan_modsec",
],
}
def __init__(self, names):
super().__init__(names, include_defaults=True)
@classmethod
def update_merged_config(cls):
merger = cls(cls.get_layer_names())
config_dict = merger.configs_to_dict()
# DEF-42492: ConfigReader silently swallows FileNotFoundError as
# {}, so a layer file that came from get_layer_names() but is
# unreadable when opened (a TOCTOU race during yum upgrades or
# similar) would silently degrade the merged config to schema
# defaults. Re-check existence post-read and abort the persistent
# merged-config write if any layer is missing — the previously-
# good imunify360-merged.config is preserved instead. The check
# is scoped to update_merged_config rather than BaseMerger so it
# does not break read-only callers (migrations, RPC endpoints).
# lexists() (matching listdir's no-symlink-follow semantics) so a
# broken symlink — entry present, target missing — is treated as
# a legitimate empty layer rather than a disappeared one. The
# agent integration image ships such a symlink intentionally
# (10_on_first_install.config -> nonexistent target).
for layer in merger.layers:
if not os.path.lexists(layer.path):
logger.warning(
"Aborting merged config update: "
"Config layer %s disappeared during merge",
layer.path,
)
return
try:
ConfigsValidator.validate(config_dict)
except (ConfigsValidatorError, ConfigValidationError) as e:
logger.warning("Config file is invalid! %s", e)
else:
# Re-normalize to apply coercers that depend on other config values
# (e.g., user_override_proactive_defense depends on MY_IMUNIFY.enable)
normalizer = Normalizer(config_schema_root)
config_dict = normalizer.normalize(
config_dict, without_defaults=False
)
priv_dict, nonpriv_dict = cls._split_settings(config_dict)
MergedConfig().dict_to_config(priv_dict, validate=False)
MergedNonPrivilegedConfig().dict_to_config(
nonpriv_dict, validate=False, normalize=False
)
@classmethod
def _split_settings(cls, config_dict: dict) -> tuple:
"""Split config into privileged and non-privileged parts.
Non-privileged config is a subset of privileged config - both contain
the same values for settings listed in NONPRIVILEGED_SETTINGS.
"""
priv_dict = deepcopy(config_dict)
nonpriv_dict: Dict[str, dict] = {}
for section, options in cls.NONPRIVILEGED_SETTINGS.items():
if section not in config_dict:
continue
if options is None:
# None means entire section is copied to nonprivileged
nonpriv_dict[section] = deepcopy(config_dict[section])
else:
for option in options:
if option in config_dict[section]:
if section not in nonpriv_dict:
nonpriv_dict[section] = {}
nonpriv_dict[section][option] = config_dict[section][
option
]
return priv_dict, nonpriv_dict
class ConfigValidator(Validator):
def __init__(
self,
*args,
allow_unknown=ANTIVIRUS_MODE,
purge_readonly=True,
**kwargs,
):
"""
Initialises ConfigValidator(Validator)
for more details on Validator params please check
https://docs.python-cerberus.org/en/stable/validation-rules.html
"""
super().__init__(
*args,
allow_unknown=allow_unknown,
purge_readonly=purge_readonly,
**kwargs,
)
def _normalize_coerce_user_override_pd_rules(self, value):
if self.root_document.get("MY_IMUNIFY", {}).get("enable", False):
return True
return value
class Packaging:
DATADIR = "/opt/imunify360/venv/share/%s" % Core.PRODUCT
class SimpleRpc:
# how long to wait for the response from RPC server in seconds
CLIENT_TIMEOUT = 3600
SOCKET_PATH = "/var/run/defence360agent/simple_rpc.sock"
# end-user stuff
NON_ROOT_SOCKET_PATH = "/var/run/defence360agent/non_root_simple_rpc.sock"
TOKEN_FILE_TMPL = ".imunify360_token_{suffix}"
# -r--------
TOKEN_MASK = 0o400
SOCKET_ACTIVATION = bool_from_envvar(
"I360_SOCKET_ACTIVATION",
ANTIVIRUS_MODE,
)
INACTIVITY_TIMEOUT = int_from_envvar(
"IMUNIFY360_INACTIVITY_TIMEOUT",
int(timedelta(minutes=5).total_seconds()),
)
MAX_CONCURRENT_CONNECTIONS = int_from_envvar(
"I360_RPC_MAX_CONNECTIONS", 256
)
READ_TIMEOUT = int_from_envvar(
"I360_RPC_READ_TIMEOUT",
int(timedelta(minutes=5).total_seconds()),
)
class Model:
# type sqlite3 - sqlite only supported
PATH = "/var/%s/%s.db" % (Core.PRODUCT, Core.PRODUCT)
PROACTIVE_PATH = "/var/%s/proactive.db" % (Core.PRODUCT,)
RESIDENT_PATH = "/var/%s/%s-resident.db" % (Core.PRODUCT, Core.PRODUCT)
class FilesUpdate:
# Check files update periodically
PERIOD = timedelta(minutes=30).total_seconds()
# Timeout for single Index update (group of files) DEF-11501
# It has to be less than watchdog timeout (60 min)
TIMEOUT = timedelta(minutes=15).total_seconds()
# Timeout for individual socket operations (connect, recv/read, etc.)
# For instance ssl-handshake timeout == SOCKET_TIMEOUT
# Than less the value than better, to do not wait to long
SOCKET_TIMEOUT = 3 # seconds
# Following settings applicable only for IM360:
# File types that should be downloaded but not applied
# to the system (e.g. for testing purposes)
DISABLED = []
# How long to keep the files on the disk
DAYS_TO_KEEP = 30
class CountryInfo:
DB = "/var/imunify360/files/geo/v1/GeoLite2-Country.mmdb"
LOCATIONS_DB = (
"/var/imunify360/files/geo/v1/GeoLite2-Country-Locations-en.csv"
)
@staticmethod
def country_subnets_file(country_code):
return "/var/imunify360/files/geo/v1/CountrySubnets-{}.txt".format(
country_code
)
class Sentry:
DSN = os.getenv(
"IMUNITY360_SENTRY_DSN", _slurp_file("%s/sentry" % Packaging.DATADIR)
)
ENABLE = FromConfig("ERROR_REPORTING", "enable")
class Malware:
SCAN_CHECK_PERIOD = 300
CONSECUTIVE_ERROR_LIMIT = 10
INOTIFY_SCAN_PERIOD = 60
CONFIG_CHECK_PERIOD = 30
CONFLICTS_CHECK_PERIOD = 300
MAX_TARGETS_PER_SCAN_TYPE = FromConfig(
"MALWARE_SCANNING", "max_targets_per_scan_type"
)
MAX_PATH_LEN = FromConfig("MALWARE_SCANNING", "max_path_len")
INOTIFY_ENABLED = FromConfig("MALWARE_SCANNING", "enable_scan_inotify")
PURE_SCAN = FromConfig("MALWARE_SCANNING", "enable_scan_pure_ftpd")
SEND_FILES = FromConfig("MALWARE_SCANNING", "sends_file_for_analysis")
CLOUD_ASSISTED_SCAN = FromConfig("MALWARE_SCANNING", "cloud_assisted_scan")
RAPID_SCAN = FromConfig("MALWARE_SCANNING", "rapid_scan")
CRONTABS_SCAN_ENABLED = FromConfig("MALWARE_SCANNING", "crontabs")
SCANS_PATH = "/var/imunify360/aibolit/scans.pickle"
FILE_PREVIEW_BYTES_NUM = 1024 * 100 # 100 KB
CLEANUP_STORAGE = "/var/imunify360/cleanup_storage"
CLEANUP_TRIM = FromConfig(
section="MALWARE_CLEANUP",
option="trim_file_instead_of_removal",
)
CLEANUP_KEEP = FromConfig(
section="MALWARE_CLEANUP",
option="keep_original_files_days",
)
SCAN_MODIFIED_FILES = FromConfig(
section="MALWARE_SCANNING",
option="scan_modified_files",
)
MAX_SIGNATURE_SIZE_TO_SCAN = FromConfig(
"MALWARE_SCANNING", "max_signature_size_to_scan"
)
MAX_CLOUDSCAN_SIZE_TO_SCAN = FromConfig(
"MALWARE_SCANNING", "max_cloudscan_size_to_scan"
)
MAX_MRS_UPLOAD_FILE = FromConfig("MALWARE_SCANNING", "max_mrs_upload_file")
RAPID_SCAN_RESCAN_UNCHANGING_FILES_FREQUENCY = FromConfig(
"MALWARE_SCANNING", "rapid_scan_rescan_unchanging_files_frequency"
)
HYPERSCAN = FromConfig("MALWARE_SCANNING", "hyperscan")
DATABASE_SCAN_ENABLED = FromConfig("MALWARE_DATABASE_SCAN", "enable")
CPANEL_SCAN_ENABLED = FromConfig("MALWARE_SCANNING", "enable_scan_cpanel")
CLEANUP_DISABLE_CLOUDAV = FromFlagFile("disable_cloudav")
MDS_DB_TIMEOUT = FromConfig("MALWARE_DATABASE_SCAN", "db_timeout")
class MalwareTune:
"""
Experimental and testing-only purpose settings
we don't want to expose to customers.
"""
USE_JSON_REPORT = FromFlagFile("use_json")
NO_CHECK_KNOWN_HASHES = FromFlagFile("no_check_known_hashes")
RAPID_SCAN_BASEDIR_OVERRIDE = FromFlagFile(
"rapid_scan_basedir_override", coerce=Path, default="/home"
)
NO_AUTO_UPGRADE = FromFlagFile("no_auto_upgrade")
class MalwareScanScheduleInterval:
NONE = NONE
DAY = DAY
WEEK = WEEK
MONTH = MONTH
class MalwareScanSchedule:
CMD = "/usr/bin/imunify360-agent malware user scan --background"
CRON_PATH = "/etc/cron.d/imunify_scan_schedule"
CRON_STRING = """\
# DO NOT EDIT. AUTOMATICALLY GENERATED.
0 {0} {1} * {2} root {cmd} >/dev/null 2>&1
"""
INTERVAL = FromConfig(
section="MALWARE_SCAN_SCHEDULE",
option="interval",
)
HOUR = FromConfig(
section="MALWARE_SCAN_SCHEDULE",
option="hour",
)
DAY_OF_WEEK = FromConfig(
section="MALWARE_SCAN_SCHEDULE",
option="day_of_week",
)
DAY_OF_MONTH = FromConfig(
section="MALWARE_SCAN_SCHEDULE",
option="day_of_month",
)
class MalwareScanIntensity:
CPU = FromConfig(
section="MALWARE_SCAN_INTENSITY",
option="cpu",
)
IO = FromConfig(
section="MALWARE_SCAN_INTENSITY",
option="io",
)
RAM = FromConfig(
section="MALWARE_SCAN_INTENSITY",
option="ram",
)
USER_CPU = FromConfig(
section="MALWARE_SCAN_INTENSITY",
option="user_scan_cpu",
)
USER_IO = FromConfig(
section="MALWARE_SCAN_INTENSITY",
option="user_scan_io",
)
USER_RAM = FromConfig(
section="MALWARE_SCAN_INTENSITY",
option="user_scan_ram",
)
RESIDENT_RAM = FromConfig(
section="MALWARE_SCAN_INTENSITY",
option="resident_ram",
)
class FileBasedResourceLimits:
CPU = FromConfig(
section="RESOURCE_MANAGEMENT",
option="cpu_limit",
)
IO = FromConfig(
section="RESOURCE_MANAGEMENT",
option="io_limit",
)
RAM = FromConfig(
section="RESOURCE_MANAGEMENT",
option="ram_limit",
)
class KernelCare:
EDF = FromConfig(
section="KERNELCARE",
option="edf",
)
def get_rapid_rescan_frequency():
value = Malware.RAPID_SCAN_RESCAN_UNCHANGING_FILES_FREQUENCY
if value is None:
freq = {
MalwareScanScheduleInterval.NONE: 1,
MalwareScanScheduleInterval.MONTH: 2,
MalwareScanScheduleInterval.WEEK: 5,
MalwareScanScheduleInterval.DAY: 10,
}
return freq.get(MalwareScanSchedule.INTERVAL, 1)
return value
class MalwareSignatures:
_dir = "/var/imunify360/files/sigs/v1/"
RFXN = os.path.join(_dir, "rfxn")
i360 = os.path.join(_dir, "i360")
AI_BOLIT_HOSTER = os.path.join(_dir, "aibolit", "ai-bolit-hoster-full.db")
AI_BOLIT_HYPERSCAN = os.path.join(_dir, "aibolit", "hyperscan")
MDS_AI_BOLIT_HOSTER = os.path.join(
_dir, "aibolit", "mds-ai-bolit-hoster.db"
)
PROCU_DB = os.path.join(_dir, "aibolit", "procu2.db")
MDS_PROCU_DB = os.path.join(_dir, "aibolit", "mds-procu2.db")
class Logger:
MAX_LOG_FILE_SIZE = FromConfig(
section="LOGGER",
option="max_log_file_size",
)
BACKUP_COUNT = FromConfig(
section="LOGGER",
option="backup_count",
)
# directory mode for main log directory and all inner
LOG_DIR_PERM = 0o700
# file mode for main log directory and all inner
LOG_FILE_PERM = 0o660
class UserType:
ROOT = "root"
NON_ROOT = "non_root"
# Set by RPC middleware to the authenticated caller; defaults to ROOT so
# non-RPC paths (migrations, workers, direct CLI) keep admin semantics.
caller_type: ContextVar[str] = ContextVar("caller_type", default=UserType.ROOT)
class UIRole:
CLIENT = "client"
ADMIN = "admin"
class NoCP:
# path to script implementing No CP API
CLIENT_SCRIPT = "/etc/imunify360/scripts/domains"
# latest version of the API supported by agent
LATEST_VERSION = 1
class CustomBillingConfig(Config):
def __init__(self):
path = os.path.join(
"/etc/sysconfig/imunify360", Core.CUSTOM_BILLING_CONFIGFILENAME
)
super().__init__(
path=path, validation_schema=CONFIG_SCHEMA_CUSTOM_BILLING
)
class CustomBilling:
UPGRADE_URL = FromConfig(
section="CUSTOM_BILLING",
option="upgrade_url",
config_cls=CustomBillingConfig,
)
UPGRADE_URL_360 = FromConfig(
section="CUSTOM_BILLING",
option="upgrade_url_360",
config_cls=CustomBillingConfig,
)
NOTIFICATIONS = FromConfig(
section="CUSTOM_BILLING",
option="billing_notifications",
config_cls=CustomBillingConfig,
)
IP_LICENSE = FromConfig(
section="CUSTOM_BILLING",
option="ip_license",
config_cls=CustomBillingConfig,
)
class PermissionsConfig:
USER_IGNORE_LIST = FromConfig(
section="PERMISSIONS",
option="user_ignore_list",
)
ALLOW_MALWARE_SCAN = FromConfig(
section="PERMISSIONS",
option="allow_malware_scan",
)
USER_OVERRIDE_MALWARE_ACTIONS = FromConfig(
section="PERMISSIONS", option="user_override_malware_actions"
)
USER_OVERRIDE_PROACTIVE_DEFENSE = FromConfig(
section="PERMISSIONS",
option="user_override_proactive_defense",
)
ALLOW_LOCAL_MALWARE_IGNORE_LIST_MANAGEMENT = FromConfig(
section="PERMISSIONS",
option="allow_local_malware_ignore_list_management",
)
USE_PLESK_SERVICE_PLAN = FromConfig(
section="PERMISSIONS",
option="use_plesk_service_plan",
)
ALLOW_WP_WAF_RULES_MANAGEMENT = FromConfig(
section="PERMISSIONS",
option="allow_wp_waf_rules_management",
)
class MyImunifyConfig:
ENABLED = FromConfig(
section="MY_IMUNIFY",
option="enable",
)
PURCHASE_PAGE_URL = FromConfig(
section="MY_IMUNIFY",
option="purchase_page_url",
)
class ControlPanelConfig:
SMART_ADVICE_ALLOWED = FromConfig(
section="CONTROL_PANEL",
option="smart_advice_allowed",
)
ADVICE_EMAIL_NOTIFICATION = FromConfig(
section="CONTROL_PANEL",
option="advice_email_notification",
)
def effective_user_config(admin_config, user_config):
allowed_sections = [
"BACKUP_RESTORE",
"MALWARE_CLEANUP",
"MALWARE_SCANNING",
"ERROR_REPORTING",
"PROACTIVE_DEFENCE",
"PERMISSIONS",
"MY_IMUNIFY",
"CONTROL_PANEL",
"MALWARE_SCAN_SCHEDULE",
"WORDPRESS",
]
overridable = {
(
"MALWARE_SCAN_SCHEDULE",
"interval",
): PermissionsConfig.USER_OVERRIDE_MALWARE_ACTIONS,
(
"MALWARE_SCAN_SCHEDULE",
"hour",
): PermissionsConfig.USER_OVERRIDE_MALWARE_ACTIONS,
(
"MALWARE_SCAN_SCHEDULE",
"day_of_week",
): PermissionsConfig.USER_OVERRIDE_MALWARE_ACTIONS,
(
"MALWARE_SCAN_SCHEDULE",
"day_of_month",
): PermissionsConfig.USER_OVERRIDE_MALWARE_ACTIONS,
(
"MALWARE_SCANNING",
"default_action",
): PermissionsConfig.USER_OVERRIDE_MALWARE_ACTIONS,
(
"PROACTIVE_DEFENCE",
"mode",
): PermissionsConfig.USER_OVERRIDE_PROACTIVE_DEFENSE,
}
admin_dict = admin_config.config_to_dict()
user_dict = user_config.config_to_dict()
# Users can disable WAF per-account when admin has it enabled,
# but cannot re-enable it when admin has disabled it globally.
overridable[("WORDPRESS", "waf_enabled")] = admin_dict.get(
"WORDPRESS", {}
).get("waf_enabled", True)
def normalize_section(section):
admin_options = deepcopy(admin_dict.get(section, {}))
user_options = deepcopy(user_dict.get(section, {}))
resulting_dict = {}
for option, admin_value in admin_options.items():
user_value = user_options.get(option)
if (
user_value is not None
# All options available to user are overridable by default
and overridable.get((section, option), True)
):
resulting_dict[option] = user_value
else:
resulting_dict[option] = admin_value
return resulting_dict
effective_config = {
section: normalize_section(section) for section in allowed_sections
}
return fm_config_cleanup(effective_config, user_config.username)
class HookEvents:
IM360_EVENTS = (
AGENT,
LICENSE,
MALWARE_SCANNING,
MALWARE_CLEANUP,
MALWARE_DETECTED,
) = (
"agent",
"license",
"malware-scanning",
"malware-cleanup",
"malware-detected",
)
IMAV_EVENTS = (
LICENSE,
MALWARE_SCANNING,
MALWARE_CLEANUP,
MALWARE_DETECTED,
)
EVENTS = IMAV_EVENTS if ANTIVIRUS_MODE else IM360_EVENTS
class ConfigsValidatorError(Exception):
def __init__(self, configs_to_errors: Dict[Config, str]):
self.configs_to_errors = configs_to_errors
def __repr__(self):
errors = []
for config, error in self.configs_to_errors.items():
errors.append(f"{config!r}: {error}")
return "\n".join(errors)
class ConfigsValidator:
"""A class that has methods to validate configs bypassing the cache"""
@classmethod
def validate_system_config(cls):
"""
Validate merged config
:raises ConfigsValidatorError
"""
SystemConfig().validate()
@classmethod
def validate_config_layers(cls):
"""
Validate all config layers, collect all errors
:raises ConfigsValidatorError
"""
configs_to_errors = {}
for layer in Merger(Merger.get_layer_names()).layers:
try:
layer.validate()
except ConfigsValidatorError as e:
configs_to_errors.update(e.configs_to_errors)
if configs_to_errors:
raise ConfigsValidatorError(configs_to_errors)
@classmethod
def validate(
cls,
config_dict: dict,
validation_schema: Union[dict, Callable] = config_schema_root,
) -> None:
"""
Validate config represented by a dict
:param config_dict: config to validate
:param validation_schema: schema to validate config against
:raises ConfigValidationError
"""
schema = cls.get_validation_schema(validation_schema)
v = ConfigValidator(schema)
if not v.validate(config_dict):
raise ConfigValidationError(v.errors)
@staticmethod
def get_validation_schema(
validation_schema: Union[Mapping, Callable],
) -> Mapping:
if callable(validation_schema):
return validation_schema()
return validation_schema
ConfigFile = config_file_factory
class AdminContacts:
ENABLE_ICONTACT_NOTIFICATIONS = FromConfig(
section="ADMIN_CONTACTS",
option="enable_icontact_notifications",
)
class IContactMessageType(str, Enum):
MALWARE_FOUND = "MalwareFound"
SCAN_NOT_SCHEDULED = "ScanNotScheduled"
GENERIC = "Generic"
def __str__(self):
return self.value
CONFIG_SCHEMA_BACKUP_SYSTEM = {
"BACKUP_SYSTEM": {
"type": "dict",
"schema": {
"enabled": {
"type": "boolean",
"default": False,
},
"backup_system": {
"type": "string",
"default": None,
"nullable": True,
"allowed": [
CPANEL,
PLESK,
R1SOFT,
ACRONIS,
CLOUDLINUX,
DIRECTADMIN,
CLOUDLINUX_ON_PREMISE,
CLUSTERLOGICS,
SAMPLE_BACKEND,
],
},
},
"default": {},
}
}
class BackupConfig(Config):
DISCLAIMER = """\
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
# DO NOT EDIT. AUTOMATICALLY GENERATED.
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#
# Direct modifications to this file WILL be lost upon subsequent
# regeneration of this configuration file.
#
# To have your modifications retained, you should use CLI command
# imunify360-agent backup-systems <init|disable> <backup-system>
# or activate/deactivate appropriate feature in UI.
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
"""
def __init__(
self,
*,
path=os.path.join(
"/etc/sysconfig/imunify360", Core.BACKUP_CONFIGFILENAME
),
validation_schema=CONFIG_SCHEMA_BACKUP_SYSTEM,
):
super().__init__(path=path, validation_schema=validation_schema)
class BackupRestore:
ENABLED = FromConfig(
section="BACKUP_SYSTEM", option="enabled", config_cls=BackupConfig
)
_BACKUP_SYSTEM = FromConfig(
section="BACKUP_SYSTEM",
option="backup_system",
config_cls=BackupConfig,
)
CL_BACKUP_ALLOWED = FromConfig(
section="BACKUP_RESTORE",
option="cl_backup_allowed",
)
CL_ON_PREMISE_BACKUP_ALLOWED = FromConfig(
section="BACKUP_RESTORE",
option="cl_on_premise_backup_allowed",
)
@classmethod
def backup_system(cls):
return _get_backend_system(cls._BACKUP_SYSTEM)
def _get_backend_system(name):
"""
Get backup module from its name
:param name: backup system name
:return: backup system module
"""
from restore_infected import backup_backends
if name in (CLOUDLINUX, CLOUDLINUX_ON_PREMISE):
# cloudlinux backup is actually acronis one
name = ACRONIS
elif name is None:
return None
return backup_backends.backend(name, async_=True)
class AcronisBackup:
# https://kb.acronis.com/content/1711
# https://kb.acronis.com/content/47189
LOG_NAME = "acronis-installer.log"
PORTS = (8443, 44445, 55556)
RANGE = {(7770, 7800)}
def should_try_autorestore_malicious(username: str) -> bool:
"""
Checks is Agent should try restore malware file firts
and returns user that set this action in config
"""
try_restore, _ = choose_value_from_config(
"MALWARE_SCANNING", "try_restore_from_backup_first", username
)
return BackupRestore.ENABLED and try_restore
def choose_use_backups_start_from_date(username: str) -> datetime:
max_days, _ = choose_value_from_config(
"BACKUP_RESTORE", "max_days_in_backup", username
)
until = datetime.now() - timedelta(days=max_days)
return until
def should_send_user_notifications(username: str) -> bool:
should_send, _ = choose_value_from_config(
"CONTROL_PANEL",
"generic_user_notifications",
username=username,
)
return should_send
class Wordpress:
SECURITY_PLUGIN_ENABLED = FromConfig(
"WORDPRESS", "security_plugin_enabled"
)
WAF_ENABLED = FromConfig("WORDPRESS", "waf_enabled")
WAF_DEFAULT = FromConfig("WORDPRESS", "waf_default")
AI_BOT_PROTECTION = FromConfig("WORDPRESS", "ai_bot_protection")
AI_BOT_PROTECTION_PRESET = FromConfig(
"WORDPRESS", "ai_bot_protection_preset"
)
class HackerTrap:
DIR = "/var/imunify360"
NAME = "malware_found_b64.list"
SA_NAME = "malware_standalone_b64.list"
DIR_PD = "/opt/imunify360/proactive/dangerlist/"
defence360agent/contracts/config_provider.py 0000644 0000000 0000000 00000033361 00000000000 016305 0 ustar import json
import logging
import os
import pwd
from abc import abstractmethod
from contextlib import suppress
from textwrap import dedent
from typing import Mapping, Optional, Protocol
import sentry_sdk
import yaml
from defence360agent.utils import atomic_rewrite
from defence360agent.utils.fd_ops import open_dir_no_symlinks
logger = logging.getLogger(__name__)
# Don't read config if its file is larger than this.
_MAX_CONFIG_SIZE = 1 << 20 # 1MiB
class IConfigProvider(Protocol):
@abstractmethod
def read_config_file(
self, force_read: bool = False, ignore_errors: bool = True
):
raise NotImplementedError
@abstractmethod
def write_config_file(self, config: Mapping) -> None:
raise NotImplementedError
@abstractmethod
def modified_since(self, timestamp: Optional[float]) -> bool:
raise NotImplementedError
class ConfigError(Exception):
pass
class JsonMessage:
"""Pretty-print given *obj* as JSON.
To be used for logging. Example:
logging.info("object: %s", JsonMessage(obj))
"""
def __init__(self, obj):
self._obj = obj
def __str__(self):
return json.dumps(self._obj, sort_keys=True)
def diff_section(prev_section: Optional[dict], section: Optional[dict]):
"""Return difference between config sections."""
prev_section = prev_section or {}
section = section or {}
removed_settings = prev_section.keys() - section.keys()
added_settings = section.keys() - prev_section.keys()
return {
"-": {v: prev_section[v] for v in removed_settings},
"+": {v: section[v] for v in added_settings},
# modified settings
"?": {
v: (prev_section[v], section[v])
for v in (prev_section.keys() & section.keys())
if prev_section[v] != section[v]
},
}
def diff_config(prev_conf: dict, conf: dict):
"""Compare *prev_conf* with the current *conf*."""
removed_sections = prev_conf.keys() - conf.keys()
yield {section: prev_conf[section] for section in removed_sections}
added_sections = conf.keys() - prev_conf.keys()
yield {section: conf[section] for section in added_sections}
# changed sections
yield {
section: diff_section(prev_conf[section], conf[section])
for section in (prev_conf.keys() & conf.keys())
if prev_conf[section] != conf[section]
}
def exclude_equals(*, main_conf: dict, base_conf: dict) -> dict:
"""
Return dict derived from *main_conf* excluding parts
that are equal in *base_conf*.
For example,
>>> base_conf = {
"SECTION1": {"OPTION1": "default", "OPTION2": "default"},
"SECTION2": {"OPTION1": "default"}
}
>>> main_conf = {
"SECTION1": {"OPTION1": "value", "OPTION2": "default"},
"SECTION2": {"OPTION1": "default"}
}
>>>
>>> exclude_equals(main_conf=main_conf, base_conf=base_conf)
{'SECTION1': {'OPTION1': 'value'}}
>>>
"""
_, added, changed = diff_config(base_conf, main_conf)
result = {}
for section, value in main_conf.items():
if section in added.keys():
result[section] = value
if section in changed.keys():
result.setdefault(section, {}).update(changed[section]["+"])
result.setdefault(section, {}).update(
{k: v[1] for k, v in changed[section]["?"].items()}
)
return result
class ConfigReader:
"""
ConfigFile file for settings page.
Location config file is PATH
"""
def __init__(self, path, disclaimer="", permissions=None):
self.path = path
self.disclaimer = disclaimer
self.permissions = permissions
def __repr__(self):
return "<{classname}({path})>".format(
classname=self.__class__.__qualname__, path=self.path
)
def __str__(self):
return f"ConfigReader at {self.path}"
def read_config_file(
self, force_read: bool = False, ignore_errors: bool = True
) -> dict:
"""Read config file into memory.
Raises ConfigError.
"""
try:
if os.path.getsize(self.path) > _MAX_CONFIG_SIZE:
raise ConfigError("Config file is too large")
filename = self.path
with open(filename, "r") as config_file:
logger.info("Reading config file %s", filename)
text = config_file.read()
except UnicodeDecodeError as e:
raise ConfigError("Unable to decode config file") from e
except FileNotFoundError:
return {}
try:
return self.load_config_body(text)
except ConfigError as e:
logger.error(e)
if ignore_errors:
return {}
raise e
def load_config_body(self, text: str) -> dict:
try:
config = yaml.safe_load(text)
except yaml.YAMLError as e:
raise ConfigError(
f"Imunify360 config is not valid YAML document ({e})"
) from e
if config is None:
return {}
if not isinstance(config, dict):
raise ConfigError(
"Imunify360 config is invalid or empty"
": path={!r}, text={!r}".format(self.path, text)
)
return config
def _pre_write(self):
pass
def _post_write(self):
pass
def _serialize_config(self, config) -> str:
config_text = ""
if self.disclaimer:
config_text += dedent(self.disclaimer)
config_text += "\n"
config_text += yaml.dump(config, default_flow_style=False)
return config_text
def write_config_file(self, config) -> str:
self._pre_write()
config_text = self._serialize_config(config)
atomic_rewrite(
self.path, config_text, backup=False, permissions=self.permissions
)
self._post_write()
return config_text
def modified_since(self, timestamp: Optional[float]) -> bool:
return True
class CachedConfigReader(ConfigReader):
def __init__(self, path, disclaimer="", permissions=None):
super().__init__(path, disclaimer)
self.mtime: Optional[float] = None
self.size: Optional[float] = None
self._config = {}
self.permissions = permissions
def __str__(self):
return (
"{classname} <'{path}', modified at {mtime}, {size} bytes>".format(
classname=self.__class__.__qualname__,
path=self.path,
mtime=self.mtime,
size=self.size,
)
)
def read_config_file(
self, force_read: bool = False, ignore_errors: bool = True
):
"""Update config if config file is modified"""
if self.modified_since(self.mtime) or force_read:
prev_config = self._config
try:
self._config = super().read_config_file(
ignore_errors=ignore_errors
)
except ConfigError as error:
sentry_sdk.capture_exception(error)
logger.warning(
"%s is invalid, using previous settings: %s",
self,
JsonMessage(self._config),
)
if not ignore_errors:
raise error
else:
if self.mtime is not None: # don't log on startup
diffs = list(diff_config(prev_config, self._config))
if any(diffs):
# content has changed, log it
logger.info(
"%s modified: removed=%s, added=%s, changed=%s",
self,
*map(JsonMessage, diffs),
)
self._refresh_stat_cache()
return self._config
def _refresh_stat_cache(self) -> None:
"""Sync cached mtime/size with the file on disk."""
try:
stat = os.stat(self.path)
self.mtime = stat.st_mtime
self.size = stat.st_size
except FileNotFoundError:
self.mtime = 0.0
self.size = 0.0
def modified_since(self, timestamp: Optional[float]) -> bool:
"""Whether the config has updated since *timestamp*.
(as defined by its last modification time and size)
:param timestamp: None means that the file has never been read before
"""
# On startup consider timestamp to be None
if timestamp is None:
timestamp = 0.0
try:
stat = os.stat(self.path)
except FileNotFoundError:
st_mtime, st_size = 0.0, 0.0
else:
st_mtime, st_size = stat.st_mtime, stat.st_size
return st_mtime > timestamp or st_size != self.size
class WriteOnlyConfigReader(CachedConfigReader):
def __init__(self, path, disclaimer="", permissions=None):
super().__init__(path, disclaimer, permissions)
# write-only readers never hit the parent read path that populates
# mtime/size, so seed them from disk now — otherwise the size
# fallback in modified_since() (st_size != self.size) compares
# against None forever and the check is stuck at True.
self._refresh_stat_cache()
def read_config_file(self, *_, **__):
return self._config
def write_config_file(self, config):
config_text = super().write_config_file(config)
self._config = self.load_config_body(config_text)
self._refresh_stat_cache()
return config_text
class UserConfigReader(CachedConfigReader):
"""Per-user config reader that resists TOCTOU symlink attacks.
The user-specific subdirectory ``<USER_CONFDIR>/<username>/`` and the
config file inside it must end up owned by ``root:<user-gid>`` with
modes ``0750`` / ``0640``. Earlier revisions performed the
``mkdir`` -> ``chown`` -> ``chmod`` sequence on path strings, which
left a TOCTOU window: between the directory existing and the
metadata syscalls, a swap to a symlink could redirect the chown to
an arbitrary inode. See DEF-41586 / CLOS-3965 for context.
The hardened path opens the parent ``USER_CONFDIR`` once with
``O_NOFOLLOW`` at every component, then performs every subsequent
operation (``mkdir``/``chown``/``chmod``/atomic write) relative to
that fd or to a fresh ``O_NOFOLLOW`` fd of the user subdir. No
user-controlled path string is dereferenced more than once.
"""
DIR_PERMISSIONS = 0o750
FILE_PERMISSIONS = 0o640
def __init__(self, path, username):
super().__init__(path)
self.username = username
def __str__(self):
return f"Config of user {self.username}"
def _open_user_subdir(self, parent_fd: int, name: str) -> int:
"""Return an O_NOFOLLOW fd for ``name`` inside *parent_fd*.
Creates the directory first if it does not already exist. The
``O_NOFOLLOW`` flag guarantees that, if a symlink appears in the
slot at any time after this call returns, every subsequent
``fchown``/``fchmod``/atomic-rewrite bound to the returned fd
operates on the originally opened inode.
"""
with suppress(FileExistsError):
os.mkdir(name, mode=self.DIR_PERMISSIONS, dir_fd=parent_fd)
return os.open(
name,
os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW,
dir_fd=parent_fd,
)
def write_config_file(self, config) -> str:
gid = pwd.getpwnam(self.username).pw_gid
confdir, basename = os.path.split(self.path)
userconfdir, username = os.path.split(confdir)
# Open USER_CONFDIR (root-owned, package-controlled) with full
# symlink protection at every path component. Then descend to
# the per-user subdir using a dir_fd-relative open with
# O_NOFOLLOW so a symlink swap cannot redirect us.
parent_fd = open_dir_no_symlinks(userconfdir)
try:
user_fd = self._open_user_subdir(parent_fd, username)
try:
# Apply directory ownership/permissions on the fd we
# just opened — bound to the inode, not to the path.
os.chown(user_fd, 0, gid)
os.fchmod(user_fd, self.DIR_PERMISSIONS)
config_text = self._serialize_config(config)
# atomic_rewrite_fd creates a temp file via
# O_CREAT|O_EXCL|O_NOFOLLOW relative to user_fd, chowns
# and chmods the temp inode (not a path), then renames
# it into place — all without leaving a TOCTOU window.
atomic_rewrite(
basename,
config_text,
backup=False,
uid=0,
gid=gid,
permissions=self.FILE_PERMISSIONS,
dir_fd=user_fd,
)
# Re-normalize ownership/permissions on every call so
# that an out-of-band ``chmod``/``chown`` between writes
# cannot leave the file with weaker permissions. When
# ``atomic_rewrite_fd`` short-circuits on identical
# content, no chown/chmod runs there, so we apply them
# here. ``O_NOFOLLOW`` keeps the fix TOCTOU-safe.
file_fd = os.open(
basename,
os.O_RDONLY | os.O_NOFOLLOW,
dir_fd=user_fd,
)
try:
os.chown(file_fd, 0, gid)
os.fchmod(file_fd, self.FILE_PERMISSIONS)
finally:
os.close(file_fd)
finally:
os.close(user_fd)
finally:
os.close(parent_fd)
return config_text
defence360agent/contracts/eula.py 0000644 0000000 0000000 00000002742 00000000000 014053 0 ustar import asyncio
import os.path
from typing import Optional
from defence360agent import files
from defence360agent.contracts.config import ANTIVIRUS_MODE
from defence360agent.model.simplification import Eula, run_in_executor
_MESSAGE_TEMPLATE = "message{}.txt"
_SUFFIX = "-av" if ANTIVIRUS_MODE else ""
_TEXT_TEMPLATE = "eula{}.txt"
_UPDATED_TEMPLATE = "updated{}.txt"
def _readfile(path: str, errors: Optional[str] = None) -> str:
with open(path, errors=errors) as f:
return f.read().strip()
def _get_path(template: str) -> str:
return os.path.join(
files.Index.files_path(files.EULA), template.format(_SUFFIX)
)
async def is_accepted() -> bool:
"""Return True if latest EULA was accepted, False otherwise."""
return await run_in_executor(asyncio.get_event_loop(), Eula.is_accepted)
async def accept() -> None:
"""Accepts EULA."""
await run_in_executor(asyncio.get_event_loop(), Eula.accept)
async def update() -> None:
"""Updates latest EULA date from files."""
await run_in_executor(
asyncio.get_event_loop(), lambda: Eula.get_or_create(updated=updated())
)
def text() -> str:
"""Return main text of the EULA."""
return _readfile(_get_path(_TEXT_TEMPLATE), errors="ignore")
def message() -> str:
"""Return a message inviting to accept EULA."""
return _readfile(_get_path(_MESSAGE_TEMPLATE))
def updated() -> str:
"""Return last EULA's update time."""
return _readfile(_get_path(_UPDATED_TEMPLATE))
defence360agent/contracts/hook_events.py 0000644 0000000 0000000 00000003014 00000000000 015442 0 ustar # todo: figure out how HookEvents.* is typed
# type: ignore
from defence360agent.contracts.config import HookEvents
from defence360agent.contracts.messages import Message
STARTED, FINISHED = "started", "finished"
class _HookEventBase(Message):
event = None
subtype = None
def __repr__(self):
filtered = {k: v for k, v in self.items() if k != "DUMP"}
return f"{self.__class__.__qualname__}({repr(filtered)})"
class _Agent(_HookEventBase):
event = HookEvents.AGENT
class _License(_HookEventBase):
event = HookEvents.LICENSE
class _MalwareScanning(_HookEventBase):
event = HookEvents.MALWARE_SCANNING
class _MalwareDetected(_HookEventBase):
event = HookEvents.MALWARE_DETECTED
class _MalwareCleanup(_HookEventBase):
event = HookEvents.MALWARE_CLEANUP
class HookEvent:
class AgentStarted(_Agent):
subtype = STARTED
class AgentMisconfig(_Agent):
subtype = "misconfig"
class LicenseExpired(_License):
subtype = "expired"
class LicenseExpiring(_License):
subtype = "expiring"
class LicenseRenewed(_License):
subtype = "renewed"
class MalwareScanningStarted(_MalwareScanning):
subtype = STARTED
class MalwareScanningFinished(_MalwareScanning):
subtype = FINISHED
class MalwareDetectedCritical(_MalwareDetected):
subtype = "critical"
class MalwareCleanupStarted(_MalwareCleanup):
subtype = STARTED
class MalwareCleanupFinished(_MalwareCleanup):
subtype = FINISHED
defence360agent/contracts/hooks.py 0000644 0000000 0000000 00000014206 00000000000 014246 0 ustar import grp
import os
from defence360agent.contracts.config import Config, Core
from defence360agent.contracts.config_provider import ConfigReader
from defence360agent.utils import antivirus_mode
class Schema:
@staticmethod
def dict(data):
return {
"type": "dict",
"schema": data,
"default": {},
}
@staticmethod
def list_of_strings(regex=None):
return {
"type": "list",
"schema": {
"type": "string",
**({"regex": regex} if regex else {}),
},
"nullable": False,
"default": [],
}
@staticmethod
def list_of_emails(default_enabled=True):
regex = (
r"^.+@(.+\.)+.+|default$" if default_enabled else r"^.+@(.+\.)+.+$"
)
return Schema.list_of_strings(regex)
@staticmethod
def period():
return {
"period": {
"type": "integer",
"coerce": int,
"min": 1,
"default": 1,
}
}
@staticmethod
def string(nullable):
return {
"type": "string",
"nullable": nullable,
}
@staticmethod
def enabled():
return {
"enabled": {
"type": "boolean",
"default": False,
}
}
@staticmethod
def admin(period):
return {
"ADMIN": Schema.dict(
{
**Schema.enabled(),
"admin_emails": Schema.list_of_emails(),
**(Schema.period() if period else {}),
}
)
}
@staticmethod
def script(period):
return {
"SCRIPT": Schema.dict(
{
**Schema.enabled(),
"scripts": Schema.list_of_strings(r"^\/.+$"),
**(Schema.period() if period else {}),
}
)
}
@staticmethod
def user(period):
return {
"USER": Schema.dict(
{
**Schema.enabled(),
**(Schema.period() if period else {}),
}
)
}
@staticmethod
def target_script(period=False):
return Schema.dict(
{
**Schema.script(period=period),
}
)
@staticmethod
def target_admin_and_script(period=False):
return Schema.dict(
{
**Schema.admin(period=period),
**Schema.script(period=period),
}
)
@staticmethod
def target_all(period=False):
return Schema.dict(
{
**Schema.admin(period=period),
# **Schema.user(period=period), # stage 2
**Schema.script(period=period),
}
)
class HooksConfigReader(ConfigReader):
GROUP_NAME = "_imunify"
def _post_write(self):
os.chmod(self.path, 0o640)
os.chown(self.path, 0, grp.getgrnam(self.GROUP_NAME).gr_gid)
class HooksConfig(Config):
def __init__(
self, path=os.path.join(Core.GLOBAL_CONFDIR, Core.HOOKS_CONFIGFILENAME)
):
validation_schema = (
{
"admin": Schema.dict(
{
"default_emails": Schema.list_of_emails(
default_enabled=False
),
"notify_from_email": {
"type": "string",
"default": None,
"nullable": True,
},
"locale": Schema.string(nullable=True),
}
),
"users": {
"type": "list",
"schema": Schema.dict(
{
"username": Schema.string(nullable=False),
"emails": Schema.list_of_emails(),
"locale": Schema.string(nullable=True),
}
),
"nullable": True,
"default": [],
},
"rules": Schema.dict(
{
"REALTIME_MALWARE_FOUND": (
Schema.target_admin_and_script(period=True)
),
"USER_SCAN_MALWARE_FOUND": Schema.target_all(),
"SCRIPT_BLOCKED": Schema.target_admin_and_script(
period=True
),
"USER_SCAN_STARTED": Schema.target_script(),
"CUSTOM_SCAN_STARTED": Schema.target_script(),
"USER_SCAN_FINISHED": Schema.target_script(),
"CUSTOM_SCAN_FINISHED": Schema.target_script(),
"CUSTOM_SCAN_MALWARE_FOUND": (
Schema.target_admin_and_script()
),
}
),
"default": {},
}
if antivirus_mode.disabled
else {
"rules": Schema.dict(
{
"USER_SCAN_MALWARE_FOUND": Schema.target_script(),
"USER_SCAN_STARTED": Schema.target_script(),
"CUSTOM_SCAN_STARTED": Schema.target_script(),
"USER_SCAN_FINISHED": Schema.target_script(),
"CUSTOM_SCAN_FINISHED": Schema.target_script(),
"CUSTOM_SCAN_MALWARE_FOUND": Schema.target_script(),
}
),
"default": {},
}
)
super().__init__(
path=path,
validation_schema=validation_schema,
config_reader=HooksConfigReader(path),
)
def get(self):
data = self.config_to_dict()
data.pop("users", None)
return data
def update(self, data):
data.pop("users", None)
self.dict_to_config(data)
defence360agent/contracts/license.py 0000644 0000000 0000000 00000061503 00000000000 014547 0 ustar import asyncio
import base64
import binascii
import datetime
import json
import os
import shutil
import subprocess
import tempfile
import time
from contextlib import suppress
from json import JSONDecodeError
from pathlib import Path
from subprocess import TimeoutExpired
from typing import Optional
from peewee import OperationalError
from defence360agent.application.determine_hosting_panel import (
is_cpanel_installed,
)
from defence360agent.contracts import sentry
from defence360agent.contracts.config import (
ANTIVIRUS_MODE,
Core,
CustomBilling,
int_from_envvar,
logger,
)
from defence360agent.contracts.hook_events import HookEvent
from defence360agent.internals.global_scope import g
from defence360agent.subsys.panels.plesk.upgrade_urls import (
get_plesk_upgrade_urls,
)
from defence360agent.utils import retry_on, timed_cache
from defence360agent.utils.common import HOUR, rate_limit
from defence360agent.utils.ipecho import APIError, IPEchoAPI
from defence360agent.utils.validate import IP
AV_DEFAULT_ID = "IMUNIFYAV"
UNLIMITED_USERS_COUNT = 2147483647
# no need to check the license file more often than
# once every 10 minutes, this should be enough to fix DEF-14677
_CACHE_LICENSE_TOKEN_TIMEOUT = int_from_envvar(
"IMUNIFY360_CACHE_LICENSE_TOKEN_TIMEOUT",
10 * 60, # in seconds
)
# path to openssl binary used to check license signature
# we need to check several paths because of different OSes
# and different installation paths with fallback to system default
if not (OPENSSL_BIN := Path("/opt/alt/openssl11/bin/openssl")).exists():
if not (OPENSSL_BIN := Path("/opt/alt/openssl/bin/openssl")).exists():
OPENSSL_BIN = Path("/usr/bin/openssl")
throttled_log_error = rate_limit(period=HOUR, on_drop=logger.warning)(
logger.error
)
throttled_log_no_v2 = rate_limit(period=HOUR, on_drop=logger.warning)(
logger.error
)
class LicenseError(Exception):
"""Used to communicate that some function requires a license"""
class LicenseCLN:
VERIFY_FIELDS_V1 = (
"id",
"status",
"group",
"limit",
"token_created_utc",
"token_expire_utc",
)
VERIFY_FIELDS_V2 = (
"id",
"status",
"limit",
"token_created_utc",
"token_expire_utc",
"group_id",
"permissions",
)
VERIFY_FIELDS_MAP = {
1: VERIFY_FIELDS_V1,
2: VERIFY_FIELDS_V2,
}
_PUBKEY_FILE = "/usr/share/imunify360/cln-pub.key"
_ALTERNATIVE_PUBKEY_FILES = (
# keys for self-signed licenses
"/usr/share/imunify360/alt-license-pub.key",
)
_LICENSE_FILE = "/var/imunify360/license.json"
_FREE_LICENSE_FILE = "/var/imunify360/license-free.json"
AV_PLUS_BUY_URL = (
"https://cln.cloudlinux.com/console/purchase/ImunifyAvPlus"
)
IM360_BUY_URL_TEMPLATE = (
"https://www.cloudlinux.com/upgrade-imunify-{user_count}/"
)
CPANEL_UPGRADE_URL = (
"../../../scripts14/purchase_imunifyavplus_init_IMUNIFY"
)
CPANEL_UPGRADE_URL_360 = (
"../../../scripts14/purchase_imunify360_init_IMUNIFY"
)
VERSION_THRESHOLDS = [1, 30, 250]
_token = {}
users_count = None
@staticmethod
@retry_on(TimeoutExpired, max_tries=2)
def _verify_signature(
pubkey_path: str, content: bytes, signature: bytes
) -> tuple[bool, Optional[list[str]]]:
"""Verify that `content` is correctly signed with public key from file
`pubkey_path` with resulting `signature`. Returns a tuple with (success, error_list).
"""
errors: list[str] = []
result = False
with tempfile.NamedTemporaryFile(delete=True) as sig_file:
sig_file.write(signature)
sig_file.flush()
cmd = [
OPENSSL_BIN,
"dgst",
"-sha512",
"-verify",
pubkey_path,
"-signature",
sig_file.name,
]
try:
p = subprocess.run(
cmd,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
input=content,
timeout=5,
)
except FileNotFoundError as e:
errors.append(f"openssl command failed: missing {e.filename}")
else:
if p.returncode == 0:
result = True
else:
errors.append(
"Signature verification failed - "
f"openssl returned {p.returncode}. "
f"stdout: {p.stdout}, stderr: {p.stderr}"
)
return result, errors or None
@classmethod
def _get_signature_input(cls, license, version: int = 1) -> bytes:
parts = []
for key in cls.VERIFY_FIELDS_MAP[version]:
value = license[key]
if isinstance(value, dict):
parts.append(
"".join(
f"{subkey}={subvalue}"
for subkey, subvalue in value.items()
)
)
elif value is None:
parts.append("null")
else:
parts.append(str(value))
return "".join(parts).encode()
@classmethod
def _find_signature(
cls, license_token, signature_list: list[tuple[str, int]]
) -> tuple[Optional[str], bool]:
"""
Verify signatures in license
:return: signature, is_alternative, version
"""
sign: str
all_errors: list[str] = []
def verify_and_collect_errors(*args, **kwargs):
success, errors = cls._verify_signature(*args, **kwargs)
if errors:
all_errors.extend(errors)
return success
for sign, version in signature_list:
signature = base64.b64decode(sign)
try:
content = cls._get_signature_input(
license_token, version=version
)
except KeyError:
continue
if verify_and_collect_errors(cls._PUBKEY_FILE, content, signature):
return sign, False
for alt_pubkey in cls._ALTERNATIVE_PUBKEY_FILES:
if verify_and_collect_errors(alt_pubkey, content, signature):
return sign, True
for error in all_errors:
logger.warning("%s", error)
return None, False
@classmethod
def _load_token(cls, path):
"""
Load license token from file and verify signature
If signature verification successful, put
first valid signature to 'sign' field of license
token
:return: license token
"""
default = {} # default value returned on error
try:
with open(path) as f:
license_token = json.load(f)
if not isinstance(license_token, dict):
logger.error(
"Failed to load license. Expected JSON object, got %r"
% (license_token,)
)
return default
signature, is_alternative = cls._find_signature(
license_token,
[
(sign, 1)
for sign in license_token.get("signatures", [])
],
)
v2_sign = license_token.get("signature_v2")
if v2_sign:
_sign, _ = cls._find_signature(
license_token, [(v2_sign, 2)]
)
if _sign is None:
throttled_log_error(
"Failed to verify license signature v2"
)
license_token.pop("permissions", None)
elif "permissions" in license_token:
license_token.pop("permissions")
throttled_log_no_v2(
"License missing signature_v2 but contained "
"permissions; stripped (possible tampering or "
"stale token)"
)
if signature is None:
throttled_log_error("Failed to verify license signature")
return default
license_token["sign"] = signature
license_token["is_alternative"] = is_alternative
return license_token
except FileNotFoundError:
# this is a common case
logger.info("Failed to load license: not registered?")
except JSONDecodeError as e:
# Likely a TOCTOU read of the file mid-write by the updater;
# the next read cycle will pick up the fully-written content.
logger.warning("Failed to load license: %s", e)
except (
OSError,
KeyError,
UnicodeDecodeError,
binascii.Error,
TypeError,
) as e:
# not loading broken license
logger.error("Failed to load license: %s", e)
return default
@classmethod
@timed_cache(
datetime.timedelta(seconds=_CACHE_LICENSE_TOKEN_TIMEOUT), maxsize=1
)
def get_token(cls) -> dict:
"""
Get available license.
In Antivirus mode, if main license is unavailable, return free license
:return: license token
"""
lic_token = {}
license_files = (
[cls._LICENSE_FILE, cls._FREE_LICENSE_FILE]
if ANTIVIRUS_MODE
else [cls._LICENSE_FILE]
)
for lf in license_files:
lic_token = cls._load_token(lf)
if lic_token:
return lic_token
return lic_token
@classmethod
def get_server_id(cls) -> Optional[str]:
"""
:return: server id
"""
return cls.get_token().get("id")
@classmethod
def is_registered(cls):
"""
:return: bool: if we have token
"""
return bool(cls.get_token())
@classmethod
def is_valid_av_plus(cls):
"""
:return: Return true only if we have valid ImunifyAV+ or
Imunify360 license
"""
return ANTIVIRUS_MODE and cls.is_valid() and (not cls.is_free())
@classmethod
def is_free(cls):
if not ANTIVIRUS_MODE:
return False
return cls.get_server_id() == AV_DEFAULT_ID
@classmethod
def is_cloud_assisted_cleanup_allowed(cls) -> bool:
"""Cloud-assisted cleanup is a paid feature (Imunify360 / ImunifyAV+)."""
if not ANTIVIRUS_MODE:
return True
return cls.is_valid_av_plus()
@classmethod
def is_valid(cls, token=None):
"""License check based on license token
return True - if license token is valid for this server
return False - if license token is invalid
"""
token = token or cls.get_token()
if not token:
return False
if ANTIVIRUS_MODE:
return (
token.get("status", "").startswith("ok")
and token["token_expire_utc"] >= time.time()
)
return (
token["status"] in ("ok", "ok-trial")
and token["token_expire_utc"] >= time.time()
and (cls.users_count is None or cls.users_count <= token["limit"])
)
@classmethod
def has_permission(cls, permission: str, token=None):
"""License check for a specific permission based on a license token
return True - if license token has a given permission for this server
return False - if license token does not have permission
"""
token = token or cls.get_token()
if not token:
return False
return (
permission in (perm := token.get("permissions", {}))
and perm[permission] == "ENABLED"
)
@classmethod
def update(cls, token):
"""
Write new license token to file
:param token: new token
:return:
"""
old_token = cls.get_token()
# Save user_limit under different name only during registration
# Check if this is initial registration by checking if old token exists
if not old_token and token.get("limit") is not None:
token["saved_user_limit"] = token["limit"]
temp_file = cls._LICENSE_FILE + ".tmp"
flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
mode = 0o640
with suppress(FileNotFoundError):
os.unlink(temp_file)
with os.fdopen(os.open(temp_file, flags, mode), "w") as f:
json.dump(token, f)
shutil.chown(temp_file, user="root", group="_imunify")
os.rename(temp_file, cls._LICENSE_FILE)
cls.get_token.cache_clear()
sentry.set_server_id(cls.get_server_id())
sentry.set_product_name(cls.get_product_name())
try:
cls.renew_hook(old_token, token)
except OperationalError:
pass
@classmethod
def renew_hook(cls, old_token, token):
important_keys = ["license_expire_utc", "status", "limit", "id"]
exp_time = token.get("license_expire_utc")
license_type = cls.fill_license_type(token)
condition = any(
[token.get(elem) != old_token.get(elem) for elem in important_keys]
)
if condition:
license_updated = HookEvent.LicenseRenewed(
exp_time=exp_time, license=license_type
)
from defence360agent.hooks.execute import execute_hooks
asyncio.gather(
execute_hooks(license_updated), return_exceptions=True
)
@classmethod
def delete(cls):
"""
Delete license token along with old-style license data
:return:
"""
with suppress(FileNotFoundError):
os.unlink(cls._LICENSE_FILE)
cls.get_token.cache_clear()
sentry.set_server_id(None)
sentry.set_product_name(cls.get_product_name())
@classmethod
def fill_license_type(cls, token):
license_type = token.get("status")
license_type_to_product = {
"ok": "imunify360",
"ok-trial": "imunify360Trial",
"ok-av": "imunifyAV",
"ok-avp": "imunifyAVPlus",
}
return license_type_to_product.get(license_type)
@classmethod
def get_license_type(cls):
return cls.fill_license_type(cls.get_token())
@classmethod
def is_ip_license_type(cls):
token = cls.get_token()
if token.get("id", "").lower().startswith("ip-"):
return True
return False
@classmethod
def format_upgrade_url(cls, url_template: Optional[str]) -> Optional[str]:
"""Format upgrade URL template with available parameters.
Args:
url_template: URL template string that may contain
{user_count}, {iaid}, and {users} placeholders
Returns:
Formatted URL with placeholders replaced with actual values
"""
if not url_template:
return url_template
n = cls.users_count
iaid = g.get("iaid", "")
# Determine user_count value
if n is None:
user_count = 1
else:
for threshold in cls.VERSION_THRESHOLDS:
if n <= threshold:
user_count = threshold
break
else:
user_count = "unlimited"
url_template = url_template.replace("{user_count}", str(user_count))
url_template = url_template.replace("{iaid}", iaid)
url_template = url_template.replace(
"{users}", str(n if n is not None else 1)
)
return url_template
@classmethod
def _get_license_tier_recommendation(cls, user_count):
"""Get recommended license tier based on user count."""
if user_count == 1:
return "Single user"
elif user_count <= 30:
return "Up to 30 users"
elif user_count <= 250:
return "Up to 250 users"
else:
return "Unlimited users"
@classmethod
def _format_license_exceeded_message(cls, user_count):
"""Format enhanced message when user count exceeds saved limit."""
if user_count is None:
return (
"WARNING: License is invalid for current server. "
"Unable to determine user count; please check KB article: "
"https://cloudlinux.zendesk.com/hc/en-us/articles/"
)
tier_name = cls._get_license_tier_recommendation(user_count)
user_word = "user" if user_count == 1 else "users"
return (
"WARNING: License is invalid for current server. "
f"Detected {user_count} {user_word} → "
f'purchase the "{tier_name}" Imunify360 license. '
"Pricing: https://imunify360.com/pricing"
)
@classmethod
def license_info(cls):
token = cls.get_token()
key_360 = token.get("status") in ("ok", "ok-trial")
message = token.get("message", None)
if (
ANTIVIRUS_MODE
and CustomBilling.UPGRADE_URL
and not CustomBilling.NOTIFICATIONS
):
message = None
if ANTIVIRUS_MODE and key_360 and not message:
# TODO: remove after auto-upgrade will be implemented
message = (
"You've got a license for the advanced security product "
"Imunify360. Please, uninstall ImunifyAV and replace it with "
"the Imunify360 providing comprehensive security for your "
"server. Here are the steps for upgrade: "
"https://docs.imunify360.com/installation/"
)
if token:
info = {
"status": cls.is_valid(),
"expiration": token.get("license_expire_utc", 0),
"user_limit": token.get("limit"),
"id": token.get("id"),
"user_count": cls.users_count,
"message": message,
"license_type": cls.fill_license_type(token),
}
# Generate enhanced message if license is invalid due to user limit exceeded
# Compare against saved_user_limit instead of current limit
if (
not ANTIVIRUS_MODE
and token.get("saved_user_limit") is not None
and cls.users_count is not None
and cls.users_count > token.get("saved_user_limit")
):
info["message"] = cls._format_license_exceeded_message(
cls.users_count
)
else:
info = {"status": False}
info["upgrade_url"] = None
info["upgrade_url_360"] = None
if ANTIVIRUS_MODE:
ignored_messages = [
"user limits",
]
if info.get("message"):
for msg in ignored_messages:
if msg in info["message"]:
info["message"] = None
# Only add ip_license when we have a valid token, since the schema
# for status=false doesn't allow this property (additionalProperties: false)
if token:
info["ip_license"] = CustomBilling.IP_LICENSE and (
CustomBilling.UPGRADE_URL is not None
or CustomBilling.UPGRADE_URL_360 is not None
)
plesk_urls = get_plesk_upgrade_urls()
info["upgrade_url"] = (
cls.format_upgrade_url(CustomBilling.UPGRADE_URL)
or plesk_urls["buy_url"]
or token.get("upgrade_url")
or cls.AV_PLUS_BUY_URL
)
info["upgrade_url_360"] = (
cls.format_upgrade_url(CustomBilling.UPGRADE_URL_360)
or plesk_urls["upgrade_license_url"]
or plesk_urls["buy_url"]
or upgrade_url_default()
)
# redirect_url is required for the no-license schema (status=false)
# Set it to None when there's no token, and from token otherwise
if not token:
info["redirect_url"] = None
elif not ANTIVIRUS_MODE:
info["redirect_url"] = token.get("upgrade_url", None)
if cls.is_demo(): # pragma: no cover
info["demo"] = True
info[
"eligible_for_imunify_patch"
] = cls.is_eligible_for_imunify_patch()
return info
@classmethod
def is_vps(cls) -> bool:
return cls.users_count is not None and cls.users_count <= 1
@classmethod
def is_custom_reseller_configured(cls) -> bool:
upgrade_urls: list[Optional[str]] = [None]
upgrade_urls_360: list[Optional[str]] = [None]
if is_cpanel_installed():
upgrade_urls.append(cls.CPANEL_UPGRADE_URL)
upgrade_urls_360.append(cls.CPANEL_UPGRADE_URL_360)
# customer has any upgrade url other than default ones
return not (
CustomBilling.UPGRADE_URL in upgrade_urls
and CustomBilling.UPGRADE_URL_360 in upgrade_urls_360
)
@classmethod
def is_eligible_for_imunify_patch(cls) -> bool:
return (
cls.is_vps()
and cls.is_free()
and not cls.is_custom_reseller_configured()
)
@classmethod
def get_product_name(cls) -> str:
if not ANTIVIRUS_MODE:
return Core.NAME
license_status = cls.get_token().get("status", "")
if license_status == "ok-av":
return "imunify.av"
elif license_status in ("ok-avp", "ok", "ok-trial"):
return "imunify.av+"
else:
logger.error("Unknown license %s", license_status)
return "Unknown license"
@classmethod
def is_demo(cls) -> bool:
return os.path.isfile("/var/imunify360/demo")
@classmethod
def is_unlimited(cls):
token = cls.get_token()
return token.get("limit", 0) >= UNLIMITED_USERS_COUNT
@classmethod
def get_im360_buy_url(cls) -> str:
if cls.users_count is None:
return cls.IM360_BUY_URL_TEMPLATE.format(user_count=1)
for threshold in cls.VERSION_THRESHOLDS:
if cls.users_count <= threshold:
return cls.IM360_BUY_URL_TEMPLATE.format(user_count=threshold)
return cls.IM360_BUY_URL_TEMPLATE.format(user_count="unlimited")
def upgrade_url_default():
n = LicenseCLN.users_count
iaid = g.get("iaid", "")
if (
# apply custom direct store links on cPanel
is_cpanel_installed()
# where upgrade URL is not set or set to the old value
and CustomBilling.UPGRADE_URL == LicenseCLN.CPANEL_UPGRADE_URL
):
# We have a complex default value for cPanel installations configured
# with that use cPanel as a reseller. They don't populate
# the CUSTOM_BILLING config well, so we generate the links here.
# (they care less about upsell than we do)
if not _eligible_for_new_upgrade_links(iaid):
# A/B experiment control (old) variant:
# return the old URL that leads through cPanel login page
return LicenseCLN.CPANEL_UPGRADE_URL_360
# A/B experiment test (new) variant:
# return the new URL that leads directly to the store
base_url = (
"https://store.cpanel.net/index.php?rp=/store/partner-addons/"
)
server_ip = ""
try:
ip = IPEchoAPI.server_ip()
# cPanel Store only accepts w4, not IPv6
# If we got IPv6, leave the IP field blank
if IP.is_valid_ipv4_addr(ip):
server_ip = ip
else:
logger.info(
"Server IP is IPv6 (%s), cPanel Store requires IPv4. "
"Omitting IP parameter.",
ip,
)
except APIError as e:
logger.warning("Failed to get server IP: %s", e)
if n == 1:
suffix = (
f"imunify360-for-cpanel-solo&customfield%5B55%5D={server_ip}"
)
else:
suffix = f"imunify360&customfield%5B375%5D={server_ip}"
return base_url + suffix
return (
LicenseCLN.get_im360_buy_url()
+ f"?iaid={iaid}"
+ f"&users={n}" * bool(n)
)
def _eligible_for_new_upgrade_links(iaid: str) -> bool:
logger.debug("checking if iaid: %s is eligible for upgrade", iaid)
if len(iaid) == 0:
logger.warning("receive empty iaid, fallback to old link")
return False
try:
hex_bucket = int(iaid[0], 16)
except ValueError:
logger.warning("iaid is not hex, fallback to old link")
return False
hex_mid = 8
# check if iaid falls under 50% of iaid distribution
return hex_bucket < hex_mid
defence360agent/contracts/messages.py 0000644 0000000 0000000 00000042401 00000000000 014730 0 ustar import asyncio
import json
import os
from enum import Enum
from typing import List
from defence360agent.contracts.config import Core as CoreConfig
class MessageNotFoundError(Exception):
pass
class UnknownMessage:
"""
Used as stub for MessageType
"""
def __init__(self):
raise MessageNotFoundError("Message class is not found.")
def __getattr__(self, name):
return "Unknown" # pragma: no cover
class MessageT:
_subclasses = []
def __init_subclass__(cls, **kwargs):
super().__init_subclass__(**kwargs)
cls._subclasses.append(cls)
@classmethod
def get_subclasses(cls):
return tuple(cls._subclasses)
class _MessageType:
"""
Used to get specific message class. For example,
>>> _MessageType().ConfigUpdate
<class 'defence360agent.contracts.messages.ConfigUpdate'>
>>> _MessageType().NotExistMessage
<class 'defence360agent.contracts.messages.UnknownMessage'>
>>>
"""
def __getattr__(self, name):
for subcls in Message.get_subclasses():
# is is supposed that all subclasses have different names
if subcls.__name__ == name:
return subcls
return UnknownMessage
MessageType = _MessageType()
class ReportTarget(Enum):
API = "api"
PERSISTENT_CONNECTION = "conn"
class Reportable(MessageT):
"""
Mixin class for messages that should be sent to the server
"""
TARGET = ReportTarget.PERSISTENT_CONNECTION
@classmethod
def get_subclass_with_method(cls, method: str):
"""
Return a subclass with the same DEFAULT_METHOD as *method*.
It can be used to detect report target from message method.
NOTE: it is not guaranteed that the class with the *method* is unique,
in this case the first subclass found is returned, but
it is tested that all such subclasses have the same TARGET.
"""
for subclass in cls.__subclasses__():
if method == getattr(subclass, "DEFAULT_METHOD"):
return subclass
return None # pragma: no cover
class Received(MessageT):
"""
Mixin class for messages received from the server.
These messages are created in the client360 plugin when receiving a
request from imunify360.cloudlinux.com.
"""
@classmethod
def get_subclass_with_action(cls, action: str):
for subclass in cls.__subclasses__():
received_actions = getattr(subclass, "RECEIVED_ACTIONS", []) or [
getattr(subclass, "DEFAULT_METHOD")
]
if action in received_actions:
return subclass
raise MessageNotFoundError(
'Message class is not found for "{}" action'.format(action)
)
class Lockable(MessageT):
_lock = None
@classmethod
async def acquire(cls) -> None:
if cls._lock is None:
cls._lock = asyncio.Lock()
await cls._lock.acquire()
@classmethod
def locked(cls) -> bool:
return cls._lock is not None and cls._lock.locked()
@classmethod
def release(cls) -> None:
if cls._lock is not None:
cls._lock.release()
class Message(dict, MessageT):
"""
Base class for messages to be passed as
a parameter to plugins.MessageSink.process_message()
"""
# Default method='...' to send to the Server
DEFAULT_METHOD = ""
PRIORITY = 10
PROCESSING_TIME_THRESHOLD = 60 # 1 min
#: fold collections' repr with more than the threshold number of items
_FOLD_LIST_THRESHOLD = 100
#: shorten strings longer than the threshold characters
_SHORTEN_STR_THRESHOLD = 320
def __init__(self, *args, **kwargs) -> None:
if self.DEFAULT_METHOD:
self["method"] = self.DEFAULT_METHOD
super(Message, self).__init__(*args, **kwargs)
@property
def payload(self):
return {k: v for k, v in self.items() if k != "method"}
def __getattr__(self, name):
"""
Called when an attribute lookup has not found the attribute
in the usual places
A shortcut to access an item from dict
"""
try:
return self[name]
except KeyError as exc:
raise AttributeError(name) from exc
def __repr__(self):
"""Render for logs: collections with more than _FOLD_LIST_THRESHOLD
items are collapsed to a count and strings longer than
_SHORTEN_STR_THRESHOLD are shortened, recursively through nested
payloads, so a single message cannot flood the log."""
folded_msg = {
k: _fold_repr_value(
v,
fold_limit=self._FOLD_LIST_THRESHOLD,
str_limit=self._SHORTEN_STR_THRESHOLD,
)
for k, v in self.items()
}
return "{}({})".format(self.__class__.__qualname__, folded_msg)
def __str__(self):
return self.__repr__()
class MessageList(Message):
def __init__(self, msg_list):
super().__init__(list=msg_list)
@property
def payload(self):
return self.list
class ShortenReprListMixin:
"""
Do not flood console.log with large sequences
The method collapses messages that are a list.
Instead of showing all the elements of the message,
their number will be displayed.
"""
def __repr__(self: dict): # type: ignore
return "{}({})".format(
self.__class__.__qualname__,
"<{} item(s)>".format(len(self.get("items", []))),
)
class Accumulatable(Message):
"""Messages of this class will be grouped into a list of LIST_CLASS
message instance by Accumulate plugin. Messages whose do_accumulate()
call returns False will not be added to list."""
LIST_CLASS = MessageList
def do_accumulate(self) -> bool:
"""Return True if this message is worth collecting, False otherwise."""
return True
class ServerConnected(Message):
pass
# alias (for better client code readability)
class ServerReconnected(ServerConnected):
pass
class Ping(Message, Reportable):
"""
Will send this message on connected, reconnected events
to provide central server with agent version
"""
DEFAULT_METHOD = "PING"
PRIORITY = 0
def __init__(self):
super().__init__()
self["version"] = CoreConfig.VERSION
class Ack(Message, Reportable):
"""
Notify Server that a persistent message with *seq_number* has been
received by Agent.
"""
DEFAULT_METHOD = "ACK"
def __init__(self, seq_number, **kwargs):
super().__init__(**kwargs)
self["_meta"] = dict(per_seq=seq_number)
class Noop(Message):
"""
Sending NOOP to the agent to track the message in agent logs.
"""
DEFAULT_METHOD = "NOOP"
class ServerConfig(Message, Reportable):
"""
Information about server environment
"""
DEFAULT_METHOD = "SERVER_CONFIG"
TARGET = ReportTarget.API
def __repr__(self):
return "{}()".format(self.__class__.__qualname__)
class WpSecurityPluginStats(Message, Reportable):
DEFAULT_METHOD = "WP_SECURITY_PLUGIN_STATS"
TARGET = ReportTarget.API
class DomainList(Message, Reportable):
"""
Information about server domains
"""
DEFAULT_METHOD = "DOMAIN_LIST"
TARGET = ReportTarget.API
def __repr__(self):
return "{}()".format(self.__class__.__qualname__)
class FilesUpdated(Message):
"""
To consume products of files.update()
"""
def __init__(self, files_type, files_index):
"""
:param files_type: files.Type
:param files_index: files.LocalIndex
"""
# explicit is better than implicit
self["files_type"] = files_type
self["files_index"] = files_index
def __repr__(self):
"""
Do not flood console.log with large sequences
"""
return "{}({{'files_type':'{}', 'files_index':{}}})".format(
self.__class__.__qualname__,
self["files_type"],
self["files_index"],
)
class UpdateFiles(Message, Received):
"""
Update files by getting message from the server
"""
DEFAULT_METHOD = "UPDATE"
class ConfigUpdate(Message):
DEFAULT_METHOD = "CONFIG_UPDATE"
class Reject(Exception):
"""
Kinda message filtering facility.
Raised in order to stop message processing through plugins.
Takes reason of reject as argument.
"""
pass
class Health(Message):
DEFAULT_METHOD = "HEALTH"
class CommandInvoke(Message, Reportable):
DEFAULT_METHOD = "COMMAND_INVOKE"
class ScanFailed(Message, Reportable):
DEFAULT_METHOD = "SCAN_FAILED"
class CleanupFailed(Message, Reportable):
DEFAULT_METHOD = "CLEANUP_FAILED"
class RestoreFromBackupTask(Message):
"""
Creates a task to restore files from backup
"""
DEFAULT_METHOD = "MALWARE_RESTORE_FROM_BACKUP"
class cPanelEvent(Message):
DEFAULT_METHOD = "PANEL_EVENT"
ALLOWED_FIELDS = {
"new_pkg",
"plan",
"exclude",
"imunify360_proactive",
"imunify360_av",
}
@classmethod
def from_hook_event(
cls, username: str, hook: str, ts: float, fields: dict
):
data = {
k.lower(): v
for k, v in fields.items()
if k.lower() in cls.ALLOWED_FIELDS
}
# Check for user rename
if (
hook == "Modify"
and "user" in fields
and "newuser" in fields
and fields["user"] != fields["newuser"]
):
data["old_username"] = fields["user"]
return cls(
{
"username": username,
"hook": hook,
"data": data,
"timestamp": ts,
}
)
class IContactSent(Message, Reportable):
DEFAULT_METHOD = "ICONTACT_SENT"
def _shorten_str(s: str, limit: int) -> str:
"""Shorten *s* string if its length exceeds *limit*."""
assert limit > 4
return (
f"{s[: limit // 2 - 1]}...{s[-limit // 2 + 2 :]}"
if len(s) > limit
else s
)
def _fold_repr_value(value, *, fold_limit: int, str_limit: int):
if isinstance(value, str):
return _shorten_str(value, str_limit)
if isinstance(value, dict):
if len(value) > fold_limit:
return "<{} item(s)>".format(len(value))
return {
k: _fold_repr_value(v, fold_limit=fold_limit, str_limit=str_limit)
for k, v in value.items()
}
if isinstance(value, (list, tuple, set, frozenset)):
if len(value) > fold_limit:
return "<{} item(s)>".format(len(value))
return type(value)(
_fold_repr_value(v, fold_limit=fold_limit, str_limit=str_limit)
for v in value
)
return value
class BackupInfo(Message, Reportable):
"""Information about enabled backup backend"""
DEFAULT_METHOD = "BACKUP_INFO"
# Target serialized size per outgoing message chunk. Kept far below the
# 10 MB NATS max_payload so envelope overhead and size-estimate drift cannot
# push a chunk over the transport limit; the transport keeps a split-on-
# overflow safety net for the rare cases this estimate misses.
MAX_MESSAGE_SIZE = int(
os.environ.get("IMUNIFY360_MAX_MESSAGE_SIZE", 1024 * 1024)
)
def serialized_size(obj) -> int:
from defence360agent.utils.json import ServerJSONEncoder
try:
return len(json.dumps(obj, cls=ServerJSONEncoder).encode())
except (TypeError, ValueError):
return len(repr(obj).encode())
def estimate_size(obj) -> int:
"""Upper bound on obj's JSON byte size as sent on the wire (ensure_ascii),
biased to never undercount. Far cheaper than a full ``serialized_size`` per
call on big scans: JSON-native values are measured structurally without
building the encoded string, and printable-ASCII strings (the common path
for file paths/snippets) are counted with C-level ``str`` ops. Non-native
values (peewee Models, IPs, ...) fall back to the exact ``serialized_size``
— their ``repr`` would wildly undercount the ServerJSONEncoder output. The
transport keeps a split-on-overflow net for the rare drift this leaves."""
if obj is None:
return 4
if isinstance(obj, bool):
return 5
if isinstance(obj, int):
return max(20, len(str(obj)) + 1)
if isinstance(obj, float):
return 24
if isinstance(obj, str):
if obj.isascii() and obj.isprintable():
return len(obj) + 2 + obj.count('"') + obj.count("\\")
return len(json.dumps(obj))
if isinstance(obj, (list, tuple)):
return 2 + sum(estimate_size(v) + 1 for v in obj)
if isinstance(obj, dict):
return 2 + sum(
estimate_size(k if isinstance(k, str) else str(k))
+ 1
+ estimate_size(v)
+ 1
for k, v in obj.items()
)
return serialized_size(obj)
class Splittable:
"""
A message list could be split into multiple batches.
The split is possible for a list itself along with internal resources.
"""
LIST_SIZE = None
BATCH_SIZE = None
BATCH_FIELD = None
@classmethod
def _max_message_size(cls) -> int:
return MAX_MESSAGE_SIZE
@classmethod
def _split_items(cls, messages: List[Accumulatable]):
"""
Split messages' internal lists of things into batches.
A field that is meant to split is defined by `BATCH_FIELD`.
"""
if cls.BATCH_FIELD and cls.BATCH_SIZE:
for message in messages:
if (items := message.get(cls.BATCH_FIELD)) is None:
yield message
else:
message_class = type(message)
for batch in cls._size_bounded_batches(items, message):
data = message.copy()
data[cls.BATCH_FIELD] = batch
new_message = message_class(data)
yield new_message
else:
yield from iter(messages)
@classmethod
def _unit_size(cls, unit, is_dict: bool, message) -> int:
"""Serialized byte cost of one BATCH_FIELD unit. Subclasses override
to also count data paired with the unit in sibling fields of the
message (e.g. a per-hit cleanup result), so those bytes are not
excluded from the byte budget."""
return estimate_size({unit[0]: unit[1]} if is_dict else unit)
@classmethod
def _message_size(cls, message) -> int:
"""Subclasses override when the list class drops part of the message
before sending, so the budget counts only the bytes that go out."""
return estimate_size(message)
@classmethod
def _size_bounded_batches(cls, items, message):
"""Pack `items` into batches bounded by both the byte budget and the
`BATCH_SIZE` count. A single element larger than the budget is emitted
alone rather than dropped."""
budget = cls._max_message_size()
is_dict = isinstance(items, dict)
units = list(items.items()) if is_dict else items
def build(buffer):
return dict(buffer) if is_dict else list(buffer)
buffer = []
size = 0
for unit in units:
unit_size = cls._unit_size(unit, is_dict, message)
if buffer and (
size + unit_size > budget or len(buffer) >= cls.BATCH_SIZE
):
yield build(buffer)
buffer, size = [], 0
buffer.append(unit)
size += unit_size
if buffer:
yield build(buffer)
@classmethod
def batched(cls, messages: List[Accumulatable]):
list_size = cls.LIST_SIZE or len(messages)
budget = cls._max_message_size()
buffer = []
size = 0
for message in cls._split_items(messages):
message_size = cls._message_size(message)
if buffer and (
size + message_size > budget or len(buffer) >= list_size
):
yield buffer
buffer, size = [], 0
buffer.append(message)
size += message_size
if buffer:
yield buffer
class MDSReportList(ShortenReprListMixin, Message, Reportable, Splittable):
DEFAULT_METHOD = "MDS_SCAN_LIST"
class MDSReport(Accumulatable):
LIST_CLASS = MDSReportList
class EnsureServiceState(Message):
"""Ensure the service has the appropriate status"""
DEFAULT_METHOD = "ENSURE_SERVICE_STATE"
class SensorWordpressIncidentList(MessageList, Reportable, Splittable):
"""Aggregated incident list"""
DEFAULT_METHOD = "INCIDENT_LIST"
class WordpressPluginAction(Message):
DEFAULT_METHOD = "WP_SECURITY_PLUGIN_ACTION"
class WordpressPluginTelemetry(Message, Reportable):
"""
Information about telemetry event related to Imunify Security WordPress plugin
"""
DEFAULT_METHOD = "WP_SECURITY_PLUGIN_EVENT"
TARGET = ReportTarget.API
def __repr__(self):
return "{}()".format(self.__class__.__qualname__)
class WPRuleDisabled(Message, Reportable):
"""WordPress protection rule disabled."""
DEFAULT_METHOD = "RULE_DISABLED"
class WPRuleEnabled(Message, Reportable):
"""WordPress protection rule re-enabled."""
DEFAULT_METHOD = "RULE_ENABLED"
class GeneralMetrics(MessageList, Reportable):
DEFAULT_METHOD = "GENERAL_METRICS"
defence360agent/contracts/myimunify_id.py 0000644 0000000 0000000 00000013413 00000000000 015624 0 ustar import os
import pwd
import stat
import uuid
from pathlib import Path
from typing import Dict, List, Optional
from defence360agent.contracts.permissions import logger
from defence360agent.model import instance
from defence360agent.myimunify.model import MyImunify, update_users_protection
from defence360agent.subsys.panels.hosting_panel import HostingPanel
from defence360agent.utils import safe_fileops
MYIMUNIFY_ID_FILE_NAME = ".myimunify_id"
_BANNER = (
"# DO NOT EDIT\n# This file contains MyImunify id unique to this user\n\n"
)
_ID_LEN = 32
_HEX = frozenset("0123456789abcdef")
class MyImunifyIdError(Exception):
"""Exception representing issues related to MyImunify id"""
async def add_myimunify_user(
sink, user: str, protection: bool
) -> Optional[str]:
"""Save subscription type to the DB and generate id file"""
myimunify, _ = MyImunify.get_or_create(user=user)
myimunify.save()
await update_users_protection(sink, [user], protection)
logger.info("Applied setting MyImunify=%s for user %s", protection, user)
try:
myimunify_id = await _get_or_generate_id(user)
except MyImunifyIdError:
# User no longer exists
return None
return myimunify_id
async def get_myimunify_users() -> List[Dict]:
"""
Get a list of MyImunify users, their subscription types and unique ids
"""
users = []
user_details = await HostingPanel().get_user_details()
myimunify_user_to_id = await _myimunify_user_to_id()
with instance.db.transaction():
for user, myimunify_uid in sorted(myimunify_user_to_id.items()):
record, _ = MyImunify.get_or_create(user=user)
users.append(
{
"email": user_details.get(user, {}).get("email", ""),
"username": user,
"myimunify_id": myimunify_uid,
"protection": record.protection,
"locale": user_details.get(user, {}).get("locale", ""),
}
)
return users
async def _myimunify_user_to_id() -> Dict[str, str]:
"""Get a list of users and their MyImunify ids"""
user_to_id = {}
for user in await HostingPanel().get_users():
try:
user_to_id[user] = await _get_or_generate_id(user)
except MyImunifyIdError:
# User does not exist
continue
except safe_fileops.UnsafeFileOperation as e:
logger.warning(
"Unable to generate id for user=%s, error=%s", user, str(e)
)
continue
return user_to_id
async def _get_or_generate_id(user: str) -> str:
"""
Read MyImunify id if exists and valid, or generate a new one and write into the file.
Malformed files are regenerated.
"""
id_file = await _get_myimunify_id_file(user)
try:
return _read_id(id_file)
except (FileNotFoundError, MyImunifyIdError):
myimunify_id = uuid.uuid1().hex
return await _write_id(myimunify_id, id_file)
async def _write_id(myimunify_id: str, id_file: Path) -> str:
"""Write MyImunify id to file"""
text = _BANNER + myimunify_id + "\n"
try:
await safe_fileops.write_text(str(id_file), text)
except OSError as e:
logger.warning("Unable to write myimunify_id in user home dir: %s", e)
raise MyImunifyIdError from e
return myimunify_id
def _read_id(id_file: Path) -> str:
"""Read and validate MyImunify id from file. Raises MyImunifyIdError if malformed.
Opens with O_RDONLY | O_NONBLOCK and verifies via fstat() that the
fd refers to a regular file before reading. This eliminates the
TOCTOU window between a path-level type check and the actual read
(e.g. an attacker replacing the file with a FIFO between the two).
"""
try:
fd = os.open(str(id_file), os.O_RDONLY | os.O_NONBLOCK)
except FileNotFoundError:
raise
except OSError:
raise MyImunifyIdError
try:
if not stat.S_ISREG(os.fstat(fd).st_mode):
raise MyImunifyIdError
data = os.read(fd, 8192)
text = data.decode("utf-8")
except UnicodeDecodeError:
raise MyImunifyIdError
finally:
os.close(fd)
return _parse_id(text)
def _parse_id(text: str) -> str:
"""Read line by line: skip comments (#). First non-comment line must be valid id; nothing after it."""
id_line = None
for line in text.splitlines():
s = line.strip()
if not s:
continue
if s.startswith("#"):
continue
if id_line is not None:
raise MyImunifyIdError
if len(s) != _ID_LEN or not all(c in _HEX for c in s):
raise MyImunifyIdError
id_line = s
if id_line is None:
raise MyImunifyIdError
return id_line
async def _get_myimunify_id_file(user: str) -> Path:
"""Get a file with MyImunify id and create it if does not exist"""
try:
user_pwd = pwd.getpwnam(user)
except KeyError as e:
logger.warning("No such user: %s", user)
raise MyImunifyIdError from e
else:
id_file = Path(user_pwd.pw_dir) / MYIMUNIFY_ID_FILE_NAME
try:
safe_fileops.ensure_regular_file(str(id_file))
except FileNotFoundError:
if not id_file.parent.exists():
logger.warning("No such user homedir: %s", user)
raise MyImunifyIdError
try:
await safe_fileops.touch(str(id_file))
except OSError as e:
logger.warning(
"Unable to put myimunify_id in user home dir: %s", e
)
raise MyImunifyIdError from e
except OSError:
logger.warning("Cannot access identity file: %s", id_file)
raise MyImunifyIdError
return id_file
defence360agent/contracts/permissions.py 0000644 0000000 0000000 00000016021 00000000000 015473 0 ustar import logging
from asyncio.coroutines import iscoroutinefunction
from pathlib import Path
from typing import Optional
from defence360agent.contracts.config import (
MyImunifyConfig,
PermissionsConfig,
Wordpress,
)
from defence360agent.contracts.license import LicenseCLN
from defence360agent.feature_management.constants import AV_REPORT, FULL
from defence360agent.feature_management.model import FeatureManagementPerms
from defence360agent.myimunify.model import MyImunify
from defence360agent.subsys.panels.hosting_panel import HostingPanel
from defence360agent.subsys.panels.plesk import Plesk
from defence360agent.utils import importer
try:
from imav.malwarelib.api.imunify_patch_subscription import (
ImunifyPatchSubscriptionAPI,
)
except ImportError:
ImunifyPatchSubscriptionAPI = None
logger = logging.getLogger(__name__)
PERMISSIONS = (
MS_VIEW,
MS_CLEAN,
MS_CLEAN_REQUIRES_MYIMUNIFY_PROTECTION,
MS_ON_DEMAND_SCAN,
MS_ON_DEMAND_SCAN_WITHOUT_RATE_LIMIT,
MS_IGNORE_LIST_EDIT,
MS_CONFIG_DEFAULT_ACTION_EDIT,
MS_IMUNIFY_PATCH_ENABLED,
MS_IMUNIFY_PATCH_ELIGIBLE_TO_PURCHASE,
PD_VIEW,
PD_CONFIG_MODE_EDIT,
WP_WAF_EDIT,
WP_WAF_RULES_EDIT,
) = (
"malware_scanner.view",
"malware_scanner.clean",
"malware_scanner.clean_requires_myimunify_protection",
"malware_scanner.on_demand.scan",
"malware_scanner.on_demand.scan_without_rate_limit",
"malware_scanner.ignore_list.edit",
"malware_scanner.config.default_action.edit",
"malware_scanner.imunify_patch.enabled",
"malware_scanner.imunify_patch.eligible_to_purchase",
"proactive_defense.view",
"proactive_defense.config.mode.edit",
"wordpress.waf.edit",
"wordpress.waf.rules.edit",
)
GLOBAL_CONFDIR = Path("/etc/sysconfig/imunify360")
def is_plesk_service_plan_enabled() -> bool:
return (
HostingPanel().NAME == Plesk.NAME
and PermissionsConfig.USE_PLESK_SERVICE_PLAN
)
def myimunify_protection_enabled(user: Optional[str] = None) -> bool:
return MyImunify.get_protection(user)
def ms_view(user: Optional[str] = None) -> bool:
if user is None:
return True
return FeatureManagementPerms.get_perm(user).av in (
AV_REPORT,
FULL,
)
def ms_clean(user: Optional[str] = None) -> bool:
if LicenseCLN.is_free() or not LicenseCLN.is_valid():
return False
if user is None:
return True
if is_plesk_service_plan_enabled():
# should be handled by Plesk extension
return True
return FeatureManagementPerms.get_perm(user).av == FULL
def ms_clean_requires_myimunify_protection(user: Optional[str] = None):
if MyImunifyConfig.ENABLED:
return myimunify_protection_enabled(user)
return ms_clean(user)
def ms_on_demand_scan(user: Optional[str] = None) -> bool:
if user is None:
return True
if MyImunifyConfig.ENABLED:
# on-demand scan is available for both Basic and Pro subscriptions
return True
if is_plesk_service_plan_enabled():
# should be handled by Plesk extension
return True
return PermissionsConfig.ALLOW_MALWARE_SCAN
def ms_on_demand_scan_without_rate_limit(
user: Optional[str] = None,
) -> bool:
if MyImunifyConfig.ENABLED:
return myimunify_protection_enabled(user)
return PermissionsConfig.ALLOW_MALWARE_SCAN
def ms_ignore_list_edit(user: Optional[str] = None):
if user is None:
return True
if MyImunifyConfig.ENABLED:
# so far, MyImunify doesn't allow to the user editing ignore list
return False
return PermissionsConfig.USER_IGNORE_LIST
def ms_config_default_action_edit(user: Optional[str] = None):
if user is None:
return True
if MyImunifyConfig.ENABLED:
# so far, MyImunify doesn't allow to the user
# editing default malware action
return False
return PermissionsConfig.USER_OVERRIDE_MALWARE_ACTIONS
ms_imunify_patch_enabled = importer.get(
module="imav.contracts.permissions",
name="is_imunify_patch_enabled",
default=lambda _: False,
)
has_imunify_patch_subscriptions = importer.get(
module="imav.malwarelib.api.imunify_patch_subscription",
name="has_imunify_patch_subscriptions",
default=lambda _: False,
)
async def ms_imunify_patch_eligible_to_purchase(
user: str | None = None,
) -> bool:
if ImunifyPatchSubscriptionAPI is None:
return (
LicenseCLN.is_eligible_for_imunify_patch()
or has_imunify_patch_subscriptions(user)
)
return (
LicenseCLN.is_eligible_for_imunify_patch()
or has_imunify_patch_subscriptions(user)
or (
await ImunifyPatchSubscriptionAPI.get_purchase_eligibility()
).eligible
)
def pd_view(user: Optional[str] = None):
if user is None:
return True
return FeatureManagementPerms.get_perm(user).proactive == FULL
def pd_config_mode_edit(user: Optional[str] = None):
if user is None:
return True
if MyImunifyConfig.ENABLED:
return False
return PermissionsConfig.USER_OVERRIDE_PROACTIVE_DEFENSE
def wp_waf_edit(user: Optional[str] = None):
if user is None:
return True
if not Wordpress.SECURITY_PLUGIN_ENABLED:
return False
try:
return bool(Wordpress.WAF_ENABLED)
except KeyError:
return True
def wp_waf_rules_edit(user: Optional[str] = None):
if user is None:
return True
try:
return bool(PermissionsConfig.ALLOW_WP_WAF_RULES_MANAGEMENT)
except KeyError:
return True
HAS_PERMISSION = {
MS_VIEW: ms_view,
MS_CLEAN: ms_clean,
MS_CLEAN_REQUIRES_MYIMUNIFY_PROTECTION: (
ms_clean_requires_myimunify_protection
),
MS_ON_DEMAND_SCAN: ms_on_demand_scan,
MS_ON_DEMAND_SCAN_WITHOUT_RATE_LIMIT: ms_on_demand_scan_without_rate_limit,
MS_IGNORE_LIST_EDIT: ms_ignore_list_edit,
MS_CONFIG_DEFAULT_ACTION_EDIT: ms_config_default_action_edit,
MS_IMUNIFY_PATCH_ENABLED: ms_imunify_patch_enabled,
MS_IMUNIFY_PATCH_ELIGIBLE_TO_PURCHASE: ms_imunify_patch_eligible_to_purchase,
PD_VIEW: pd_view,
PD_CONFIG_MODE_EDIT: pd_config_mode_edit,
WP_WAF_EDIT: wp_waf_edit,
WP_WAF_RULES_EDIT: wp_waf_rules_edit,
}
async def has_permission(permission, user) -> bool:
func = HAS_PERMISSION.get(permission)
if func is None:
return False
if iscoroutinefunction(func):
return await func(user)
return func(user)
async def check_permission(permission, user) -> None:
func = HAS_PERMISSION.get(permission)
if func is None:
raise PermissionError("notifications.generalPermissionError")
if iscoroutinefunction(func):
if not await func(user):
raise PermissionError("notifications.generalPermissionError")
else:
if not func(user):
raise PermissionError("notifications.generalPermissionError")
async def permissions_list(user) -> list[str]:
return [
permission
for permission in PERMISSIONS
if await has_permission(permission, user)
]
defence360agent/contracts/plugins.py 0000644 0000000 0000000 00000020202 00000000000 014575 0 ustar import asyncio
import inspect
import logging
import subprocess
from abc import ABC, ABCMeta, abstractmethod
from contextlib import suppress
from functools import lru_cache, wraps
from defence360agent.contracts.messages import Message, MessageType
from defence360agent.utils import Scope
logger = logging.getLogger(__name__)
class BasePlugin(object):
SCOPE = Scope.AV_IM360
SHUTDOWN_PRIORITY = 100 # lower means shuts down first
AVAILABLE_ON_FREEMIUM = True
_subclasses = []
def __init_subclass__(cls, **kwargs):
super().__init_subclass__(**kwargs)
cls._subclasses.append(cls)
@classmethod
def get_active_plugins(cls):
# consider all non-abstract subclasses are active
return [
plugin
for plugin in cls._subclasses
if not inspect.isabstract(plugin)
]
async def shutdown(self):
"""Shutdown plugin's subsystems, cancel running tasks,
clean iptables (if plugin is protector).
It should be safe to assume that it is called after
corresponding create_source if applicable.
It is called only from the shutdown task that runs at most once,
meaning shutdown() is never called twice.
"""
pass
def __repr__(self):
return "%s.%s" % (self.__class__.__module__, self.__class__.__name__)
class MessageSource(BasePlugin, ABC):
@abstractmethod
async def create_source(self, loop, sink):
"""This method is a coroutine."""
class Sensor(MessageSource, ABC):
"""
Sensor is alias to MessageSource.
"""
async def create_source(self, loop, sink):
"""This method is a coroutine."""
return await self.create_sensor(loop, sink)
@abstractmethod
async def create_sensor(self, loop, sink):
"""This method is a coroutine."""
class LogStreamReader(Sensor, metaclass=ABCMeta):
source_file = None
# Limit of bytes consumed from stream
# while trying to read one line (128 kB)
_LIMIT = 2**17
_cmd = None
async def create_sensor(self, loop, sink):
self._loop = loop
self._sink = sink
self._cmd = None
if not self.source_file:
return
self._cmd = (
"/usr/bin/tail",
# follow beyond the end of the file
"--follow=name",
"-n0",
# keep trying to open a file if it is inaccessible
"--retry",
self.source_file,
)
self._child_process = await asyncio.create_subprocess_exec(
*self._cmd,
stdin=subprocess.DEVNULL,
stdout=subprocess.PIPE,
stderr=subprocess.DEVNULL,
bufsize=0,
limit=self._LIMIT,
)
loop.create_task(
self._infinite_read_and_proceed(self._child_process.stdout)
)
async def shutdown(self):
if self._cmd is not None:
cmd, self._cmd = self._cmd, None
logger.debug("Terminating child process [%s]", cmd)
# child process dies from the same signal when agent
# is run from console (not as --daemon)
with suppress(ProcessLookupError):
self._child_process.kill()
rc = await self._child_process.wait()
logger.debug(
"Terminated child process [%s] with code [%d]", cmd, rc
)
@abstractmethod
async def _infinite_read_and_proceed(self, stream_reader):
raise NotImplementedError
class BaseMessageProcessor:
@lru_cache(maxsize=1)
def _message_processors(self):
rv = []
for attr_str in dir(self):
if attr_str.startswith("_"):
continue # skip non-public attributes
func = getattr(self, attr_str)
if callable(func) and hasattr(
func, "_decorated_for_process_message"
):
rv.append(func)
return rv
async def process_message(self, message):
logger.debug("Dispatching %r through %r...", message, self)
for coro in self._message_processors():
result = await coro(message)
if isinstance(result, Message):
return result
class MessageSink(BasePlugin, BaseMessageProcessor, ABC):
class ProcessingOrder:
# e.g. check is valid ipv4
PRE_PROCESS_MESSAGE = 10
# lfd plugin should process lfd alerts before other ignore plugins
LFD = 18
# e.g. for ignore_alert_with_whitelisted_ip
IGNORE_MESSAGE = 20
# Should be before check ip in graylist
UNBLOCK_FROM_SUBNET = 30
# Check ip in the graylist already
CHECK_IP_IN_GRAYLIST = 40
# Append ttl to alert
GRAYLIST_TIMEOUT = 50
# Store graylist to db
GRAYLIST_DB_FIXUP = 55
# this should run before IPSET_PROTECTOR
IMPORT_EXPORT_WBLIST = 60
# make ml prediction before lazy_init
ML_PREDICTION = 70
# the default
DEFAULT = 80
IPSET_PROTECTOR = DEFAULT
WEBSHIELD_PROTECTOR = 81
# should be run after ManageGrayList(DEFAULT)
WHITELIST_UNBLOCKED = 90
# Synclist timestamp update
SYNCLIST_UPDATE = 100
# post action
POST_ACTION = 120
# event hook processing
EVENT_HOOK = 150
# iContact
ICONTACT_SENT = 200
# e.g. Accumulate
POST_PROCESS_MESSAGE = 999
# alias for DEFAULT
PROCESSING_ORDER = ProcessingOrder.DEFAULT
@abstractmethod
async def create_sink(self, loop):
pass
def expect(*message_type, async_lock=None, **expect_fields):
"""
@expect decorator for MessageSink.dosmth(message) async methods.
MessageSink method will be called by MessageSink.process_message()
if message_type and expect_fields match the message ones.
@expect's can be stacked together and decision whether to call decorated
coro is made by evaluating stacked @expect's with logical OR:
@expect(MessageType.SensorAlert) # -- OR --
@expect(MessageType.SensorIncident, plugin_id='ossec')
def protect(message): ...
"""
def decorate(coro):
if getattr(coro, "__name__", "").startswith("_"):
raise TypeError("{coro} is not public".format(coro=coro))
@wraps(coro)
async def decorated(self, message):
def match():
return isinstance(message, message_type) and all(
message.get(k) == v for k, v in expect_fields.items()
)
def is_stacked(coro):
return hasattr(coro, "_decorated_for_process_message")
def terminal(coro):
if is_stacked(coro):
return terminal(coro._decorated_for_process_message)
return coro
# process stacked decorators with logical OR
if match():
if async_lock is True:
await message.acquire()
try:
result = await terminal(coro)(self, message)
except Exception as exc:
if (
isinstance(message, MessageType.Lockable)
and message.locked()
):
message.release()
raise exc
else:
if (
async_lock is False
and isinstance(message, MessageType.Lockable)
and message.locked()
):
message.release()
return result
if is_stacked(coro):
# Give next decorator a chance: logical OR
return await coro(self, message)
return None
decorated._decorated_for_process_message = coro
return decorated
return decorate
_plugin_registry = set()
def thisguy(plugincls):
"""Register class as a plugin.
>>> @thisguy
>>> class ConcreteSink (MessageSink):
>>> ...
"""
_plugin_registry.add(plugincls)
return plugincls
def theseguys():
"""Enumerate classobj for registered plugins."""
return _plugin_registry
defence360agent/contracts/sentry.py 0000644 0000000 0000000 00000006134 00000000000 014450 0 ustar from pathlib import Path
from subprocess import DEVNULL, CalledProcessError, check_output
from typing import Any
from defence360agent.utils import stub_unexpected_error
def _run_cmd(cmd):
try:
out = check_output(cmd, stderr=DEVNULL)
except (FileNotFoundError, CalledProcessError):
return None
return out.decode("utf-8", errors="ignore").strip()
@stub_unexpected_error
def _get_virtualization_type():
systemd_virt = _run_cmd(["systemd-detect-virt"])
if systemd_virt:
return systemd_virt
virt_what = _run_cmd(["virt-what"])
if virt_what:
return virt_what
demicode = _run_cmd(["dmidecode", "-s", "system-manufacturer"])
if demicode:
return demicode
return "fail to detect"
@stub_unexpected_error
def _get_total_ram():
import psutil
return psutil.virtual_memory().total // 2**20
_TAGS = None
def _tags():
global _TAGS
if _TAGS is None:
from defence360agent.utils import OsReleaseInfo
_TAGS = {
"av_version": None,
"core_version": None,
"version": None,
"os_details": stub_unexpected_error(OsReleaseInfo.pretty_name)(),
"ip": None,
"hosting_panel": None,
"total_ram": _get_total_ram(),
"firewall": None,
"strategy": None,
"virtualization": _get_virtualization_type(),
"server_id": None,
"iaid": None,
"name": None,
"test_build_id": None,
"test_build_job_id": None,
"test_parent_build_id": None,
}
return _TAGS
def set_firewall_type(firewall: str) -> None:
_tags()["firewall"] = firewall
def set_hosting_panel(panel: str) -> None:
_tags()["hosting_panel"] = panel
def set_strategy(strategy: str) -> None:
_tags()["strategy"] = strategy
def set_ip(ip: str) -> None:
_tags()["ip"] = ip
def set_product_name(product: str) -> None:
_tags()["name"] = product
def set_server_id(id: str | None) -> None:
_tags()["server_id"] = id
def set_iaid(iaid: str | None) -> None:
_tags()["iaid"] = iaid
def set_version(version: str) -> None:
_tags()["version"] = version
def set_av_version(version: str) -> None:
_tags()["av_version"] = version
def set_core_version(version: str) -> None:
_tags()["core_version"] = version
def tags() -> dict:
return _tags().copy()
def tag(name: str) -> Any:
return _tags()[name]
def set_test_env() -> None:
"""Set tags for sentry events about test environment."""
for file_name, tag in [
(
Path("/var/imunify360/TEST_BUILD_ID"),
"test_build_id",
),
(
Path("/var/imunify360/TEST_BUILD_JOB_ID"),
"test_build_job_id",
),
(
Path("/var/imunify360/TEST_PARENT_BUILD_ID"),
"test_parent_build_id",
),
]:
if file_name.exists():
try:
_tags()[tag] = file_name.read_text().strip()
except Exception:
# Ignore errors on loading test env tags
pass
defence360agent/defence360.py 0000644 0000000 0000000 00000007660 00000000000 012753 0 ustar import asyncio
import logging
import os
import sys
from pathlib import Path
import defence360agent.internals.logger
from defence360agent.contracts.config import Core as Config
from defence360agent.rpc_tools.exceptions import ResponseError
from defence360agent.simple_rpc import SUCCESS, SocketError
from defence360agent.utils import is_root_user
from defence360agent.utils.cli import (
EXIT_CODES,
EXITCODE_GENERAL_ERROR,
print_error,
print_response,
print_warnings,
)
from defence360agent.utils.parsers import EnvParser, create_cli_parser
from defence360agent.sentry import flush_sentry
logger = logging.getLogger(__name__)
RPM_TRANSACTION_LOCK = Path(
"/var/lib/rpm-state/imunify360-transaction-in-progress"
)
def main(rpc_handlers_init, cli_args):
# get ready to start: set conservative umask
os.umask(Config.FILE_UMASK)
defence360agent.internals.logger.reconfigure()
rpc_handlers_init()
parser = create_cli_parser()
args = parser.parse_args(args=cli_args)
if args.log_config or os.environ.get("IMUNIFY360_LOGGING_CONFIG_FILE"):
defence360agent.internals.logger.update_logging_config_from_file(
args.log_config or os.environ.get("IMUNIFY360_LOGGING_CONFIG_FILE")
)
if args.console_log_level:
defence360agent.internals.logger.setConsoleLogLevel(
args.console_log_level
)
if hasattr(args, "completions_command"):
from defence360agent.utils.completions import generate_completions
print(generate_completions(parser, args.shell))
return
if hasattr(args, "endpoint") and hasattr(args, "generate_endpoint_params"):
try:
cli_kwargs = args.generate_endpoint_params(args)
envvar_kwargs = EnvParser.parse(
os.environ,
args.command,
args.envvar_parameter_options,
exclude=cli_kwargs,
)
result, data = args.endpoint(**envvar_kwargs, **cli_kwargs)
print_warnings(data)
flush_sentry()
if result == SUCCESS:
print_response(args.command, data, args.json, args.verbose)
else:
print_error(result, data, args.json, args.verbose)
sys.exit(EXIT_CODES[result])
except SocketError as e:
print_response(
None, {"items": "ERROR: {}".format(e)}, args.json, args.verbose
)
sys.exit(EXITCODE_GENERAL_ERROR)
else:
print(parser.format_help())
def entrypoint(rpc_handlers_init):
if not is_root_user():
logger.info("%s could be used by the root user only!", Config.NAME)
print(
"Imunify360 CLI is unavailable for non-root user", file=sys.stderr
)
sys.exit(EXITCODE_GENERAL_ERROR)
try:
main(rpc_handlers_init, sys.argv[1:])
except KeyboardInterrupt:
logger.warning("User pressed Ctrl+C, exiting...")
sys.exit(EXITCODE_GENERAL_ERROR)
except ResponseError as e:
logger.error("Response error: %s", e)
sys.exit(EXITCODE_GENERAL_ERROR)
except ImportError as e:
if RPM_TRANSACTION_LOCK.exists():
logger.error("RPM transaction is in progress. %s", e)
print(
"RPM transaction is in progress. Please, wait until it is "
"finished and try again.",
file=sys.stderr,
)
sys.exit(EXITCODE_GENERAL_ERROR)
else:
logger.exception(
"Unknown error happened. See logs for more information"
)
sys.exit(EXITCODE_GENERAL_ERROR)
except Exception:
logger.exception(
"Unknown error happened. See logs for more information"
)
sys.exit(EXITCODE_GENERAL_ERROR)
finally:
# ensure loop is closed to prevent asyncio warning
# (https://bugs.python.org/issue23548)
asyncio.get_event_loop().close()
defence360agent/feature_management/ 0000755 0000000 0000000 00000000000 00000000000 014375 5 ustar defence360agent/feature_management/__init__.py 0000644 0000000 0000000 00000000000 00000000000 016474 0 ustar defence360agent/feature_management/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 016605 5 ustar defence360agent/feature_management/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000315 00000000000 024004 0 ustar
r_j d S )N r `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/__init__.py<module>r s r defence360agent/feature_management/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000315 00000000000 023045 0 ustar
r_j d S )N r `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/__init__.py<module>r s r defence360agent/feature_management/__pycache__/checkers.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006556 00000000000 024051 0 ustar
r_j d dl mZ d dlmZ ddlmZ ddlmZ ddlm Z de
dee
d e
fd
Z dde
d e
d e
fd
Z dde
d e
de
fdZde
d e
fdZdS ) )List)deepcopy )FeatureDisabledError)CONFIG_MAPPINGS)FeatureManagementPermsfeature permissionsuserc |dS t j | }| | }||vr$t d | | dS )a
Raise exception if feature is disabled for user
:param feature: feature name
:param permissions: permissions required
:param user: user name
:return: None
:raises FeatureDisabledError: if user is prohibited from use of the feature
Nz.Feature '{name}' is disabled for user '{user}')namer )r get_perm get_featurer format)r r
r permpermission_values `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/checkers.py
check_featurer
su | ! *4 0 0D''00{**" < C C 4
D
+* Fsectionc |dS | t vrdS |t | vrdS t | t | | | n# t $ r |r Y dS w xY wdS )at
Check if section is allowed to be read or write by user
:param feature: feature name
:param user: user name
:param section: section name to check
:param raise_: True to raise exception, otherwise return True or False
:return: True if config sections is allowed to user, False otherwise
:raises FeatureDisabledError: raised if raise_=True
NTF)r r r )r r r raise_s r check_configr " s |to%%tog...tgw 7 @$GGGG uu
4s "A
AANdatareturnc j t | }t D ]}| D ]}t ||| s||= |S )z
Remove prohibited sections from user config
:param data: config data
:param user: user name
:return: new config data
)r r r )r r new_datar r s r config_cleanupr @ sV ~~H" & & & &G w77
& W% & Or c J t D ]}| D ]}t |||d dS )z
Raise exception if user is making changes on prohibited sections of config
:param data: config data
:param user: user name
:return: None
:raises FeatureDisabledError: if user is prohibited
T)r N)r r )r r r r s r config_validationr R sK # > > > >G $ = = = = = >> >r )F)N)typingr copyr
exceptionsr constantsr modelr strr r dictr r r r <module>r) s , , , , , , & & & & & & ) ) ) ) ) )
3
T#Y
c
0 # S 3 < S D $ >D > > > > > > >r defence360agent/feature_management/__pycache__/checkers.cpython-311.pyc 0000644 0000000 0000000 00000006556 00000000000 023112 0 ustar
r_j d dl mZ d dlmZ ddlmZ ddlmZ ddlm Z de
dee
d e
fd
Z dde
d e
d e
fd
Z dde
d e
de
fdZde
d e
fdZdS ) )List)deepcopy )FeatureDisabledError)CONFIG_MAPPINGS)FeatureManagementPermsfeature permissionsuserc |dS t j | }| | }||vr$t d | | dS )a
Raise exception if feature is disabled for user
:param feature: feature name
:param permissions: permissions required
:param user: user name
:return: None
:raises FeatureDisabledError: if user is prohibited from use of the feature
Nz.Feature '{name}' is disabled for user '{user}')namer )r get_perm get_featurer format)r r
r permpermission_values `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/checkers.py
check_featurer
su | ! *4 0 0D''00{**" < C C 4
D
+* Fsectionc |dS | t vrdS |t | vrdS t | t | | | n# t $ r |r Y dS w xY wdS )at
Check if section is allowed to be read or write by user
:param feature: feature name
:param user: user name
:param section: section name to check
:param raise_: True to raise exception, otherwise return True or False
:return: True if config sections is allowed to user, False otherwise
:raises FeatureDisabledError: raised if raise_=True
NTF)r r r )r r r raise_s r check_configr " s |to%%tog...tgw 7 @$GGGG uu
4s "A
AANdatareturnc j t | }t D ]}| D ]}t ||| s||= |S )z
Remove prohibited sections from user config
:param data: config data
:param user: user name
:return: new config data
)r r r )r r new_datar r s r config_cleanupr @ sV ~~H" & & & &G w77
& W% & Or c J t D ]}| D ]}t |||d dS )z
Raise exception if user is making changes on prohibited sections of config
:param data: config data
:param user: user name
:return: None
:raises FeatureDisabledError: if user is prohibited
T)r N)r r )r r r r s r config_validationr R sK # > > > >G $ = = = = = >> >r )F)N)typingr copyr
exceptionsr constantsr modelr strr r dictr r r r <module>r) s , , , , , , & & & & & & ) ) ) ) ) )
3
T#Y
c
0 # S 3 < S D $ >D > > > > > > >r defence360agent/feature_management/__pycache__/constants.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001340 00000000000 024260 0 ustar
r_j/ p d Z dZdZdZdZdZe deegiiZdZede d iZee eee eiZ eed
z fZ
d S ) proactiveavnafullreportlogPROACTIVE_DEFENCE
imunify360
imunify360_avimunify360_proactivez.tt2N) PROACTIVEAVNAFULL AV_REPORTLOGCONFIG_MAPPINGSNATIVE_EXTENSION_NAMEFEATURE_EXT_VARIABLESEXTENSION_DEFAULTS1NATIVE_FEATURE_MANAGEMENT_PACKAGE_EXTENSION_FILES a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/constants.py<module>r s
dC[ %
% " y)$d F"5 1 1 1r defence360agent/feature_management/__pycache__/constants.cpython-311.pyc 0000644 0000000 0000000 00000001340 00000000000 023321 0 ustar
r_j/ p d Z dZdZdZdZdZe deegiiZdZede d iZee eee eiZ eed
z fZ
d S ) proactiveavnafullreportlogPROACTIVE_DEFENCE
imunify360
imunify360_avimunify360_proactivez.tt2N) PROACTIVEAVNAFULL AV_REPORTLOGCONFIG_MAPPINGSNATIVE_EXTENSION_NAMEFEATURE_EXT_VARIABLESEXTENSION_DEFAULTS1NATIVE_FEATURE_MANAGEMENT_PACKAGE_EXTENSION_FILES a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/constants.py<module>r s
dC[ %
% " y)$d F"5 1 1 1r defence360agent/feature_management/__pycache__/control.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000010723 00000000000 023731 0 ustar
r_j d dl Z d dlZd dlmZ d dlmZmZmZmZ d dl m
Z
d dl m Z d dl
mZ ej e Zd Zd Zed Zed
Zed ZdS ) N)Version)EXTENSION_DEFAULTSFEATURE_EXT_VARIABLESNATIVE_EXTENSION_NAME1NATIVE_FEATURE_MANAGEMENT_PACKAGE_EXTENSION_FILES)reset_features)cPanel) HostingPanelc F t j fd }|S )z-Do not run a function on an unsupported panelc K t d {V r | i | d {V S t d d S )Nz*Native feature management is not supported)&is_native_feature_management_supportedloggerinfo)argskwargsfuncs _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/control.pywrapperzsupported.<locals>.wrapper sg 799 9 9 9 9 9 9 / t.v........ . @AAAAA ) functoolswraps)r r s ` r supportedr s? _TB B B B B
Nr c K t } | j t j k rJ t | d{V t d k S # t
$ r Y dS w xY wdS )z:Whether we support native feature management on the panel.Nz68.0F)r
NAMEr r version
ValueErrorhps r r
r
s
B w&+ ------..'&//A A 55 5s 7A
A-,A-c K t } | t o| d{V S )z1Whether the native feature management is enabled.)pkgsN)r
is_extension_installedr is_hook_installedr s r $is_native_feature_management_enabledr# + sY
B
!!B "
) &&(( ( ( ( ( ( ( r c K t } t di d t j D d{V | j t
t fi t d{V t d dS )z!Enable native feature management.c 0 i | ]\ }}|t | S )r ).0featurepe_vars r
<dictcomp>z4enable_native_feature_management.<locals>.<dictcomp>@ s4
'/
r Nz-Imunify360 native feature management enabled.r& )
r
r r itemsinstall_extensionr r r r r r s r enable_native_feature_managementr- 8 s
B
#8#>#@#@
"
9 KK?@@@@@r c K t d{V s t d dS t t
t d{V t d dS )z"Disable native feature management.Nz,No Imunify360 package extensions to disable.Tz.Imunify360 native feature management disabled.)r# r r r
uninstall_extensionr r r& r r !disable_native_feature_managementr0 O s 677 7 7 7 7 7 7 BCCCt
..
,
, 9
KK@AAA 4r )r loggingpackaging.versionr ,defence360agent.feature_management.constantsr r r r (defence360agent.feature_management.utilsr $defence360agent.subsys.panels.cpanelr +defence360agent.subsys.panels.hosting_panelr
getLogger__name__r r r
r# r- r0 r& r r <module>r9 s/ % % % % % % D C C C C C 7 7 7 7 7 7 D D D D D D 8 $ $
A A A,
r defence360agent/feature_management/__pycache__/control.cpython-311.pyc 0000644 0000000 0000000 00000010723 00000000000 022772 0 ustar
r_j d dl Z d dlZd dlmZ d dlmZmZmZmZ d dl m
Z
d dl m Z d dl
mZ ej e Zd Zd Zed Zed
Zed ZdS ) N)Version)EXTENSION_DEFAULTSFEATURE_EXT_VARIABLESNATIVE_EXTENSION_NAME1NATIVE_FEATURE_MANAGEMENT_PACKAGE_EXTENSION_FILES)reset_features)cPanel) HostingPanelc F t j fd }|S )z-Do not run a function on an unsupported panelc K t d {V r | i | d {V S t d d S )Nz*Native feature management is not supported)&is_native_feature_management_supportedloggerinfo)argskwargsfuncs _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/control.pywrapperzsupported.<locals>.wrapper sg 799 9 9 9 9 9 9 / t.v........ . @AAAAA ) functoolswraps)r r s ` r supportedr s? _TB B B B B
Nr c K t } | j t j k rJ t | d{V t d k S # t
$ r Y dS w xY wdS )z:Whether we support native feature management on the panel.Nz68.0F)r
NAMEr r version
ValueErrorhps r r
r
s
B w&+ ------..'&//A A 55 5s 7A
A-,A-c K t } | t o| d{V S )z1Whether the native feature management is enabled.)pkgsN)r
is_extension_installedr is_hook_installedr s r $is_native_feature_management_enabledr# + sY
B
!!B "
) &&(( ( ( ( ( ( ( r c K t } t di d t j D d{V | j t
t fi t d{V t d dS )z!Enable native feature management.c 0 i | ]\ }}|t | S )r ).0featurepe_vars r
<dictcomp>z4enable_native_feature_management.<locals>.<dictcomp>@ s4
'/
r Nz-Imunify360 native feature management enabled.r& )
r
r r itemsinstall_extensionr r r r r r s r enable_native_feature_managementr- 8 s
B
#8#>#@#@
"
9 KK?@@@@@r c K t d{V s t d dS t t
t d{V t d dS )z"Disable native feature management.Nz,No Imunify360 package extensions to disable.Tz.Imunify360 native feature management disabled.)r# r r r
uninstall_extensionr r r& r r !disable_native_feature_managementr0 O s 677 7 7 7 7 7 7 BCCCt
..
,
, 9
KK@AAA 4r )r loggingpackaging.versionr ,defence360agent.feature_management.constantsr r r r (defence360agent.feature_management.utilsr $defence360agent.subsys.panels.cpanelr +defence360agent.subsys.panels.hosting_panelr
getLogger__name__r r r
r# r- r0 r& r r <module>r9 s/ % % % % % % D C C C C C 7 7 7 7 7 7 D D D D D D 8 $ $
A A A,
r defence360agent/feature_management/__pycache__/exceptions.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002026 00000000000 024427 0 ustar
r_j2 Z G d de Z G d de Z G d de ZdS )c e Zd ZdZdS )FeatureManagementErrorz%Base exception for feature managementN__name__
__module__ __qualname____doc__ b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/exceptions.pyr r s ////r
r c e Zd ZdZdS )FeatureDisabledErrorz Feature is disabled for userNr r r
r r
r
s &&&&r
r
c e Zd ZdZdS )UserArgumentNotFoundz;Method/function lack the parameter which contains user nameNr r r
r r r s EEEEr
r N) Exceptionr r
r r r
r <module>r s 0 0 0 0 0Y 0 0 0' ' ' ' '1 ' ' 'F F F F F1 F F F F Fr
defence360agent/feature_management/__pycache__/exceptions.cpython-311.pyc 0000644 0000000 0000000 00000002026 00000000000 023470 0 ustar
r_j2 Z G d de Z G d de Z G d de ZdS )c e Zd ZdZdS )FeatureManagementErrorz%Base exception for feature managementN__name__
__module__ __qualname____doc__ b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/exceptions.pyr r s ////r
r c e Zd ZdZdS )FeatureDisabledErrorz Feature is disabled for userNr r r
r r
r
s &&&&r
r
c e Zd ZdZdS )UserArgumentNotFoundz;Method/function lack the parameter which contains user nameNr r r
r r r s EEEEr
r N) Exceptionr r
r r r
r <module>r s 0 0 0 0 0Y 0 0 0' ' ' ' '1 ' ' 'F F F F F1 F F F F Fr
defence360agent/feature_management/__pycache__/hooks.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007634 00000000000 023403 0 ustar
r_j
& d Z ddlZddlZddlmZmZmZ ddlmZ ddl m
Z
m Z m Z m
Z
ej e Zd Zd Zedee d ed
efd Ze de d iZedee d ed
efd
Ze
ee
eiZded
eee egef fdZdS )a
This module contains hook, which are called on feature management permission
changes. Note that hooks are not executed automatically, developer is
responsible to obtain specific hook using get_hook() function and call it.
To add hook, create function with name equal to feature name
N)AnyCallableOptional)
ConfigFile)AVFULLLOG PROACTIVEc dS )NT )_s ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/hooks.py
_hook_stubr s 4 c F t j fd }|S )Nc h | | }|p!t dj || |S )Nz#Hook '%s(%s)' failed for user '%s'.)loggerwarning__name__)uservalueresultcallbacks r wrapz_result_warn.<locals>.wrap sC $&&
&.. 1
r ) functoolswraps)r r s ` r _result_warnr s8 _X Kr r r returnc p | sdS t }| dd }t | }| dd }|t k rd}n0|r.| d r|r| d rd} | dd| n# t
$ r Y dS w xY wdS )z#Called when 'av' feature is changedTMALWARE_SCANNINGdefault_actionNcleanupnotifyF)r getr
startswithset Exception)r r config config_value user_configuser_config_values r antivirusr, ) s t
\\F:: 02BCCL T""K#(:<LMM }} % ( ( 3 3%
%
# #I . . % % 02C
uu 4s
B% %
B32B3r c | sdS t |d } t | dd| n# t $ r Y dS w xY wdS )z*Called when 'proactive' feature is changedTDISABLEDPROACTIVE_DEFENCEmodeF) _PROACTIVE_MODE_BY_PERMISSIONr$ r r& r' )r r r) s r proactiver2 P sx t044UJGGL4 0&,GGGG uu 4s $A
AAfeaturec B t | t S )z
Get hook for specific feature. If no hook is implemented for this feature,
return stub function
:param feature: feature name
:return: callable hook
)HOOKSr$ r )r3 s r get_hookr6 f s 99Wj ) ))r )__doc__r loggingtypingr r r defence360agent.contracts.configr ,defence360agent.feature_management.constantsr r r r
getLoggerr r r r strboolr, r1 r2 r5 r6 r r r <module>r? s * * * * * * * * * * 7 7 7 7 7 7
8 $ $ HSM # $ @ $! HSM # $
y *c *h
s';T'A B * * * * * *r defence360agent/feature_management/__pycache__/hooks.cpython-311.pyc 0000644 0000000 0000000 00000007634 00000000000 022444 0 ustar
r_j
& d Z ddlZddlZddlmZmZmZ ddlmZ ddl m
Z
m Z m Z m
Z
ej e Zd Zd Zedee d ed
efd Ze de d iZedee d ed
efd
Ze
ee
eiZded
eee egef fdZdS )a
This module contains hook, which are called on feature management permission
changes. Note that hooks are not executed automatically, developer is
responsible to obtain specific hook using get_hook() function and call it.
To add hook, create function with name equal to feature name
N)AnyCallableOptional)
ConfigFile)AVFULLLOG PROACTIVEc dS )NT )_s ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/hooks.py
_hook_stubr s 4 c F t j fd }|S )Nc h | | }|p!t dj || |S )Nz#Hook '%s(%s)' failed for user '%s'.)loggerwarning__name__)uservalueresultcallbacks r wrapz_result_warn.<locals>.wrap sC $&&
&.. 1
r ) functoolswraps)r r s ` r _result_warnr s8 _X Kr r r returnc p | sdS t }| dd }t | }| dd }|t k rd}n0|r.| d r|r| d rd} | dd| n# t
$ r Y dS w xY wdS )z#Called when 'av' feature is changedTMALWARE_SCANNINGdefault_actionNcleanupnotifyF)r getr
startswithset Exception)r r config config_value user_configuser_config_values r antivirusr, ) s t
\\F:: 02BCCL T""K#(:<LMM }} % ( ( 3 3%
%
# #I . . % % 02C
uu 4s
B% %
B32B3r c | sdS t |d } t | dd| n# t $ r Y dS w xY wdS )z*Called when 'proactive' feature is changedTDISABLEDPROACTIVE_DEFENCEmodeF) _PROACTIVE_MODE_BY_PERMISSIONr$ r r& r' )r r r) s r proactiver2 P sx t044UJGGL4 0&,GGGG uu 4s $A
AAfeaturec B t | t S )z
Get hook for specific feature. If no hook is implemented for this feature,
return stub function
:param feature: feature name
:return: callable hook
)HOOKSr$ r )r3 s r get_hookr6 f s 99Wj ) ))r )__doc__r loggingtypingr r r defence360agent.contracts.configr ,defence360agent.feature_management.constantsr r r r
getLoggerr r r r strboolr, r1 r2 r5 r6 r r r <module>r? s * * * * * * * * * * 7 7 7 7 7 7
8 $ $ HSM # $ @ $! HSM # $
y *c *h
s';T'A B * * * * * *r defence360agent/feature_management/__pycache__/lookup.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000010663 00000000000 023565 0 ustar
r_j d dl Z d dlmZmZmZ ddlmZ ddlmZ ddl m
Z
ddl m Z dd l
mZ e Zd
ed ee d ed
ef deded
ef f
dZ dd
ed ee deegef fdZdS ) N)AnyCallableList )MyImunifyConfig) is_plesk_service_plan_enabled)wraps )
check_feature)UserArgumentNotFoundname permissionsfunc.user_keyreturnc R t j }|j vrt d |j j j u fdt
fd }t
fd }t j r|S |S )z
Wrapper to enable feature management for func
:param name: feature name
:param func: function/method to wrap
:param user_key: parameter name which contains user name
:return: new callable object
z Expecting argument '%s' for %sc r| vrt d t j r d S t r d S | j }t
| d S )Nz3Argument '%s' for '%s' must be specified explicitly)r r ENABLEDr getdefaultr )kwargsuserr r
r r user_key_required
user_params ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/lookup.pycheckerz_wrapper.<locals>.checker! s !7!7&E
" > F ( * * G Fzz(J$677dK..... c $ di | | i |S N r argsr r r s r wrapperz_wrapper.<locals>.wrapper4 s. &tT$V$$$r c 4 K di | | i | d {V S r r r! s r
async_wrapperz _wrapper.<locals>.async_wrapper9 sD &T4*6*********r )inspect signature
parametersr r emptyr iscoroutinefunction)
r
r r r r' r# r% r r r s
```` @@@r _wrapperr+
s !$''Iy+++" ,h
%h/J"*j.>>/ / / / / / / / / /& 4[[% % % % % [% 4[[+ + + + + [+ "4(( Nr r c fd}|S )a
Get decorator to manage function/method with feature management
:param name: feature name
:param user_key: parameter name which contains user name
:param permissions: list of permission values, with which user can
access specifig endpoint
:return: decorator
c t j | rvt | di D ]Q\ }}| d s7t j | r#t
| }t | || Rn&t j | rt
| } t | S )N__dict___)
r& isclassgetattritems
startswith
isfunctionr+ setattrfeaturesadd)objm_namem_objr# r
r r s r decoratorzfeature.<locals>.decoratorP s ?3 =!(j"!=!=!C!C!E!E
2
2
((-- 2'2DU2K2K 2 &t[% J JGC111
2
$
$ =4c8<<C T
r r )r
r r r; s ``` r featurer< C s0 r )r )r& typingr r r contracts.configr contracts.permissionsr rpc_tools.lookupr checkersr
exceptionsr setr6 strr+ r< r r r <module>rE s3 & & & & & & & & & & . . . . . . A A A A A A $ $ $ $ $ $ # # # # # # , , , , , , 3553
3 I3-5c3h-?3KN3
c3h3 3 3 3n 17
I
seSj r defence360agent/feature_management/__pycache__/lookup.cpython-311.pyc 0000644 0000000 0000000 00000010663 00000000000 022626 0 ustar
r_j d dl Z d dlmZmZmZ ddlmZ ddlmZ ddl m
Z
ddl m Z dd l
mZ e Zd
ed ee d ed
ef deded
ef f
dZ dd
ed ee deegef fdZdS ) N)AnyCallableList )MyImunifyConfig) is_plesk_service_plan_enabled)wraps )
check_feature)UserArgumentNotFoundname permissionsfunc.user_keyreturnc R t j }|j vrt d |j j j u fdt
fd }t
fd }t j r|S |S )z
Wrapper to enable feature management for func
:param name: feature name
:param func: function/method to wrap
:param user_key: parameter name which contains user name
:return: new callable object
z Expecting argument '%s' for %sc r| vrt d t j r d S t r d S | j }t
| d S )Nz3Argument '%s' for '%s' must be specified explicitly)r r ENABLEDr getdefaultr )kwargsuserr r
r r user_key_required
user_params ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/lookup.pycheckerz_wrapper.<locals>.checker! s !7!7&E
" > F ( * * G Fzz(J$677dK..... c $ di | | i |S N r argsr r r s r wrapperz_wrapper.<locals>.wrapper4 s. &tT$V$$$r c 4 K di | | i | d {V S r r r! s r
async_wrapperz _wrapper.<locals>.async_wrapper9 sD &T4*6*********r )inspect signature
parametersr r emptyr iscoroutinefunction)
r
r r r r' r# r% r r r s
```` @@@r _wrapperr+
s !$''Iy+++" ,h
%h/J"*j.>>/ / / / / / / / / /& 4[[% % % % % [% 4[[+ + + + + [+ "4(( Nr r c fd}|S )a
Get decorator to manage function/method with feature management
:param name: feature name
:param user_key: parameter name which contains user name
:param permissions: list of permission values, with which user can
access specifig endpoint
:return: decorator
c t j | rvt | di D ]Q\ }}| d s7t j | r#t
| }t | || Rn&t j | rt
| } t | S )N__dict___)
r& isclassgetattritems
startswith
isfunctionr+ setattrfeaturesadd)objm_namem_objr# r
r r s r decoratorzfeature.<locals>.decoratorP s ?3 =!(j"!=!=!C!C!E!E
2
2
((-- 2'2DU2K2K 2 &t[% J JGC111
2
$
$ =4c8<<C T
r r )r
r r r; s ``` r featurer< C s0 r )r )r& typingr r r contracts.configr contracts.permissionsr rpc_tools.lookupr checkersr
exceptionsr setr6 strr+ r< r r r <module>rE s3 & & & & & & & & & & . . . . . . A A A A A A $ $ $ $ $ $ # # # # # # , , , , , , 3553
3 I3-5c3h-?3KN3
c3h3 3 3 3n 17
I
seSj r defence360agent/feature_management/__pycache__/model.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007551 00000000000 023356 0 ustar
r_j| f d dl mZmZmZ d dlmZmZmZmZm Z m
Z
d dl m Z m
Z
G d de ZdS ) ) CharFieldCheck TextField)AV AV_REPORTFULLLOGNA PROACTIVE)Modelinstancec
^ e Zd ZdZdZ G d d Z ed Z ed e d
e e e
ge
Z ed e d
e ee
ge Zed ed d fd
Zed Zd Zded efdZdedefdZd ZdS )FeatureManagementPermszrPermissions state for Feature Management.
Each record/instance is a set of permissions of a single user.
c e Zd Zej ZdZdS )FeatureManagementPerms.Meta feature_management_permissionsN)__name__
__module__ __qualname__r
dbdatabasedb_table ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/model.pyMetar s ;3r r T)uniqueFz proactive in ('{}','{}','{}'))null constraintsdefaultzav in ('{}','{}','{}')userreturnc | }||S t |j t |j i}| || \ }}|S )z
Get feature permissions by user name
:param user: user name
:return: :class:`FeatureManagementPerms` object for user
N)r" defaults) get_defaultr avr proactive
get_or_create)clsr" r! r% perm_s r get_permz FeatureManagementPerms.get_perm0 sX //## <N
w(
###AAa r c 8 | | j S )zGet default permissions)r" )getDEFAULT)r* s r r& z"FeatureManagementPerms.get_defaultE s wwCKw(((r c " | j | j k S )z&Check if current permission is default)r" r0 selfs r
is_defaultz!FeatureManagementPerms.is_defaultJ s yDL((r keyc " t | | S )z Get permission by feature name)getattr)r3 r5 s r get_featurez"FeatureManagementPerms.get_featureN s tS!!!r valuec P t | || | dS )zSet permissionN)setattrsave)r3 r5 r9 s r set_featurez"FeatureManagementPerms.set_featureR s% c5!!! r c 6 t | j t | j iS )N)r r' r r( r2 s r as_dictz FeatureManagementPerms.as_dictW s t~
r N)r r r __doc__r0 r r r" r r formatr
r r r( r r' classmethodstrr- r& r4 r8 r= r? r r r r r s
G4 4 4 4 4 4 4 4 9D ! ! !D
E188S$GG H H
I
E*11"iFF G G
B C $< [( ) ) [)) ) )"s "s " " " "s 3
r r N)peeweer r r ,defence360agent.feature_management.constantsr r r r r
r defence360agent.modelr r
r r r r <module>rG s . . . . . . . . . . 2 1 1 1 1 1 1 1M
M
M
M
M
U M
M
M
M
M
r defence360agent/feature_management/__pycache__/model.cpython-311.pyc 0000644 0000000 0000000 00000007551 00000000000 022417 0 ustar
r_j| f d dl mZmZmZ d dlmZmZmZmZm Z m
Z
d dl m Z m
Z
G d de ZdS ) ) CharFieldCheck TextField)AV AV_REPORTFULLLOGNA PROACTIVE)Modelinstancec
^ e Zd ZdZdZ G d d Z ed Z ed e d
e e e
ge
Z ed e d
e ee
ge Zed ed d fd
Zed Zd Zded efdZdedefdZd ZdS )FeatureManagementPermszrPermissions state for Feature Management.
Each record/instance is a set of permissions of a single user.
c e Zd Zej ZdZdS )FeatureManagementPerms.Meta feature_management_permissionsN)__name__
__module__ __qualname__r
dbdatabasedb_table ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/model.pyMetar s ;3r r T)uniqueFz proactive in ('{}','{}','{}'))null constraintsdefaultzav in ('{}','{}','{}')userreturnc | }||S t |j t |j i}| || \ }}|S )z
Get feature permissions by user name
:param user: user name
:return: :class:`FeatureManagementPerms` object for user
N)r" defaults) get_defaultr avr proactive
get_or_create)clsr" r! r% perm_s r get_permz FeatureManagementPerms.get_perm0 sX //## <N
w(
###AAa r c 8 | | j S )zGet default permissions)r" )getDEFAULT)r* s r r& z"FeatureManagementPerms.get_defaultE s wwCKw(((r c " | j | j k S )z&Check if current permission is default)r" r0 selfs r
is_defaultz!FeatureManagementPerms.is_defaultJ s yDL((r keyc " t | | S )z Get permission by feature name)getattr)r3 r5 s r get_featurez"FeatureManagementPerms.get_featureN s tS!!!r valuec P t | || | dS )zSet permissionN)setattrsave)r3 r5 r9 s r set_featurez"FeatureManagementPerms.set_featureR s% c5!!! r c 6 t | j t | j iS )N)r r' r r( r2 s r as_dictz FeatureManagementPerms.as_dictW s t~
r N)r r r __doc__r0 r r r" r r formatr
r r r( r r' classmethodstrr- r& r4 r8 r= r? r r r r r s
G4 4 4 4 4 4 4 4 9D ! ! !D
E188S$GG H H
I
E*11"iFF G G
B C $< [( ) ) [)) ) )"s "s " " " "s 3
r r N)peeweer r r ,defence360agent.feature_management.constantsr r r r r
r defence360agent.modelr r
r r r r <module>rG s . . . . . . . . . . 2 1 1 1 1 1 1 1M
M
M
M
M
U M
M
M
M
M
r defence360agent/feature_management/__pycache__/utils.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000016646 00000000000 023423 0 ustar
r_j d dl Z d dlZd dlmZ d dlmZmZ d dlmZ d dl m
Z
d dl m Z d dl
mZ d dlmZmZmZ d d
lmZ e j e Zd ed ed
edefdZd edee d
edee fdZd ed
efdZ dee defdZ d Z dS ) N)chain)ListAny)Core)hooks)FeatureManagementPerms)instance)execute_iterable_expressionis_safe_subdir_namermtree )featuresuserfeaturevaluereturnc K t j 5 }t j | }| || t
j | } || | }|r t d||| n1t
d||| | |cddd S # 1 swxY w Y dS )zSets a `feature` to `value` for a given `user`.
Calls appropriate hook and returns its (bool) result. Logs the result of
setting change. If hook fails rollbacks changes to database.
!Applied setting %s=%s for user %s)Failed to apply setting %s=%s for user %sN) r dbatomicr get_perm set_featurer get_hookloggerinfoerrorrollback)r r r trxpermhookoks ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/utils.pyr r s%
%.t44 %(((~g&&
T$
KK3WeT
LL;
LLNNN# s B C CCusersexisting_usersc K g g d}|D ]p}||vr t d| "t || | d {V r |d | U|d | q|S )N) succeededfailedzNo such user: %sr' r( )r warningr append)r r$ r r% resultr s r# update_usersr, . s
,
,F * * ~ % % NN-t 4 4 4 T7E22 2 2 2 2 2 2 * ; & &t , , , , 8 # #D ) ) ) ) M c K t j }| | | t j | } |d | S N)r get_defaultr r r )r r r r! s r# update_defaultr1 @ sK ! - / /DWe$$$ >' " "D 4e r- c K t | }t j t j }t t | }||z
}| t j |rt d| d }t |t | |D ]}t | st j t j | } t% | M# t& $ r Y Yt( $ r&}t d|| Y d}~d}~ww xY w||z
}|rt d| |D ]U}t j | } t. D ]7}
| |
} t3 j |
} | || 8Vt7 | pt7 | S )z1Synchronize existing permissions with panel usersz Remove permissions of users %sc t j t j | S r/ )r deletewherer in_)perms_to_removes r#
expressionz sync_users.<locals>.expressionT s7 )02288&+//@@
r- z'Failed to remove user_config dir %s: %sNzAdd permissions to users %s) setr selectr r tuplesremoveDEFAULTr r r
listr ospathjoinr USER_CONFDIRr FileNotFoundErrorOSErrorr) r r get_featurer r bool)
r$ panel_users
perm_usersr7 r8 r targete perms_to_addr r r callbacks
r#
sync_usersrM G s e**K'./E/JKKJUJ - - / /011J ;.O19::: 4oFFF
$J_0E0EFFF# D&t,,
W\\$"3T::F
v$
=vq
+L A 1<@@@ " "%.t44 " "G$$W--E ~g..H HT5 ! ! ! ! " 6o!6!66s 8D
E E D>>Ec 4 K t t t j t j t j t j k }d } | j D ]\ }}t j
| }g }|D ]A} ||| r| | $t
d||| Bt |||| |D ] }t d||| dS )zlSets feature values for all existing users in feature management
database to given values in `features`.c t j di ||i t j | S )N )r updater5 r r6 )chunkr r s r# r8 z"reset_features.<locals>.expression sD %,@@/?@@FF " ' + +E 2 2
r- r r N)r> r r r: r r5 r= r; itemsr r r* r r r
r )r r$ r8 r r r! appliedr s r# reset_featuresrU w sU
#
*+A+F
G
G
U&+/E/MM VXX
E
)(.** ~g&&
DtD%
t$$$$ ? $J%HHH D KK3WeT
) r- ) loggingr? itertoolsr typingr r defence360agent.contracts.configr "defence360agent.feature_managementr (defence360agent.feature_management.modelr defence360agent.modelr defence360agent.utilsr
r r lookupr getLogger__name__r strrF r r, r1 rM rU rP r- r# <module>rb s 1 1 1 1 1 1 4 4 4 4 4 4 K K K K K K * * * * * *
8 $ $C # c d 4
c+.@DS $ # c -7DI -7$ -7 -7 -7 -7`) ) ) ) )r- defence360agent/feature_management/__pycache__/utils.cpython-311.pyc 0000644 0000000 0000000 00000016646 00000000000 022464 0 ustar
r_j d dl Z d dlZd dlmZ d dlmZmZ d dlmZ d dl m
Z
d dl m Z d dl
mZ d dlmZmZmZ d d
lmZ e j e Zd ed ed
edefdZd edee d
edee fdZd ed
efdZ dee defdZ d Z dS ) N)chain)ListAny)Core)hooks)FeatureManagementPerms)instance)execute_iterable_expressionis_safe_subdir_namermtree )featuresuserfeaturevaluereturnc K t j 5 }t j | }| || t
j | } || | }|r t d||| n1t
d||| | |cddd S # 1 swxY w Y dS )zSets a `feature` to `value` for a given `user`.
Calls appropriate hook and returns its (bool) result. Logs the result of
setting change. If hook fails rollbacks changes to database.
!Applied setting %s=%s for user %s)Failed to apply setting %s=%s for user %sN) r dbatomicr get_perm set_featurer get_hookloggerinfoerrorrollback)r r r trxpermhookoks ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/utils.pyr r s%
%.t44 %(((~g&&
T$
KK3WeT
LL;
LLNNN# s B C CCusersexisting_usersc K g g d}|D ]p}||vr t d| "t || | d {V r |d | U|d | q|S )N) succeededfailedzNo such user: %sr' r( )r warningr append)r r$ r r% resultr s r# update_usersr, . s
,
,F * * ~ % % NN-t 4 4 4 T7E22 2 2 2 2 2 2 * ; & &t , , , , 8 # #D ) ) ) ) M c K t j }| | | t j | } |d | S N)r get_defaultr r r )r r r r! s r# update_defaultr1 @ sK ! - / /DWe$$$ >' " "D 4e r- c K t | }t j t j }t t | }||z
}| t j |rt d| d }t |t | |D ]}t | st j t j | } t% | M# t& $ r Y Yt( $ r&}t d|| Y d}~d}~ww xY w||z
}|rt d| |D ]U}t j | } t. D ]7}
| |
} t3 j |
} | || 8Vt7 | pt7 | S )z1Synchronize existing permissions with panel usersz Remove permissions of users %sc t j t j | S r/ )r deletewherer in_)perms_to_removes r#
expressionz sync_users.<locals>.expressionT s7 )02288&+//@@
r- z'Failed to remove user_config dir %s: %sNzAdd permissions to users %s) setr selectr r tuplesremoveDEFAULTr r r
listr ospathjoinr USER_CONFDIRr FileNotFoundErrorOSErrorr) r r get_featurer r bool)
r$ panel_users
perm_usersr7 r8 r targete perms_to_addr r r callbacks
r#
sync_usersrM G s e**K'./E/JKKJUJ - - / /011J ;.O19::: 4oFFF
$J_0E0EFFF# D&t,,
W\\$"3T::F
v$
=vq
+L A 1<@@@ " "%.t44 " "G$$W--E ~g..H HT5 ! ! ! ! " 6o!6!66s 8D
E E D>>Ec 4 K t t t j t j t j t j k }d } | j D ]\ }}t j
| }g }|D ]A} ||| r| | $t
d||| Bt |||| |D ] }t d||| dS )zlSets feature values for all existing users in feature management
database to given values in `features`.c t j di ||i t j | S )N )r updater5 r r6 )chunkr r s r# r8 z"reset_features.<locals>.expression sD %,@@/?@@FF " ' + +E 2 2
r- r r N)r> r r r: r r5 r= r; itemsr r r* r r r
r )r r$ r8 r r r! appliedr s r# reset_featuresrU w sU
#
*+A+F
G
G
U&+/E/MM VXX
E
)(.** ~g&&
DtD%
t$$$$ ? $J%HHH D KK3WeT
) r- ) loggingr? itertoolsr typingr r defence360agent.contracts.configr "defence360agent.feature_managementr (defence360agent.feature_management.modelr defence360agent.modelr defence360agent.utilsr
r r lookupr getLogger__name__r strrF r r, r1 rM rU rP r- r# <module>rb s 1 1 1 1 1 1 4 4 4 4 4 4 K K K K K K * * * * * *
8 $ $C # c d 4
c+.@DS $ # c -7DI -7$ -7 -7 -7 -7`) ) ) ) )r- defence360agent/feature_management/checkers.py 0000644 0000000 0000000 00000004714 00000000000 016544 0 ustar from typing import List
from copy import deepcopy
from .exceptions import FeatureDisabledError
from .constants import CONFIG_MAPPINGS
from .model import FeatureManagementPerms
def check_feature(feature: str, permissions: List[str], user: str):
"""
Raise exception if feature is disabled for user
:param feature: feature name
:param permissions: permissions required
:param user: user name
:return: None
:raises FeatureDisabledError: if user is prohibited from use of the feature
"""
if user is None:
return
perm = FeatureManagementPerms.get_perm(user)
permission_value = perm.get_feature(feature)
if permission_value not in permissions:
raise FeatureDisabledError(
"Feature '{name}' is disabled for user '{user}'".format(
name=feature, user=user
)
)
def check_config(feature: str, user: str, section: str, raise_=False):
"""
Check if section is allowed to be read or write by user
:param feature: feature name
:param user: user name
:param section: section name to check
:param raise_: True to raise exception, otherwise return True or False
:return: True if config sections is allowed to user, False otherwise
:raises FeatureDisabledError: raised if raise_=True
"""
if user is None:
return True
if feature not in CONFIG_MAPPINGS:
return True
if section not in CONFIG_MAPPINGS[feature]:
return True
try:
check_feature(feature, CONFIG_MAPPINGS[feature][section], user)
except FeatureDisabledError:
if raise_:
raise
return False
return True
def config_cleanup(data: dict, user: str = None) -> dict:
"""
Remove prohibited sections from user config
:param data: config data
:param user: user name
:return: new config data
"""
new_data = deepcopy(data)
for feature in CONFIG_MAPPINGS:
for section in data:
if not check_config(feature, user, section):
del new_data[section]
return new_data
def config_validation(data: dict, user: str):
"""
Raise exception if user is making changes on prohibited sections of config
:param data: config data
:param user: user name
:return: None
:raises FeatureDisabledError: if user is prohibited
"""
for feature in CONFIG_MAPPINGS:
for section in data:
check_config(feature, user, section, raise_=True)
defence360agent/feature_management/constants.py 0000644 0000000 0000000 00000002057 00000000000 016767 0 ustar # feature name constants
PROACTIVE = "proactive"
AV = "av"
#: Not available permissions
NA = "na"
#: Full permissions
FULL = "full"
#: Report only permission for AV feature
AV_REPORT = "report"
#: Log-only permission for PROACTIVE feature.
#: User retains the feature in observation mode (PROACTIVE_DEFENCE.mode=LOG)
#: instead of having it fully disabled. Selected by the
#: FEATURE_MANAGEMENT.proactive_disable_target config toggle.
LOG = "log"
# config sections related to feature
CONFIG_MAPPINGS = {
PROACTIVE: {
"PROACTIVE_DEFENCE": [FULL, LOG],
},
}
# Native FM panel extension name
NATIVE_EXTENSION_NAME = "imunify360"
# Mapping of feature names to extension variables
FEATURE_EXT_VARIABLES = {
AV: "imunify360_av",
PROACTIVE: "imunify360_proactive",
}
# Mapping of extension variable to default value
EXTENSION_DEFAULTS = {
FEATURE_EXT_VARIABLES[AV]: AV_REPORT,
FEATURE_EXT_VARIABLES[PROACTIVE]: FULL,
}
NATIVE_FEATURE_MANAGEMENT_PACKAGE_EXTENSION_FILES = (
NATIVE_EXTENSION_NAME,
NATIVE_EXTENSION_NAME + ".tt2",
)
defence360agent/feature_management/control.py 0000644 0000000 0000000 00000004774 00000000000 016443 0 ustar import functools
import logging
from packaging.version import Version
from defence360agent.feature_management.constants import (
EXTENSION_DEFAULTS,
FEATURE_EXT_VARIABLES,
NATIVE_EXTENSION_NAME,
NATIVE_FEATURE_MANAGEMENT_PACKAGE_EXTENSION_FILES,
)
from defence360agent.feature_management.utils import reset_features
from defence360agent.subsys.panels.cpanel import cPanel
from defence360agent.subsys.panels.hosting_panel import HostingPanel
logger = logging.getLogger(__name__)
def supported(func):
"""Do not run a function on an unsupported panel"""
@functools.wraps(func)
async def wrapper(*args, **kwargs):
if await is_native_feature_management_supported():
return await func(*args, **kwargs)
logger.info("Native feature management is not supported")
return wrapper
async def is_native_feature_management_supported():
"""Whether we support native feature management on the panel."""
hp = HostingPanel()
if hp.NAME == cPanel.NAME:
try:
return Version(await hp.version()) >= Version("68.0")
except ValueError:
return False
return False
@supported
async def is_native_feature_management_enabled():
"""Whether the native feature management is enabled."""
hp = HostingPanel()
return (
hp.is_extension_installed(
pkgs=NATIVE_FEATURE_MANAGEMENT_PACKAGE_EXTENSION_FILES
)
and await hp.is_hook_installed()
)
@supported
async def enable_native_feature_management():
"""Enable native feature management."""
hp = HostingPanel()
# reset feature values for all existing users
await reset_features(
**{
feature: EXTENSION_DEFAULTS[pe_var]
for feature, pe_var in FEATURE_EXT_VARIABLES.items()
}
)
await hp.install_extension(
NATIVE_EXTENSION_NAME,
NATIVE_FEATURE_MANAGEMENT_PACKAGE_EXTENSION_FILES,
**EXTENSION_DEFAULTS,
)
logger.info("Imunify360 native feature management enabled.")
@supported
async def disable_native_feature_management():
"""Disable native feature management."""
if not await is_native_feature_management_enabled():
logger.info("No Imunify360 package extensions to disable.")
return True
await HostingPanel().uninstall_extension(
NATIVE_EXTENSION_NAME,
NATIVE_FEATURE_MANAGEMENT_PACKAGE_EXTENSION_FILES,
)
logger.info("Imunify360 native feature management disabled.")
return True # disabled successfully
defence360agent/feature_management/exceptions.py 0000644 0000000 0000000 00000000462 00000000000 017132 0 ustar class FeatureManagementError(Exception):
"""Base exception for feature management"""
class FeatureDisabledError(FeatureManagementError):
"""Feature is disabled for user"""
class UserArgumentNotFound(FeatureManagementError):
"""Method/function lack the parameter which contains user name"""
defence360agent/feature_management/hooks.py 0000644 0000000 0000000 00000005215 00000000000 016075 0 ustar """
This module contains hook, which are called on feature management permission
changes. Note that hooks are not executed automatically, developer is
responsible to obtain specific hook using get_hook() function and call it.
To add hook, create function with name equal to feature name
"""
import functools
import logging
from typing import Any, Callable, Optional
from defence360agent.contracts.config import ConfigFile
from defence360agent.feature_management.constants import (
AV,
FULL,
LOG,
PROACTIVE,
)
logger = logging.getLogger(__name__)
def _hook_stub(*_):
return True
def _result_warn(callback):
@functools.wraps(callback)
def wrap(user, value):
result = callback(user, value)
result or logger.warning(
"Hook '%s(%s)' failed for user '%s'.",
callback.__name__,
value,
user,
)
return result
return wrap
@_result_warn
def antivirus(user: Optional[str], value: Any) -> bool:
"""Called when 'av' feature is changed"""
if not user:
return True
config = ConfigFile()
config_value = config.get("MALWARE_SCANNING", "default_action")
user_config = ConfigFile(user)
user_config_value = user_config.get("MALWARE_SCANNING", "default_action")
if value == FULL:
user_config_value = None
elif (
user_config_value
and user_config_value.startswith("cleanup")
and config_value
and config_value.startswith("cleanup")
):
user_config_value = "notify"
try:
user_config.set(
"MALWARE_SCANNING", "default_action", user_config_value
)
except Exception:
return False
return True
_PROACTIVE_MODE_BY_PERMISSION = {
FULL: None, # inherit global PROACTIVE_DEFENCE.mode
LOG: "LOG", # observe only, no enforcement
# any other value (NA, legacy entries) maps to DISABLED below
}
@_result_warn
def proactive(user: Optional[str], value: Any) -> bool:
"""Called when 'proactive' feature is changed"""
if not user:
return True # do nothing if no user specified
config_value = _PROACTIVE_MODE_BY_PERMISSION.get(value, "DISABLED")
try:
ConfigFile(user).set("PROACTIVE_DEFENCE", "mode", config_value)
except Exception:
return False
return True
HOOKS = {
AV: antivirus,
PROACTIVE: proactive,
}
def get_hook(feature: str) -> Callable[[Optional[str], Any], bool]:
"""
Get hook for specific feature. If no hook is implemented for this feature,
return stub function
:param feature: feature name
:return: callable hook
"""
return HOOKS.get(feature, _hook_stub)
defence360agent/feature_management/lookup.py 0000644 0000000 0000000 00000005417 00000000000 016267 0 ustar import inspect
from typing import Any, Callable, List
from ..contracts.config import MyImunifyConfig
from ..contracts.permissions import is_plesk_service_plan_enabled
from ..rpc_tools.lookup import wraps
from .checkers import check_feature
from .exceptions import UserArgumentNotFound
features = set() # feature storage
def _wrapper(
name: str, permissions: List[str], func: Callable[..., Any], user_key: str
) -> Callable[..., Any]:
"""
Wrapper to enable feature management for func
:param name: feature name
:param func: function/method to wrap
:param user_key: parameter name which contains user name
:return: new callable object
"""
signature = inspect.signature(func)
if user_key not in signature.parameters:
raise UserArgumentNotFound(
"Expecting argument '%s' for %s", user_key, func
)
user_param = signature.parameters[user_key]
user_key_required = user_param.default is user_param.empty
def checker(**kwargs):
if user_key_required and user_key not in kwargs:
raise UserArgumentNotFound(
"Argument '%s' for '%s' must be specified explicitly",
user_key,
func,
)
if MyImunifyConfig.ENABLED:
"""Ignore the decorator if MyImunify is enabled"""
return
if is_plesk_service_plan_enabled():
"""Ignore the decorator if Plesk service plan is enabled"""
return
user = kwargs.get(user_key, user_param.default)
check_feature(name, permissions, user)
@wraps(func)
def wrapper(*args, **kwargs):
checker(**kwargs)
return func(*args, **kwargs)
@wraps(func)
async def async_wrapper(*args, **kwargs):
checker(**kwargs)
return await func(*args, **kwargs)
if inspect.iscoroutinefunction(func):
return async_wrapper
return wrapper
def feature(
name: str, permissions: List[str], user_key="user"
) -> Callable[[Any], Any]:
"""
Get decorator to manage function/method with feature management
:param name: feature name
:param user_key: parameter name which contains user name
:param permissions: list of permission values, with which user can
access specifig endpoint
:return: decorator
"""
def decorator(obj):
if inspect.isclass(obj):
for m_name, m_obj in getattr(obj, "__dict__", {}).items():
if not m_name.startswith("_") and inspect.isfunction(m_obj):
wrapper = _wrapper(name, permissions, m_obj, user_key)
setattr(obj, m_name, wrapper)
elif inspect.isfunction(obj):
obj = _wrapper(name, permissions, obj, user_key)
features.add(name)
return obj
return decorator
defence360agent/feature_management/model.py 0000644 0000000 0000000 00000004574 00000000000 016061 0 ustar from peewee import CharField, Check, TextField
from defence360agent.feature_management.constants import (
AV,
AV_REPORT,
FULL,
LOG,
NA,
PROACTIVE,
)
from defence360agent.model import Model, instance
class FeatureManagementPerms(Model):
"""Permissions state for Feature Management.
Each record/instance is a set of permissions of a single user.
"""
DEFAULT = ""
class Meta:
database = instance.db
db_table = "feature_management_permissions"
#: The username of the end-user, or an empty string for the default value
#: for all new users.
user = CharField(unique=True)
#: How much the user can access and control Proactive Defense feature.
#: Must be one of :obj:`.NA`, :obj:`.LOG` or :obj:`.FULL`.
proactive = TextField(
null=False,
constraints=[
Check("proactive in ('{}','{}','{}')".format(NA, LOG, FULL))
],
default=FULL,
)
#: How much the user can access and control Proactive Defense feature.
#: Must be either :obj:`.NA` or :obj:`.AV_REPORT` or :obj:`.FULL`.
av = TextField(
null=False,
constraints=[
Check("av in ('{}','{}','{}')".format(NA, AV_REPORT, FULL))
],
default=AV_REPORT,
)
@classmethod
def get_perm(cls, user: str) -> "FeatureManagementPerms":
"""
Get feature permissions by user name
:param user: user name
:return: :class:`FeatureManagementPerms` object for user
"""
default = cls.get_default()
if user is None:
return default
defaults = {
AV: default.av,
PROACTIVE: default.proactive,
}
perm, _ = cls.get_or_create(user=user, defaults=defaults)
return perm
@classmethod
def get_default(cls):
"""Get default permissions"""
return cls.get(user=cls.DEFAULT)
def is_default(self):
"""Check if current permission is default"""
return self.user == self.DEFAULT
def get_feature(self, key: str) -> str:
"""Get permission by feature name"""
return getattr(self, key)
def set_feature(self, key: str, value: str):
"""Set permission"""
setattr(self, key, value)
self.save()
def as_dict(self):
return {
AV: self.av,
PROACTIVE: self.proactive,
}
defence360agent/feature_management/plugins/ 0000755 0000000 0000000 00000000000 00000000000 016056 5 ustar defence360agent/feature_management/plugins/__init__.py 0000644 0000000 0000000 00000000000 00000000000 020155 0 ustar defence360agent/feature_management/plugins/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 020266 5 ustar defence360agent/feature_management/plugins/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000325 00000000000 025466 0 ustar
r_j d S )N r h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/plugins/__init__.py<module>r s r defence360agent/feature_management/plugins/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000325 00000000000 024527 0 ustar
r_j d S )N r h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/plugins/__init__.py<module>r s r defence360agent/feature_management/plugins/__pycache__/native.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000014746 00000000000 025231 0 ustar
r_jJ
d dl mZ d dlmZ d dlmZmZmZmZm Z d dl
m Z d dl m
Z
d dlmZ d dlmZ d dlmZ ee Z G d d
e Zd S ) ) getLogger)Dict)AVEXTENSION_DEFAULTSFEATURE_EXT_VARIABLESNATIVE_EXTENSION_NAME PROACTIVE$is_native_feature_management_enabled)FeatureManagementPerms set_feature)SettingsChangeBase)packagesc e Zd ZeegZ fdZ fdZd Ze de
de de e
e
f fd Z
ede e
e
f fd Zd Zd
Zd Z xZS ) %NativeFeatureManagementSettingsChangec x K t | d {V | d p| d }|rct d| t j t
j |k d S d S )Nuserusernamez Resetting FM settings for %s)
super_process_account_removedgetloggerinfor deletewherer execute)selfmessager __class__s f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/plugins/native.pyr z>NativeFeatureManagementSettingsChange._process_account_removed s gg..w777777777{{6""=gkk*&=&= KK6 = = = " ) + + 1 1&+t3
giiiii c $ K t | d {V d|j v r\|j d }t j |j t j |k d S d S )N old_username)r ) r _process_modifydatar updater r r r )r r r$ r s r! r% z5NativeFeatureManagementSettingsChange._process_modify$ s gg%%g......... W\ ) )"<7L " )w/? @ @ @ F F&+|;
giiiii * )r" c K i }| j D ]3} |j t | }n# t $ r d }Y nw xY w|||< 4|S N)
FEATURES_LISTr& r KeyError)r r settingsfeaturevalues r! _get_settings_from_messagez@NativeFeatureManagementSettingsChange._get_settings_from_message, sl ) & &G
%:7%CD
%HW s ( 77 package_nameadd_to_packagereturnc l K t d| t j | d {V }nD# t j $ r2 t d| | cY S w xY wi } t j D ]\ }}|| ||< |S # t $ rC t d| |r#t j
t |fi t d {V Y n/t j $ r t d| Y nw xY w| S )NzGetting package settings %szPackage %s doesn't existz,No extension's fields in package settings %s)
r r r get_package_infoPackageNotExistErrorwarning_default_settingsr itemsr+
add_extensionr r )clsr0 r1 pkg_infopackage_settingsr- pe_vars r! _get_package_settingsz;NativeFeatureManagementSettingsChange._get_package_settings6 s 1<@@@ + % 6| D DDDDDDDHH, + + + NN5| D D D((** * * * +
E#8#>#@#@
=
=,4V,< ))# # KK>
,)8 7I , E E E NN5| D D D D D E $$&&&s( : >A;:A;%B' 'A
D 3)D D c < d t j D S )Nc 0 i | ]\ }}|t | S )r ).0r- r= s r!
<dictcomp>zKNativeFeatureManagementSettingsChange._default_settings.<locals>.<dictcomp>T s4
'/
r" )r r8 rA r" r! r7 z7NativeFeatureManagementSettingsChange._default_settingsR s,
#8#>#@#@
r" c 8 K t ||| d {V d S r) r
)r r r- r. s r! on_settings_changez8NativeFeatureManagementSettingsChange.on_settings_changeY s0 $///////////r" c dS )NTrA )r r s r! _message_is_relatablez;NativeFeatureManagementSettingsChange._message_is_relatable\ s tr" c . K t d {V S r) r
)r s r!
is_enabledz0NativeFeatureManagementSettingsChange.is_enabled_ s$ 9;;;;;;;;;r" )__name__
__module__ __qualname__r r r* r r% r/ classmethodstrboolr r> staticmethodr7 rE rG rI
__classcell__)r s @r! r r s OM ' '04'
c3h ' ' ' ['6
tCH~
\
0 0 0 < < < < < < <r" r N)loggingr typingr ,defence360agent.feature_management.constantsr r r r r *defence360agent.feature_management.controlr (defence360agent.feature_management.modelr (defence360agent.feature_management.utilsr 7defence360agent.plugins.event_monitor_message_processorr $defence360agent.subsys.panels.cpanelr rJ r r rA r" r! <module>rZ s4 L K K K K K @ @ @ @ @ @ : 9 9 9 9 9 8 H< H< H< H< H<,> H< H< H< H< H<r" defence360agent/feature_management/plugins/__pycache__/native.cpython-311.pyc 0000644 0000000 0000000 00000014746 00000000000 024272 0 ustar
r_jJ
d dl mZ d dlmZ d dlmZmZmZmZm Z d dl
m Z d dl m
Z
d dlmZ d dlmZ d dlmZ ee Z G d d
e Zd S ) ) getLogger)Dict)AVEXTENSION_DEFAULTSFEATURE_EXT_VARIABLESNATIVE_EXTENSION_NAME PROACTIVE$is_native_feature_management_enabled)FeatureManagementPerms set_feature)SettingsChangeBase)packagesc e Zd ZeegZ fdZ fdZd Ze de
de de e
e
f fd Z
ede e
e
f fd Zd Zd
Zd Z xZS ) %NativeFeatureManagementSettingsChangec x K t | d {V | d p| d }|rct d| t j t
j |k d S d S )Nuserusernamez Resetting FM settings for %s)
super_process_account_removedgetloggerinfor deletewherer execute)selfmessager __class__s f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/plugins/native.pyr z>NativeFeatureManagementSettingsChange._process_account_removed s gg..w777777777{{6""=gkk*&=&= KK6 = = = " ) + + 1 1&+t3
giiiii c $ K t | d {V d|j v r\|j d }t j |j t j |k d S d S )N old_username)r ) r _process_modifydatar updater r r r )r r r$ r s r! r% z5NativeFeatureManagementSettingsChange._process_modify$ s gg%%g......... W\ ) )"<7L " )w/? @ @ @ F F&+|;
giiiii * )r" c K i }| j D ]3} |j t | }n# t $ r d }Y nw xY w|||< 4|S N)
FEATURES_LISTr& r KeyError)r r settingsfeaturevalues r! _get_settings_from_messagez@NativeFeatureManagementSettingsChange._get_settings_from_message, sl ) & &G
%:7%CD
%HW s ( 77 package_nameadd_to_packagereturnc l K t d| t j | d {V }nD# t j $ r2 t d| | cY S w xY wi } t j D ]\ }}|| ||< |S # t $ rC t d| |r#t j
t |fi t d {V Y n/t j $ r t d| Y nw xY w| S )NzGetting package settings %szPackage %s doesn't existz,No extension's fields in package settings %s)
r r r get_package_infoPackageNotExistErrorwarning_default_settingsr itemsr+
add_extensionr r )clsr0 r1 pkg_infopackage_settingsr- pe_vars r! _get_package_settingsz;NativeFeatureManagementSettingsChange._get_package_settings6 s 1<@@@ + % 6| D DDDDDDDHH, + + + NN5| D D D((** * * * +
E#8#>#@#@
=
=,4V,< ))# # KK>
,)8 7I , E E E NN5| D D D D D E $$&&&s( : >A;:A;%B' 'A
D 3)D D c < d t j D S )Nc 0 i | ]\ }}|t | S )r ).0r- r= s r!
<dictcomp>zKNativeFeatureManagementSettingsChange._default_settings.<locals>.<dictcomp>T s4
'/
r" )r r8 rA r" r! r7 z7NativeFeatureManagementSettingsChange._default_settingsR s,
#8#>#@#@
r" c 8 K t ||| d {V d S r) r
)r r r- r. s r! on_settings_changez8NativeFeatureManagementSettingsChange.on_settings_changeY s0 $///////////r" c dS )NTrA )r r s r! _message_is_relatablez;NativeFeatureManagementSettingsChange._message_is_relatable\ s tr" c . K t d {V S r) r
)r s r!
is_enabledz0NativeFeatureManagementSettingsChange.is_enabled_ s$ 9;;;;;;;;;r" )__name__
__module__ __qualname__r r r* r r% r/ classmethodstrboolr r> staticmethodr7 rE rG rI
__classcell__)r s @r! r r s OM ' '04'
c3h ' ' ' ['6
tCH~
\
0 0 0 < < < < < < <r" r N)loggingr typingr ,defence360agent.feature_management.constantsr r r r r *defence360agent.feature_management.controlr (defence360agent.feature_management.modelr (defence360agent.feature_management.utilsr 7defence360agent.plugins.event_monitor_message_processorr $defence360agent.subsys.panels.cpanelr rJ r r rA r" r! <module>rZ s4 L K K K K K @ @ @ @ @ @ : 9 9 9 9 9 8 H< H< H< H< H<,> H< H< H< H< H<r" defence360agent/feature_management/plugins/__pycache__/proactive_log_migration.cpython-311.opt-1.pyc0000644 0000000 0000000 00000010637 00000000000 030644 0 ustar
r_j d Z ddlZddlmZ ddlmZ ddlmZmZ ddl m
Z
m Z m Z ddl
mZ ddlmZ dd lmZmZ ee Ze G d
d e ZdS ) a, Promote stale `proactive: na` perms to `log` when the deployment toggle
``FEATURE_MANAGEMENT.proactive_disable_target == "log"`` is set.
DEF-42523. Without this, customers (notably Cloudways) flipping the toggle
post-upgrade would only see the new behavior on users whose add-on state
changes; pre-existing disabled users would linger in NA / mode=DISABLED
indefinitely. Re-firing the proactive hook with LOG writes
``mode=LOG`` to user_config and updates the perm row.
Idempotent: once promoted, no NA proactive perms remain, so subsequent
boots no-op.
N) getLogger)
ConfigFile) MessageSinkthisguy)LOGNA PROACTIVE)FeatureManagementPerms) set_feature)Scope create_task_and_log_exceptionsc N e Zd Zej Zdej fdZd Z e
d Z dS )ProactiveLogMigrationloopc > K t || j | _ d S )N)r
_migrate_migration_task)selfr s w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/plugins/proactive_log_migration.py create_sinkz!ProactiveLogMigration.create_sink! s' > $-
c K t | dd }|| rd S | | d {V d S # t j $ r Y d S w xY w)Nr )getattrdonecancelasyncioCancelledError)r tasks r shutdownz ProactiveLogMigration.shutdown, sz t .55 <499;;< F
JJJJJJJJJ% DD s A A A c v K t dd } | dk rd S d t j t j t k t j t j k z D }|sd S t
dt | d}|D ]T} t |t t d {V r|dz
}*# t $ r t d| Y Qw xY wt
d |t | d S )
NFEATURE_MANAGEMENTproactive_disable_targetlogc g | ] }|j
S )user).0rows r
<listcomp>z2ProactiveLogMigration._migrate.<locals>.<listcomp>> s*
H
r z2Promoting %d proactive=na users to log (DEF-42523)r z-Failed to promote proactive=na user %s to logz%Promoted %d/%d users to proactive=log)r getr
selectwhere proactiver r& DEFAULTloggerinfolenr r r Exception exception)targetuserspromotedr& s r r z ProactiveLogMigration._migrate6 s| !! "<
U?? F
-466<<'1R7*/-56
F @ JJ
D
$T9c:::::::: " MH
CT
3 JJ
s >&C%%%D
D
N) __name__
__module__ __qualname__r IM360SCOPEr AbstractEventLoopr r staticmethodr r% r r r r se
KE
g&?
%
%
\%
%
%
r r )__doc__r loggingr defence360agent.contracts.configr !defence360agent.contracts.pluginsr r ,defence360agent.feature_management.constantsr r r (defence360agent.feature_management.modelr
(defence360agent.feature_management.utilsr defence360agent.utilsr r
r8 r0 r r% r r <module>rG s 7 7 7 7 7 7 B B B B B B B B K K K K K K K K K K K K K K K K @ @ @ @ @ @ G G G G G G G G 8 A
A
A
A
A
K A
A
A
A
A
r defence360agent/feature_management/plugins/__pycache__/proactive_log_migration.cpython-311.pyc 0000644 0000000 0000000 00000010637 00000000000 027705 0 ustar
r_j d Z ddlZddlmZ ddlmZ ddlmZmZ ddl m
Z
m Z m Z ddl
mZ ddlmZ dd lmZmZ ee Ze G d
d e ZdS ) a, Promote stale `proactive: na` perms to `log` when the deployment toggle
``FEATURE_MANAGEMENT.proactive_disable_target == "log"`` is set.
DEF-42523. Without this, customers (notably Cloudways) flipping the toggle
post-upgrade would only see the new behavior on users whose add-on state
changes; pre-existing disabled users would linger in NA / mode=DISABLED
indefinitely. Re-firing the proactive hook with LOG writes
``mode=LOG`` to user_config and updates the perm row.
Idempotent: once promoted, no NA proactive perms remain, so subsequent
boots no-op.
N) getLogger)
ConfigFile) MessageSinkthisguy)LOGNA PROACTIVE)FeatureManagementPerms) set_feature)Scope create_task_and_log_exceptionsc N e Zd Zej Zdej fdZd Z e
d Z dS )ProactiveLogMigrationloopc > K t || j | _ d S )N)r
_migrate_migration_task)selfr s w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/plugins/proactive_log_migration.py create_sinkz!ProactiveLogMigration.create_sink! s' > $-
c K t | dd }|| rd S | | d {V d S # t j $ r Y d S w xY w)Nr )getattrdonecancelasyncioCancelledError)r tasks r shutdownz ProactiveLogMigration.shutdown, sz t .55 <499;;< F
JJJJJJJJJ% DD s A A A c v K t dd } | dk rd S d t j t j t k t j t j k z D }|sd S t
dt | d}|D ]T} t |t t d {V r|dz
}*# t $ r t d| Y Qw xY wt
d |t | d S )
NFEATURE_MANAGEMENTproactive_disable_targetlogc g | ] }|j
S )user).0rows r
<listcomp>z2ProactiveLogMigration._migrate.<locals>.<listcomp>> s*
H
r z2Promoting %d proactive=na users to log (DEF-42523)r z-Failed to promote proactive=na user %s to logz%Promoted %d/%d users to proactive=log)r getr
selectwhere proactiver r& DEFAULTloggerinfolenr r r Exception exception)targetuserspromotedr& s r r z ProactiveLogMigration._migrate6 s| !! "<
U?? F
-466<<'1R7*/-56
F @ JJ
D
$T9c:::::::: " MH
CT
3 JJ
s >&C%%%D
D
N) __name__
__module__ __qualname__r IM360SCOPEr AbstractEventLoopr r staticmethodr r% r r r r se
KE
g&?
%
%
\%
%
%
r r )__doc__r loggingr defence360agent.contracts.configr !defence360agent.contracts.pluginsr r ,defence360agent.feature_management.constantsr r r (defence360agent.feature_management.modelr
(defence360agent.feature_management.utilsr defence360agent.utilsr r
r8 r0 r r% r r <module>rG s 7 7 7 7 7 7 B B B B B B B B K K K K K K K K K K K K K K K K @ @ @ @ @ @ G G G G G G G G 8 A
A
A
A
A
K A
A
A
A
A
r defence360agent/feature_management/plugins/native.py 0000644 0000000 0000000 00000006512 00000000000 017722 0 ustar from logging import getLogger
from typing import Dict
from defence360agent.feature_management.constants import (
AV,
EXTENSION_DEFAULTS,
FEATURE_EXT_VARIABLES,
NATIVE_EXTENSION_NAME,
PROACTIVE,
)
from defence360agent.feature_management.control import (
is_native_feature_management_enabled,
)
from defence360agent.feature_management.model import FeatureManagementPerms
from defence360agent.feature_management.utils import set_feature
from defence360agent.plugins.event_monitor_message_processor import (
SettingsChangeBase,
)
from defence360agent.subsys.panels.cpanel import packages
logger = getLogger(__name__)
class NativeFeatureManagementSettingsChange(SettingsChangeBase):
FEATURES_LIST = [PROACTIVE, AV]
async def _process_account_removed(self, message):
await super()._process_account_removed(message)
user = message.get("user") or message.get("username")
if user:
logger.info("Resetting FM settings for %s", user)
FeatureManagementPerms.delete().where(
FeatureManagementPerms.user == user
).execute()
async def _process_modify(self, message):
await super()._process_modify(message)
if "old_username" in message.data: # User renamed
old_username = message.data["old_username"]
FeatureManagementPerms.update(user=message.username).where(
FeatureManagementPerms.user == old_username
).execute()
async def _get_settings_from_message(self, message):
settings = {}
for feature in self.FEATURES_LIST:
try:
value = message.data[FEATURE_EXT_VARIABLES[feature]]
except KeyError:
value = None
settings[feature] = value
return settings
@classmethod
async def _get_package_settings(
cls, package_name: str, add_to_package: bool
) -> Dict[str, str]:
logger.info("Getting package settings %s", package_name)
try:
pkg_info = await packages.get_package_info(package_name)
except packages.PackageNotExistError:
logger.warning("Package %s doesn't exist", package_name)
return cls._default_settings()
package_settings = {}
try:
for feature, pe_var in FEATURE_EXT_VARIABLES.items():
package_settings[feature] = pkg_info[pe_var]
return package_settings
except KeyError:
logger.info(
"No extension's fields in package settings %s", pkg_info
)
if add_to_package:
await packages.add_extension(
NATIVE_EXTENSION_NAME, pkg_info, **EXTENSION_DEFAULTS
)
except packages.PackageNotExistError:
logger.warning("Package %s doesn't exist", package_name)
return cls._default_settings()
@staticmethod
def _default_settings() -> Dict[str, str]:
return {
feature: EXTENSION_DEFAULTS[pe_var]
for feature, pe_var in FEATURE_EXT_VARIABLES.items()
}
async def on_settings_change(self, user, feature, value):
await set_feature(user, feature, value)
def _message_is_relatable(self, message):
return True
async def is_enabled(self):
return await is_native_feature_management_enabled()
defence360agent/feature_management/plugins/proactive_log_migration.py 0000644 0000000 0000000 00000006326 00000000000 023345 0 ustar """Promote stale `proactive: na` perms to `log` when the deployment toggle
``FEATURE_MANAGEMENT.proactive_disable_target == "log"`` is set.
DEF-42523. Without this, customers (notably Cloudways) flipping the toggle
post-upgrade would only see the new behavior on users whose add-on state
changes; pre-existing disabled users would linger in NA / mode=DISABLED
indefinitely. Re-firing the proactive hook with LOG writes
``mode=LOG`` to user_config and updates the perm row.
Idempotent: once promoted, no NA proactive perms remain, so subsequent
boots no-op.
"""
import asyncio
from logging import getLogger
from defence360agent.contracts.config import ConfigFile
from defence360agent.contracts.plugins import MessageSink, thisguy
from defence360agent.feature_management.constants import LOG, NA, PROACTIVE
from defence360agent.feature_management.model import FeatureManagementPerms
from defence360agent.feature_management.utils import set_feature
from defence360agent.utils import Scope, create_task_and_log_exceptions
logger = getLogger(__name__)
@thisguy
class ProactiveLogMigration(MessageSink):
# Proactive Defence is an Imunify360-only feature. ImunifyAV-only
# installs have no proactive permissions to migrate and no
# FEATURE_MANAGEMENT.proactive_disable_target schema key.
SCOPE = Scope.IM360
async def create_sink(self, loop: asyncio.AbstractEventLoop):
# Spawn the migration as a background task so the agent's other
# MessageSinks (and serving traffic) come up immediately. The
# migration is idempotent on retry, so cancellation at shutdown
# is safe. create_task_and_log_exceptions surfaces failures
# to the agent's exception handler instead of silently dropping
# them (the bare loop.create_task would).
self._migration_task = create_task_and_log_exceptions(
loop, self._migrate
)
async def shutdown(self):
task = getattr(self, "_migration_task", None)
if task is None or task.done():
return
task.cancel()
try:
await task
except asyncio.CancelledError:
pass
@staticmethod
async def _migrate():
target = ConfigFile().get(
"FEATURE_MANAGEMENT", "proactive_disable_target"
)
if target != "log":
return
users = [
row.user
for row in FeatureManagementPerms.select().where(
(FeatureManagementPerms.proactive == NA)
& (
FeatureManagementPerms.user
!= FeatureManagementPerms.DEFAULT
)
)
]
if not users:
return
logger.info(
"Promoting %d proactive=na users to log (DEF-42523)",
len(users),
)
promoted = 0
for user in users:
try:
if await set_feature(user, PROACTIVE, LOG):
promoted += 1
except Exception:
logger.exception(
"Failed to promote proactive=na user %s to log", user
)
logger.info(
"Promoted %d/%d users to proactive=log",
promoted,
len(users),
)
defence360agent/feature_management/rpc/ 0000755 0000000 0000000 00000000000 00000000000 015161 5 ustar defence360agent/feature_management/rpc/__init__.py 0000644 0000000 0000000 00000000000 00000000000 017260 0 ustar defence360agent/feature_management/rpc/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 017371 5 ustar defence360agent/feature_management/rpc/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000321 00000000000 024565 0 ustar
r_j d S )N r d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/__init__.py<module>r s r defence360agent/feature_management/rpc/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000321 00000000000 023626 0 ustar
r_j d S )N r d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/__init__.py<module>r s r defence360agent/feature_management/rpc/endpoints/ 0000755 0000000 0000000 00000000000 00000000000 017164 5 ustar defence360agent/feature_management/rpc/endpoints/__init__.py 0000644 0000000 0000000 00000000113 00000000000 021270 0 ustar from . import native, show, update
__all__ = ["native", "show", "update"]
defence360agent/feature_management/rpc/endpoints/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 021374 5 ustar defence360agent/feature_management/rpc/endpoints/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000516 00000000000 026576 0 ustar
r_jK " d dl mZmZmZ g dZdS ) )nativeshowupdateN) r r r __all__ n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/endpoints/__init__.py<module>r s2 " " " " " " " " " "
&
&
&r defence360agent/feature_management/rpc/endpoints/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000516 00000000000 025637 0 ustar
r_jK " d dl mZmZmZ g dZdS ) )nativeshowupdateN) r r r __all__ n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/endpoints/__init__.py<module>r s2 " " " " " " " " " "
&
&
&r defence360agent/feature_management/rpc/endpoints/__pycache__/native.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005563 00000000000 026334 0 ustar
r_j | d dl mZ d dlmZ d dlmZmZ ddlmZm Z m
Z
m Z ee Z
g Z G d de ZdS ) ) getLogger)MyImunifyConfig)
RootEndpointsbind )!disable_native_feature_management enable_native_feature_management$is_native_feature_management_enabled&is_native_feature_management_supportedc e Zd Z fdZ eddd d Z eddd d Z eddd d Z xZS )
FeatureManagementNativeEndpointsc J t | d S N)super__init__)selfsink __class__s l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/endpoints/native.pyr z)FeatureManagementNativeEndpoints.__init__ s!
zfeature-managementnativestatusc K t j sCt t d {V }t t d {V }nd}d}d||diS )NFitems) supportedenabled)r ENABLEDboolr r
)r r r s r feature_management_native_statuszAFeatureManagementNativeEndpoints.feature_management_native_status s & #I#K#K K K K K K KLLI!E!G!GGGGGGGHHGG IG
&"
r enablec 2 K t d {V d S r )r )r s r feature_management_native_enablezAFeatureManagementNativeEndpoints.feature_management_native_enable& s* .00000000000r disablec > K t d {V }|rddiS d S )Nr zAImunify360 package extensions have been removed from all packages)r )r disableds r !feature_management_native_disablezBFeatureManagementNativeEndpoints.feature_management_native_disable* sE :<<<<<<<< \
r ) __name__
__module__ __qualname__r r r r" r&
__classcell__)r s @r r
r
s
T
(33
43
T
(331 1 431
T
)44 54 r r
N)loggingr defence360agent.contracts.configr defence360agent.rpc_tools.lookupr r controlr r r
r r' logger__all__r
r r <module>r2 s < < < < < < @ @ @ @ @ @ @ @
8
} r defence360agent/feature_management/rpc/endpoints/__pycache__/native.cpython-311.pyc 0000644 0000000 0000000 00000005563 00000000000 025375 0 ustar
r_j | d dl mZ d dlmZ d dlmZmZ ddlmZm Z m
Z
m Z ee Z
g Z G d de ZdS ) ) getLogger)MyImunifyConfig)
RootEndpointsbind )!disable_native_feature_management enable_native_feature_management$is_native_feature_management_enabled&is_native_feature_management_supportedc e Zd Z fdZ eddd d Z eddd d Z eddd d Z xZS )
FeatureManagementNativeEndpointsc J t | d S N)super__init__)selfsink __class__s l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/endpoints/native.pyr z)FeatureManagementNativeEndpoints.__init__ s!
zfeature-managementnativestatusc K t j sCt t d {V }t t d {V }nd}d}d||diS )NFitems) supportedenabled)r ENABLEDboolr r
)r r r s r feature_management_native_statuszAFeatureManagementNativeEndpoints.feature_management_native_status s & #I#K#K K K K K K KLLI!E!G!GGGGGGGHHGG IG
&"
r enablec 2 K t d {V d S r )r )r s r feature_management_native_enablezAFeatureManagementNativeEndpoints.feature_management_native_enable& s* .00000000000r disablec > K t d {V }|rddiS d S )Nr zAImunify360 package extensions have been removed from all packages)r )r disableds r !feature_management_native_disablezBFeatureManagementNativeEndpoints.feature_management_native_disable* sE :<<<<<<<< \
r ) __name__
__module__ __qualname__r r r r" r&
__classcell__)r s @r r
r
s
T
(33
43
T
(331 1 431
T
)44 54 r r
N)loggingr defence360agent.contracts.configr defence360agent.rpc_tools.lookupr r controlr r r
r r' logger__all__r
r r <module>r2 s < < < < < < @ @ @ @ @ @ @ @
8
} r defence360agent/feature_management/rpc/endpoints/__pycache__/show.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000013154 00000000000 026021 0 ustar
r_j3
d dl mZ d dlmc mc mZ d dlmZm Z m
Z
d dl m Z d dl
mZ d dlmZ d dlmZ d dlmZmZmZ ee Ze G d d
e Z G d d e ZdS )
) getLoggerN)AVFULL PROACTIVE)features)FeatureManagementPerms) builtin_feature_management_only)apply_order_by)CommonEndpoints
RootEndpointsbindc e Zd Zd Z edd d Z edd d Z edd d
d ZdS ) "FeatureManagementShowRootEndpointsc P t t fD ]}|| t k ||< |S N)r r r )selfitemfeatures j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/endpoints/show.py _adapt_valuez/FeatureManagementShowRootEndpoints._adapt_value s. 9} 2 2G MT 1DMM feature-managementlistc 2 K dt t iS )zGet list of featuresitems)r r )r s r feature_management_listz:FeatureManagementShowRootEndpoints.feature_management_list s h ((r defaultsc ~ K t j }d| | iS )z Get default feature permissionsr )r get_defaultr as_dict)r perms r feature_management_defaultsz>FeatureManagementShowRootEndpoints.feature_management_defaults s7 &133**4<<>>::;;r showNc K t j d{V r fd D t j }|rt
|t | } fd|D }t | }|r
||d }|r
|d| } fd|D }||fS )zShow permissionsNc d i | ],\ }}|v s t t fd | )||-S )c | v S r )xsearchs r <lambda>zWFeatureManagementShowRootEndpoints.feature_management_show.<locals>.<dictcomp>.<lambda>0 s v{ r )anymap).0userdomainsr) s r
<dictcomp>zNFeatureManagementShowRootEndpoints.feature_management_show.<locals>.<dictcomp>- sP !D'T>>S-B-B-B-BG)L)L%M%M> g!>>r c & g | ]
}|j v |S r' )r. )r- r! userss r
<listcomp>zNFeatureManagementShowRootEndpoints.feature_management_show.<locals>.<listcomp>6 s% :::$tyE'9'9'9'9'9r c g | ]=}|j |j | d >S ))namer/ r )r. r r )r- r! r r2 s r r3 zNFeatureManagementShowRootEndpoints.feature_management_show.<locals>.<listcomp>< sZ
+ - -dllnn = =
r )hp HostingPanelget_domains_per_userr r selectr
len)
r r) limitoffsetorder_byqperms perms_lenresultr2 s
`` @r feature_management_showz:FeatureManagementShowRootEndpoints.feature_management_show& s#
o''<<>>>>>>>> %*[[]] E
# ) + + D x)?CCA::::!:::JJ #&''NE "&5&ME
& r )NNNN)__name__
__module__ __qualname__r r
r r" rB r' r r r r s
T
'') ) (')
T
++< < ,+<
T
''=A ! ! ! (' ! ! !r r c J e Zd Ze edd dd ZdS )!FeatureManagementShowAnyEndpointsr getNc Z K t j | }d| iS )z Get user feature permissionsr )r get_permr )r. r! s r feature_management_getz8FeatureManagementShowAnyEndpoints.feature_management_getI s+ &.t44 ((r r )rC rD rE staticmethodr
rK r' r r rG rG H sJ T
&&) ) ) '& \) ) )r rG )loggingr +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelr6 ,defence360agent.feature_management.constantsr r r )defence360agent.feature_management.lookupr (defence360agent.feature_management.modelr 6defence360agent.feature_management.rpc.endpoints.utilsr $defence360agent.model.simplificationr
defence360agent.rpc_tools.lookupr r r
rC loggerr rG r' r r <module>rY s_ 8 8 8 8 8 8 8 8 8 8 8 8 L L L L L L L L L L > > > > > > K K K K K K @ ? ? ? ? ?
8 !0! 0! 0! 0! 0! 0! 0! ! 0!f) ) ) ) ) ) ) ) ) )r defence360agent/feature_management/rpc/endpoints/__pycache__/show.cpython-311.pyc 0000644 0000000 0000000 00000013154 00000000000 025062 0 ustar
r_j3
d dl mZ d dlmc mc mZ d dlmZm Z m
Z
d dl m Z d dl
mZ d dlmZ d dlmZ d dlmZmZmZ ee Ze G d d
e Z G d d e ZdS )
) getLoggerN)AVFULL PROACTIVE)features)FeatureManagementPerms) builtin_feature_management_only)apply_order_by)CommonEndpoints
RootEndpointsbindc e Zd Zd Z edd d Z edd d Z edd d
d ZdS ) "FeatureManagementShowRootEndpointsc P t t fD ]}|| t k ||< |S N)r r r )selfitemfeatures j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/endpoints/show.py _adapt_valuez/FeatureManagementShowRootEndpoints._adapt_value s. 9} 2 2G MT 1DMM feature-managementlistc 2 K dt t iS )zGet list of featuresitems)r r )r s r feature_management_listz:FeatureManagementShowRootEndpoints.feature_management_list s h ((r defaultsc ~ K t j }d| | iS )z Get default feature permissionsr )r get_defaultr as_dict)r perms r feature_management_defaultsz>FeatureManagementShowRootEndpoints.feature_management_defaults s7 &133**4<<>>::;;r showNc K t j d{V r fd D t j }|rt
|t | } fd|D }t | }|r
||d }|r
|d| } fd|D }||fS )zShow permissionsNc d i | ],\ }}|v s t t fd | )||-S )c | v S r )xsearchs r <lambda>zWFeatureManagementShowRootEndpoints.feature_management_show.<locals>.<dictcomp>.<lambda>0 s v{ r )anymap).0userdomainsr) s r
<dictcomp>zNFeatureManagementShowRootEndpoints.feature_management_show.<locals>.<dictcomp>- sP !D'T>>S-B-B-B-BG)L)L%M%M> g!>>r c & g | ]
}|j v |S r' )r. )r- r! userss r
<listcomp>zNFeatureManagementShowRootEndpoints.feature_management_show.<locals>.<listcomp>6 s% :::$tyE'9'9'9'9'9r c g | ]=}|j |j | d >S ))namer/ r )r. r r )r- r! r r2 s r r3 zNFeatureManagementShowRootEndpoints.feature_management_show.<locals>.<listcomp>< sZ
+ - -dllnn = =
r )hp HostingPanelget_domains_per_userr r selectr
len)
r r) limitoffsetorder_byqperms perms_lenresultr2 s
`` @r feature_management_showz:FeatureManagementShowRootEndpoints.feature_management_show& s#
o''<<>>>>>>>> %*[[]] E
# ) + + D x)?CCA::::!:::JJ #&''NE "&5&ME
& r )NNNN)__name__
__module__ __qualname__r r
r r" rB r' r r r r s
T
'') ) (')
T
++< < ,+<
T
''=A ! ! ! (' ! ! !r r c J e Zd Ze edd dd ZdS )!FeatureManagementShowAnyEndpointsr getNc Z K t j | }d| iS )z Get user feature permissionsr )r get_permr )r. r! s r feature_management_getz8FeatureManagementShowAnyEndpoints.feature_management_getI s+ &.t44 ((r r )rC rD rE staticmethodr
rK r' r r rG rG H sJ T
&&) ) ) '& \) ) )r rG )loggingr +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelr6 ,defence360agent.feature_management.constantsr r r )defence360agent.feature_management.lookupr (defence360agent.feature_management.modelr 6defence360agent.feature_management.rpc.endpoints.utilsr $defence360agent.model.simplificationr
defence360agent.rpc_tools.lookupr r r
rC loggerr rG r' r r <module>rY s_ 8 8 8 8 8 8 8 8 8 8 8 8 L L L L L L L L L L > > > > > > K K K K K K @ ? ? ? ? ?
8 !0! 0! 0! 0! 0! 0! 0! ! 0!f) ) ) ) ) ) ) ) ) )r defence360agent/feature_management/rpc/endpoints/__pycache__/update.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000010262 00000000000 026320 0 ustar
r_j d dl mZ d dlmZmZ d dlmc mc mZ d dl
m Z d dl m
Z
mZmZmZmZmZ d dlmZ d dlmZmZ d dlmZmZ ee Z d e fd
Z e G d d e Z dS )
) getLogger)AnyListN)
ConfigFile)AV AV_REPORTFULLLOGNA PROACTIVE) builtin_feature_management_only)update_default update_users)
RootEndpointsbindreturnc n t dd } | dk rt nt S )zReturn the permission value that "disable proactive" should resolve to.
Reads FEATURE_MANAGEMENT.proactive_disable_target. Default "na"
preserves legacy behavior; "log" gives observe-only PROACTIVE_DEFENCE
instead of fully off.
FEATURE_MANAGEMENTproactive_disable_targetlog)r getr
r )values l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/endpoints/update.py_proactive_disable_targetr s1
LL 13M N NE5..33b( c e Zd Zededee defd Zd Z e dd d defd Z
e dd
d defd Z dS )
FeatureManagementUpdateEndpointsfeatureusersr c K |s dt | | d {V rdndiS dt | ||t j d {V d {V iS )Nitemssucceedfailed)r r hp HostingPanel get_users)r r r s r _updatez(FeatureManagementUpdateEndpoints._update' s '77777777
<R_->->-H-H-J-J'J'J'J'J'J'J
r c x |rt S |t k rt S |t k rt S t
S N)r r r r r r )selfr r s r _adapt_valuez-FeatureManagementUpdateEndpoints._adapt_value5 s: K b== i ,.. . r zfeature-managementenableNc h K | ||| |d d{V S )zEnable specified featureTNr' r+ r* r r s r feature_management_enablez:FeatureManagementUpdateEndpoints.feature_management_enable> sS \\ UD - -gt < <
r disablec h K | ||| |d d{V S )zDisable specified featureFNr. r/ s r feature_management_disablez;FeatureManagementUpdateEndpoints.feature_management_disableE sS \\ UD - -gu = =
r r) ) __name__
__module__ __qualname__ staticmethodstrr r r' r+ r r0 r3 r r r r % s
s
49
S
\
T
))
s
*)
T
**
+*
r r ) loggingr typingr r +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelr$ defence360agent.contracts.configr ,defence360agent.feature_management.constantsr r r r
r r 6defence360agent.feature_management.rpc.endpoints.utilsr
(defence360agent.feature_management.utilsr r defence360agent.rpc_tools.lookupr r r4 loggerr8 r r r9 r r <module>rF s 8 8 8 8 8 8 8 8 8 8 8 8 7 7 7 7 7 7 A @ @ @ @ @ @ @ 8 )3 ) ) ) ) !$
$
$
$
$
} $
$
! $
$
$
r defence360agent/feature_management/rpc/endpoints/__pycache__/update.cpython-311.pyc 0000644 0000000 0000000 00000010262 00000000000 025361 0 ustar
r_j d dl mZ d dlmZmZ d dlmc mc mZ d dl
m Z d dl m
Z
mZmZmZmZmZ d dlmZ d dlmZmZ d dlmZmZ ee Z d e fd
Z e G d d e Z dS )
) getLogger)AnyListN)
ConfigFile)AV AV_REPORTFULLLOGNA PROACTIVE) builtin_feature_management_only)update_default update_users)
RootEndpointsbindreturnc n t dd } | dk rt nt S )zReturn the permission value that "disable proactive" should resolve to.
Reads FEATURE_MANAGEMENT.proactive_disable_target. Default "na"
preserves legacy behavior; "log" gives observe-only PROACTIVE_DEFENCE
instead of fully off.
FEATURE_MANAGEMENTproactive_disable_targetlog)r getr
r )values l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/endpoints/update.py_proactive_disable_targetr s1
LL 13M N NE5..33b( c e Zd Zededee defd Zd Z e dd d defd Z
e dd
d defd Z dS )
FeatureManagementUpdateEndpointsfeatureusersr c K |s dt | | d {V rdndiS dt | ||t j d {V d {V iS )Nitemssucceedfailed)r r hp HostingPanel get_users)r r r s r _updatez(FeatureManagementUpdateEndpoints._update' s '77777777
<R_->->-H-H-J-J'J'J'J'J'J'J
r c x |rt S |t k rt S |t k rt S t
S N)r r r r r r )selfr r s r _adapt_valuez-FeatureManagementUpdateEndpoints._adapt_value5 s: K b== i ,.. . r zfeature-managementenableNc h K | ||| |d d{V S )zEnable specified featureTNr' r+ r* r r s r feature_management_enablez:FeatureManagementUpdateEndpoints.feature_management_enable> sS \\ UD - -gt < <
r disablec h K | ||| |d d{V S )zDisable specified featureFNr. r/ s r feature_management_disablez;FeatureManagementUpdateEndpoints.feature_management_disableE sS \\ UD - -gu = =
r r) ) __name__
__module__ __qualname__ staticmethodstrr r r' r+ r r0 r3 r r r r % s
s
49
S
\
T
))
s
*)
T
**
+*
r r ) loggingr typingr r +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelr$ defence360agent.contracts.configr ,defence360agent.feature_management.constantsr r r r
r r 6defence360agent.feature_management.rpc.endpoints.utilsr
(defence360agent.feature_management.utilsr r defence360agent.rpc_tools.lookupr r r4 loggerr8 r r r9 r r <module>rF s 8 8 8 8 8 8 8 8 8 8 8 8 7 7 7 7 7 7 A @ @ @ @ @ @ @ 8 )3 ) ) ) ) !$
$
$
$
$
} $
$
! $
$
$
r defence360agent/feature_management/rpc/endpoints/__pycache__/utils.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004272 00000000000 026202 0 ustar
r_j 8 d dl Z d dlmZ d dlmZ d dlmZ d ZdS ) N)$is_native_feature_management_enabledwraps)ValidationErrorc $ d }t j | s
J d t | di D ]J\ }}| d s0t j | r || }t
| || K| S )z
This decorator is intended to wrap rpc endpoint classes. It will
throw ValidationError if native feature management is enabled
when any of decorated class methods is called
c < t fd }|S )Nc j K t d {V rt d | i | d {V S )Nz|Command is disabled because native feature management is enabled. Please use your hosting panel interface to manage features)r r )argskwargscoros k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/endpoints/utils.pywrapperzBbuiltin_feature_management_only.<locals>._wrapper.<locals>.wrapper sg 9;;;;;;;;
%* t.v........ . r )r r s ` r
_wrapperz1builtin_feature_management_only.<locals>._wrapper s3 t / / / /
/ r z+This decorator can only be used for classes__dict___)inspectisclassgetattritems
startswithiscoroutinefunctionsetattr)clsr m_namem_objwrappeds r
builtin_feature_management_onlyr
s ?3 NN!NNN j"55;;== * *
%% *'*Ee*L*L * huooG C ) ) ) Jr )r *defence360agent.feature_management.controlr defence360agent.rpc_tools.lookupr "defence360agent.rpc_tools.validater r r r
<module>r# sk 3 2 2 2 2 2 > > > > > > r defence360agent/feature_management/rpc/endpoints/__pycache__/utils.cpython-311.pyc 0000644 0000000 0000000 00000004272 00000000000 025243 0 ustar
r_j 8 d dl Z d dlmZ d dlmZ d dlmZ d ZdS ) N)$is_native_feature_management_enabledwraps)ValidationErrorc $ d }t j | s
J d t | di D ]J\ }}| d s0t j | r || }t
| || K| S )z
This decorator is intended to wrap rpc endpoint classes. It will
throw ValidationError if native feature management is enabled
when any of decorated class methods is called
c < t fd }|S )Nc j K t d {V rt d | i | d {V S )Nz|Command is disabled because native feature management is enabled. Please use your hosting panel interface to manage features)r r )argskwargscoros k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/feature_management/rpc/endpoints/utils.pywrapperzBbuiltin_feature_management_only.<locals>._wrapper.<locals>.wrapper sg 9;;;;;;;;
%* t.v........ . r )r r s ` r
_wrapperz1builtin_feature_management_only.<locals>._wrapper s3 t / / / /
/ r z+This decorator can only be used for classes__dict___)inspectisclassgetattritems
startswithiscoroutinefunctionsetattr)clsr m_namem_objwrappeds r
builtin_feature_management_onlyr
s ?3 NN!NNN j"55;;== * *
%% *'*Ee*L*L * huooG C ) ) ) Jr )r *defence360agent.feature_management.controlr defence360agent.rpc_tools.lookupr "defence360agent.rpc_tools.validater r r r
<module>r# sk 3 2 2 2 2 2 > > > > > > r defence360agent/feature_management/rpc/endpoints/native.py 0000644 0000000 0000000 00000002745 00000000000 021034 0 ustar from logging import getLogger
from defence360agent.contracts.config import MyImunifyConfig
from defence360agent.rpc_tools.lookup import RootEndpoints, bind
from ...control import (
disable_native_feature_management,
enable_native_feature_management,
is_native_feature_management_enabled,
is_native_feature_management_supported,
)
logger = getLogger(__name__)
__all__ = []
class FeatureManagementNativeEndpoints(RootEndpoints):
def __init__(self, sink):
super().__init__(sink)
@bind("feature-management", "native", "status")
async def feature_management_native_status(self):
if not MyImunifyConfig.ENABLED:
supported = bool(await is_native_feature_management_supported())
enabled = bool(await is_native_feature_management_enabled())
else:
supported = False
enabled = False
return {
"items": {
"supported": supported,
"enabled": enabled,
}
}
@bind("feature-management", "native", "enable")
async def feature_management_native_enable(self):
await enable_native_feature_management()
@bind("feature-management", "native", "disable")
async def feature_management_native_disable(self):
disabled = await disable_native_feature_management()
if disabled:
return {
"items": "Imunify360 package extensions have been removed from all packages" # noqa: E501
}
defence360agent/feature_management/rpc/endpoints/show.py 0000644 0000000 0000000 00000005063 00000000000 020522 0 ustar from logging import getLogger
import defence360agent.subsys.panels.hosting_panel as hp
from defence360agent.feature_management.constants import AV, FULL, PROACTIVE
from defence360agent.feature_management.lookup import features
from defence360agent.feature_management.model import FeatureManagementPerms
from defence360agent.feature_management.rpc.endpoints.utils import (
builtin_feature_management_only,
)
from defence360agent.model.simplification import apply_order_by
from defence360agent.rpc_tools.lookup import (
CommonEndpoints,
RootEndpoints,
bind,
)
logger = getLogger(__name__)
@builtin_feature_management_only
class FeatureManagementShowRootEndpoints(RootEndpoints):
def _adapt_value(self, item):
for feature in AV, PROACTIVE:
item[feature] = item[feature] == FULL
return item
@bind("feature-management", "list")
async def feature_management_list(self):
"""Get list of features"""
return {"items": list(features)}
@bind("feature-management", "defaults")
async def feature_management_defaults(self):
"""Get default feature permissions"""
perm = FeatureManagementPerms.get_default()
return {"items": self._adapt_value(perm.as_dict())}
@bind("feature-management", "show")
async def feature_management_show(
self, search=None, limit=None, offset=None, order_by=None
):
"""Show permissions"""
users = await hp.HostingPanel().get_domains_per_user()
if search:
users = {
user: domains
for user, domains in users.items()
if search in user or any(map(lambda x: search in x, domains))
}
q = FeatureManagementPerms.select()
if order_by:
q = apply_order_by(order_by, FeatureManagementPerms, q)
perms = [perm for perm in q if perm.user in users]
perms_len = len(perms)
if offset:
perms = perms[offset:]
if limit:
perms = perms[:limit]
result = [
{
"name": perm.user,
"domains": users[perm.user],
"features": self._adapt_value(perm.as_dict()),
}
for perm in perms
]
return perms_len, result
class FeatureManagementShowAnyEndpoints(CommonEndpoints):
@staticmethod
@bind("feature-management", "get")
async def feature_management_get(user=None):
"""Get user feature permissions"""
perm = FeatureManagementPerms.get_perm(user)
return {"items": perm.as_dict()}
defence360agent/feature_management/rpc/endpoints/update.py 0000644 0000000 0000000 00000004363 00000000000 021026 0 ustar from logging import getLogger
from typing import Any, List
import defence360agent.subsys.panels.hosting_panel as hp
from defence360agent.contracts.config import ConfigFile
from defence360agent.feature_management.constants import (
AV,
AV_REPORT,
FULL,
LOG,
NA,
PROACTIVE,
)
from defence360agent.feature_management.rpc.endpoints.utils import (
builtin_feature_management_only,
)
from defence360agent.feature_management.utils import (
update_default,
update_users,
)
from defence360agent.rpc_tools.lookup import RootEndpoints, bind
logger = getLogger(__name__)
def _proactive_disable_target() -> str:
"""Return the permission value that "disable proactive" should resolve to.
Reads FEATURE_MANAGEMENT.proactive_disable_target. Default "na"
preserves legacy behavior; "log" gives observe-only PROACTIVE_DEFENCE
instead of fully off.
"""
value = ConfigFile().get("FEATURE_MANAGEMENT", "proactive_disable_target")
return LOG if value == "log" else NA
@builtin_feature_management_only
class FeatureManagementUpdateEndpoints(RootEndpoints):
@staticmethod
async def _update(feature: str, users: List[str], value: Any):
if not users:
return {
"items": "succeed"
if await update_default(feature, value)
else "failed"
}
return {
"items": await update_users(
feature, users, value, await hp.HostingPanel().get_users()
)
}
def _adapt_value(self, feature, value):
if value:
return FULL
if feature == AV:
return AV_REPORT
if feature == PROACTIVE:
return _proactive_disable_target()
return NA
@bind("feature-management", "enable")
async def feature_management_enable(self, feature: str, users=None):
"""Enable specified feature"""
return await self._update(
feature, users, self._adapt_value(feature, True)
)
@bind("feature-management", "disable")
async def feature_management_disable(self, feature: str, users=None):
"""Disable specified feature"""
return await self._update(
feature, users, self._adapt_value(feature, False)
)
defence360agent/feature_management/rpc/endpoints/utils.py 0000644 0000000 0000000 00000002410 00000000000 020673 0 ustar import inspect
from defence360agent.feature_management.control import (
is_native_feature_management_enabled,
)
from defence360agent.rpc_tools.lookup import wraps
from defence360agent.rpc_tools.validate import ValidationError
def builtin_feature_management_only(cls):
"""
This decorator is intended to wrap rpc endpoint classes. It will
throw ValidationError if native feature management is enabled
when any of decorated class methods is called
"""
def _wrapper(coro):
@wraps(coro)
async def wrapper(*args, **kwargs):
if await is_native_feature_management_enabled():
raise ValidationError(
"Command is disabled because native "
"feature management is enabled. "
"Please use your hosting panel interface"
" to manage features"
)
return await coro(*args, **kwargs)
return wrapper
assert inspect.isclass(cls), "This decorator can only be used for classes"
for m_name, m_obj in getattr(cls, "__dict__", {}).items():
if not m_name.startswith("_") and inspect.iscoroutinefunction(m_obj):
wrapped = _wrapper(m_obj)
setattr(cls, m_name, wrapped)
return cls
defence360agent/feature_management/rpc/schema/ 0000755 0000000 0000000 00000000000 00000000000 016421 5 ustar defence360agent/feature_management/rpc/schema/native.pickle 0000644 0000000 0000000 00000000660 00000000000 021102 0 ustar }( feature-management native enable}( return_typeNullAgentResponsehelp
(internal)cli}(users]roota require_rpcanyuu!feature-management native disable}(help
(internal)cli}(users]roota require_rpcanyuu feature-management native status}( return_type+FeaturesManagementNativeStatusAgentResponsehelp
(internal)cli}(users]roota require_rpcanyuuu. defence360agent/feature_management/rpc/schema/native.yaml 0000644 0000000 0000000 00000001025 00000000000 020571 0 ustar # enables native feature-management
feature-management native enable:
return_type: NullAgentResponse
help: (internal)
cli:
users:
- root
require_rpc: any
feature-management native disable:
help: (internal)
cli:
users:
- root
require_rpc: any
# checks native feature-management status
# (enabled/disabled supported/not supported)
feature-management native status:
return_type: FeaturesManagementNativeStatusAgentResponse
help: (internal)
cli:
users:
- root
require_rpc: any
defence360agent/feature_management/rpc/schema/show.pickle 0000644 0000000 0000000 00000002372 00000000000 020576 0 ustar }(feature-management list}( return_type#FeaturesManagementListAgentResponsehelpList all available featurestypedictcli}users]rootasufeature-management defaults}( return_type'FeaturesManagementDefaultsAgentResponsehelp3Get the default state of all features for new userstypedictcli}users]rootasufeature-management show}( return_type#FeaturesManagementShowAgentResponsehelp,List the state of all features for all userstypedictcli}users]rootasschema}(search}(help Search specific users by name.typestringnullableulimit}(help5Limits the output with specified number of incidents.typeintegercoerceintdefaultKduoffset}(helpOffset for pagination.typeintegercoerceintdefaultK uorder_by}(help&List of fields to sort the results by.typelistschema}(typeorder_bycoerceorder_byunullableuuufeature-management get}( return_type"FeaturesManagementGetAgentResponsehelp1Get the state of all features for a specific usertypedictcli}users]rootasschema}user}(help:Specifies a user name to obtain the status of features fortypestringusuu. defence360agent/feature_management/rpc/schema/show.yaml 0000644 0000000 0000000 00000002440 00000000000 020265 0 ustar feature-management list:
return_type: FeaturesManagementListAgentResponse
help: List all available features
type: dict
cli:
users:
- root
feature-management defaults:
return_type: FeaturesManagementDefaultsAgentResponse
help: Get the default state of all features for new users
type: dict
cli:
users:
- root
feature-management show:
return_type: FeaturesManagementShowAgentResponse
help: List the state of all features for all users
type: dict
cli:
users:
- root
schema:
search:
help: Search specific users by name.
type: string
nullable: true
limit:
help: Limits the output with specified number of incidents.
type: integer
coerce: int
default: 100
offset:
help: Offset for pagination.
type: integer
coerce: int
default: 0
order_by:
help: List of fields to sort the results by.
type: list
schema:
type: order_by
coerce: order_by
nullable: true
feature-management get:
return_type: FeaturesManagementGetAgentResponse
help: Get the state of all features for a specific user
type: dict
cli:
users:
- root
schema:
user:
help: Specifies a user name to obtain the status of features for
type: string
defence360agent/feature_management/rpc/schema/update.pickle 0000644 0000000 0000000 00000002176 00000000000 021102 0 ustar s }(feature-management enable}( return_type#FeaturesManagementEditAgentResponsehelpCEnable a feature for specified users or all new ones (set defaults)typedictcli}users]rootasschema}(feature}(helpKAllowed values: `av` for Malware Cleanup, `proactive` for Proactive Defensetypestringallowed]( proactiveaverequireduusers}(helptList of users to enable the feature for. If not specified, the feature will be enabled by default for all new users.typelistschema}typestringsnullableuuufeature-management disable}( return_type#FeaturesManagementEditAgentResponsehelpDDisable a feature for specified users or all new ones (set defaults)typedictcli}users]rootasschema}(feature}(helpKAllowed values: `av` for Malware Cleanup, `proactive` for Proactive Defensetypestringallowed]( proactiveaverequireduusers}(helpvList of users to disable the feature for. If not specified, the feature will be disabled by default for all new users.typelistschema}typestringsnullableuuuu. defence360agent/feature_management/rpc/schema/update.yaml 0000644 0000000 0000000 00000002315 00000000000 020570 0 ustar feature-management enable:
return_type: FeaturesManagementEditAgentResponse
help: Enable a feature for specified users or all new ones (set defaults)
type: dict
cli:
users:
- root
schema:
feature:
help: "Allowed values: `av` for Malware Cleanup, `proactive` for Proactive Defense"
type: string
allowed:
- proactive
- av
required: true
users:
help: List of users to enable the feature for. If not specified, the feature will be enabled by default for all new users.
type: list
schema:
type: string
nullable: true
feature-management disable:
return_type: FeaturesManagementEditAgentResponse
help: Disable a feature for specified users or all new ones (set defaults)
type: dict
cli:
users:
- root
schema:
feature:
help: "Allowed values: `av` for Malware Cleanup, `proactive` for Proactive Defense"
type: string
allowed:
- proactive
- av
required: true
users:
help: List of users to disable the feature for. If not specified, the feature will be disabled by default for all new users.
type: list
schema:
type: string
nullable: true
defence360agent/feature_management/utils.py 0000644 0000000 0000000 00000011674 00000000000 016120 0 ustar import logging
import os
from itertools import chain
from typing import List, Any
from defence360agent.contracts.config import Core
from defence360agent.feature_management import hooks
from defence360agent.feature_management.model import FeatureManagementPerms
from defence360agent.model import instance
from defence360agent.utils import (
execute_iterable_expression,
is_safe_subdir_name,
rmtree,
)
from .lookup import features
logger = logging.getLogger(__name__)
async def set_feature(user: str, feature: str, value: str) -> bool:
"""Sets a `feature` to `value` for a given `user`.
Calls appropriate hook and returns its (bool) result. Logs the result of
setting change. If hook fails rollbacks changes to database.
"""
with instance.db.atomic() as trx:
perm = FeatureManagementPerms.get_perm(user)
perm.set_feature(feature, value)
hook = hooks.get_hook(feature)
ok = hook(user, value)
if ok:
logger.info(
"Applied setting %s=%s for user %s", feature, value, user
)
else:
logger.error(
"Failed to apply setting %s=%s for user %s",
feature,
value,
user,
)
trx.rollback()
return ok
async def update_users(
feature: str, users: List[str], value: Any, existing_users: List[str]
):
result = {"succeeded": [], "failed": []}
for user in users:
if user not in existing_users:
logger.warning("No such user: %s", user)
continue
if await set_feature(user, feature, value):
result["succeeded"].append(user)
else:
result["failed"].append(user)
return result
async def update_default(feature: str, value: Any):
perm = FeatureManagementPerms.get_default()
perm.set_feature(feature, value)
hook = hooks.get_hook(feature)
return hook(None, value)
async def sync_users(users: List[str]) -> bool:
"""Synchronize existing permissions with panel users"""
panel_users = set(users)
perm_users = FeatureManagementPerms.select(FeatureManagementPerms.user)
perm_users = set(chain(*perm_users.tuples()))
perms_to_remove = perm_users - panel_users
perms_to_remove.remove(FeatureManagementPerms.DEFAULT)
if perms_to_remove:
logger.info("Remove permissions of users %s", perms_to_remove)
def expression(perms_to_remove):
return FeatureManagementPerms.delete().where(
FeatureManagementPerms.user.in_(perms_to_remove)
)
execute_iterable_expression(expression, list(perms_to_remove))
for user in perms_to_remove:
if not is_safe_subdir_name(user):
continue
target = os.path.join(Core.USER_CONFDIR, user)
try:
rmtree(target)
except FileNotFoundError:
pass
except OSError as e:
logger.warning(
"Failed to remove user_config dir %s: %s", target, e
)
perms_to_add = panel_users - perm_users
if perms_to_add:
logger.info("Add permissions to users %s", perms_to_add)
for user in perms_to_add:
perm = FeatureManagementPerms.get_perm(user)
for feature in features:
value = perm.get_feature(feature)
callback = hooks.get_hook(feature)
callback(user, value)
return bool(perms_to_add) or bool(perms_to_remove)
async def reset_features(**features):
"""Sets feature values for all existing users in feature management
database to given values in `features`."""
users = list(
chain(
*FeatureManagementPerms.select(FeatureManagementPerms.user)
.where(
FeatureManagementPerms.user != FeatureManagementPerms.DEFAULT
)
.tuples()
)
)
def expression(chunk, feature, value):
return FeatureManagementPerms.update(**{feature: value}).where(
FeatureManagementPerms.user.in_(chunk)
)
for feature, value in features.items():
hook = hooks.get_hook(feature)
# Hooks touch the filesystem, so they run before the write
# transaction opens: on a server with many users, doing this per user
# inside the transaction holds the SQLite write lock for tens of
# seconds and starves every other writer.
applied = []
for user in users:
if hook(user, value):
applied.append(user)
else:
logger.error(
"Failed to apply setting %s=%s for user %s",
feature,
value,
user,
)
execute_iterable_expression(expression, applied, feature, value)
for user in applied:
logger.info(
"Applied setting %s=%s for user %s", feature, value, user
)
defence360agent/files/ 0000755 0000000 0000000 00000000000 00000000000 011650 5 ustar defence360agent/files/__init__.py 0000644 0000000 0000000 00000145016 00000000000 013770 0 ustar """Utilities for managing local file storage synchronised with a remote
server.
Files are divided into types: signatures, modsecurity bundles, ip white
lists, etc. Each type is represented by an Index instance.
Index has a local subdirectory and a description that contains its
files' metadata used to decide if the update is necessary.
"""
import asyncio
import datetime as DT
import hashlib
import http.client
import io
import json
import math
import os
import pathlib
import random
import shutil
import socket
import time
import zipfile
import urllib.error
import urllib.request
from collections import defaultdict, namedtuple
from contextlib import ExitStack, suppress, contextmanager
from email.utils import formatdate, parsedate_to_datetime
from gzip import GzipFile
from itertools import chain
from logging import getLogger
from packaging.version import Version
from typing import (
Any,
BinaryIO,
Dict,
Iterable,
List,
Optional,
Set,
Tuple,
Union,
)
from urllib.parse import urlparse
from defence360agent.contracts import config
from defence360agent.contracts.license import LicenseCLN
from defence360agent.subsys.panels.base import PanelException
from defence360agent.utils import file_hash, retry_on, run_with_umask
from defence360agent.utils.common import rate_limit, HOUR
from defence360agent.utils.threads import to_thread
from defence360agent.utils.net_transport import (
UrlTransport,
RandomIpChooserWithIPv6Toggle,
)
from defence360agent.utils.zipsafe import safe_extractall as _safe_extractall
from .hooks import default_hook
logger = getLogger(__name__)
_IPV6_DISABLED_STATE = pathlib.Path("/var/imunify360/.ipv6_disabled")
_SYSCTL_DISABLE_IPV6 = "/proc/sys/net/ipv6/conf/all/disable_ipv6"
_MOD_PAR_PATH = "/sys/module/{mod}/parameters/{parameter}"
def _is_kernel_ipv6_disabled() -> bool:
"""Check whether IPv6 is disabled at the kernel level.
Reads the module parameter and the runtime sysctl without
depending on the im360 package.
"""
param_file = _MOD_PAR_PATH.format(mod="ipv6", parameter="disable")
try:
with open(param_file) as f:
if f.read().strip() != "0":
return True
except OSError:
# ipv6 module is absent
return True
try:
with open(_SYSCTL_DISABLE_IPV6) as f:
if f.read().strip() == "1":
return True
except OSError:
pass
return False
# static file types
EULA = "eula"
SIGS = "sigs" # malware signatures
REALTIME_AV_CONF = "realtime-av-conf"
WP_RULES = "wp-rules"
GEO = "geo"
FILES_DIR = pathlib.Path("/var/imunify360/files")
BASE_URL = "https://files.imunify360.com/static/"
# chunk size for network and file operations, in bytes
_BUFSIZE = 32 * 1024
_MAX_TRIES_FOR_DOWNLOAD = 10
_TIMEOUT_MULTIPLICATOR = 0.025
"""
>>> _MAX_TRIES_FOR_DOWNLOAD = 10
>>> _TIMEOUT_MULTIPLICATOR = 0.025
>>> [(1 << i) * _TIMEOUT_MULTIPLICATOR for i in range(1, _MAX_TRIES_FOR_DOWNLOAD)] # noqa
[0.05, 0.1, 0.2, 0.4, 0.8, 1.6, 3.2, 6.4, 12.8]
"""
#: sentinel: mtime for a missing/never modified file
_NEVER = -math.inf
# https://github.com/python/typing/issues/182
JSONType = Union[str, int, float, bool, None, Dict[str, Any], List[Any]]
# ip chooser and urllib transport wrapper — lazy-initialized on first use
# to avoid loading the SSL CA store (~1.5-2 MB) at import time (DEF-39725)
_IP_CHOOSER: Optional[RandomIpChooserWithIPv6Toggle] = None
_TRANSPORT: Optional[UrlTransport] = None
def _should_disable_ipv6() -> bool:
"""Check if IPv6 should be disabled at startup.
True when either the kernel has disabled IPv6 or a previous agent
run persisted the disabled state after a runtime network failure.
"""
return _is_kernel_ipv6_disabled() or _IPV6_DISABLED_STATE.exists()
def _persist_ipv6_disabled() -> None:
"""Persist IPv6 disabled state so it survives agent restarts."""
try:
_IPV6_DISABLED_STATE.touch()
except OSError:
logger.debug("Could not persist IPv6 disabled state", exc_info=True)
def _get_ip_chooser() -> RandomIpChooserWithIPv6Toggle:
global _IP_CHOOSER
if _IP_CHOOSER is None:
ipv6_enabled = not _should_disable_ipv6()
_IP_CHOOSER = RandomIpChooserWithIPv6Toggle(ipv6_enabled=ipv6_enabled)
if not ipv6_enabled:
logger.info(
"IPv6 disabled at startup (kernel flag or persisted state)"
)
return _IP_CHOOSER
def _get_transport() -> UrlTransport:
global _TRANSPORT
if _TRANSPORT is None:
_TRANSPORT = UrlTransport(ip_chooser=_get_ip_chooser())
return _TRANSPORT
class IntegrityError(RuntimeError):
"""Raised when on disk content does not match hashes in description.json"""
class UpdateError(RuntimeError):
"""Raised on other errors during files update.
Possible reasons are:
* server returns non 200 status;
* hash mismatched between downloaded content and description.json;
* urllib errors;
* JSON decoding errors;
* errors while writing to disk.
"""
async def _log_failed_update(exc, i):
logger.warning(
"Files update failed with error: {err}, try: {try_}".format(
err=exc, try_=i
)
)
# exponential backoff
await asyncio.sleep(random.randrange(1 << i) * _TIMEOUT_MULTIPLICATOR)
def _open_with_mode(path: os.PathLike, mode: int) -> BinaryIO:
"""Open file at `path` using permission `mode` for writing in binary mode
and return file object."""
with run_with_umask(0):
fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, mode)
return os.fdopen(fd, "wb")
def _fetch_json_sync(url, timeout) -> JSONType:
with _fetch_url(url, timeout=timeout) as response:
return json.load(
io.TextIOWrapper(
response["file"],
encoding=response["headers"].get_content_charset("utf-8"),
)
)
def _disable_ipv6_on_network_error(url: str, exc: Exception) -> None:
chooser = _get_ip_chooser()
if chooser.is_ipv6_enabled() and chooser.last_ip_was_ipv6():
logger.warning(
"Network error for %s via IPv6 IP %r, disabling IPv6. Error: %r",
url,
chooser.last_ip(),
exc,
)
chooser.disable_ipv6()
_persist_ipv6_disabled()
@retry_on(
UpdateError, on_error=_log_failed_update, max_tries=_MAX_TRIES_FOR_DOWNLOAD
)
async def _fetch_json(url: str, timeout) -> JSONType:
"""Download and decode JSON from *url*.
Return decoded JSON. Raise UpdateError:
* HTTP response status code is not 200;
* Unicode or JSON decoding fails;
* on time outs during HTTP request;
* on other HTTP errors.
"""
loop = asyncio.get_event_loop()
try:
return await loop.run_in_executor(None, _fetch_json_sync, url, timeout)
except (UnicodeDecodeError, json.JSONDecodeError) as e:
raise UpdateError("json decode error [{}] for url {}".format(e, url))
except socket.timeout as e:
_disable_ipv6_on_network_error(url, e)
raise UpdateError("request to {} timed out".format(url))
except ConnectionResetError as e:
_disable_ipv6_on_network_error(url, e)
raise UpdateError("request to {} reset".format(url))
except EOFError as e:
raise UpdateError(
f"eof error while updating files, url: {url}, err: {e}"
)
except (http.client.HTTPException, urllib.error.URLError) as e:
_disable_ipv6_on_network_error(url, e)
raise UpdateError(
"urllib/http error while updating files, url: {}, err: {}".format(
url, e
)
)
except OSError as e:
_disable_ipv6_on_network_error(url, e)
raise UpdateError(f"Can't fetch {url}, reason: {e}")
def _perform_http_head_sync( # NOSONAR pylint:W0102
url: str, timeout: float, *, headers={}
):
"""Perform HEAD http request to *url* with *timeout* & *headers*."""
req = urllib.request.Request(
url,
headers={
"Imunify-Server-Id": LicenseCLN.get_server_id() or "",
**headers,
},
method="HEAD",
)
with _get_transport().open(req, timeout=timeout) as r:
return r.code, r.headers
@retry_on(
UpdateError, on_error=_log_failed_update, max_tries=_MAX_TRIES_FOR_DOWNLOAD
)
async def _need_to_download(
url: str, current_mtime: float, timeout: float
) -> bool:
"""Check if we need to download description.json file:
- perform HEAD request if local file exists and older return True
otherwise return False
"""
if current_mtime is _NEVER: # file has never been updated
return True # need to download it
formatted_mtime = formatdate(current_mtime, usegmt=True)
try:
code, headers = await to_thread(
_perform_http_head_sync,
url,
timeout,
headers={"If-Modified-Since": formatted_mtime},
)
except socket.timeout as e:
_disable_ipv6_on_network_error(url, e)
raise UpdateError("request to {} timed out".format(url))
except ConnectionResetError as e:
_disable_ipv6_on_network_error(url, e)
raise UpdateError("request to {} reset".format(url))
except (http.client.HTTPException, urllib.error.URLError) as e:
if hasattr(e, "code") and e.code == 304:
return False
_disable_ipv6_on_network_error(url, e)
raise UpdateError(
"urllib/http error while updating files, url: {}, err: {}".format(
url, e
)
)
else:
if code != 200:
raise UpdateError(
f"Unexpected http code {code!r} for {url}"
) # pragma: no cover
with suppress(Exception):
last_mtime = parsedate_to_datetime(
headers["Last-Modified"]
).timestamp()
if last_mtime <= current_mtime: # file on the server NOT newer
logger.warning(
"Got code %r, but last modification date %s is earlier"
" than or equal to the date provided in the"
" If-Modified-Since header, the origin server SHOULD"
" generate a 304 (Not Modified) response [rfc7232]."
" Here's curl cmd:\ncurl -s -I -w '%%{http_code}' -H"
" 'If-Modified-Since: %s' '%s'",
code,
headers["Last-Modified"],
formatted_mtime,
url,
)
return True # file has been modified since current mtime, re-download
@contextmanager
def _fetch_url(url: str, *, timeout: float, compress=True):
"""
Fetch *url* as binary file.
If *compress* is true, ungzipping is done automatically
if necessary.
"""
parameters = {}
if timeout is not None: # use default timeout instead None
parameters["timeout"] = timeout
req_headers = {"Imunify-Server-Id": LicenseCLN.get_server_id() or ""}
if compress:
# express preference for gzip but don't forbid identity encoding
req_headers.update({"Accept-Encoding": "gzip"})
req = urllib.request.Request(url, headers=req_headers)
with _get_transport().open(
req, **parameters
) as response, ExitStack() as stack:
# check whether response is gzipped regardless *compress* arg
gzipped = response.headers.get("Content-Encoding") == "gzip"
if (
compress
and not gzipped
and response.headers.get("Content-Type") != "application/zip"
):
logger.info(
"Requested gzip but got Content-Encoding=%r."
" Read response as is [identity]. Headers: %s,"
" as curl cmd:\ncurl -Is -H 'Accept-Encoding: gzip' '%s'",
response.headers.get("Content-Encoding"),
response.headers.items(),
url,
)
yield {
"file": (
stack.enter_context(GzipFile(fileobj=response))
if gzipped
else response
),
"headers": response.headers,
}
def _fetch_n_md5sum_url(
url, dest_file: BinaryIO, timeout, *, compress, md5sum
):
"""
Fetch *url* to *dest_file* and return its md5sum.
Raise *urllib.error.ContentTooShortError* if the downloaded file
has unexpected length.
"""
md5 = hashlib.md5()
initial_file_offset = dest_file.tell()
with _fetch_url(url, timeout=timeout, compress=compress) as response:
while chunk := response["file"].read(_BUFSIZE): # NOSONAR
md5.update(chunk)
dest_file.write(chunk)
if not response["headers"].get("Content-Encoding") == "gzip":
# Content-Length is compressed size
# -> no point in comparing with the uncompressed result
file_length = dest_file.tell() - initial_file_offset
# make sure the file has been downloaded correctly
# Content-Length may not be set if exist header
# Transfer-Encoding: chunked
content_length_header = response["headers"].get("Content-Length", None)
if content_length_header is not None:
expected_file_length = int(content_length_header)
if expected_file_length != file_length:
raise urllib.error.ContentTooShortError(
message="{got} bytes read, {diff} more expected".format(
got=file_length,
diff=expected_file_length - file_length,
),
content=None,
)
got_md5sum = md5.hexdigest()
if md5sum is not None and got_md5sum != md5sum:
raise UpdateError(
f"content fetched from {url} does not match hash:"
f" expected={md5sum}, got={got_md5sum}"
)
return got_md5sum
async def _fetch_and_save_should_retry_handler(exc: Exception, i: int) -> bool:
return "HTTP Error 404" not in str(exc)
@retry_on(
UpdateError,
on_error=_log_failed_update,
max_tries=_MAX_TRIES_FOR_DOWNLOAD,
should_retry=_fetch_and_save_should_retry_handler,
)
async def _fetch_and_save(
url: str,
dest_path: os.PathLike,
timeout,
*,
dest_mode: int,
compress=True,
md5sum=None,
) -> str:
"""Fetch bytes from `url`, save them to `dest_path`,
and return md5 checksum of downloaded content.
Raise UpdateError:
* HTTP response status code is not 200;
* on time outs during HTTP request;
* on other HTTP errors.
"""
try:
with _open_with_mode(dest_path, dest_mode) as dest_file:
return await to_thread(
_fetch_n_md5sum_url,
url,
dest_file,
timeout,
compress=compress,
md5sum=md5sum,
)
except socket.timeout as e:
_disable_ipv6_on_network_error(url, e)
raise UpdateError("request to {} timed out".format(url))
except ConnectionResetError as e:
_disable_ipv6_on_network_error(url, e)
raise UpdateError("request to {} reset".format(url))
except EOFError as e:
_disable_ipv6_on_network_error(url, e)
raise UpdateError(
f"eof error while updating files, url: {url}, err: {e}"
)
except (http.client.HTTPException, urllib.error.URLError) as e:
_disable_ipv6_on_network_error(url, e)
raise UpdateError(
"urllib/http error while updating files, url: {}, err: {}".format(
url, e
)
)
except OSError as e:
_disable_ipv6_on_network_error(url, e)
raise UpdateError(f"Can't fetch {url} to {dest_path}, reason: {e}")
_Item = namedtuple("_Item", ["url", "md5sum"])
def _items(data: Any) -> Set[_Item]:
"""Return a set of _Item for easy manipulation."""
return {_Item(item["url"], item["md5sum"]) for item in data["items"]}
def check_mode_dirs(dirname, dir_perm, file_perm):
"""Check and change file/dir modes recursively.
Starting at dirname, change all inner directory permissions to dir_perm,
file permissions to file_perm
"""
def _os_chmod(file_dir_path, permission):
try:
current_mode = os.lstat(file_dir_path).st_mode & 0o777
if current_mode != permission and not os.path.islink(
file_dir_path
):
logger.warning(
"Fixing wrong permission to file/dir"
" %s [%s] expected [%s] (not symlink)",
file_dir_path,
oct(current_mode),
oct(permission),
)
os.chmod(file_dir_path, permission)
except PermissionError:
logger.error(
"Failed to change permission to file %s", file_dir_path
)
_os_chmod(dirname, dir_perm)
for path, dirs, files in os.walk(dirname):
for directory in dirs:
_os_chmod(os.path.join(path, directory), dir_perm)
for name in files:
_os_chmod(os.path.join(path, name), file_perm)
def _fix_directory_structure(
description_path: pathlib.Path, files_path: pathlib.Path = FILES_DIR
) -> None:
"""
Try to fix the structure of /var/imunify360/files/ when
NotADirectoryError happens.
It indicates that some part in the path is a file:
/var/imunify360/files/sigs <- is a file
=> open("/var/imunify360/files/sigs/v1/description.json") will fail.
We try to rectify it by deleting the file but up to FILES_DIR.
"""
assert files_path in description_path.parents
_dir = description_path.parent
topmost_dir = _dir
while _dir != files_path:
if _dir.is_file():
_dir.unlink(missing_ok=True)
topmost_dir.mkdir(parents=True, exist_ok=True)
break
_dir = _dir.parent
class Index:
# one lock is shared via Index and that allows
# more than one instance of Index to co-exist
_lock = defaultdict(asyncio.Lock) # type: Dict[Any, asyncio.Lock]
_HOOKS = defaultdict(set) # type: Dict[str, Set[Any]]
_PATHS = {} # type: Dict[str, str]
_PERMS = {} # type: Dict[str, Dict[str, int]]
_TYPES = set() # type: Set[str]
_ESSENTIAL_TYPES = set() # type: Set[str]
_ALL_ZIP_SUPPORT = {} # type: Dict[str, bool]
_URL_PATH_PREFIX = "/static"
_throttled_log_error = rate_limit(period=4 * HOUR)(logger.error)
def __init__(self, type_, integrity_check=True):
"""
:param bool integrity_check: check if last update
did not break anything (by interrupting it in the middle or
another programmatic error)
:raise IntegrityError:
"""
if type_ not in self._TYPES:
raise ValueError(
f"Trying to initiate unregistered file type {type_}. Allowed"
f" types {self._TYPES}"
)
self.type = type_
self._is_blank = False
self._json = {"items": []}
path = self._descriptionfile_path()
try:
with open(path) as f:
self._json = json.load(f)
except NotADirectoryError:
Index._throttled_log_error("Path %s has a file in parents", path)
_fix_directory_structure(pathlib.Path(path), FILES_DIR)
except (
FileNotFoundError,
UnicodeDecodeError,
json.JSONDecodeError,
) as e:
if integrity_check:
raise IntegrityError(
"cannot read description file {}".format(path)
) from e
self._is_blank = True
if integrity_check:
bad_files = self._corrupted_files()
if len(bad_files):
raise IntegrityError(
"some files are missing or corrupted: {}".format(
", ".join(bad_files)
)
)
if not self._is_blank:
self.check_mode_dirs()
def __eq__(self, other):
return (
self.__class__ == other.__class__
and self.type == other.type
and self._is_blank == other._is_blank
and self._json == other._json
)
def __repr__(self): # pragma: no cover
return (
f"<{self.__class__.__name__}(type_={self.type})"
f" is_blank={self._is_blank}, "
f"json={{<{len(self.items())}"
" item(s)>}>"
)
def validate(self, files_path: os.PathLike) -> None:
"""Whether *files_path* dir may be used for this type's file group.
:raises: IntegrityError
"""
logger.info("Validating [%s]: %s", self.type, files_path)
FileGroup = self._make_file_group(
files_path
) # noqa NOSONAR disable python:S117
FileGroup(self.type, integrity_check=True)
def _make_file_group(self, files_path: os.PathLike):
"""
Return FileGroup class: Index class with local path == *files_path*.
"""
class FileGroup(self.__class__):
@classmethod
def files_path(cls, type_: str) -> str:
"""Return local base path for given file type."""
assert type_ == self.type
return os.fspath(files_path)
return FileGroup
def check_mode_dirs(self):
perms = Index._PERMS[self.type]
check_mode_dirs(
os.path.normpath(
os.path.join(FILES_DIR, Index._PATHS[self.type], os.pardir)
),
perms["dir"],
perms["file"],
)
@classmethod
def add_type(
cls,
type_: str,
relative_path: str,
dir_perm: int,
file_perm: int,
*,
all_zip: bool = False,
essential: bool = True,
) -> None:
"""Add a type to known file types.
* relative_path is a relative path to all files for that type.
* dir_perm is permission mask used to create directories.
* file_perm is permission mask used to create files.
* all_zip is a flag which shows whether that type of files can
be downloaded in all.zip archive. all.zip is expected to be on
the server.
* essential is whether the agent can start if there are errors
updating that type.
"""
cls._TYPES.add(type_)
if essential:
cls._ESSENTIAL_TYPES.add(type_)
cls._PATHS[type_] = relative_path
cls._PERMS[type_] = {"dir": dir_perm, "file": file_perm}
cls._ALL_ZIP_SUPPORT[type_] = all_zip
@classmethod
async def essential_files_exist(cls) -> bool:
"""Whether essential files exist.
Note: the files may be corrupted (integrity check is not performed).
"""
# use the existence of the description files as a proxy
return all(
not Index(type_, integrity_check=False)._is_blank
for type_ in cls._ESSENTIAL_TYPES
)
@classmethod
def types(cls) -> Set[str]:
"""Return a set of all known files types."""
return cls._TYPES.copy()
@classmethod
def files_path(cls, type_: str) -> str:
"""Return local base path for given file type."""
return os.path.join(FILES_DIR, cls._PATHS[type_])
def _descriptionfile_path(self, latest=False) -> str:
"""Return local path for description.json for current index."""
if latest and self.type in config.FilesUpdate.DISABLED:
# for disabled types, use the latest veriosn path
return os.path.join(
self._descriptionfile_path_latest(), "description.json"
)
return os.path.join(self.files_path(self.type), "description.json")
def _descriptionfile_path_latest(self) -> str:
lts = [x["dir"] for x in self._get_list().values() if x["latest"]][0]
return lts
def _corrupted_files(self) -> Set[str]:
"""Return a set of file paths that are missing or corrupted."""
bad_files = set()
for item in _items(self._json):
path = self.localfilepath(item.url)
try:
actual = file_hash(path, hashlib.md5, _BUFSIZE)
except FileNotFoundError:
bad_files.add(path)
continue
if actual != item.md5sum:
bad_files.add(path)
return bad_files
@classmethod
def locked(cls, type_):
"""
usage example:
>> async with Index.locked(WHITELISTS):
...
"""
return cls._lock[type_]
def files(self) -> Iterable[str]:
"""Return iterable over all files in index."""
return (self.localfilepath(item.url) for item in _items(self._json))
def items(self):
"""Return 'items' field from JSON description."""
return self._json["items"]
def _descriptionfile_mtime(self, default=_NEVER) -> float:
"""Return mtime of description file if it exists, otherwise -math.inf"""
try:
return os.stat(self._descriptionfile_path(latest=True)).st_mtime
except OSError:
return default
def _is_outdated(self) -> bool:
"""Return True if last update was too late in the past."""
_desc_mtime = self._descriptionfile_mtime()
if not _desc_mtime:
return True # pragma: no cover
return _desc_mtime + config.FilesUpdate.PERIOD < time.time()
async def is_update_needed(self, timeout: float) -> bool:
"""Return True if update from server is needed for current index."""
return (
self._is_blank
or len(self._corrupted_files()) > 0
or (
self._is_outdated()
and await _need_to_download(
self._descriptionfile_url(self.type),
self._descriptionfile_mtime(),
timeout,
)
)
)
def _makedirs(self, dirname, dir_mode, exist_ok=False):
"""Create local directory for current index."""
try:
with run_with_umask(0):
os.makedirs(dirname, mode=dir_mode, exist_ok=exist_ok)
except OSError as e:
raise UpdateError(str(e)) from e
async def _update_files(
self, files_path: pathlib.Path, to_update: Set[_Item], timeout
) -> None:
"""
Fetch files from *to_update* set, verify hashes, save to *files_path*.
"""
FileGroup = self._make_file_group(
files_path
) # noqa NOSONAR disable python:S117
fg = FileGroup(self.type, integrity_check=False)
dir_mode = fg._PERMS[fg.type]["dir"] # NOSONAR disable python:W0212
file_mode = fg._PERMS[fg.type]["file"] # NOSONAR disable python:W0212
for item in to_update:
filename = fg.localfilepath(item.url)
dirname = os.path.dirname(filename)
if not os.path.isdir(dirname):
self._makedirs(dirname, dir_mode, exist_ok=False)
await _fetch_and_save(
item.url,
filename,
timeout,
dest_mode=file_mode,
md5sum=item.md5sum,
)
def _calculate_changes(
self, remote_items: Set[_Item]
) -> Tuple[Set[_Item], Set[str]]:
"""Figure out what should be updated based on current items,
file system state and remote items.
Return tuple of files to fetch and files to delete.
Files to fetch is a set of _Item.
Files to delete is a set of file paths."""
local_items = _items(self._json)
local_files = {self.localfilepath(item.url) for item in local_items}
remote_files = {self.localfilepath(item.url) for item in remote_items}
to_remove = local_files - remote_files
bad_files = self._corrupted_files()
local_set = {
item
for item in local_items
if self.localfilepath(item.url) not in bad_files
}
to_update = remote_items - local_set
return to_update, to_remove
@classmethod
def _descriptionfile_url(cls, type_: str) -> str:
"""Return remote path for description.json"""
return "{}{}/description.json".format(BASE_URL, cls._PATHS[type_])
@classmethod
def _all_zip_url(cls, type_: str) -> str:
"""Return remote path for all.zip"""
return "{}{}/all.zip".format(BASE_URL, cls._PATHS[type_])
@staticmethod
def _all_zip_cleanup(files_path, all_zip_localpath, remove_files=False):
try:
os.unlink(all_zip_localpath)
except OSError as e:
logger.warning(
"failed to remove %s: %s", all_zip_localpath, str(e)
)
if remove_files:
logger.info("Removing old path on all.zip update: %s", files_path)
shutil.rmtree(files_path, ignore_errors=True)
@staticmethod
def _generate_new_path(live_path: pathlib.Path) -> pathlib.Path:
"""Generate new base local path for *live_path* files.
It should be on the same filesystem partition as
*live_path* so that the rename would be atomic.
"""
new_suffix = DT.datetime.utcnow().strftime("_%Y-%m-%dT%H%M%S.%fZ")
return live_path.with_name(live_path.name + new_suffix)
async def _run_update_all_zip(self, timeout) -> bool:
"""
Update current type of files using all.zip archive. Directory with
current type of files will be cleared and replaced with all.zip
contents. all.zip is expected to be on the server
Return whether updated.
:param timeout:
:raise UpdateError: if OSError or http error or
integrity check error (got wrong data from
the server)
"""
live_path = pathlib.Path(self.files_path(self.type))
new_path = Index._generate_new_path(live_path)
archive_path = new_path.with_name(new_path.name + "all.zip")
file_mode = self._PERMS[self.type]["file"]
dir_mode = self._PERMS[self.type]["dir"]
all_zip_url = self._all_zip_url(self.type)
with ExitStack() as rollback_stack:
# make new download dir
self._makedirs(new_path, dir_mode, exist_ok=False)
rollback_stack.callback(
Index._all_zip_cleanup,
new_path,
archive_path,
remove_files=True,
)
# download the archive
# TODO: DEF-16354 check md5sum for all.zip
_ = await _fetch_and_save(
all_zip_url,
archive_path,
timeout,
dest_mode=file_mode,
compress=False,
)
# extract files to new dir with right permissions & verify
try:
with zipfile.ZipFile(archive_path, "r") as archive:
# NOTE: this also verifies crc-32 checksum for files
_safe_extractall(archive, new_path)
# set mode
for root, directories, filenames in os.walk(new_path):
for directory in directories:
os.chmod(os.path.join(root, directory), dir_mode)
for filename in filenames:
os.chmod(os.path.join(root, filename), file_mode)
# verify against included description.json
self.validate(new_path)
# create symlink to new dir, replace *live* with the symlink
old_path = self._replace_live_with_new_dir(new_path, live_path)
except (
EOFError,
IntegrityError,
OSError,
ValueError,
zipfile.BadZipfile,
zipfile.LargeZipFile,
) as e:
raise UpdateError(str(e)) from e
# no exception, clear the rollback stack
rollback_stack.pop_all()
# cleanup: remove old dir & new all.zip
Index._all_zip_cleanup(
old_path, archive_path, remove_files=bool(old_path)
)
# DEF-41801: when the type is in FILES_UPDATE.disabled_types,
# _replace_live_with_new_dir skipped the symlink flip, so no
# new files are actually live — report not-updated so downstream
# hooks (e.g. update_vendors → Apache reload) stay quiet.
return self.type not in config.FilesUpdate.DISABLED
async def update_to(self, version: str, force: bool = False) -> None:
"""Update to the version specified in *version*.
:param version: version to update to
:raise UpdateError: if OSError or http error or
integrity check error (got wrong data from
the server)
"""
# change symlink to exact version
live_path = pathlib.Path(self.files_path(self.type))
if not live_path.is_symlink():
raise UpdateError(
"Cannot update %s, because it is not a symlink: %s"
% (self.type, live_path)
)
if version == "latest":
versions = self._get_list()
version = [
ver for ver, prop in versions.items() if prop["latest"]
][0]
logger.info(
"Try to update to latest version %s %s", self.type, version
)
current_path = live_path.resolve(strict=False)
try:
if (
Version((current_path / "VERSION").read_text().strip())
== Version(version)
and not force
):
raise UpdateError(
f"Version {version} is already set for {self.type}"
)
except FileNotFoundError:
raise UpdateError(
"Cannot update %s, because current version doesn't have"
" VERSION file: %s" % (self.type, current_path)
)
# check if version exists
for path in live_path.parent.iterdir():
if not path.is_symlink() and path.is_dir():
if Version((path / "VERSION").read_text().strip()) == Version(
version
):
new_live_path = path.with_name(path.name + "live")
new_live_path.symlink_to(path, target_is_directory=True)
new_live_path.rename(live_path)
await self._run_hooks(is_updated=True)
return
raise UpdateError("Version %s not found in %s" % (version, self.type))
def _get_list(self) -> Dict[Version, Dict[str, bool | str]]:
live_path = pathlib.Path(self.files_path(self.type))
if not live_path.is_symlink():
return {}
current_path = live_path.resolve(strict=False)
result = {}
max_version = Version("0")
for path in live_path.parent.iterdir():
if path.is_symlink():
# skip live path symlink
continue
# if /var is symlink, we need to resolve it too to compare
if path.resolve() == current_path:
current = True
else:
current = False
if (version_file := path / "VERSION").exists():
version = None
try:
version = version_file.read_text()
_ver = Version(version)
result[_ver] = {
"current": current,
"latest": False,
"dir": str(path),
}
if _ver > max_version:
max_version = _ver
except ValueError:
logger.error(
"Version file %s is not valid: %s",
version_file,
version,
)
continue
if max_version > Version("0"):
result[max_version]["latest"] = True
return result
def get_list(self) -> List[str]:
"""Return list of versions available in the index."""
result = []
for version, prop in sorted(
self._get_list().items(), key=lambda x: x[0]
):
marker = (
" (current)"
if prop["current"]
else " (latest)"
if prop["latest"]
else ""
)
result.append(f"{version}{marker}")
return result
def _clean_old_versions(self) -> None:
"""Remove old versions of files.
This is done by removing old directories in the path, that older than 30 days.
"""
# remove old versions of files
live_path = pathlib.Path(self.files_path(self.type))
if not live_path.is_symlink():
return
current_path = live_path.resolve(strict=False)
for path in live_path.parent.iterdir():
days_old = (
DT.datetime.now(DT.timezone.utc)
- DT.datetime.fromtimestamp(
path.stat().st_mtime, DT.timezone.utc
)
).days
if (
path.is_dir()
and not path.is_symlink()
and path != current_path
and (days_old > config.FilesUpdate.DAYS_TO_KEEP)
):
logger.info("Removing old version of %s: %s", self.type, path)
shutil.rmtree(path, ignore_errors=True)
def _replace_live_with_new_dir(
self, new_path: pathlib.Path, live_path: pathlib.Path
) -> Optional[pathlib.Path]:
"""Replace *live_path* with *new_path*.
Return *old_path*
:raises: OSError
"""
if self.type in config.FilesUpdate.DISABLED:
self._clean_old_versions()
logger.info(
"Skipping update for %s, because it is disabled. New files"
" stored in %s",
self.type,
new_path,
)
return None
new_live_path = new_path.with_name(new_path.name + "live")
moved_path = None
with ExitStack() as rollback_stack:
new_live_path.symlink_to(new_path, target_is_directory=True)
rollback_stack.callback(new_live_path.unlink)
# save the path to old dir for the cleanup
old_path = (
live_path.resolve(strict=False)
if live_path.is_symlink()
else None
)
# switch to the new version
# NOTE: nothing until this point touched old version;
# the rename should be atomic
# (paths are on the same partition)
for last in range(2): # pragma: no branch
try:
new_live_path.rename(live_path)
break
except IsADirectoryError:
if last: # give up (keep old)
raise # pragma: no cover
# live_path is a directory
# (old agent version or tests)
# move it so that the rename above could happen
if not live_path.is_symlink(): # pragma: no branch
# use unique to the current update name
moved_path = new_live_path.with_name(
new_live_path.name + ".live-moved"
)
logger.info(
"Moving %s [live] to %s,"
" to rename %s to it [live]",
live_path,
moved_path,
new_live_path,
)
live_path.replace(moved_path)
# if enabling new_live fails the 2nd time,
# try to move back, to restore old dir
rollback_stack.callback(moved_path.replace, live_path)
if moved_path is not None:
shutil.rmtree(moved_path, ignore_errors=True)
# no exception, clear the rollback stack
rollback_stack.pop_all()
return old_path
async def _run_update(self, timeout) -> bool:
"""
Run update, return whether updated.
:raise UpdateError: if OSError or http error or
integrity check error (got wrong data from
the server)
"""
url = self._descriptionfile_url(self.type)
as_json = await _fetch_json(url, timeout=timeout)
to_update, to_remove = self._calculate_changes(_items(as_json))
need_update = to_update or to_remove
if not need_update:
logger.info("updating %s: nothing to update.", self.type)
self._touch() # postpone the next try for FilesUpdate.PERIOD
return False # not updated
# perform atomic update
live_path = pathlib.Path(self.files_path(self.type))
# note: it is ok if the symlink changes before .resolve() is called
old_path = (
live_path.resolve(strict=False) if live_path.is_symlink() else None
)
new_path = Index._generate_new_path(live_path)
# make new download dir
with ExitStack() as rollback_stack:
self._makedirs(
new_path, self._PERMS[self.type]["dir"], exist_ok=False
)
rollback_stack.callback(
shutil.rmtree, new_path, ignore_errors=True
)
# copy all files from *old* dir to *new* dir except those
# that needs updating
from_path = (
old_path if old_path and old_path.is_dir() else live_path
)
if from_path.is_dir():
await Index._copytree(
from_path,
new_path,
to_remove.union(
self.localfilepath(item.url) for item in to_update
),
)
# download *to_update* files to *new_path*
await self._update_files(new_path, to_update, timeout=timeout)
try:
# write description.json
with _open_with_mode(
new_path / "description.json",
self._PERMS[self.type]["file"],
) as file:
file.write(json.dumps(as_json).encode())
# verify against included description.json
self.validate(new_path)
# create symlink to new dir, replace *live* with the symlink
old_path = self._replace_live_with_new_dir(new_path, live_path)
except (IntegrityError, OSError) as e:
raise UpdateError(str(e)) from e
# no exception, clear the rollback stack
rollback_stack.pop_all()
# cleanup: remove old path on success
if old_path and old_path.is_dir():
logger.info(
"Removing old path on file by file update: %s", old_path
)
shutil.rmtree(old_path, ignore_errors=True)
# DEF-41801: see _run_update_all_zip — same rationale.
return self.type not in config.FilesUpdate.DISABLED
@staticmethod
async def _copytree(
from_dir: os.PathLike, to_dir: os.PathLike, ignored_paths: Set[str]
) -> None:
"""Copy *from_dir* to *to_dir* except for *ignored_paths*."""
def ignore_names(path, names):
"""Return names that should not be copied."""
assert isinstance(os.fspath(path), str) # no bytes here
return frozenset(
name
for name in names
if os.path.join(path, name) in ignored_paths
)
await to_thread(
shutil.copytree,
from_dir,
to_dir,
symlinks=True,
ignore=ignore_names,
dirs_exist_ok=True,
)
def localfilepath(self, url: str) -> str:
"""Return a local file path corresponding to URL."""
url_relpath = os.path.relpath(
urlparse(url).path, self._URL_PATH_PREFIX
)
type_path = self._PATHS[self.type]
assert (
pathlib.Path(type_path) in pathlib.Path(url_relpath).parents
), "url ({}) does not fit file path ({})".format(url, type_path)
relative_path = os.path.relpath(url_relpath, type_path)
return os.path.join(self.files_path(self.type), relative_path)
def _touch(self) -> None:
"""Update mtime of description.json file so it is fresh."""
try:
path = self._descriptionfile_path(latest=True)
if os.path.isfile(path): # pragma: no branch
os.utime(path)
except OSError as e: # pragma: no cover
logger.warning(str(e))
async def _run_hooks(self, is_updated) -> None:
for hook in chain(self._HOOKS[self.type], [default_hook]):
try:
await hook(self, is_updated)
except (IntegrityError, PanelException) as e:
logger.error("hook %s error: %s", hook, e)
except Exception as e:
logger.exception("hook %s error: %s", hook, e)
logger.info(
"%s files update finished%s",
self.type,
" (not updated)" * (not is_updated),
)
async def update(self, force=False) -> None:
"""Run update for the current `type` of files.
Normally update is performed when either is true:
* index is never been fetched (description.json missing or broken);
* last update was performed longer than configured period of time ago;
* some local files are missing or have wrong content (md5 hash differs
from description.json).
If force is True then update is performed unconditionally.
Raises asyncio.TimeoutError, UpdateError.
"""
timeout = config.FilesUpdate.TIMEOUT # total timeout
if not force and not await self.is_update_needed(timeout):
logger.info(
"%s was updated less than %s minutes ago.",
self.type,
int(config.FilesUpdate.PERIOD // 60),
)
await self._run_hooks(is_updated=False)
return
all_zip = self._is_blank and self._ALL_ZIP_SUPPORT[self.type]
file_by_file = not all_zip
if all_zip:
log_str = "all.zip"
logger.info("Updating %s files via %s", self.type, log_str)
# Download updates using all.zip in case of empty or
# corrupted description.json.
# Initially we try to download updates using all.zip, if
# error happened - download file by file.
try:
updated = await asyncio.wait_for(
self._run_update_all_zip(
config.FilesUpdate.SOCKET_TIMEOUT
),
timeout,
)
if updated:
logger.info("Updated %s using %s", self.type, log_str)
except (asyncio.TimeoutError, UpdateError) as e:
logger.warning(
"%s update error via %s: %s", self.type, log_str, e
)
file_by_file = True
if file_by_file:
log_str = "file by file download"
logger.info("Updating %s files via %s", self.type, log_str)
try:
updated = await asyncio.wait_for(
self._run_update(config.FilesUpdate.SOCKET_TIMEOUT),
timeout,
)
if updated:
logger.info("Updated %s using %s", self.type, log_str)
except (asyncio.TimeoutError, UpdateError) as e:
logger.warning(
"%s update error via %s: %s", self.type, log_str, e
)
await self._run_hooks(is_updated=False)
# Ignore errors only for non-essential files
if self.type in self._ESSENTIAL_TYPES:
raise e
else:
return
await self._run_hooks(is_updated=updated or force)
@classmethod
async def update_all(
cls, only_type: Optional[str] = None, force=False, only_essential=False
) -> None:
"""Run update for all registered `types` of files.
Raises asyncio.TimeoutError, UpdateError.
"""
if only_type:
index = cls(only_type, integrity_check=False)
async with cls.locked(only_type):
await index.update(force)
elif only_essential:
logger.info("Updating essential files")
for type_ in cls._ESSENTIAL_TYPES:
index = cls(type_, integrity_check=False)
async with cls.locked(type_):
await index.update(force)
else:
logger.info("Updating all files")
for type_ in cls._TYPES:
index = cls(type_, integrity_check=False)
async with cls.locked(type_):
await index.update(force)
@classmethod
def add_hook(cls, type_: str, hook) -> None:
"""Add a hook for type_ to be called after successful update."""
cls._HOOKS[type_].add(hook)
def configure() -> None:
"""Register required file types."""
Index.add_type(EULA, "eula/v1", 0o770, 0o660, all_zip=False)
Index.add_type(SIGS, "sigs/v1", 0o775, 0o644, all_zip=True)
Index.add_type(
REALTIME_AV_CONF,
"realtime-av-conf/v1",
0o770,
0o660,
all_zip=False,
)
Index.add_type(
WP_RULES,
"wp-rules/v1",
0o770,
0o660,
all_zip=True,
essential=False,
)
Index.add_type(GEO, "geo/v1", 0o770, 0o660, all_zip=True, essential=False)
update = Index.update_all
essential_files_exist = Index.essential_files_exist
async def update_and_log_error(
only_type: Optional[str] = None, force=False
) -> None:
"""Run files.update and log Update/TimeoutErrors."""
try:
return await Index.update_all(only_type, force)
except (asyncio.TimeoutError, UpdateError) as err:
logger.warning(
"Failed to update files [%s] with error: %s", only_type, err
)
async def update_all_no_fail_if_files_exist():
"""Update all files. Don't fail if essential files exist."""
try:
return await Index.update_all(only_essential=True)
except (asyncio.TimeoutError, UpdateError) as err:
if await Index.essential_files_exist():
logger.error(
"Failed to update files [essential files exist]: %s", err
)
else: # re-raise
if isinstance(err, asyncio.TimeoutError):
raise UpdateError from err # wrap
else:
raise
defence360agent/files/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 014060 5 ustar defence360agent/files/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000222254 00000000000 021267 0 ustar
r_j
P U d Z ddlZddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZddlZddlZddlZddlmZmZ ddlmZmZmZ ddlm Z m Z ddl m Z ddl m!Z! ddl"m#Z# dd l$m%Z% dd
l&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/ dd l0m1Z1 dd l2m3Z3 dd
l4m5Z5 ddl6m7Z7 ddl8m9Z9m:Z:m;Z; ddl<m=Z=m>Z> ddl?m@Z@ ddlAmBZBmCZC ddlDmEZF ddlGmHZH e#eI ZJ e jK d ZLdZMdZNdeOfdZPdZQd ZRd ZSd ZTd ZU e jK d ZVd!ZWd"ZXd#ZYd$ZZ e j[ Z\e/e]e^e_eOde)e]e'f e+e' f Z`daae,eC ebd%< dace,eB ebd&< deOfd'ZddYd(ZedeCfd)ZfdeBfd*Zg G d+ d,eh Zi G d- d.eh Zjd/ Zkd0e
jl d1e^de(fd2Zmde`fd3Znd4e]d5eoddfd6Zp e:ejekeY7 d4e]de`fd8 Zqi d9d4e]d:e_fd;Zr e:ejekeY7 d4e]d<e_d:e_deOfd= Zsed>d?d4e]d:e_fd@ ZtdAe(fdBZud5eodCe^deOfdDZv e:ejekeYevE d>ddFd4e]dGe
jl dHe^de]fdI Zw edJd4dKg ZxdLe'de-ex fdMZydN ZzeVfdOe jK dPe jK ddfdQZ{ G dR dS Z|dYdTZ}e|j~ Ze|j Z dZdVe,e] ddfdWZdX ZdS )[aP Utilities for managing local file storage synchronised with a remote
server.
Files are divided into types: signatures, modsecurity bundles, ip white
lists, etc. Each type is represented by an Index instance.
Index has a local subdirectory and a description that contains its
files' metadata used to decide if the update is necessary.
N) defaultdict
namedtuple) ExitStacksuppresscontextmanager)
formatdateparsedate_to_datetime)GzipFile)chain) getLogger)Version) AnyBinaryIODictIterableListOptionalSetTupleUnion)urlparse)config)
LicenseCLN)PanelException) file_hashretry_onrun_with_umask)
rate_limitHOUR) to_thread) UrlTransport RandomIpChooserWithIPv6Toggle)safe_extractall ) default_hookz /var/imunify360/.ipv6_disabledz(/proc/sys/net/ipv6/conf/all/disable_ipv6z(/sys/module/{mod}/parameters/{parameter}returnc t dd } t | 5 }| dk r ddd dS ddd n # 1 swxY w Y n# t
$ r Y dS w xY w t t 5 }| dk r ddd dS ddd n # 1 swxY w Y n# t
$ r Y nw xY wdS ) zCheck whether IPv6 is disabled at the kernel level.
Reads the module parameter and the runtime sysctl without
depending on the im360 package.
ipv6disable)mod parameter0NT1F)
_MOD_PAR_PATHformatopenreadstripOSError_SYSCTL_DISABLE_IPV6)
param_filefs S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/files/__init__.py_is_kernel_ipv6_disabledr8 D s %%&I%FFJ
*
vvxx~~ 3&& & tt
&
'
' 1vvxx~~ 3&& &
5sv A? ,A3 A? ' A? 3A77A? :A7;A? ?
B
B
C7 %,C+ C7 C7 +C//C7 2C/3C7 7
DDeulasigszrealtime-av-confzwp-rulesgeoz/var/imunify360/filesz$https://files.imunify360.com/static/i
g? _IP_CHOOSER
_TRANSPORTc P t pt S )zCheck if IPv6 should be disabled at startup.
True when either the kernel has disabled IPv6 or a previous agent
run persisted the disabled state after a runtime network failure.
)r8 _IPV6_DISABLED_STATEexists r7 _should_disable_ipv6rD ~ s" $ % % F)=)D)D)F)FFrC c t dS # t $ r t dd Y dS w xY w)z:Persist IPv6 disabled state so it survives agent restarts.z%Could not persist IPv6 disabled stateT)exc_infoN)r@ touchr3 loggerdebugrB rC r7 _persist_ipv6_disabledrJ s_ M ""$$$$$ M M M <t LLLLLLMs &AAc t ;t } t | a | st d t S )N ipv6_enabledz9IPv6 disabled at startup (kernel flag or persisted state))r= rD r" rH inforL s r7 _get_ip_chooserrO sO /111 3 NNN KKK
rC c V t t t a t S )N)
ip_chooser)r> r! rO rB rC r7 _get_transportrR s$ !_->->???
rC c e Zd ZdZdS )IntegrityErrorzERaised when on disk content does not match hashes in description.jsonN__name__
__module__ __qualname____doc__rB rC r7 rT rT s OOOOrC rT c e Zd ZdZdS ) UpdateErrora
Raised on other errors during files update.
Possible reasons are:
* server returns non 200 status;
* hash mismatched between downloaded content and description.json;
* urllib errors;
* JSON decoding errors;
* errors while writing to disk.
NrU rB rC r7 r[ r[ s rC r[ c K t d | | t j t j d|z t z d {V d S )Nz2Files update failed with error: {err}, try: {try_})errtry_r$ )rH warningr/ asynciosleeprandom randrange_TIMEOUT_MULTIPLICATORexcis r7 _log_failed_updaterh sy
NN<CC! D
-(a003II
J
JJJJJJJJJJrC pathmodec t d 5 t j | t j t j z t j z | }ddd n # 1 swxY w Y t j |d S )zbOpen file at `path` using permission `mode` for writing in binary mode
and return file object.r Nwb)r osr0 O_WRONLYO_CREATO_TRUNCfdopen)ri rj fds r7 _open_with_moders s
H H
WT2;3bj@$
G
GH H H H H H H H H H H H H H H
9R s ;AA Ac t | | 5 }t j t j |d |d d cd d d S # 1 swxY w Y d S )Ntimeoutfileheaderszutf-8)encoding)
_fetch_urljsonloadio
TextIOWrapperget_content_charset)urlrv responses r7 _fetch_json_syncr s C ) ) )
Xy !),@@II
s AA&&A*-A*r rf c t }| rg| rUt d| | | | t d S d S d S )Nz>Network error for %s via IPv6 IP %r, disabling IPv6. Error: %r)rO is_ipv6_enabledlast_ip_was_ipv6rH r_ last_ip disable_ipv6rJ )r rf choosers r7 _disable_ipv6_on_network_errorr s G !W%=%=%?%? ! L OO
! ! ! !rC )on_error max_triesc Z K t j } | dt | | d{V S # t t
j f$ r(}t d || d}~wt j
$ r7}t | | t d | d}~wt $ r7}t | | t d | d}~wt $ r}t d| d| d}~wt j j t" j j f$ r8}t | | t d | | d}~wt( $ r*}t | | t d| d | d}~ww xY w)
zDownload and decode JSON from *url*.
Return decoded JSON. Raise UpdateError:
* HTTP response status code is not 200;
* Unicode or JSON decoding fails;
* on time outs during HTTP request;
* on other HTTP errors.
Nz!json decode error [{}] for url {}request to {} timed outrequest to {} reset%eof error while updating files, url: , err: 8urllib/http error while updating files, url: {}, err: {} Can't fetch
, reason: )r` get_event_looprun_in_executorr UnicodeDecodeErrorr{ JSONDecodeErrorr[ r/ socketrv r ConnectionResetErrorEOFErrorhttpclient
HTTPExceptionurlliberrorURLErrorr3 )r rv loopes r7 _fetch_jsonr s ! # #D=))$0@#wOOOOOOOOO 4 5 N N N=DDQLLMMM > A A A&sA...3::3??@@@ = = =&sA.../66s;;<<<
CC C C C C
K %v|'< =
&sA... F M MQ
= = =&sA...;;;;;<<<=sQ ": F*#A33F*2B77
F*2C66
F*D(F* 3E33
F* %F%%F*rx rv c
t j | dt j pdi|d }t || 5 }|j |j fcddd S # 1 swxY w Y dS )z>Perform HEAD http request to *url* with *timeout* & *headers*.Imunify-Server-Id HEAD)rx methodru N) r requestRequestr
get_server_idrR r0 coderx )r rv rx reqrs r7 _perform_http_head_syncr s .
!9!;!;!Ar
! C
sG 4 4 !vqy ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !s A88A<?A<
current_mtimec K |t u rdS t |d } t t | |d|i d{V \ }}|dk rt d|d| t t 5 t |d }||k r$t
d
||d || ddd n # 1 swxY w Y dS # t j $ r7}t | | t d | d}~wt $ r7}t | | t d | d}~wt j j t& j j f$ rY}t- |d
r|j dk rY d}~dS t | | t d | | d}~ww xY w)zCheck if we need to download description.json file:
- perform HEAD request if local file exists and older return True
otherwise return False
T)usegmtzIf-Modified-Sincer N zUnexpected http code z for z
Last-Modifieda Got code %r, but last modification date %s is earlier than or equal to the date provided in the If-Modified-Since header, the origin server SHOULD generate a 304 (Not Modified) response [rfc7232]. Here's curl cmd:
curl -s -I -w '%%{http_code}' -H 'If-Modified-Since: %s' '%s'r r r i0 Fr )_NEVERr r r r[ r Exceptionr timestamprH r_ r rv r r/ r r r r r r r hasattrr )r r rv formatted_mtimer rx
last_mtimer s r7 _need_to_downloadr s t t<<<O- ' # (/:
g, 3;; :::S::
i
.( ikk
]**4 O,# $ tM > A A A&sA...3::3??@@@ = = =&sA.../66s;;<<< K %v|'< =
1f !&C--55555&sA... F M MQ
sH #C 2ACCC G ,2D
G +2E (G G&3GG T)compressc # K i }|||d< dt j pdi}|r| ddi t j | | } t
j |fi |5 }t 5 }|j
d dk }|rl|sj|j
d d
k rLt d |j
d |j
| |r#| t | n||j d
V ddd n # 1 swxY w Y ddd dS # 1 swxY w Y dS )zs
Fetch *url* as binary file.
If *compress* is true, ungzipping is done automatically
if necessary.
Nrv r r zAccept-Encodinggzipr Content-Encodingz Content-Typezapplication/zipzRequested gzip but got Content-Encoding=%r. Read response as is [identity]. Headers: %s, as curl cmd:
curl -Is -H 'Accept-Encoding: gzip' '%s')fileobj)rw rx )r r updater r r rR r0 r rx getrH rN items
enter_contextr
) r rv r
parameters req_headersr r stackgzippeds r7 rz rz Q s7 J '
9 &
(@(B(B(HbIK 8 -v6777
.
k
:
:C
9;;
"'"&&'9::fD $$^448III KKJ $$%788 &&((
##HX$>$>$>??? '
%
s7 7E(B>E E(E E(E E((E,/E, dest_filec 0 t j }| }t | || 5 }|d t
x}rL| | | | |d t
x}Lddd n # 1 swxY w Y |d d dk s| |z
} |d dd }
|
Nt |
} | | k r9t j d
| | | z
d
| } | | |k rt d | d | d
| | S )z
Fetch *url* to *dest_file* and return its md5sum.
Raise *urllib.error.ContentTooShortError* if the downloaded file
has unexpected length.
)rv r rw Nrx r r zContent-Lengthz&{got} bytes read, {diff} more expected)gotdiff)messagecontentzcontent fetched from z does not match hash: expected=z, got=)hashlibmd5tellrz r1 _BUFSIZEr writer intr r ContentTooShortErrorr/ hexdigestr[ )
r r rv r md5sumr initial_file_offsetr chunk file_lengthcontent_length_headerexpected_file_length
got_md5sums
r7 _fetch_n_md5sum_urlr ~ s +--C#..** C8 < < < # ',,X666e # JJu OOE " " " ',,X666e ## # # # # # # # # # # # # # # I " "#5 6 6& @ @ nn&&)<< !) 3 7 78H$ O O ,#&'<#=#= #{22 l77 D K K ' 1K ? L ! 8 J
jF 2 2
4C
4
4
4
4'1
4
4
s A/B55B9<B9rg c ( K dt | vS )NzHTTP Error 404)strre s r7 $_fetch_and_save_should_retry_handlerr s 3s88 ++rC )r r should_retryr r dest_path dest_modec 0 K t || 5 }t t | |||| d{V cddd S # 1 swxY w Y dS # t j $ r7}t | | t
d | d}~wt $ r7}t | | t
d | d}~wt $ r*}t | | t
d| d| d}~wt j j t j j f$ r8}t | | t
d | | d}~wt $ r-}t | | t
d| d | d
| d}~ww xY w) zFetch bytes from `url`, save them to `dest_path`,
and return md5 checksum of downloaded content.
Raise UpdateError:
* HTTP response status code is not 200;
* on time outs during HTTP request;
* on other HTTP errors.
r Nr r r r r r z to r )rs r r r rv r r[ r/ r r r r r r r r r3 )r r rv r r r r r s r7 _fetch_and_saver sT 0 L
Y
2
2 i"#!
> A A A&sA...3::3??@@@ = = =&sA.../66s;;<<<
&sA... CC C C C C
K %v|'< =
&sA... F M MQ
L L L&sA...JJJ)JJqJJKKKLsi A A A AA A A F 2B
F 2C
F%D (F(3E
F((FF_Itemr datac & d | d D S )z,Return a set of _Item for easy manipulation.c F h | ] }t |d |d S )r r )r ).0items r7 <setcomp>z_items.<locals>.<setcomp> s* I I I4E$u+tH~ . . I I IrC r rB )r s r7 _itemsr s I I4= I I IIrC c d } || | t j | D ]d\ }}}|D ],} |t j || | -|D ],} |t j || | -edS )zCheck and change file/dir modes recursively.
Starting at dirname, change all inner directory permissions to dir_perm,
file permissions to file_perm
c t j | j dz }||k rmt j | sPt
d| t | t | t j | | d S d S d S # t $ r t
d| Y d S w xY w)Ni zGFixing wrong permission to file/dir %s [%s] expected [%s] (not symlink)z&Failed to change permission to file %s) rm lstatst_moderi islinkrH r_ octchmodPermissionErrorr )
file_dir_path
permission current_modes r7 _os_chmodz"check_mode_dirs.<locals>._os_chmod s 8M22:UBLz))"'.. 3 3) ;! %%
OO
33333 *))) LL8-
s B
B %B>=B>N)rm walkri join) dirnamedir_perm file_permr ri dirsfiles directorynames r7 check_mode_dirsr s & Igx WW - - ; ;dE ? ?I Ibgll433X > > > > ; ;D Ibgll4.. : : : : ;; ;rC description_path
files_pathc || j v sJ | j }|}||k rR| r/| d | dd dS |j }||k PdS dS )aP
Try to fix the structure of /var/imunify360/files/ when
NotADirectoryError happens.
It indicates that some part in the path is a file:
/var/imunify360/files/sigs <- is a file
=> open("/var/imunify360/files/sigs/v1/description.json") will fail.
We try to rectify it by deleting the file but up to FILES_DIR.
T)
missing_ok)parentsexist_okN)r
parentis_fileunlinkmkdir)r r _dir topmost_dirs r7 _fix_directory_structurer s )1 1 1 1 1 "DK
*
<<>> KK4K ( ( ( dT : : : E{ *
rC c e Zd Z eej Z ee Zi Z i Z
e Z e Z i Z
dZ edez ej ZdDdZd Zd Zdej d d
fd Zdej fd Zd
Ze dddde de de de de de d d
fd Z e d e fd Z!e d e"e fd Z#e de d e fd Z$dEd e fdZ%d e fdZ&d e"e fd Z'e d Z(d e)e fd Z*d Z+e,fd e-fd Z.d e fd!Z/d"e-d e fd#Z0dEd$Z1de2j3 d%e"e4 d d
fd&Z5d'e"e4 d e6e"e4 e"e f fd(Z7e de d e fd) Z8e de d e fd* Z9e:dEd+ Z;e:d,e2j3 d e2j3 fd- Z<d e fd.Z=dEd/e d0e d d
fd1Z>d e?e@e?e e e z f f fd2ZAd eBe fd3ZCdFd4ZDd5e2j3 d,e2j3 d eEe2j3 fd6ZFd e fd7ZGe:d8ej d9ej d:e"e d d
fd; ZHd<e d e fd=ZIdFd>ZJdFd?ZKdEdFd@ZLe dGdAeEe d d
fdB ZMe de d d
fdC ZNd
S )HIndexz/static )periodTc X || j vrt d| d| j || _ d| _ dg i| _ | } t
| 5 }t j | | _ ddd n # 1 swxY w Y n# t $ rE t d| t t j | t Y nTt t" t j f$ r6}|r#t' d | |d| _ Y d}~nd}~ww xY w|rX| }t- | r5t' d d
| | j s| dS dS ) z
:param bool integrity_check: check if last update
did not break anything (by interrupting it in the middle or
another programmatic error)
:raise IntegrityError:
z*Trying to initiate unregistered file type z. Allowed types Fr Nz Path %s has a file in parentsz cannot read description file {}Tz'some files are missing or corrupted: {}z, )_TYPES
ValueErrortype _is_blank_json_descriptionfile_pathr0 r{ r| NotADirectoryErrorr _throttled_log_errorr pathlibPath FILES_DIRFileNotFoundErrorr r rT r/ _corrupted_fileslenr r )selftype_integrity_checkri r6 r bad_filess r7 __init__zIndex.__init__1 s) # # (U ( ( +( (
r]
))++ "d
*q !Yq\\
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*! D D D & &'F M M M $W\$%7%7 C C C C C
" " "
$5<<TBB "DNNNNNN " --//I9~~
$=DD ),,
~ # " " " " " # #sC B B9 B B B B
B A D0 D0:,D++D0c | j |j k o/| j |j k o | j |j k o| j |j k S N) __class__r r r )r& others r7 __eq__z Index.__eq__\ sH Neo -
* UZ'
*%/1
*
ek)
rC c d| j j d| j d| j dt | d S )N<z(type_=z ) is_blank=z , json={<z item(s)>}>)r- rV r r r% r r& s r7 __repr__zIndex.__repr__d s\
'
4::<<((
rC r r& Nc t d| j | | | } || j d dS )zjWhether *files_path* dir may be used for this type's file group.
:raises: IntegrityError
zValidating [%s]: %sTr( N)rH rN r _make_file_groupr& r FileGroups r7 validatezIndex.validatel sT
)49jAAA))
$)T222222rC c 6 G fdd j }|S )zV
Return FileGroup class: Index class with local path == *files_path*.
c 6 e Zd Zededef fd ZdS ))Index._make_file_group.<locals>.FileGroupr' r& c F |j k sJ t j S z+Return local base path for given file type.)r rm fspath)clsr' r r& s r7 r z4Index._make_file_group.<locals>.FileGroup.files_path~ s( ))))y,,,rC N)rV rW rX classmethodr r )r r& s r7 r8 r< } sP
-s
-s
-
-
-
-
-
- [
-
-
-rC r8 )r- r7 s `` r7 r6 zIndex._make_file_groupx sG
- - - - - - - - - - - rC c . t j | j }t t j t j t t j | j t j
|d |d d S )Ndirrw ) r _PERMSr r rm ri normpathr r" _PATHSpardir)r& permss r7 r zIndex.check_mode_dirs sq TY' G Y TY(?KK
%L &M
rC Fall_zip essentialr'
relative_pathr r rJ rK c | j | |r| j | || j |< ||d| j |< || j |< dS )a Add a type to known file types.
* relative_path is a relative path to all files for that type.
* dir_perm is permission mask used to create directories.
* file_perm is permission mask used to create files.
* all_zip is a flag which shows whether that type of files can
be downloaded in all.zip archive. all.zip is expected to be on
the server.
* essential is whether the agent can start if there are errors
updating that type.
)rC rw N)r add_ESSENTIAL_TYPESrF rD _ALL_ZIP_SUPPORT)r@ r' rL r r rJ rK s r7 add_typezIndex.add_type sj ,
u , $ $U + + + )
5$,i @ @
5&- U###rC c B K t d | j D S )zuWhether essential files exist.
Note: the files may be corrupted (integrity check is not performed).
c 3 D K | ]}t |d j V dS )Fr5 N)r r )r r' s r7 <genexpr>z.Index.essential_files_exist.<locals>.<genexpr> sI
eU333= =
rC )allrO r@ s r7 essential_files_existzIndex.essential_files_exist s9
-
rC c 4 | j S )z&Return a set of all known files types.)r copyrV s r7 typesz Index.types s z rC c b t j t | j | S r> )rm ri r r" rF r@ r' s r7 r zIndex.files_path s! w||Isz%'8999rC c
|rJ| j t j j v r2t j | d S t j | | j d S )z9Return local path for description.json for current index.description.json) r r FilesUpdateDISABLEDrm ri r _descriptionfile_path_latestr )r& latests r7 r zIndex._descriptionfile_path sm di6#5#>>>7<<11335G
w||DOODI 6 68JKKKrC c r d | D d }|S )Nc . g | ]}|d
|d S )rb rC rB )r xs r7
<listcomp>z6Index._descriptionfile_path_latest.<locals>.<listcomp> s% JJJAakJqxJJJrC r ) _get_listvalues)r& ltss r7 ra z"Index._descriptionfile_path_latest s5 JJ !1!1!8!8!:!:JJJ1M
rC c R t }t | j D ]}| |j } t |t j t }n%# t $ r |
| Y _w xY w||j k r|
| |S )z9Return a set of file paths that are missing or corrupted.) setr r
localfilepathr r r r r r# rN r )r& r) r ri actuals r7 r$ zIndex._corrupted_files s EE 4:&& $ $D%%dh//D
"4h??$
d###
$$
d###s A!! BBc | j | S )z`
usage example:
>> async with Index.locked(WHITELISTS):
...
)_lockr\ s r7 lockedz Index.locked s y rC c D fdt j D S )z(Return iterable over all files in index.c 3 L K | ] } |j V d S r, rl r r r r& s r7 rT z Index.files.<locals>.<genexpr> s3 LL""48,,LLLLLLrC )r r r2 s `r7 r z Index.files s' LLLL
9K9KLLLLrC c | j d S )z+Return 'items' field from JSON description.r )r r2 s r7 r z Index.items s z'""rC c t j | d j S # t $ r |cY S w xY w)zBReturn mtime of description file if it exists, otherwise -math.infTrb )rm statr st_mtimer3 )r& defaults r7 _descriptionfile_mtimez Index._descriptionfile_mtime sO 7455T5BBCCL L NNN s ,/ >>c | }|sdS |t j j z t j k S )z4Return True if last update was too late in the past.T)r{ r r_ PERIODtime)r& _desc_mtimes r7 _is_outdatedzIndex._is_outdated s< 1133 4V / 66DDrC rv c K | j pyt | dk pT| o@t | | j | | d{V S )z>Return True if update from server is needed for current index.r N)r r% r$ r r _descriptionfile_urlr r{ )r& rv s r7 is_update_neededzIndex.is_update_needed s
N
4((**++a/
!!## +--di88//11
rC c t d 5 t j ||| ddd dS # 1 swxY w Y dS # t $ r"}t t | |d}~ww xY w)z)Create local directory for current index.r )rj r N)r rm makedirsr3 r[ r )r& r dir_moder r s r7 _makedirszIndex._makedirs s - ""
G
G G(XFFFF
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G - - - c!ff%%1 , -s2 A 6 A :A :A
A/
A**A/ to_updatec K | | } || j d }|j |j d }|j |j d }|D ]}| |j } t
j | }
t
j |
s| |
|d t |j | |||j d{V dS )zX
Fetch files from *to_update* set, verify hashes, save to *files_path*.
Fr5 rC rw r )r r N) r6 r rD rl r rm ri r isdirr r r ) r& r r rv r8 fgr file_moder filenamer s r7
_update_fileszIndex._update_files s ))
Yty%
8
8
89RW%e,Ibg&v. D''11Hgooh//G7==))
Bw5AAA!#{
rC remote_itemsc t j } fd|D } fd|D }||z
} fd|D }||z
}||fS )zFigure out what should be updated based on current items,
file system state and remote items.
Return tuple of files to fetch and files to delete.
Files to fetch is a set of _Item.
Files to delete is a set of file paths.c D h | ] } |j S rB rs rt s r7 r z+Index._calculate_changes.<locals>.<setcomp>7 s) LLLt))$(33LLLrC c D h | ] } |j S rB rs rt s r7 r z+Index._calculate_changes.<locals>.<setcomp>8 s) NNN**4844NNNrC c L h | ] } |j v |!S rB rs )r r r) r& s r7 r z+Index._calculate_changes.<locals>.<setcomp>< s>
!!$(++9<<
<<<rC )r r r$ ) r& r local_items local_files remote_files to_remove local_setr r) s ` @r7 _calculate_changeszIndex._calculate_changes- s TZ(( LLLL LLL NNNN NNN ,. ))++
#
!9, )##rC c N d t | j | S )z'Return remote path for description.jsonz{}{}/description.jsonr/ BASE_URLrF r\ s r7 r zIndex._descriptionfile_urlD s! '--h
58IJJJrC c N d t | j | S )z Return remote path for all.zipz {}{}/all.zipr r\ s r7 _all_zip_urlzIndex._all_zip_urlI s! $$Xsz%/@AAArC c t j | n@# t $ r3}t d|t | Y d }~nd }~ww xY w|r3t d| t j | d d S d S )Nzfailed to remove %s: %sz'Removing old path on all.zip update: %sT
ignore_errors) rm r r3 rH r_ r rN shutilrmtree)r all_zip_localpath remove_filesr s r7 _all_zip_cleanupzIndex._all_zip_cleanupN s I' ( ( ( ( NN)+<c!ff
: KKA: N N N M*D 9 9 9 9 9 9 : :s
A)AA live_pathc t j d }| | j |z S )zGenerate new base local path for *live_path* files.
It should be on the same filesystem partition as
*live_path* so that the rename would be atomic.
z_%Y-%m-%dT%H%M%S.%fZ)DTdatetimeutcnowstrftime with_namer )r
new_suffixs r7 _generate_new_pathzIndex._generate_new_pathZ sA [''))223IJJ
""9>J#>???rC c K t j | | j }t | }| |j dz }| j | j d }| j | j d }| | j }t 5 }| ||d | t j
||d t ||||d d {V } t j |d
5 }
t# |
| d d d n # 1 swxY w Y t% j | D ]v\ } } }
| D ]5}t% j t$ j | | | 6|
D ]5}t% j t$ j | | | 6w| | | || }nX# t2 t4 t6 t8 t j t j f$ r"}t? tA | |d }~ww xY w|! d d d n # 1 swxY w Y t
||tE | | j tF j$ j% vS ) a
Update current type of files using all.zip archive. Directory with
current type of files will be cleared and replaced with all.zip
contents. all.zip is expected to be on the server
Return whether updated.
:param timeout:
:raise UpdateError: if OSError or http error or
integrity check error (got wrong data from
the server)
all.ziprw rC Fr T)r )r r Nr )&r r! r r r r r r rD r r r callbackr r zipfileZipFile_safe_extractallrm r r ri r r9 _replace_live_with_new_dirr rT r3 r
BadZipfile LargeZipFiler[ r pop_allboolr r_ r` )r& rv r new_path archive_pathr r all_zip_urlrollback_stack_archiveroot directories filenamesr r old_pathr s r7 _run_update_all_zipzIndex._run_update_all_zipe sT L !;!;<< ++I66 ))(-)*CDD K *62 ;ty)%0'' 22
[[ 1 %N NN8XN > > > # #& !
$
& # A
1 _\377 87$Wh7778 8 8 8 8 8 8 8 8 8 8 8 8 8 8
57GH4E4E J J0D+y%0 J J dI!>!>IIII$- J J dH!=!=yIIIIJ
h''' ::8YOO "$
1
1
1 "#a&&))q0
1
" " $ $ $c1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 %h lh
y 2 ;;;s\ >AJH *E; H E H E B9H J 3I < II JJJversionforcec K t j | | j }| st d| j d| |dk rY| }d | D d }t d| j | |
d } t |d z
t | k r |st d
| d | j n(# t $ r t d| j d | w xY w|j D ]}| s| rt |d z
t | k rh| |j d
z }| |d | | | d d{V dS t d
|d| j )a Update to the version specified in *version*.
:param version: version to update to
:raise UpdateError: if OSError or http error or
integrity check error (got wrong data from
the server)
zCannot update z , because it is not a symlink: rb c ( g | ]\ }}|d
|S rw rB )r verprops r7 rf z#Index.update_to.<locals>.<listcomp> s5 !Th rC r z%Try to update to latest version %s %sFstrictVERSIONzVersion z is already set for z5, because current version doesn't have VERSION file: liveTtarget_is_directory
is_updatedNz not found in )r r! r r
is_symlinkr[ rg r rH rN resolver
read_textr2 r# r iterdiris_dirr r
symlink_torename
_run_hooks)r& r r r versions current_pathri
new_live_paths r7 update_tozIndex.update_to s L !;!;<< ##%% +999ii)
h ~~''H %-^^%5%5 G
KK7G
!(((66
1<<>>DDFFGG7##$ $ $ "GwGGDIGG ! +'+yyy,,@
$,,.. D??$$
D9 ,7799??AABBgG G %)NN49v3E$F$FM!,,Tt,LLL!((333 //T/:::::::::FFk'''499MNNNs
A#D7 7%E c t j | | j }| si S | d }i }t
d }|j D ]}| r| |k rd}nd}|dz x} rqd } |
}t
| } |dt | d|| < | |k r| }# t $ r t d|| Y w xY w|t
d k r d|| d< |S ) NFr r, Tr )currentrb rC z Version file %s is not valid: %srb )r r! r r r r r
r r rA r r r rH r )
r& r r result max_versionri r version_filer _vers
r7 rg zIndex._get_list s L !;!;<< ##%% I (((66 cll $,,.. D
||~~ -- $y 00 88::
* 4 4 6 6G"7++D#*"' "4yy$ $F4L
k))&* ! LL:$
H
& % %,0F; )
s AD&D>=D>c g }t | d D ]4\ }}|d rdn |d rdnd}| | | 5|S )z/Return list of versions available in the index.c | d S )Nr rB )re s r7 <lambda>z Index.get_list.<locals>.<lambda> s
AaD rC )keyr z
(current)rb z (latest)r )sortedrg r append)r& r r r markers r7 get_listzIndex.get_list s # NN " " $ $..
0
0MGT
? >[[
MMW.f.. / / / /
rC c t j | | j }| sdS | d }|j D ]}t j
t j j t j
| j t j j z
j }| rf| sR||k rL|t$ j j k r7t* d| j | t/ j |d dS )z~Remove old versions of files.
This is done by removing old directories in the path, that older than 30 days.
NFr z Removing old version of %s: %sTr )r r! r r r r r r r r nowtimezoneutc
fromtimestamprx ry daysr r r_ DAYS_TO_KEEPrH rN r r )r& r r ri days_olds r7 _clean_old_versionszIndex._clean_old_versions s6 L !;!;<< ##%% F (((66 $,,.. 8 8D 00+++IIKK("+/
8 ))
8 L(( 2 ??? <diNNN
d$7777 8 8rC r c | j t j j v r7| t
d| j | dS | |j dz }d}t 5 }|
|d | |j |
r| d nd}t d D ]} | | n# t" $ r |r |
sj| |j d z }t
d
||| | | | |j | Y w xY w|t' j |d | ddd n # 1 swxY w Y |S ) zbReplace *live_path* with *new_path*.
Return *old_path*
:raises: OSError
zFSkipping update for %s, because it is disabled. New files stored in %sNr Tr Fr z .live-movedz1Moving %s [live] to %s, to rename %s to it [live]r )r r r_ r` r rH rN r r r r r r r r ranger IsADirectoryErrorreplacer r r )r& r r r
moved_pathr r lasts r7 r z Index._replace_live_with_new_dir: s^ 9*3 3 3 $ $ & & & KK
4 **8=6+ABB
[[ - %N $ $X4 $ H H H # #M$8 9 9 9 '')) !!!///
a
O
OO!((333E( O O O
%//11 O%2%<%< ) . >& &
9 % & ) "))*555 '//
0BINNN-O0 %
j====
" " $ $ $[- % - % - % - % - % - % - % - % - % - % - % - % - % - % - %^ s8 =A/G
-DG
B FG
F/G
GGc K j }t || d{V } t | \ }}|p|}|s6t
d j dS t j
j }| r| d nd}t | } t 5 }
| j j d d |
t& j | d |r| r|n|} | rAt | | | fd
|D d{V | || d{V t3 | d z j j d 5 } | t7 j | ddd n # 1 swxY w Y | | | }n6# t@ tB f$ r"}
tE tG |
|
d}
~
ww xY w|
$ ddd n # 1 swxY w Y |rE| r1t
d
| t' j |d j tJ j& j' vS )z
Run update, return whether updated.
:raise UpdateError: if OSError or http error or
integrity check error (got wrong data from
the server)
ru Nz updating %s: nothing to update.Fr rC r Tr c 3 L K | ] } |j V d S r, rs rt s r7 rT z$Index._run_update.<locals>.<genexpr> sD $ $9=**4844$ $ $ $ $ $rC r^ rw z,Removing old path on file by file update: %s)(r r r r r rH rN _touchr r! r r r r r r r rD r r r r _copytreeunionr rs r r{ dumpsencoder9 r rT r3 r[ r r r r_ r` )r& rv r as_jsonr r need_updater r r r from_pathrw r s ` r7 _run_updatezIndex._run_update s '' 22#C999999999 # 6 6vg G G 9 ,9 KK949 E E E KKMMM5 L !;!;<< 09/C/C/E/E OI U + + +4 ++I66 [[ * %N NN$+di07%
# #
xt
$
%I ):):I
!!
oo OO $ $ $ $AJ$ $ $ $$Xy'$JJ J J J J J J J
1$ 11K *62 = JJtz' 2 2 9 9 ; ;<<< = = = = = = = = = = = = = = =
h''' ::8YOO"G,
1
1
1!#a&&))q0
1
" " $ $ $U* % * % * % * % * % * % * % * % * % * % * % * % * % * % * %Z 8)) 8 KK>
M($ 7 7 7 7 y 2 ;;;s[ C K15)J :I$ J$I( (J+I( ,.JK1K, K KK11K58K5from_dirto_dir
ignored_pathsc ` K fd}t t j | |d|d d{V dS )z7Copy *from_dir* to *to_dir* except for *ignored_paths*.c t t j t sJ t fd|D S )z(Return names that should not be copied.c 3 ` K | ](}t j | v $|V )d S r, )rm ri r )r r r ri s r7 rT z8Index._copytree.<locals>.ignore_names.<locals>.<genexpr> sJ 7<<d++}<< <<<< rC )
isinstancerm r? r frozenset)ri namesr s ` r7 ignore_namesz%Index._copytree.<locals>.ignore_names s_ bioos33 3 33 !
rC T)symlinksignore
dirs_exist_okN)r r copytree)r
r r r s ` r7 r zIndex._copytree su O
rC r c t j t | j | j }| j | j }t j | t j | j v s J d
|| t j || }t j | | j | S )z.Return a local file path corresponding to URL.z$url ({}) does not fit file path ({}))
rm ri relpathr _URL_PATH_PREFIXrF r r r! r
r/ r r )r& r url_relpath type_pathrL s r7 rl zIndex.localfilepath s goo SMM 5
K * L # #w|K'@'@'H H H H 1 8 8i H H
I H H Y??
w||DOODI 6 6
FFFrC c | d }t j | rt j | dS dS # t
$ r2}t t | Y d}~dS d}~ww xY w)z5Update mtime of description.json file so it is fresh.Trw N) r rm ri isfileutimer3 rH r_ r )r& ri r s r7 r z Index._touch s #--T-::Dw~~d##
# # # NN3q66 " " " " " " " " " #s A A
B 'BB c K t | j | j t g D ]}} || | d {V # t t
f$ r&}t d|| Y d }~Hd }~wt $ r&}t d|| Y d }~vd }~ww xY wt
d| j d| z d S )Nzhook %s error: %sz%s files update finished%sz (not updated)) r _HOOKSr r% rT r rH r r exceptionrN )r& r hookr s r7 r zIndex._run_hooks s $+di0<.AA ? ?D
?d4,,,,,,,,,,"N3
;
;
; 0$::::::::
?
?
? !4dA>>>>>>>>
? ( I J /
s! ?B$ A11
B$> B B$c $ K t j j }|sy| | d{V s^t d| j t t j j dz | d d{V dS | j
o| j | j }| }|rd}t d| j | t j
| t j j | d{V }|r!t d| j | nG# t j t" f$ r.}t d | j || d
}Y d}~nd}~ww xY w|rd }t d| j | t j
| t j j | d{V }|r!t d| j | nr# t j t" f$ rY}t d | j || | d d{V | j | j v r|Y d}~dS d}~ww xY w| |p| d{V dS ) a Run update for the current `type` of files.
Normally update is performed when either is true:
* index is never been fetched (description.json missing or broken);
* last update was performed longer than configured period of time ago;
* some local files are missing or have wrong content (md5 hash differs
from description.json).
If force is True then update is performed unconditionally.
Raises asyncio.TimeoutError, UpdateError.
Nz(%s was updated less than %s minutes ago.< Fr r zUpdating %s files via %szUpdated %s using %sz%s update error via %s: %sTzfile by file download)r r_ TIMEOUTr rH rN r r r} r r rP r` wait_forr SOCKET_TIMEOUT TimeoutErrorr[ r_ r rO )r& r rv rJ file_by_filelog_strupdatedr s r7 r z Index.update s $, 4#8#8#A#A A A A A A A KK: F&-344
//U/33 3 3 3 3 3 3 3 F.ET%:49%E"{ $ G KK2DIw G G G
$ ' 0,, *9 ! ! KKK 5ty'JJJ(+6
$
$
$0$)Wa $
$
-G KK2DIw G G G
' 0$$V%7%FGG! ! KKK 5ty'JJJ(+6
0$)Wa ooo7777777779 555GFFFFF
oo)9Eo:::::::::::s3 A D2 2E6$E11E6 A H I/AI**I/ only_typec K |rj | |d }| | 4 d{V | | d{V ddd d{V dS # 1 d{V swxY w Y dS |rt d | j D ]i} | |d }| | 4 d{V | | d{V ddd d{V n# 1 d{V swxY w Y jdS t d | j D ]i} | |d }| | 4 d{V | | d{V ddd d{V n# 1 d{V swxY w Y jdS )zkRun update for all registered `types` of files.
Raises asyncio.TimeoutError, UpdateError.
Fr5 NzUpdating essential fileszUpdating all files)rp r rH rN rO r )r@ r- r only_essentialindexr' s r7
update_allzIndex.update_allO ss .C 5999Ezz),,
*
*
*
*
*
*
*
*ll5)))))))))
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
. KK2 3 3 3 -
.
.E5999 ::e,, . . . . . . . . ,,u---------. . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
KK, - - -
.
.E5999 ::e,, . . . . . . . . ,,u---------. . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.s5 A
A&)A&< C**
C4 7C4 E77
F F c F | j | | dS )z:Add a hook for type_ to be called after successful update.N)r! rN )r@ r' r# s r7 add_hookzIndex.add_hookh s%
5 d#####rC )T)Fr& N)NFF)OrV rW rX r r` Lockro rk r! rF rD r rO rP r r r rH r r r* r/ r3 rm PathLiker9 r6 r rA r r r rQ rW r rZ r r ra r$ rp r r r r floatr{ r r r r r! r r r r r r staticmethodr r r r r r
rg r r r r r r r rl r r r r1 r3 rB rC r7 r r $ s
K % %E
[
F
F
F
SUUFsuu 6::QX666v|DD)# )# )# )#V
32;
34
3
3
3
3 2;
. . .. . .
. . .
. . . [.8
D
[
!c#h ! ! ! [! :s :s : : : [:L LS L L L Lc #c( [ Mx} M M M M# # # .4 Ed E E E E
e
- - - -!,36u:
2$ J$ s5z3s8# $$ $ $ $. K K K K K [K B B B B B [B : : : \ : @gl @w| @ @ @ \@O<D O< O< O< O<b1O 1Os 1O4 1OD 1O 1O 1O 1Of%4c4#:o)> >? % % % %N$s) 8 8 8 84C C18 C ', C C C CJN<D N< N< N< N<`
+
'){
CFs8
\
. G G G G G G# # # #
B; B; B; B; B;H JO. .
.
. . . [.0 $S $4 $ $ $ [$ $ $rC r c r t t dddd t t dddd t t d
ddd t t
d ddd d t t d
ddd d dS )z Register required file types.zeula/v1i i F)rJ zsigs/v1i i Tzrealtime-av-conf/v1z wp-rules/v1rI zgeo/v1N)r rQ EULASIGSREALTIME_AV_CONFWP_RULESGEOrB rC r7 configurer? n s NN4E5%N@@@ NN4E5$N??? NN
NN
NN3%NNNNNNrC Fr- c K t | | d{V S # t j t f$ r'}t
d| | Y d}~dS d}~ww xY w)z.Run files.update and log Update/TimeoutErrors.Nz*Failed to update files [%s] with error: %s)r r1 r` r) r[ rH r_ )r- r r] s r7 update_and_log_errorrA s
%%i777777777 + .
8)S
s % A" A A"c N K t d d{V S # t j t f$ ri} t d{V r t d| n#t | t j rt | Y d} ~ dS d} ~ ww xY w)z6Update all files. Don't fail if essential files exist.T)r/ Nz2Failed to update files [essential files exist]: %s) r r1 r` r) r[ rW rH r r )r] s r7 !update_all_no_fail_if_files_existrC s %%T%::::::::: + . ,,.. . . . . . . LLDc
#w 344
!s*
s % B$A B B$r4 )NF)rY r` r r r http.clientr r} r{ mathrm r rb r r r~ r urllib.errorr urllib.request collectionsr r
contextlibr r r email.utilsr r r r
itertoolsr loggingr packaging.versionr
typingr r r r r r r r r urllib.parser defence360agent.contractsr !defence360agent.contracts.licenser "defence360agent.subsys.panels.baser defence360agent.utilsr r r defence360agent.utils.commonr r defence360agent.utils.threadsr #defence360agent.utils.net_transportr! r" defence360agent.utils.zipsafer# r hooksr% rV rH r! r@ r4 r. r r8 r: r; r< r= r> r" r r _MAX_TRIES_FOR_DOWNLOADrd infr r r r7 JSONTyper= __annotations__r> rD rJ rO rR RuntimeErrorrT r[ rh r6 rs r r r r r r rz r r r r r r r r r? r1 r rW rA rC rB rC r7 <module>r^ s
/ / / / / / / / : : : : : : : : : : 9 9 9 9 9 9 9 9 % % % % % %
" ! ! ! ! ! - , , , , , 8 8 8 8 8 8 = = = = = = E E E E E E E E E E 9 9 9 9 9 9 9 9 3 3 3 3 3 3 N M M M M M 8 #w|$DEE A :
$ 4
% GL0 1 1 1 ( c5$d38nd3iG H 8< X3
4 ; ; ;%)
H\ " ) ) )Gd G G G GM M M M 6 P P P P P\ P P P
,
K K K "+ S X
h
!
!)
!
!
!
!
!
,8O "=3 "=H "= "= "= "=L *,
!
!
!
!
!
!
!
!
,8O 7 7 "7-27 7 7 7 7t 59 )
)
)
C )
U )
)
)
)
X& & & & &R,I ,# ,$ , , , ,
%5 0L 0L 0L 0L{0L
0L 0L 0L 0L
0Lf
7UH -..J JU J J J J
; ; ;F @I l07 ,G
$ G
$ G
$ G
$ G
$ G
$ G
$ G
$TO O O O,
3 ,1
}
rC defence360agent/files/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000222254 00000000000 020330 0 ustar
r_j
P U d Z ddlZddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZddlZddlZddlZddlmZmZ ddlmZmZmZ ddlm Z m Z ddl m Z ddl m!Z! ddl"m#Z# dd l$m%Z% dd
l&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/ dd l0m1Z1 dd l2m3Z3 dd
l4m5Z5 ddl6m7Z7 ddl8m9Z9m:Z:m;Z; ddl<m=Z=m>Z> ddl?m@Z@ ddlAmBZBmCZC ddlDmEZF ddlGmHZH e#eI ZJ e jK d ZLdZMdZNdeOfdZPdZQd ZRd ZSd ZTd ZU e jK d ZVd!ZWd"ZXd#ZYd$ZZ e j[ Z\e/e]e^e_eOde)e]e'f e+e' f Z`daae,eC ebd%< dace,eB ebd&< deOfd'ZddYd(ZedeCfd)ZfdeBfd*Zg G d+ d,eh Zi G d- d.eh Zjd/ Zkd0e
jl d1e^de(fd2Zmde`fd3Znd4e]d5eoddfd6Zp e:ejekeY7 d4e]de`fd8 Zqi d9d4e]d:e_fd;Zr e:ejekeY7 d4e]d<e_d:e_deOfd= Zsed>d?d4e]d:e_fd@ ZtdAe(fdBZud5eodCe^deOfdDZv e:ejekeYevE d>ddFd4e]dGe
jl dHe^de]fdI Zw edJd4dKg ZxdLe'de-ex fdMZydN ZzeVfdOe jK dPe jK ddfdQZ{ G dR dS Z|dYdTZ}e|j~ Ze|j Z dZdVe,e] ddfdWZdX ZdS )[aP Utilities for managing local file storage synchronised with a remote
server.
Files are divided into types: signatures, modsecurity bundles, ip white
lists, etc. Each type is represented by an Index instance.
Index has a local subdirectory and a description that contains its
files' metadata used to decide if the update is necessary.
N) defaultdict
namedtuple) ExitStacksuppresscontextmanager)
formatdateparsedate_to_datetime)GzipFile)chain) getLogger)Version) AnyBinaryIODictIterableListOptionalSetTupleUnion)urlparse)config)
LicenseCLN)PanelException) file_hashretry_onrun_with_umask)
rate_limitHOUR) to_thread) UrlTransport RandomIpChooserWithIPv6Toggle)safe_extractall ) default_hookz /var/imunify360/.ipv6_disabledz(/proc/sys/net/ipv6/conf/all/disable_ipv6z(/sys/module/{mod}/parameters/{parameter}returnc t dd } t | 5 }| dk r ddd dS ddd n # 1 swxY w Y n# t
$ r Y dS w xY w t t 5 }| dk r ddd dS ddd n # 1 swxY w Y n# t
$ r Y nw xY wdS ) zCheck whether IPv6 is disabled at the kernel level.
Reads the module parameter and the runtime sysctl without
depending on the im360 package.
ipv6disable)mod parameter0NT1F)
_MOD_PAR_PATHformatopenreadstripOSError_SYSCTL_DISABLE_IPV6)
param_filefs S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/files/__init__.py_is_kernel_ipv6_disabledr8 D s %%&I%FFJ
*
vvxx~~ 3&& & tt
&
'
' 1vvxx~~ 3&& &
5sv A? ,A3 A? ' A? 3A77A? :A7;A? ?
B
B
C7 %,C+ C7 C7 +C//C7 2C/3C7 7
DDeulasigszrealtime-av-confzwp-rulesgeoz/var/imunify360/filesz$https://files.imunify360.com/static/i
g? _IP_CHOOSER
_TRANSPORTc P t pt S )zCheck if IPv6 should be disabled at startup.
True when either the kernel has disabled IPv6 or a previous agent
run persisted the disabled state after a runtime network failure.
)r8 _IPV6_DISABLED_STATEexists r7 _should_disable_ipv6rD ~ s" $ % % F)=)D)D)F)FFrC c t dS # t $ r t dd Y dS w xY w)z:Persist IPv6 disabled state so it survives agent restarts.z%Could not persist IPv6 disabled stateT)exc_infoN)r@ touchr3 loggerdebugrB rC r7 _persist_ipv6_disabledrJ s_ M ""$$$$$ M M M <t LLLLLLMs &AAc t ;t } t | a | st d t S )N ipv6_enabledz9IPv6 disabled at startup (kernel flag or persisted state))r= rD r" rH inforL s r7 _get_ip_chooserrO sO /111 3 NNN KKK
rC c V t t t a t S )N)
ip_chooser)r> r! rO rB rC r7 _get_transportrR s$ !_->->???
rC c e Zd ZdZdS )IntegrityErrorzERaised when on disk content does not match hashes in description.jsonN__name__
__module__ __qualname____doc__rB rC r7 rT rT s OOOOrC rT c e Zd ZdZdS ) UpdateErrora
Raised on other errors during files update.
Possible reasons are:
* server returns non 200 status;
* hash mismatched between downloaded content and description.json;
* urllib errors;
* JSON decoding errors;
* errors while writing to disk.
NrU rB rC r7 r[ r[ s rC r[ c K t d | | t j t j d|z t z d {V d S )Nz2Files update failed with error: {err}, try: {try_})errtry_r$ )rH warningr/ asynciosleeprandom randrange_TIMEOUT_MULTIPLICATORexcis r7 _log_failed_updaterh sy
NN<CC! D
-(a003II
J
JJJJJJJJJJrC pathmodec t d 5 t j | t j t j z t j z | }ddd n # 1 swxY w Y t j |d S )zbOpen file at `path` using permission `mode` for writing in binary mode
and return file object.r Nwb)r osr0 O_WRONLYO_CREATO_TRUNCfdopen)ri rj fds r7 _open_with_moders s
H H
WT2;3bj@$
G
GH H H H H H H H H H H H H H H
9R s ;AA Ac t | | 5 }t j t j |d |d d cd d d S # 1 swxY w Y d S )Ntimeoutfileheaderszutf-8)encoding)
_fetch_urljsonloadio
TextIOWrapperget_content_charset)urlrv responses r7 _fetch_json_syncr s C ) ) )
Xy !),@@II
s AA&&A*-A*r rf c t }| rg| rUt d| | | | t d S d S d S )Nz>Network error for %s via IPv6 IP %r, disabling IPv6. Error: %r)rO is_ipv6_enabledlast_ip_was_ipv6rH r_ last_ip disable_ipv6rJ )r rf choosers r7 _disable_ipv6_on_network_errorr s G !W%=%=%?%? ! L OO
! ! ! !rC )on_error max_triesc Z K t j } | dt | | d{V S # t t
j f$ r(}t d || d}~wt j
$ r7}t | | t d | d}~wt $ r7}t | | t d | d}~wt $ r}t d| d| d}~wt j j t" j j f$ r8}t | | t d | | d}~wt( $ r*}t | | t d| d | d}~ww xY w)
zDownload and decode JSON from *url*.
Return decoded JSON. Raise UpdateError:
* HTTP response status code is not 200;
* Unicode or JSON decoding fails;
* on time outs during HTTP request;
* on other HTTP errors.
Nz!json decode error [{}] for url {}request to {} timed outrequest to {} reset%eof error while updating files, url: , err: 8urllib/http error while updating files, url: {}, err: {} Can't fetch
, reason: )r` get_event_looprun_in_executorr UnicodeDecodeErrorr{ JSONDecodeErrorr[ r/ socketrv r ConnectionResetErrorEOFErrorhttpclient
HTTPExceptionurlliberrorURLErrorr3 )r rv loopes r7 _fetch_jsonr s ! # #D=))$0@#wOOOOOOOOO 4 5 N N N=DDQLLMMM > A A A&sA...3::3??@@@ = = =&sA.../66s;;<<<
CC C C C C
K %v|'< =
&sA... F M MQ
= = =&sA...;;;;;<<<=sQ ": F*#A33F*2B77
F*2C66
F*D(F* 3E33
F* %F%%F*rx rv c
t j | dt j pdi|d }t || 5 }|j |j fcddd S # 1 swxY w Y dS )z>Perform HEAD http request to *url* with *timeout* & *headers*.Imunify-Server-Id HEAD)rx methodru N) r requestRequestr
get_server_idrR r0 coderx )r rv rx reqrs r7 _perform_http_head_syncr s .
!9!;!;!Ar
! C
sG 4 4 !vqy ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !s A88A<?A<
current_mtimec K |t u rdS t |d } t t | |d|i d{V \ }}|dk rt d|d| t t 5 t |d }||k r$t
d
||d || ddd n # 1 swxY w Y dS # t j $ r7}t | | t d | d}~wt $ r7}t | | t d | d}~wt j j t& j j f$ rY}t- |d
r|j dk rY d}~dS t | | t d | | d}~ww xY w)zCheck if we need to download description.json file:
- perform HEAD request if local file exists and older return True
otherwise return False
T)usegmtzIf-Modified-Sincer N zUnexpected http code z for z
Last-Modifieda Got code %r, but last modification date %s is earlier than or equal to the date provided in the If-Modified-Since header, the origin server SHOULD generate a 304 (Not Modified) response [rfc7232]. Here's curl cmd:
curl -s -I -w '%%{http_code}' -H 'If-Modified-Since: %s' '%s'r r r i0 Fr )_NEVERr r r r[ r Exceptionr timestamprH r_ r rv r r/ r r r r r r r hasattrr )r r rv formatted_mtimer rx
last_mtimer s r7 _need_to_downloadr s t t<<<O- ' # (/:
g, 3;; :::S::
i
.( ikk
]**4 O,# $ tM > A A A&sA...3::3??@@@ = = =&sA.../66s;;<<< K %v|'< =
1f !&C--55555&sA... F M MQ
sH #C 2ACCC G ,2D
G +2E (G G&3GG T)compressc # K i }|||d< dt j pdi}|r| ddi t j | | } t
j |fi |5 }t 5 }|j
d dk }|rl|sj|j
d d
k rLt d |j
d |j
| |r#| t | n||j d
V ddd n # 1 swxY w Y ddd dS # 1 swxY w Y dS )zs
Fetch *url* as binary file.
If *compress* is true, ungzipping is done automatically
if necessary.
Nrv r r zAccept-Encodinggzipr Content-Encodingz Content-Typezapplication/zipzRequested gzip but got Content-Encoding=%r. Read response as is [identity]. Headers: %s, as curl cmd:
curl -Is -H 'Accept-Encoding: gzip' '%s')fileobj)rw rx )r r updater r r rR r0 r rx getrH rN items
enter_contextr
) r rv r
parameters req_headersr r stackgzippeds r7 rz rz Q s7 J '
9 &
(@(B(B(HbIK 8 -v6777
.
k
:
:C
9;;
"'"&&'9::fD $$^448III KKJ $$%788 &&((
##HX$>$>$>??? '
%
s7 7E(B>E E(E E(E E((E,/E, dest_filec 0 t j }| }t | || 5 }|d t
x}rL| | | | |d t
x}Lddd n # 1 swxY w Y |d d dk s| |z
} |d dd }
|
Nt |
} | | k r9t j d
| | | z
d
| } | | |k rt d | d | d
| | S )z
Fetch *url* to *dest_file* and return its md5sum.
Raise *urllib.error.ContentTooShortError* if the downloaded file
has unexpected length.
)rv r rw Nrx r r zContent-Lengthz&{got} bytes read, {diff} more expected)gotdiff)messagecontentzcontent fetched from z does not match hash: expected=z, got=)hashlibmd5tellrz r1 _BUFSIZEr writer intr r ContentTooShortErrorr/ hexdigestr[ )
r r rv r md5sumr initial_file_offsetr chunk file_lengthcontent_length_headerexpected_file_length
got_md5sums
r7 _fetch_n_md5sum_urlr ~ s +--C#..** C8 < < < # ',,X666e # JJu OOE " " " ',,X666e ## # # # # # # # # # # # # # # I " "#5 6 6& @ @ nn&&)<< !) 3 7 78H$ O O ,#&'<#=#= #{22 l77 D K K ' 1K ? L ! 8 J
jF 2 2
4C
4
4
4
4'1
4
4
s A/B55B9<B9rg c ( K dt | vS )NzHTTP Error 404)strre s r7 $_fetch_and_save_should_retry_handlerr s 3s88 ++rC )r r should_retryr r dest_path dest_modec 0 K t || 5 }t t | |||| d{V cddd S # 1 swxY w Y dS # t j $ r7}t | | t
d | d}~wt $ r7}t | | t
d | d}~wt $ r*}t | | t
d| d| d}~wt j j t j j f$ r8}t | | t
d | | d}~wt $ r-}t | | t
d| d | d
| d}~ww xY w) zFetch bytes from `url`, save them to `dest_path`,
and return md5 checksum of downloaded content.
Raise UpdateError:
* HTTP response status code is not 200;
* on time outs during HTTP request;
* on other HTTP errors.
r Nr r r r r r z to r )rs r r r rv r r[ r/ r r r r r r r r r3 )r r rv r r r r r s r7 _fetch_and_saver sT 0 L
Y
2
2 i"#!
> A A A&sA...3::3??@@@ = = =&sA.../66s;;<<<
&sA... CC C C C C
K %v|'< =
&sA... F M MQ
L L L&sA...JJJ)JJqJJKKKLsi A A A AA A A F 2B
F 2C
F%D (F(3E
F((FF_Itemr datac & d | d D S )z,Return a set of _Item for easy manipulation.c F h | ] }t |d |d S )r r )r ).0items r7 <setcomp>z_items.<locals>.<setcomp> s* I I I4E$u+tH~ . . I I IrC r rB )r s r7 _itemsr s I I4= I I IIrC c d } || | t j | D ]d\ }}}|D ],} |t j || | -|D ],} |t j || | -edS )zCheck and change file/dir modes recursively.
Starting at dirname, change all inner directory permissions to dir_perm,
file permissions to file_perm
c t j | j dz }||k rmt j | sPt
d| t | t | t j | | d S d S d S # t $ r t
d| Y d S w xY w)Ni zGFixing wrong permission to file/dir %s [%s] expected [%s] (not symlink)z&Failed to change permission to file %s) rm lstatst_moderi islinkrH r_ octchmodPermissionErrorr )
file_dir_path
permission current_modes r7 _os_chmodz"check_mode_dirs.<locals>._os_chmod s 8M22:UBLz))"'.. 3 3) ;! %%
OO
33333 *))) LL8-
s B
B %B>=B>N)rm walkri join) dirnamedir_perm file_permr ri dirsfiles directorynames r7 check_mode_dirsr s & Igx WW - - ; ;dE ? ?I Ibgll433X > > > > ; ;D Ibgll4.. : : : : ;; ;rC description_path
files_pathc || j v sJ | j }|}||k rR| r/| d | dd dS |j }||k PdS dS )aP
Try to fix the structure of /var/imunify360/files/ when
NotADirectoryError happens.
It indicates that some part in the path is a file:
/var/imunify360/files/sigs <- is a file
=> open("/var/imunify360/files/sigs/v1/description.json") will fail.
We try to rectify it by deleting the file but up to FILES_DIR.
T)
missing_ok)parentsexist_okN)r
parentis_fileunlinkmkdir)r r _dir topmost_dirs r7 _fix_directory_structurer s )1 1 1 1 1 "DK
*
<<>> KK4K ( ( ( dT : : : E{ *
rC c e Zd Z eej Z ee Zi Z i Z
e Z e Z i Z
dZ edez ej ZdDdZd Zd Zdej d d
fd Zdej fd Zd
Ze dddde de de de de de d d
fd Z e d e fd Z!e d e"e fd Z#e de d e fd Z$dEd e fdZ%d e fdZ&d e"e fd Z'e d Z(d e)e fd Z*d Z+e,fd e-fd Z.d e fd!Z/d"e-d e fd#Z0dEd$Z1de2j3 d%e"e4 d d
fd&Z5d'e"e4 d e6e"e4 e"e f fd(Z7e de d e fd) Z8e de d e fd* Z9e:dEd+ Z;e:d,e2j3 d e2j3 fd- Z<d e fd.Z=dEd/e d0e d d
fd1Z>d e?e@e?e e e z f f fd2ZAd eBe fd3ZCdFd4ZDd5e2j3 d,e2j3 d eEe2j3 fd6ZFd e fd7ZGe:d8ej d9ej d:e"e d d
fd; ZHd<e d e fd=ZIdFd>ZJdFd?ZKdEdFd@ZLe dGdAeEe d d
fdB ZMe de d d
fdC ZNd
S )HIndexz/static )periodTc X || j vrt d| d| j || _ d| _ dg i| _ | } t
| 5 }t j | | _ ddd n # 1 swxY w Y n# t $ rE t d| t t j | t Y nTt t" t j f$ r6}|r#t' d | |d| _ Y d}~nd}~ww xY w|rX| }t- | r5t' d d
| | j s| dS dS ) z
:param bool integrity_check: check if last update
did not break anything (by interrupting it in the middle or
another programmatic error)
:raise IntegrityError:
z*Trying to initiate unregistered file type z. Allowed types Fr Nz Path %s has a file in parentsz cannot read description file {}Tz'some files are missing or corrupted: {}z, )_TYPES
ValueErrortype _is_blank_json_descriptionfile_pathr0 r{ r| NotADirectoryErrorr _throttled_log_errorr pathlibPath FILES_DIRFileNotFoundErrorr r rT r/ _corrupted_fileslenr r )selftype_integrity_checkri r6 r bad_filess r7 __init__zIndex.__init__1 s) # # (U ( ( +( (
r]
))++ "d
*q !Yq\\
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*! D D D & &'F M M M $W\$%7%7 C C C C C
" " "
$5<<TBB "DNNNNNN " --//I9~~
$=DD ),,
~ # " " " " " # #sC B B9 B B B B
B A D0 D0:,D++D0c | j |j k o/| j |j k o | j |j k o| j |j k S N) __class__r r r )r& others r7 __eq__z Index.__eq__\ sH Neo -
* UZ'
*%/1
*
ek)
rC c d| j j d| j d| j dt | d S )N<z(type_=z ) is_blank=z , json={<z item(s)>}>)r- rV r r r% r r& s r7 __repr__zIndex.__repr__d s\
'
4::<<((
rC r r& Nc t d| j | | | } || j d dS )zjWhether *files_path* dir may be used for this type's file group.
:raises: IntegrityError
zValidating [%s]: %sTr( N)rH rN r _make_file_groupr& r FileGroups r7 validatezIndex.validatel sT
)49jAAA))
$)T222222rC c 6 G fdd j }|S )zV
Return FileGroup class: Index class with local path == *files_path*.
c 6 e Zd Zededef fd ZdS ))Index._make_file_group.<locals>.FileGroupr' r& c F |j k sJ t j S z+Return local base path for given file type.)r rm fspath)clsr' r r& s r7 r z4Index._make_file_group.<locals>.FileGroup.files_path~ s( ))))y,,,rC N)rV rW rX classmethodr r )r r& s r7 r8 r< } sP
-s
-s
-
-
-
-
-
- [
-
-
-rC r8 )r- r7 s `` r7 r6 zIndex._make_file_groupx sG
- - - - - - - - - - - rC c . t j | j }t t j t j t t j | j t j
|d |d d S )Ndirrw ) r _PERMSr r rm ri normpathr r" _PATHSpardir)r& permss r7 r zIndex.check_mode_dirs sq TY' G Y TY(?KK
%L &M
rC Fall_zip essentialr'
relative_pathr r rJ rK c | j | |r| j | || j |< ||d| j |< || j |< dS )a Add a type to known file types.
* relative_path is a relative path to all files for that type.
* dir_perm is permission mask used to create directories.
* file_perm is permission mask used to create files.
* all_zip is a flag which shows whether that type of files can
be downloaded in all.zip archive. all.zip is expected to be on
the server.
* essential is whether the agent can start if there are errors
updating that type.
)rC rw N)r add_ESSENTIAL_TYPESrF rD _ALL_ZIP_SUPPORT)r@ r' rL r r rJ rK s r7 add_typezIndex.add_type sj ,
u , $ $U + + + )
5$,i @ @
5&- U###rC c B K t d | j D S )zuWhether essential files exist.
Note: the files may be corrupted (integrity check is not performed).
c 3 D K | ]}t |d j V dS )Fr5 N)r r )r r' s r7 <genexpr>z.Index.essential_files_exist.<locals>.<genexpr> sI
eU333= =
rC )allrO r@ s r7 essential_files_existzIndex.essential_files_exist s9
-
rC c 4 | j S )z&Return a set of all known files types.)r copyrV s r7 typesz Index.types s z rC c b t j t | j | S r> )rm ri r r" rF r@ r' s r7 r zIndex.files_path s! w||Isz%'8999rC c
|rJ| j t j j v r2t j | d S t j | | j d S )z9Return local path for description.json for current index.description.json) r r FilesUpdateDISABLEDrm ri r _descriptionfile_path_latestr )r& latests r7 r zIndex._descriptionfile_path sm di6#5#>>>7<<11335G
w||DOODI 6 68JKKKrC c r d | D d }|S )Nc . g | ]}|d
|d S )rb rC rB )r xs r7
<listcomp>z6Index._descriptionfile_path_latest.<locals>.<listcomp> s% JJJAakJqxJJJrC r ) _get_listvalues)r& ltss r7 ra z"Index._descriptionfile_path_latest s5 JJ !1!1!8!8!:!:JJJ1M
rC c R t }t | j D ]}| |j } t |t j t }n%# t $ r |
| Y _w xY w||j k r|
| |S )z9Return a set of file paths that are missing or corrupted.) setr r
localfilepathr r r r r r# rN r )r& r) r ri actuals r7 r$ zIndex._corrupted_files s EE 4:&& $ $D%%dh//D
"4h??$
d###
$$
d###s A!! BBc | j | S )z`
usage example:
>> async with Index.locked(WHITELISTS):
...
)_lockr\ s r7 lockedz Index.locked s y rC c D fdt j D S )z(Return iterable over all files in index.c 3 L K | ] } |j V d S r, rl r r r r& s r7 rT z Index.files.<locals>.<genexpr> s3 LL""48,,LLLLLLrC )r r r2 s `r7 r z Index.files s' LLLL
9K9KLLLLrC c | j d S )z+Return 'items' field from JSON description.r )r r2 s r7 r z Index.items s z'""rC c t j | d j S # t $ r |cY S w xY w)zBReturn mtime of description file if it exists, otherwise -math.infTrb )rm statr st_mtimer3 )r& defaults r7 _descriptionfile_mtimez Index._descriptionfile_mtime sO 7455T5BBCCL L NNN s ,/ >>c | }|sdS |t j j z t j k S )z4Return True if last update was too late in the past.T)r{ r r_ PERIODtime)r& _desc_mtimes r7 _is_outdatedzIndex._is_outdated s< 1133 4V / 66DDrC rv c K | j pyt | dk pT| o@t | | j | | d{V S )z>Return True if update from server is needed for current index.r N)r r% r$ r r _descriptionfile_urlr r{ )r& rv s r7 is_update_neededzIndex.is_update_needed s
N
4((**++a/
!!## +--di88//11
rC c t d 5 t j ||| ddd dS # 1 swxY w Y dS # t $ r"}t t | |d}~ww xY w)z)Create local directory for current index.r )rj r N)r rm makedirsr3 r[ r )r& r dir_moder r s r7 _makedirszIndex._makedirs s - ""
G
G G(XFFFF
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G - - - c!ff%%1 , -s2 A 6 A :A :A
A/
A**A/ to_updatec K | | } || j d }|j |j d }|j |j d }|D ]}| |j } t
j | }
t
j |
s| |
|d t |j | |||j d{V dS )zX
Fetch files from *to_update* set, verify hashes, save to *files_path*.
Fr5 rC rw r )r r N) r6 r rD rl r rm ri r isdirr r r ) r& r r rv r8 fgr file_moder filenamer s r7
_update_fileszIndex._update_files s ))
Yty%
8
8
89RW%e,Ibg&v. D''11Hgooh//G7==))
Bw5AAA!#{
rC remote_itemsc t j } fd|D } fd|D }||z
} fd|D }||z
}||fS )zFigure out what should be updated based on current items,
file system state and remote items.
Return tuple of files to fetch and files to delete.
Files to fetch is a set of _Item.
Files to delete is a set of file paths.c D h | ] } |j S rB rs rt s r7 r z+Index._calculate_changes.<locals>.<setcomp>7 s) LLLt))$(33LLLrC c D h | ] } |j S rB rs rt s r7 r z+Index._calculate_changes.<locals>.<setcomp>8 s) NNN**4844NNNrC c L h | ] } |j v |!S rB rs )r r r) r& s r7 r z+Index._calculate_changes.<locals>.<setcomp>< s>
!!$(++9<<
<<<rC )r r r$ ) r& r local_items local_files remote_files to_remove local_setr r) s ` @r7 _calculate_changeszIndex._calculate_changes- s TZ(( LLLL LLL NNNN NNN ,. ))++
#
!9, )##rC c N d t | j | S )z'Return remote path for description.jsonz{}{}/description.jsonr/ BASE_URLrF r\ s r7 r zIndex._descriptionfile_urlD s! '--h
58IJJJrC c N d t | j | S )z Return remote path for all.zipz {}{}/all.zipr r\ s r7 _all_zip_urlzIndex._all_zip_urlI s! $$Xsz%/@AAArC c t j | n@# t $ r3}t d|t | Y d }~nd }~ww xY w|r3t d| t j | d d S d S )Nzfailed to remove %s: %sz'Removing old path on all.zip update: %sT
ignore_errors) rm r r3 rH r_ r rN shutilrmtree)r all_zip_localpath remove_filesr s r7 _all_zip_cleanupzIndex._all_zip_cleanupN s I' ( ( ( ( NN)+<c!ff
: KKA: N N N M*D 9 9 9 9 9 9 : :s
A)AA live_pathc t j d }| | j |z S )zGenerate new base local path for *live_path* files.
It should be on the same filesystem partition as
*live_path* so that the rename would be atomic.
z_%Y-%m-%dT%H%M%S.%fZ)DTdatetimeutcnowstrftime with_namer )r
new_suffixs r7 _generate_new_pathzIndex._generate_new_pathZ sA [''))223IJJ
""9>J#>???rC c K t j | | j }t | }| |j dz }| j | j d }| j | j d }| | j }t 5 }| ||d | t j
||d t ||||d d {V } t j |d
5 }
t# |
| d d d n # 1 swxY w Y t% j | D ]v\ } } }
| D ]5}t% j t$ j | | | 6|
D ]5}t% j t$ j | | | 6w| | | || }nX# t2 t4 t6 t8 t j t j f$ r"}t? tA | |d }~ww xY w|! d d d n # 1 swxY w Y t
||tE | | j tF j$ j% vS ) a
Update current type of files using all.zip archive. Directory with
current type of files will be cleared and replaced with all.zip
contents. all.zip is expected to be on the server
Return whether updated.
:param timeout:
:raise UpdateError: if OSError or http error or
integrity check error (got wrong data from
the server)
all.ziprw rC Fr T)r )r r Nr )&r r! r r r r r r rD r r r callbackr r zipfileZipFile_safe_extractallrm r r ri r r9 _replace_live_with_new_dirr rT r3 r
BadZipfile LargeZipFiler[ r pop_allboolr r_ r` )r& rv r new_path archive_pathr r all_zip_urlrollback_stack_archiveroot directories filenamesr r old_pathr s r7 _run_update_all_zipzIndex._run_update_all_zipe sT L !;!;<< ++I66 ))(-)*CDD K *62 ;ty)%0'' 22
[[ 1 %N NN8XN > > > # #& !
$
& # A
1 _\377 87$Wh7778 8 8 8 8 8 8 8 8 8 8 8 8 8 8
57GH4E4E J J0D+y%0 J J dI!>!>IIII$- J J dH!=!=yIIIIJ
h''' ::8YOO "$
1
1
1 "#a&&))q0
1
" " $ $ $c1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 % 1 %h lh
y 2 ;;;s\ >AJH *E; H E H E B9H J 3I < II JJJversionforcec K t j | | j }| st d| j d| |dk rY| }d | D d }t d| j | |
d } t |d z
t | k r |st d
| d | j n(# t $ r t d| j d | w xY w|j D ]}| s| rt |d z
t | k rh| |j d
z }| |d | | | d d{V dS t d
|d| j )a Update to the version specified in *version*.
:param version: version to update to
:raise UpdateError: if OSError or http error or
integrity check error (got wrong data from
the server)
zCannot update z , because it is not a symlink: rb c ( g | ]\ }}|d
|S rw rB )r verprops r7 rf z#Index.update_to.<locals>.<listcomp> s5 !Th rC r z%Try to update to latest version %s %sFstrictVERSIONzVersion z is already set for z5, because current version doesn't have VERSION file: liveTtarget_is_directory
is_updatedNz not found in )r r! r r
is_symlinkr[ rg r rH rN resolver
read_textr2 r# r iterdiris_dirr r
symlink_torename
_run_hooks)r& r r r versions current_pathri
new_live_paths r7 update_tozIndex.update_to s L !;!;<< ##%% +999ii)
h ~~''H %-^^%5%5 G
KK7G
!(((66
1<<>>DDFFGG7##$ $ $ "GwGGDIGG ! +'+yyy,,@
$,,.. D??$$
D9 ,7799??AABBgG G %)NN49v3E$F$FM!,,Tt,LLL!((333 //T/:::::::::FFk'''499MNNNs
A#D7 7%E c t j | | j }| si S | d }i }t
d }|j D ]}| r| |k rd}nd}|dz x} rqd } |
}t
| } |dt | d|| < | |k r| }# t $ r t d|| Y w xY w|t
d k r d|| d< |S ) NFr r, Tr )currentrb rC z Version file %s is not valid: %srb )r r! r r r r r
r r rA r r r rH r )
r& r r result max_versionri r version_filer _vers
r7 rg zIndex._get_list s L !;!;<< ##%% I (((66 cll $,,.. D
||~~ -- $y 00 88::
* 4 4 6 6G"7++D#*"' "4yy$ $F4L
k))&* ! LL:$
H
& % %,0F; )
s AD&D>=D>c g }t | d D ]4\ }}|d rdn |d rdnd}| | | 5|S )z/Return list of versions available in the index.c | d S )Nr rB )re s r7 <lambda>z Index.get_list.<locals>.<lambda> s
AaD rC )keyr z
(current)rb z (latest)r )sortedrg r append)r& r r r markers r7 get_listzIndex.get_list s # NN " " $ $..
0
0MGT
? >[[
MMW.f.. / / / /
rC c t j | | j }| sdS | d }|j D ]}t j
t j j t j
| j t j j z
j }| rf| sR||k rL|t$ j j k r7t* d| j | t/ j |d dS )z~Remove old versions of files.
This is done by removing old directories in the path, that older than 30 days.
NFr z Removing old version of %s: %sTr )r r! r r r r r r r r nowtimezoneutc
fromtimestamprx ry daysr r r_ DAYS_TO_KEEPrH rN r r )r& r r ri days_olds r7 _clean_old_versionszIndex._clean_old_versions s6 L !;!;<< ##%% F (((66 $,,.. 8 8D 00+++IIKK("+/
8 ))
8 L(( 2 ??? <diNNN
d$7777 8 8rC r c | j t j j v r7| t
d| j | dS | |j dz }d}t 5 }|
|d | |j |
r| d nd}t d D ]} | | n# t" $ r |r |
sj| |j d z }t
d
||| | | | |j | Y w xY w|t' j |d | ddd n # 1 swxY w Y |S ) zbReplace *live_path* with *new_path*.
Return *old_path*
:raises: OSError
zFSkipping update for %s, because it is disabled. New files stored in %sNr Tr Fr z .live-movedz1Moving %s [live] to %s, to rename %s to it [live]r )r r r_ r` r rH rN r r r r r r r r ranger IsADirectoryErrorreplacer r r )r& r r r
moved_pathr r lasts r7 r z Index._replace_live_with_new_dir: s^ 9*3 3 3 $ $ & & & KK
4 **8=6+ABB
[[ - %N $ $X4 $ H H H # #M$8 9 9 9 '')) !!!///
a
O
OO!((333E( O O O
%//11 O%2%<%< ) . >& &
9 % & ) "))*555 '//
0BINNN-O0 %
j====
" " $ $ $[- % - % - % - % - % - % - % - % - % - % - % - % - % - % - %^ s8 =A/G
-DG
B FG
F/G
GGc K j }t || d{V } t | \ }}|p|}|s6t
d j dS t j
j }| r| d nd}t | } t 5 }
| j j d d |
t& j | d |r| r|n|} | rAt | | | fd
|D d{V | || d{V t3 | d z j j d 5 } | t7 j | ddd n # 1 swxY w Y | | | }n6# t@ tB f$ r"}
tE tG |
|
d}
~
ww xY w|
$ ddd n # 1 swxY w Y |rE| r1t
d
| t' j |d j tJ j& j' vS )z
Run update, return whether updated.
:raise UpdateError: if OSError or http error or
integrity check error (got wrong data from
the server)
ru Nz updating %s: nothing to update.Fr rC r Tr c 3 L K | ] } |j V d S r, rs rt s r7 rT z$Index._run_update.<locals>.<genexpr> sD $ $9=**4844$ $ $ $ $ $rC r^ rw z,Removing old path on file by file update: %s)(r r r r r rH rN _touchr r! r r r r r r r rD r r r r _copytreeunionr rs r r{ dumpsencoder9 r rT r3 r[ r r r r_ r` )r& rv r as_jsonr r need_updater r r r from_pathrw r s ` r7 _run_updatezIndex._run_update s '' 22#C999999999 # 6 6vg G G 9 ,9 KK949 E E E KKMMM5 L !;!;<< 09/C/C/E/E OI U + + +4 ++I66 [[ * %N NN$+di07%
# #
xt
$
%I ):):I
!!
oo OO $ $ $ $AJ$ $ $ $$Xy'$JJ J J J J J J J
1$ 11K *62 = JJtz' 2 2 9 9 ; ;<<< = = = = = = = = = = = = = = =
h''' ::8YOO"G,
1
1
1!#a&&))q0
1
" " $ $ $U* % * % * % * % * % * % * % * % * % * % * % * % * % * % * %Z 8)) 8 KK>
M($ 7 7 7 7 y 2 ;;;s[ C K15)J :I$ J$I( (J+I( ,.JK1K, K KK11K58K5from_dirto_dir
ignored_pathsc ` K fd}t t j | |d|d d{V dS )z7Copy *from_dir* to *to_dir* except for *ignored_paths*.c t t j t sJ t fd|D S )z(Return names that should not be copied.c 3 ` K | ](}t j | v $|V )d S r, )rm ri r )r r r ri s r7 rT z8Index._copytree.<locals>.ignore_names.<locals>.<genexpr> sJ 7<<d++}<< <<<< rC )
isinstancerm r? r frozenset)ri namesr s ` r7 ignore_namesz%Index._copytree.<locals>.ignore_names s_ bioos33 3 33 !
rC T)symlinksignore
dirs_exist_okN)r r copytree)r
r r r s ` r7 r zIndex._copytree su O
rC r c t j t | j | j }| j | j }t j | t j | j v s J d
|| t j || }t j | | j | S )z.Return a local file path corresponding to URL.z$url ({}) does not fit file path ({}))
rm ri relpathr _URL_PATH_PREFIXrF r r r! r
r/ r r )r& r url_relpath type_pathrL s r7 rl zIndex.localfilepath s goo SMM 5
K * L # #w|K'@'@'H H H H 1 8 8i H H
I H H Y??
w||DOODI 6 6
FFFrC c | d }t j | rt j | dS dS # t
$ r2}t t | Y d}~dS d}~ww xY w)z5Update mtime of description.json file so it is fresh.Trw N) r rm ri isfileutimer3 rH r_ r )r& ri r s r7 r z Index._touch s #--T-::Dw~~d##
# # # NN3q66 " " " " " " " " " #s A A
B 'BB c K t | j | j t g D ]}} || | d {V # t t
f$ r&}t d|| Y d }~Hd }~wt $ r&}t d|| Y d }~vd }~ww xY wt
d| j d| z d S )Nzhook %s error: %sz%s files update finished%sz (not updated)) r _HOOKSr r% rT r rH r r exceptionrN )r& r hookr s r7 r zIndex._run_hooks s $+di0<.AA ? ?D
?d4,,,,,,,,,,"N3
;
;
; 0$::::::::
?
?
? !4dA>>>>>>>>
? ( I J /
s! ?B$ A11
B$> B B$c $ K t j j }|sy| | d{V s^t d| j t t j j dz | d d{V dS | j
o| j | j }| }|rd}t d| j | t j
| t j j | d{V }|r!t d| j | nG# t j t" f$ r.}t d | j || d
}Y d}~nd}~ww xY w|rd }t d| j | t j
| t j j | d{V }|r!t d| j | nr# t j t" f$ rY}t d | j || | d d{V | j | j v r|Y d}~dS d}~ww xY w| |p| d{V dS ) a Run update for the current `type` of files.
Normally update is performed when either is true:
* index is never been fetched (description.json missing or broken);
* last update was performed longer than configured period of time ago;
* some local files are missing or have wrong content (md5 hash differs
from description.json).
If force is True then update is performed unconditionally.
Raises asyncio.TimeoutError, UpdateError.
Nz(%s was updated less than %s minutes ago.< Fr r zUpdating %s files via %szUpdated %s using %sz%s update error via %s: %sTzfile by file download)r r_ TIMEOUTr rH rN r r r} r r rP r` wait_forr SOCKET_TIMEOUT TimeoutErrorr[ r_ r rO )r& r rv rJ file_by_filelog_strupdatedr s r7 r z Index.update s $, 4#8#8#A#A A A A A A A KK: F&-344
//U/33 3 3 3 3 3 3 3 F.ET%:49%E"{ $ G KK2DIw G G G
$ ' 0,, *9 ! ! KKK 5ty'JJJ(+6
$
$
$0$)Wa $
$
-G KK2DIw G G G
' 0$$V%7%FGG! ! KKK 5ty'JJJ(+6
0$)Wa ooo7777777779 555GFFFFF
oo)9Eo:::::::::::s3 A D2 2E6$E11E6 A H I/AI**I/ only_typec K |rj | |d }| | 4 d{V | | d{V ddd d{V dS # 1 d{V swxY w Y dS |rt d | j D ]i} | |d }| | 4 d{V | | d{V ddd d{V n# 1 d{V swxY w Y jdS t d | j D ]i} | |d }| | 4 d{V | | d{V ddd d{V n# 1 d{V swxY w Y jdS )zkRun update for all registered `types` of files.
Raises asyncio.TimeoutError, UpdateError.
Fr5 NzUpdating essential fileszUpdating all files)rp r rH rN rO r )r@ r- r only_essentialindexr' s r7
update_allzIndex.update_allO ss .C 5999Ezz),,
*
*
*
*
*
*
*
*ll5)))))))))
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
. KK2 3 3 3 -
.
.E5999 ::e,, . . . . . . . . ,,u---------. . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
KK, - - -
.
.E5999 ::e,, . . . . . . . . ,,u---------. . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.s5 A
A&)A&< C**
C4 7C4 E77
F F c F | j | | dS )z:Add a hook for type_ to be called after successful update.N)r! rN )r@ r' r# s r7 add_hookzIndex.add_hookh s%
5 d#####rC )T)Fr& N)NFF)OrV rW rX r r` Lockro rk r! rF rD r rO rP r r r rH r r r* r/ r3 rm PathLiker9 r6 r rA r r r rQ rW r rZ r r ra r$ rp r r r r floatr{ r r r r r! r r r r r r staticmethodr r r r r r
rg r r r r r r r rl r r r r1 r3 rB rC r7 r r $ s
K % %E
[
F
F
F
SUUFsuu 6::QX666v|DD)# )# )# )#V
32;
34
3
3
3
3 2;
. . .. . .
. . .
. . . [.8
D
[
!c#h ! ! ! [! :s :s : : : [:L LS L L L Lc #c( [ Mx} M M M M# # # .4 Ed E E E E
e
- - - -!,36u:
2$ J$ s5z3s8# $$ $ $ $. K K K K K [K B B B B B [B : : : \ : @gl @w| @ @ @ \@O<D O< O< O< O<b1O 1Os 1O4 1OD 1O 1O 1O 1Of%4c4#:o)> >? % % % %N$s) 8 8 8 84C C18 C ', C C C CJN<D N< N< N< N<`
+
'){
CFs8
\
. G G G G G G# # # #
B; B; B; B; B;H JO. .
.
. . . [.0 $S $4 $ $ $ [$ $ $rC r c r t t dddd t t dddd t t d
ddd t t
d ddd d t t d
ddd d dS )z Register required file types.zeula/v1i i F)rJ zsigs/v1i i Tzrealtime-av-conf/v1z wp-rules/v1rI zgeo/v1N)r rQ EULASIGSREALTIME_AV_CONFWP_RULESGEOrB rC r7 configurer? n s NN4E5%N@@@ NN4E5$N??? NN
NN
NN3%NNNNNNrC Fr- c K t | | d{V S # t j t f$ r'}t
d| | Y d}~dS d}~ww xY w)z.Run files.update and log Update/TimeoutErrors.Nz*Failed to update files [%s] with error: %s)r r1 r` r) r[ rH r_ )r- r r] s r7 update_and_log_errorrA s
%%i777777777 + .
8)S
s % A" A A"c N K t d d{V S # t j t f$ ri} t d{V r t d| n#t | t j rt | Y d} ~ dS d} ~ ww xY w)z6Update all files. Don't fail if essential files exist.T)r/ Nz2Failed to update files [essential files exist]: %s) r r1 r` r) r[ rW rH r r )r] s r7 !update_all_no_fail_if_files_existrC s %%T%::::::::: + . ,,.. . . . . . . LLDc
#w 344
!s*
s % B$A B B$r4 )NF)rY r` r r r http.clientr r} r{ mathrm r rb r r r~ r urllib.errorr urllib.request collectionsr r
contextlibr r r email.utilsr r r r
itertoolsr loggingr packaging.versionr
typingr r r r r r r r r urllib.parser defence360agent.contractsr !defence360agent.contracts.licenser "defence360agent.subsys.panels.baser defence360agent.utilsr r r defence360agent.utils.commonr r defence360agent.utils.threadsr #defence360agent.utils.net_transportr! r" defence360agent.utils.zipsafer# r hooksr% rV rH r! r@ r4 r. r r8 r: r; r< r= r> r" r r _MAX_TRIES_FOR_DOWNLOADrd infr r r r7 JSONTyper= __annotations__r> rD rJ rO rR RuntimeErrorrT r[ rh r6 rs r r r r r r rz r r r r r r r r r? r1 r rW rA rC rB rC r7 <module>r^ s
/ / / / / / / / : : : : : : : : : : 9 9 9 9 9 9 9 9 % % % % % %
" ! ! ! ! ! - , , , , , 8 8 8 8 8 8 = = = = = = E E E E E E E E E E 9 9 9 9 9 9 9 9 3 3 3 3 3 3 N M M M M M 8 #w|$DEE A :
$ 4
% GL0 1 1 1 ( c5$d38nd3iG H 8< X3
4 ; ; ;%)
H\ " ) ) )Gd G G G GM M M M 6 P P P P P\ P P P
,
K K K "+ S X
h
!
!)
!
!
!
!
!
,8O "=3 "=H "= "= "= "=L *,
!
!
!
!
!
!
!
!
,8O 7 7 "7-27 7 7 7 7t 59 )
)
)
C )
U )
)
)
)
X& & & & &R,I ,# ,$ , , , ,
%5 0L 0L 0L 0L{0L
0L 0L 0L 0L
0Lf
7UH -..J JU J J J J
; ; ;F @I l07 ,G
$ G
$ G
$ G
$ G
$ G
$ G
$ G
$TO O O O,
3 ,1
}
rC defence360agent/files/__pycache__/hooks.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002511 00000000000 020643 0 ustar
r_jo H d Z ddlmZ ddlmZmZ ee Zi ZddZ dS )z9Run default hooks for files update and log errors if any. ) getLogger) check_run
CheckRunErrorreturnNc K |rt | j }|rb| rP t |g d{V dS # t
$ r&}t d| Y d}~dS d}~ww xY wdS dS dS )zDRun delivered hooks for files update. Errors are logged up on stack.Nz Error during hook execution: %s)
DEFAULT_HOOKSgettypeexistsr r loggererror)files_index_object
is_updatedhookes P/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/files/hooks.py default_hookr
s C !3!899 CDKKMM C
C '''''''''''
C
C
C >BBBBBBBBB
C C C C C C Cs A
B A>>B)r N)
__doc__loggingr defence360agent.utilsr r __name__r r r r <module>r sm ? ? : : : : : : : : 8
C C C C C Cr defence360agent/files/__pycache__/hooks.cpython-311.pyc 0000644 0000000 0000000 00000002511 00000000000 017704 0 ustar
r_jo H d Z ddlmZ ddlmZmZ ee Zi ZddZ dS )z9Run default hooks for files update and log errors if any. ) getLogger) check_run
CheckRunErrorreturnNc K |rt | j }|rb| rP t |g d{V dS # t
$ r&}t d| Y d}~dS d}~ww xY wdS dS dS )zDRun delivered hooks for files update. Errors are logged up on stack.Nz Error during hook execution: %s)
DEFAULT_HOOKSgettypeexistsr r loggererror)files_index_object
is_updatedhookes P/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/files/hooks.py default_hookr
s C !3!899 CDKKMM C
C '''''''''''
C
C
C >BBBBBBBBB
C C C C C C Cs A
B A>>B)r N)
__doc__loggingr defence360agent.utilsr r __name__r r r r <module>r sm ? ? : : : : : : : : 8
C C C C C Cr defence360agent/files/hooks.py 0000644 0000000 0000000 00000001157 00000000000 013351 0 ustar """Run default hooks for files update and log errors if any."""
from logging import getLogger
from defence360agent.utils import check_run, CheckRunError
logger = getLogger(__name__)
DEFAULT_HOOKS = {}
async def default_hook(files_index_object, is_updated) -> None:
"""Run delivered hooks for files update. Errors are logged up on stack."""
if is_updated:
hook = DEFAULT_HOOKS.get(files_index_object.type)
if hook and hook.exists():
try:
await check_run([hook])
except CheckRunError as e:
logger.error("Error during hook execution: %s", e)
defence360agent/hooks/ 0000755 0000000 0000000 00000000000 00000000000 011671 5 ustar defence360agent/hooks/__init__.py 0000644 0000000 0000000 00000000000 00000000000 013770 0 ustar defence360agent/hooks/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 014101 5 ustar defence360agent/hooks/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000300 00000000000 021272 0 ustar
r_j d S )N r S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/hooks/__init__.py<module>r s r defence360agent/hooks/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000300 00000000000 020333 0 ustar
r_j d S )N r S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/hooks/__init__.py<module>r s r defence360agent/hooks/__pycache__/execute.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000017537 00000000000 021221 0 ustar
r_jA d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl
m Z d dl m
Z
d dlmZ d dlmZmZ e Zd Zd
d
Zd
d Zej fd ZdS ) N)Corenative)EventHookLogger) EventHook)db)run
snake_casec t j rg S t j t j | k }t
| S )N)r deferredr selectwhereeventlist)r hookss R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/hooks/execute.py get_hooksr sB
{ $ $Y_%= > >E ;; Fc X t j | s"t d | |rBt j | t j s"t d | nAt j | t j s"t d | t j | } t j | }n5# t $ r(}t d | | d}~ww xY w|j t j z r"t d | t j
| }|r|dk r t j | }n5# t $ r(}t d || d}~ww xY w|j t j z r;|j t j z s)t d || dS dS dS dS )
a' Raise ValueError if path is not a safe hook file.
The original check rejected any path under /tmp, /var/tmp, /dev/shm
on the grounds that those dirs are world-writable. That blanket-
by-prefix rule was too coarse: pytest's tmp_path lives under
/tmp/pytest-of-<user>/... and the agent's own integration fixtures
legitimately put hook files there. The real threats are (a) an
attacker-owned file (DB row points at a path the attacker
controls) and (b) a hook whose immediate parent is world-writable
so the file can be swapped between this check and the exec.
The required permission bit differs between branches: subprocess
hooks are exec'd by the kernel (needs X_OK), but native hooks are
loaded via importlib's open()+exec_module path which only needs
R_OK. A standard Python file in mode 0o644 is loadable but not
executable, so requiring +x for native hooks would silently break
the typical native-hook deployment (the `hook add-native` RPC has
never required or documented an executable bit).
z-Hook path does not exist or is not a file: {}z Hook path is not readable: {}z Hook path is not executable: {}z Hook path stat failed: {}: {}Nz Hook path is world-writable: {}/z Hook parent stat failed: {}: {}z=Hook path has world-writable parent without sticky bit {}: {})ospathisfile
ValueErrorformataccessR_OKX_OKrealpathstatOSErrorst_modeS_IWOTHdirnameS_ISVTX)r r realstexcparentpsts r _validate_hook_pathr+ s; ( 7>>$
; B B4 H H
Myrw'' K < C CD I IJJ J K yrw'' M > E Ed K KLL L
7 D ! !DL
WT]] L L L8??cJJKKKL
zDL I:AA$GGHHH
W__T
"
"F
&C-- '&//CC 188EE
K$, & t|1K &..
-- s0 'C< <
D.#D))D.F$ $
G.#GGc ^ K t j }| d t | | d {V |rt j | | dS t
j | }t j
| } t | gd|| d {V \ }}}nK# t $ r}dt | fcY d }~S d }~wt $ r}dt | fcY d }~S d }~ww xY w||fS # t $ r} d t | fcY d } ~ S d } ~ ww xY w)N)r NF)shellinputcwd ~ )asyncioget_event_looprun_in_executorr+ native_hooks execute_hookjsondumpsencoder r r$ r FileNotFoundErrorreprPermissionError Exception)
r datar loopr/ exit_code_errr( es
r r6 r6 T s %''""4)<dFKKKKKKKKK %dD 1 1 17z$ &&((good## "&)e4S' ' ' ! ! ! ! ! ! Iq## ! " " "S > ! ! ! ! ! ! " " "S > ! ! ! ! ! ! " #~ T!WW} sm A
D AD B8 7D 8
D CD D
D %C;5D 6D ;D D
D,D'!D,'D,c . K | d }t | }t | j }|sd S t | j | j 5 }|rt
| j j dz }t j
d|d| }t j || |
t j | |j |d< | j | j |d}|D ]} || j | j 5 }
|
t+ | j || j d {V \ } } |
| | d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S ) NDUMPrA zw+z.json)modeprefixsuffixdir tmp_filename)r subtypeparamsr )getdictr r event_hook_loggerrK r
__class____name__tempfileNamedTemporaryFiler7 dumpflushr fsyncfilenonamer r beginr6 finish)
r tempdirrT rL r event_loggerrG tmpr> hook hook_loggerr@ rB s
r
execute_hooksr` r s? 99V D
%[[F ek " "E 5;
6 6 3, . 899C?F-&g C
IdC IIKKK HSZZ\\ " " "%(XF> " [ }
3 3D di <<<
3 !!###'3ItDK( ( ( " " " " " " 3 ""9c222
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3 3#3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3s8 B;F
AE0$ F
0E4 4F
7E4 8F
FF)F)r2 r7 r r rR defence360agent.contracts.configr defence360agent.hooksr r5 defence360agent.internals.loggerr defence360agent.model.event_hookr defence360agent.model.instancer defence360agent.utilsr r
rO r r+ r6 TMPDIRr` r r <module>ri s 1 1 1 1 1 1 8 8 8 8 8 8 < < < < < < 6 6 6 6 6 6 - - - - - - 1 1 1 1 1 1 1 1#O%% 7 7 7 7t < (,{ 3 3 3 3 3 3r defence360agent/hooks/__pycache__/execute.cpython-311.pyc 0000644 0000000 0000000 00000017537 00000000000 020262 0 ustar
r_jA d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl
m Z d dl m
Z
d dlmZ d dlmZmZ e Zd Zd
d
Zd
d Zej fd ZdS ) N)Corenative)EventHookLogger) EventHook)db)run
snake_casec t j rg S t j t j | k }t
| S )N)r deferredr selectwhereeventlist)r hookss R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/hooks/execute.py get_hooksr sB
{ $ $Y_%= > >E ;; Fc X t j | s"t d | |rBt j | t j s"t d | nAt j | t j s"t d | t j | } t j | }n5# t $ r(}t d | | d}~ww xY w|j t j z r"t d | t j
| }|r|dk r t j | }n5# t $ r(}t d || d}~ww xY w|j t j z r;|j t j z s)t d || dS dS dS dS )
a' Raise ValueError if path is not a safe hook file.
The original check rejected any path under /tmp, /var/tmp, /dev/shm
on the grounds that those dirs are world-writable. That blanket-
by-prefix rule was too coarse: pytest's tmp_path lives under
/tmp/pytest-of-<user>/... and the agent's own integration fixtures
legitimately put hook files there. The real threats are (a) an
attacker-owned file (DB row points at a path the attacker
controls) and (b) a hook whose immediate parent is world-writable
so the file can be swapped between this check and the exec.
The required permission bit differs between branches: subprocess
hooks are exec'd by the kernel (needs X_OK), but native hooks are
loaded via importlib's open()+exec_module path which only needs
R_OK. A standard Python file in mode 0o644 is loadable but not
executable, so requiring +x for native hooks would silently break
the typical native-hook deployment (the `hook add-native` RPC has
never required or documented an executable bit).
z-Hook path does not exist or is not a file: {}z Hook path is not readable: {}z Hook path is not executable: {}z Hook path stat failed: {}: {}Nz Hook path is world-writable: {}/z Hook parent stat failed: {}: {}z=Hook path has world-writable parent without sticky bit {}: {})ospathisfile
ValueErrorformataccessR_OKX_OKrealpathstatOSErrorst_modeS_IWOTHdirnameS_ISVTX)r r realstexcparentpsts r _validate_hook_pathr+ s; ( 7>>$
; B B4 H H
Myrw'' K < C CD I IJJ J K yrw'' M > E Ed K KLL L
7 D ! !DL
WT]] L L L8??cJJKKKL
zDL I:AA$GGHHH
W__T
"
"F
&C-- '&//CC 188EE
K$, & t|1K &..
-- s0 'C< <
D.#D))D.F$ $
G.#GGc ^ K t j }| d t | | d {V |rt j | | dS t
j | }t j
| } t | gd|| d {V \ }}}nK# t $ r}dt | fcY d }~S d }~wt $ r}dt | fcY d }~S d }~ww xY w||fS # t $ r} d t | fcY d } ~ S d } ~ ww xY w)N)r NF)shellinputcwd ~ )asyncioget_event_looprun_in_executorr+ native_hooks execute_hookjsondumpsencoder r r$ r FileNotFoundErrorreprPermissionError Exception)
r datar loopr/ exit_code_errr( es
r r6 r6 T s %''""4)<dFKKKKKKKKK %dD 1 1 17z$ &&((good## "&)e4S' ' ' ! ! ! ! ! ! Iq## ! " " "S > ! ! ! ! ! ! " " "S > ! ! ! ! ! ! " #~ T!WW} sm A
D AD B8 7D 8
D CD D
D %C;5D 6D ;D D
D,D'!D,'D,c . K | d }t | }t | j }|sd S t | j | j 5 }|rt
| j j dz }t j
d|d| }t j || |
t j | |j |d< | j | j |d}|D ]} || j | j 5 }
|
t+ | j || j d {V \ } } |
| | d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S ) NDUMPrA zw+z.json)modeprefixsuffixdir tmp_filename)r subtypeparamsr )getdictr r event_hook_loggerrK r
__class____name__tempfileNamedTemporaryFiler7 dumpflushr fsyncfilenonamer r beginr6 finish)
r tempdirrT rL r event_loggerrG tmpr> hook hook_loggerr@ rB s
r
execute_hooksr` r s? 99V D
%[[F ek " "E 5;
6 6 3, . 899C?F-&g C
IdC IIKKK HSZZ\\ " " "%(XF> " [ }
3 3D di <<<
3 !!###'3ItDK( ( ( " " " " " " 3 ""9c222
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3 3#3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3s8 B;F
AE0$ F
0E4 4F
7E4 8F
FF)F)r2 r7 r r rR defence360agent.contracts.configr defence360agent.hooksr r5 defence360agent.internals.loggerr defence360agent.model.event_hookr defence360agent.model.instancer defence360agent.utilsr r
rO r r+ r6 TMPDIRr` r r <module>ri s 1 1 1 1 1 1 8 8 8 8 8 8 < < < < < < 6 6 6 6 6 6 - - - - - - 1 1 1 1 1 1 1 1#O%% 7 7 7 7t < (,{ 3 3 3 3 3 3r defence360agent/hooks/__pycache__/native.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003726 00000000000 021040 0 ustar
r_j p U d dl Zd dlZd dlmZ dZ edd Zi Zee ef e
d< d Z d Z d Z
dS )
N)
namedtupleim_hook
ModuleInfoobjectmtimectimemodulesc t j | }| t v rHt | j |j k r-t | j |j k rt | j S t j
| | }t j | }|j
| t ||j |j t | < |S )Nr )osstatr
r st_mtimer st_ctimer importlibutilspec_from_file_locationmodule_from_specloader exec_moduler )path file_statspec hook_modules Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/hooks/native.py import_hookr s
I DM 9#5 5 5 DM 9#5 5 5t}## > 1 1$ = =D.11$77KKK((( )"4I<N GDM c P | t v r t | d S d S N)r
pop)r s r remove_hookr s* w D r c ` t | }t |t } || S r )r getattr
ENTRYPOINT)r
dict_paramr
entrypoints r execute_hookr& " s. d##Kj11J :j ! !!r )importlib.utilr r collectionsr r# r r
dictstr__annotations__r r r& r r <module>r- s " " " " " "
Z &B
C
C
!#c:o # # # $
" " " " "r defence360agent/hooks/__pycache__/native.cpython-311.pyc 0000644 0000000 0000000 00000003726 00000000000 020101 0 ustar
r_j p U d dl Zd dlZd dlmZ dZ edd Zi Zee ef e
d< d Z d Z d Z
dS )
N)
namedtupleim_hook
ModuleInfoobjectmtimectimemodulesc t j | }| t v rHt | j |j k r-t | j |j k rt | j S t j
| | }t j | }|j
| t ||j |j t | < |S )Nr )osstatr
r st_mtimer st_ctimer importlibutilspec_from_file_locationmodule_from_specloader exec_moduler )path file_statspec hook_modules Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/hooks/native.py import_hookr s
I DM 9#5 5 5 DM 9#5 5 5t}## > 1 1$ = =D.11$77KKK((( )"4I<N GDM c P | t v r t | d S d S N)r
pop)r s r remove_hookr s* w D r c ` t | }t |t } || S r )r getattr
ENTRYPOINT)r
dict_paramr
entrypoints r execute_hookr& " s. d##Kj11J :j ! !!r )importlib.utilr r collectionsr r# r r
dictstr__annotations__r r r& r r <module>r- s " " " " " "
Z &B
C
C
!#c:o # # # $
" " " " "r defence360agent/hooks/execute.py 0000644 0000000 0000000 00000013101 00000000000 013701 0 ustar import asyncio
import json
import os
import stat
import tempfile
from defence360agent.contracts.config import Core
from defence360agent.hooks import native as native_hooks
from defence360agent.internals.logger import EventHookLogger
from defence360agent.model.event_hook import EventHook
from defence360agent.model.instance import db
from defence360agent.utils import run, snake_case
event_hook_logger = EventHookLogger()
def get_hooks(event):
# if database is not available (i.e. direct RPC call), do not try to
# load hooks
if db.deferred:
return []
hooks = EventHook.select().where(EventHook.event == event)
return list(hooks)
def _validate_hook_path(path, native=False):
"""Raise ValueError if path is not a safe hook file.
The original check rejected any path under /tmp, /var/tmp, /dev/shm
on the grounds that those dirs are world-writable. That blanket-
by-prefix rule was too coarse: pytest's tmp_path lives under
/tmp/pytest-of-<user>/... and the agent's own integration fixtures
legitimately put hook files there. The real threats are (a) an
attacker-owned file (DB row points at a path the attacker
controls) and (b) a hook whose immediate parent is world-writable
so the file can be swapped between this check and the exec.
The required permission bit differs between branches: subprocess
hooks are exec'd by the kernel (needs X_OK), but native hooks are
loaded via importlib's open()+exec_module path which only needs
R_OK. A standard Python file in mode 0o644 is loadable but not
executable, so requiring +x for native hooks would silently break
the typical native-hook deployment (the `hook add-native` RPC has
never required or documented an executable bit).
"""
if not os.path.isfile(path):
raise ValueError(
"Hook path does not exist or is not a file: {}".format(path)
)
if native:
if not os.access(path, os.R_OK):
raise ValueError("Hook path is not readable: {}".format(path))
else:
if not os.access(path, os.X_OK):
raise ValueError("Hook path is not executable: {}".format(path))
real = os.path.realpath(path)
try:
st = os.stat(real)
except OSError as exc:
raise ValueError("Hook path stat failed: {}: {}".format(path, exc))
# Reject world-writable files: any unprivileged user could rewrite
# them between this check and the subprocess/importlib load.
if st.st_mode & stat.S_IWOTH:
raise ValueError("Hook path is world-writable: {}".format(path))
parent = os.path.dirname(real)
if parent and parent != "/":
try:
pst = os.stat(parent)
except OSError as exc:
raise ValueError(
"Hook parent stat failed: {}: {}".format(parent, exc)
)
# A world-writable parent without the sticky bit means an
# attacker can replace our hook by deleting+recreating the
# file. /tmp itself has the sticky bit so renames are owner-
# only, which is safe; pytest's tmp_path subdirs are mode 700.
if (pst.st_mode & stat.S_IWOTH) and not (pst.st_mode & stat.S_ISVTX):
raise ValueError(
"Hook path has world-writable parent without sticky bit"
" {}: {}".format(parent, path)
)
async def execute_hook(path, data, native=False):
try:
# Path validation runs filesystem syscalls (isfile/access/realpath)
# which can block the event loop on slow/NFS storage; defer to a
# threadpool executor. The same checks apply to native hooks
# because native_hooks.execute_hook imports the file via importlib
# straight in the agent's root process — a DB-sourced /tmp path
# there is at least as dangerous as a subprocess fork.
loop = asyncio.get_event_loop()
await loop.run_in_executor(None, _validate_hook_path, path, native)
if native:
native_hooks.execute_hook(path, data)
return 0, None
data = json.dumps(data).encode()
cwd = os.path.dirname(path)
try:
exit_code, _, err = await run(
[path], shell=False, input=data, cwd=cwd
)
except FileNotFoundError as exc:
# 127 = shell convention for "command not found".
return 127, repr(exc)
except PermissionError as exc:
# 126 = shell convention for "found but not executable".
return 126, repr(exc)
return exit_code, err
except Exception as e:
return None, repr(e)
async def execute_hooks(event, tempdir=Core.TMPDIR):
dump = event.get("DUMP")
params = dict(event)
hooks = get_hooks(event.event)
if not hooks:
return
with event_hook_logger(event.event, event.subtype) as event_logger:
if dump:
prefix = snake_case(event.__class__.__name__) + "_"
tmp = tempfile.NamedTemporaryFile(
mode="w+", prefix=prefix, suffix=".json", dir=tempdir
)
json.dump(dump, tmp)
tmp.flush()
os.fsync(tmp.fileno())
params["tmp_filename"] = tmp.name
data = {
"event": event.event,
"subtype": event.subtype,
"params": params,
}
for hook in hooks:
with event_logger(hook.path, native=hook.native) as hook_logger:
hook_logger.begin()
exit_code, err = await execute_hook(
hook.path, data, native=hook.native
)
hook_logger.finish(exit_code, err)
defence360agent/hooks/native.py 0000644 0000000 0000000 00000001710 00000000000 013530 0 ustar import importlib.util
import os
from collections import namedtuple
ENTRYPOINT = "im_hook"
ModuleInfo = namedtuple("ModuleInfo", ("object", "mtime", "ctime"))
modules: dict[str, ModuleInfo] = {}
def import_hook(path):
file_stat = os.stat(path)
if (
path in modules
and modules[path].mtime == file_stat.st_mtime
and modules[path].ctime == file_stat.st_ctime
):
return modules[path].object
spec = importlib.util.spec_from_file_location(path, path)
hook_module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(hook_module)
modules[path] = ModuleInfo(
object=hook_module, mtime=file_stat.st_mtime, ctime=file_stat.st_ctime
)
return hook_module
def remove_hook(path):
if path in modules:
modules.pop(path)
def execute_hook(path, dict_param):
hook_module = import_hook(path)
entrypoint = getattr(hook_module, ENTRYPOINT)
return entrypoint(dict_param)
defence360agent/internals/ 0000755 0000000 0000000 00000000000 00000000000 012545 5 ustar defence360agent/internals/__init__.py 0000644 0000000 0000000 00000000000 00000000000 014644 0 ustar defence360agent/internals/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 014755 5 ustar defence360agent/internals/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000304 00000000000 022152 0 ustar
r_j d S )N r W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/__init__.py<module>r s r defence360agent/internals/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000304 00000000000 021213 0 ustar
r_j d S )N r W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/__init__.py<module>r s r defence360agent/internals/__pycache__/auth_protocol.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003420 00000000000 023277 0 ustar
r_j l d dl Z d dlZd dlZd dlZ ej e Z G d de j ZdS ) Nc e Zd ZdZdZd ZdS )UnixSocketAuthProtocolz
This protocol uses SO_PEERCRED attribute of unix socket
to get authentication data (pid, uid, gid)
After connect, this values are stored in object's
_pid, _uid, _gid attributes
3ic ~ || _ | j d }| t j t j t
j | j }t
j | j | \ | _
| _ | _ t d| j
| j | j d S )Nsocketz1New socket connection from pid=%s, uid=%s, gid=%s)
_transportget_extra_info
getsockoptr
SOL_SOCKET SO_PEERCREDstructcalcsize
STRUCT_FORMATunpack_pid_uid_gidloggerdebug)self transportconncredss \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/auth_protocol.pyconnection_madez&UnixSocketAuthProtocol.connection_made s #--h77 OD . / /
+1- +
+
' 49di ? I I I
N)__name__
__module__ __qualname____doc__r r r r r r s4 M
r r ) asyncior loggingr
getLoggerr r Protocolr r! r r <module>r& sr
8 $ $"
"
"
"
"
W - "
"
"
"
"
r defence360agent/internals/__pycache__/auth_protocol.cpython-311.pyc 0000644 0000000 0000000 00000003420 00000000000 022340 0 ustar
r_j l d dl Z d dlZd dlZd dlZ ej e Z G d de j ZdS ) Nc e Zd ZdZdZd ZdS )UnixSocketAuthProtocolz
This protocol uses SO_PEERCRED attribute of unix socket
to get authentication data (pid, uid, gid)
After connect, this values are stored in object's
_pid, _uid, _gid attributes
3ic ~ || _ | j d }| t j t j t
j | j }t
j | j | \ | _
| _ | _ t d| j
| j | j d S )Nsocketz1New socket connection from pid=%s, uid=%s, gid=%s)
_transportget_extra_info
getsockoptr
SOL_SOCKET SO_PEERCREDstructcalcsize
STRUCT_FORMATunpack_pid_uid_gidloggerdebug)self transportconncredss \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/auth_protocol.pyconnection_madez&UnixSocketAuthProtocol.connection_made s #--h77 OD . / /
+1- +
+
' 49di ? I I I
N)__name__
__module__ __qualname____doc__r r r r r r s4 M
r r ) asyncior loggingr
getLoggerr r Protocolr r! r r <module>r& sr
8 $ $"
"
"
"
"
W - "
"
"
"
"
r defence360agent/internals/__pycache__/cln.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000051774 00000000000 021210 0 ustar
r_j6 d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
d dl m Z d dlm
Z
mZmZmZmZ d dlZd dlmZ d dlmZ d dlmZ d dlmZmZm Z d d l m Z d
Z e d Z ej! e" Z#d Z$ ed
de%fd Z&d Z' G d de( Z) G d de( Z* G d de) Z+d dZ, G d d Z- G d d Z.d Z/dS ) N) defaultdict)Path) parse_qsl urlencodeurljoinurlparse
urlunparse)ANTIVIRUS_MODE)
LicenseCLN) HostingPanel)
CheckRunErrorasync_lru_cache check_run) get_hostnamei, z/usr/sbin/ie-configzpwget -qq -O - https://repo.imunify360.cloudlinux.com/defence360/imunifyemail-deploy.sh | bash -s 'is-supported' )maxsizereturnc K t t d d {V nM# t $ r@} | j dk r*t dt
| Y d } ~ dS d } ~ ww xY wdS )NT)shelld zimunify-email check failed F)r IE_SUPPORTED_CMDr
returncodeloggererrorstr)es R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/cln.pyis_imunify_email_supportedr s (55555555555 <3 LL?s1vv?? @ @ @uuuuu 4s !
A+5A&&A+c K t rdS t sdS t t t dg d{V } n# t
$ r Y dS w xY wd| v S )z Try to get imunify-email statusFstatusNz&spamfilter exim configuration: enabled)r
_IMUNIFY_EMAIL_CONFIG_EXECUTABLEexistsr r r
decode)outputs r get_imunify_email_statusr% * s u + 2 2 4 4 u
1
2
2H =
uu 3v}} FFs )A
A A c e Zd ZddZd ZdS )CLNErrorNc " || _ || _ d S Nmessager )selfr r+ s r __init__zCLNError.__init__: s c R | j r| j S d | j S )Nz#Unexpected status code from CLN: {})r+ formatr r, s r __str__zCLNError.__str__> s* < < 4;;DKHHHr. )NN)__name__
__module__ __qualname__r- r2 r. r r' r' 9 s< I I I I Ir. r' c e Zd ZdS )InvalidLicenseErrorN)r3 r4 r5 r6 r. r r8 r8 E s Dr. r8 c * e Zd ZdZd Zd Zd Zd ZdS )BackupNotFoundi @c || _ d S r) url)r, r= s r r- zBackupNotFound.__init__L s
r. c dS )NzBackup not found in CLNr6 r1 s r r2 zBackupNotFound.__str__O s ((r. c " | j d S t | j }t t |j }| |d< t
|j |j |j |j
t | |j f S )N
used_space)
r= r dictr query _disk_usager schemenetlocpathparamsr fragment)r, purB s r add_used_spacez BackupNotFound.add_used_spaceR s 8 F
dh
Yrx(()) " . . 0 0l %
r. c N d}t j }t }|D ]i}|j |vr^d|j vrU|j d s;|t j |j j z
}| |j jt || j z S )Nr noautoz /dev/loop) psutildisk_partitionssetdeviceopts
startswith
disk_usage
mountpointusedaddroundGB)r,
total_used
partitions processedps r rC zBackupNotFound._disk_usagee s
+--
EE ( (A** QV++,,[99 , f / = = BB
ah'''Z$')***r. N)r3 r4 r5 rX r- r2 rJ rC r6 r. r r: r: I sU B ) ) )
& + + + + +r. r: c i }|||d< |t |t r| dddi nt |t r.| d }| dddi nJt
j | d }| dddi ||d < t
j t j j
| fi ||
}|5 |j d k r|j dfcddd S |j d v r | } |j t j | fcddd S # t j $ r'}t# d
| d|j |j |d}~ww xY w# t$ j $ r t) d w xY wt# |j # 1 swxY w Y dS # t
j j $ r}|j dk rt# |j |d}|j wt0 d| |||j |j | } n"# t$ j $ r t) d w xY w| d }t# ||j |d}~wt
j j $ r#}t# t | |d}~wt$ j $ r t) d t8 $ r%}t0 d| |||| d}~ww xY w)z!To be used by RestCLN._request().Nheaders Content-typezapplication/octet-streamzutf-8ztext/plain; charset=utf-8asciiz!application/x-www-form-urlencodeddata)timeout ) zNon-json data from CLN: z
for code=r* zTimed out reading responsei z,CLN.post(url=%r, data=%r, headers=%r): %d %sz Timed out reading error messagereplace)errors)r+ z Timed out receiving responsez5CLN.post(url=%r, data=%r, headers=%r, timeout=%r): %s)
isinstancebytes
setdefaultr encodeurllibparser requesturlopenRequestcodereadjsonloadsr# JSONDecodeErrorr' socketrb TimeoutErrorr HTTPErrorfpr warningreasonURLErrorOSError)
r= ra r^ rb kwargsrespcontentr r+ resp_datas
r
_post_requestr t sX
F #y dE " " N,FG
c
"
"
;;w''D N,GH
<))$//66w??D !DE
v?*~%% N "3 1 1& 1 17 &
R * *yC y$ * * * * * * * * j((! "iikkG ! #y$*W^^5E5E*F*F F * * * * * * * * / ! ! ! &!57 !5 !5)-!5 !5 $(9 !
!! ~ E E E&'CDDDE ty)))+ * * * * * * * * * *M < ! > > > 6C<<16"" ) 4 NN>
F FFHH >
F
F
F"#DEEE
F &&i&88Gwqv666A= < . . .s1vv&&&A- > ; ; ;9::: C
s
6G: G-& G-0F7,E>>F4
"F//F44G-7 GG--G14G1:M AK!I65K6 J0KM K::*M $ MM c j e Zd ZdZdZej dd Zej dd Z e
ej de Z e e d Z
e e d Z e e d Z e e d
Z e e d Z e e d Zd
ZdZeddedd Zed Zededefd Ze d dede defd Z ededefd Z edefd Z ededefd Z ed d Z!dS ) RestCLNzhttps://{domain}/api/im/zcln.cloudlinux.comIM360_CLN_API_BASE_URLzipv6.cln.cloudlinux.comzipv4.cln.cloudlinux.comdomainregister
unregistercheckinzab/credentialsz ab/removezab/checkokzok-trialN)ra r^ rb c r K t j d t |||| d {V S r) )asyncioget_event_looprun_in_executorr )clsr= ra r^ rb s r _requestzRestCLN._request sR +--== -dGW
r. c K t | j | j d }dt d} | || d {V \ }}ns# t $ rf}|j dk rOt | j | j d }| || d {V \ }}n|Y d }~nd }~ww xY w|S )Nr r IPLkeyhostnamera i ) r _URL_PATH_TEMPLATEr0 _IPV4_DOMAIN_NAMEr r r' r _IPV6_DOMAIN_NAME)r v4_license_urlra _token cln_errorv6_license_urls r process_ipl_licencezRestCLN.process_ipl_licence s! " ) )1F ) G G
,..99
\\.t\ D DDDDDDDHAuu 3&&!(*11 " 4 2 " " "% n4 !H!HHHHHHH55 5555 s A$ $
C.A CCr r c K |dk r| d{V S | | j |t d d{V \ }}|S )z
Register server with key
:param key: registration key
:return: license token in case of success
r Nr r )r r
_REGISTER_URLr )r r r r s r r zRestCLN.register s %<< 0022222222 2 ,..99 &
5 r. server_id users_countr c " K |p
t }t d{V }t } | d{V }nH# t $ r;}t
dt | d |j }Y d}~nd}~ww xY w|||||dt d{V idd}t j | } t
d| |
| j | d d
i d{V \ }
} | S ) z
Update license token
:param str server_id: server id
:param int users_count: users count
:param str hostname: current server hostname
:return: dict new license token
Nz Failed to get panel version: %sT)exc_infoIM_EMAIL)userspanel imunifyEmailsupported_features)idr imzCLN checkin: %sr_ zapplication/json)ra r^ )r r% r name Exceptionr r r NAMEr rs dumpsinfor _CHECKIN_URL) r r r r imunify_email_statusr
panel_namer reqra r r s r r zRestCLN.checkin s~ -|~~%=%?%? ? ? ? ? ? ? $ $zz||++++++JJ $ $ $ LL13q66D
JJJJJJ $ $# 4 &@&B&B B B B B B B'
z# %t,,, #%78 &
5
s A
B1BBc X K | | j d|i d{V \ }}|S )zl
Creates Acronis Backup account and get user & password
:param server_id: server id
r r N)r _ACRONIS_CREDENTIALS_URL)r r r credss r acronis_credentialszRestCLN.acronis_credentials< sV (i/@ &
5 r. c R K | | j d|i d{V dS )zT
Removes Acronis Backup account
:param server_id: server id
r r N)r _ACRONIS_REMOVE_URLr r s r acronis_removezRestCLN.acronis_removeG s> ll32$ 9JlKKKKKKKKKKKr. c K | | j d|i d{V \ }}|dk rt d |S )z
If Acronis account exists return backup size in GB or if backups
not exists URL for backups
:param server_id: server id
r r Nre r< )r _ACRONIS_CHECK_URLr: )r r r responses r
acronis_checkzRestCLN.acronis_checkO sq "% "$ ): ". "
"
S== T*** *r. c | K |pt j }| | j d|i d{V dS )z<
Unregister server id
:return: None
r r N)r
get_server_idr _UNREGISTER_URLr s r r zRestCLN.unregister] sQ ;!9!;!; ll3.dI5FlGGGGGGGGGGGr. r) )"r3 r4 r5 r _BASE_DOMAIN_NAMEosenvirongetr r r0 _BASE_URLr r r r r r r STATUS_OK_PAID_LICENSESTATUS_OK_TRIAL_LICENSE classmethod_TIMEOUTr r r rA r intr r r r r r6 r. r r r sk 3,
";
"; #))z~~ 68IJJ * I GIz22M gi 66O79i00L &wy2B C C !')[99 J77 ! ()-tX
[
[, [
+ ++ + + + + [+Z # $ [ LS L L L [L C D [ H H H [H H Hr. r c e Zd Z ee Zed Zed Zed Z ed Z
ed Z ed Z dS )CLNc F | j | | d S r) )
_CALLBACKSrV )r method_name
coro_callbacks r add_callback_forzCLN.add_callback_forj s# {#''
66666r. c K | j | D ]h} | d {V # t j $ r t $ r9}t d ||| Y d }~ad }~ww xY wd S )Nz;Error '{!r}' happened when run callback {} forCLN {} method)r r CancelledErrorr r exceptionr0 )r r callbackr s r run_callbacks_forzCLN.run_callbacks_forn s {3 H
hjj )
$$*F1h $D$D
s $A6/A11A6c , | d S )NIMAVP)rR )r r s r
is_avp_keyzCLN.is_avp_key{ s ~~g&&&r. c K | | rt st d t | d {V }t j | s5t |d d {V t d t j | | d d {V d S )Nz4Imunify360 can not be registered with ImunifyAV+ keyr z"License is invalid for this serverr )
r r
r8 r r r is_validr updater )r r licenses r r z CLN.register s >># ~ %F
((-------- "7++ L$$WT]33 3 3 3 3 3 3 3%&JKK K'"""##J///////////r. c K t d {V t j | d d {V d S )Nr )r r r deleter )r s r r zCLN.unregister se """""""""##L11111111111r. c $ K t j rt j S t j d rt j S t |d t j d{V }t d| | t
d{V nt j | | d d{V t j S )z>Refreshes token and returns new one on success, None otherwiseis_alternativer NzGot new token from CLN: %s
refresh_token)
r is_free get_tokenr r r r r r r r r r )r r new_tokens r r zCLN.refresh_token s * ')) ) ! ! % %&6 7 7 * ')) )!//%+z7MNNNNNNNN 0)<<< .."" " " " " " " " " i ( ( (##O444444444#%%%r. N)
r3 r4 r5 r rO r r r r r r r r r6 r. r r r g s S!!J7 7 [7
[
' ' ['
0
0 [
0 2 2 [2
& & [& & &r. r c H dD ] }t || d S )N)r r r )r )r r )coror s r subscribe_to_license_changesr s7 B > > [ ====> >r. )NNN)0r rs loggingr rv urllib.errorrl urllib.parseurllib.request collectionsr pathlibr r r r r r rM defence360agent.contracts.configr
!defence360agent.contracts.licenser +defence360agent.subsys.panels.hosting_panelr defence360agent.utilsr
r r defence360agent.utils.commonr r r! getLoggerr3 r r boolr r% r r' r8 r: r r r r r6 r. r <module>r s
# # # # # # L L L L L L L L L L L L L L
; ; ; ; ; ; 8 8 8 8 8 8 D D D D D D K K K K K K K K K K 5 5 5 5 5 5 #'4(=#>#> 8 $ $ $ G G G I I I I Iy I I I ) (+ (+ (+ (+ (+X (+ (+ (+VU* U* U* U*pXH XH XH XH XH XH XH XHv@& @& @& @& @& @& @& @&F> > > > >r. defence360agent/internals/__pycache__/cln.cpython-311.pyc 0000644 0000000 0000000 00000051774 00000000000 020251 0 ustar
r_j6 d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
d dl m Z d dlm
Z
mZmZmZmZ d dlZd dlmZ d dlmZ d dlmZ d dlmZmZm Z d d l m Z d
Z e d Z ej! e" Z#d Z$ ed
de%fd Z&d Z' G d de( Z) G d de( Z* G d de) Z+d dZ, G d d Z- G d d Z.d Z/dS ) N) defaultdict)Path) parse_qsl urlencodeurljoinurlparse
urlunparse)ANTIVIRUS_MODE)
LicenseCLN) HostingPanel)
CheckRunErrorasync_lru_cache check_run) get_hostnamei, z/usr/sbin/ie-configzpwget -qq -O - https://repo.imunify360.cloudlinux.com/defence360/imunifyemail-deploy.sh | bash -s 'is-supported' )maxsizereturnc K t t d d {V nM# t $ r@} | j dk r*t dt
| Y d } ~ dS d } ~ ww xY wdS )NT)shelld zimunify-email check failed F)r IE_SUPPORTED_CMDr
returncodeloggererrorstr)es R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/cln.pyis_imunify_email_supportedr s (55555555555 <3 LL?s1vv?? @ @ @uuuuu 4s !
A+5A&&A+c K t rdS t sdS t t t dg d{V } n# t
$ r Y dS w xY wd| v S )z Try to get imunify-email statusFstatusNz&spamfilter exim configuration: enabled)r
_IMUNIFY_EMAIL_CONFIG_EXECUTABLEexistsr r r
decode)outputs r get_imunify_email_statusr% * s u + 2 2 4 4 u
1
2
2H =
uu 3v}} FFs )A
A A c e Zd ZddZd ZdS )CLNErrorNc " || _ || _ d S Nmessager )selfr r+ s r __init__zCLNError.__init__: s c R | j r| j S d | j S )Nz#Unexpected status code from CLN: {})r+ formatr r, s r __str__zCLNError.__str__> s* < < 4;;DKHHHr. )NN)__name__
__module__ __qualname__r- r2 r. r r' r' 9 s< I I I I Ir. r' c e Zd ZdS )InvalidLicenseErrorN)r3 r4 r5 r6 r. r r8 r8 E s Dr. r8 c * e Zd ZdZd Zd Zd Zd ZdS )BackupNotFoundi @c || _ d S r) url)r, r= s r r- zBackupNotFound.__init__L s
r. c dS )NzBackup not found in CLNr6 r1 s r r2 zBackupNotFound.__str__O s ((r. c " | j d S t | j }t t |j }| |d< t
|j |j |j |j
t | |j f S )N
used_space)
r= r dictr query _disk_usager schemenetlocpathparamsr fragment)r, purB s r add_used_spacez BackupNotFound.add_used_spaceR s 8 F
dh
Yrx(()) " . . 0 0l %
r. c N d}t j }t }|D ]i}|j |vr^d|j vrU|j d s;|t j |j j z
}| |j jt || j z S )Nr noautoz /dev/loop) psutildisk_partitionssetdeviceopts
startswith
disk_usage
mountpointusedaddroundGB)r,
total_used
partitions processedps r rC zBackupNotFound._disk_usagee s
+--
EE ( (A** QV++,,[99 , f / = = BB
ah'''Z$')***r. N)r3 r4 r5 rX r- r2 rJ rC r6 r. r r: r: I sU B ) ) )
& + + + + +r. r: c i }|||d< |t |t r| dddi nt |t r.| d }| dddi nJt
j | d }| dddi ||d < t
j t j j
| fi ||
}|5 |j d k r|j dfcddd S |j d v r | } |j t j | fcddd S # t j $ r'}t# d
| d|j |j |d}~ww xY w# t$ j $ r t) d w xY wt# |j # 1 swxY w Y dS # t
j j $ r}|j dk rt# |j |d}|j wt0 d| |||j |j | } n"# t$ j $ r t) d w xY w| d }t# ||j |d}~wt
j j $ r#}t# t | |d}~wt$ j $ r t) d t8 $ r%}t0 d| |||| d}~ww xY w)z!To be used by RestCLN._request().Nheaders Content-typezapplication/octet-streamzutf-8ztext/plain; charset=utf-8asciiz!application/x-www-form-urlencodeddata)timeout ) zNon-json data from CLN: z
for code=r* zTimed out reading responsei z,CLN.post(url=%r, data=%r, headers=%r): %d %sz Timed out reading error messagereplace)errors)r+ z Timed out receiving responsez5CLN.post(url=%r, data=%r, headers=%r, timeout=%r): %s)
isinstancebytes
setdefaultr encodeurllibparser requesturlopenRequestcodereadjsonloadsr# JSONDecodeErrorr' socketrb TimeoutErrorr HTTPErrorfpr warningreasonURLErrorOSError)
r= ra r^ rb kwargsrespcontentr r+ resp_datas
r
_post_requestr t sX
F #y dE " " N,FG
c
"
"
;;w''D N,GH
<))$//66w??D !DE
v?*~%% N "3 1 1& 1 17 &
R * *yC y$ * * * * * * * * j((! "iikkG ! #y$*W^^5E5E*F*F F * * * * * * * * / ! ! ! &!57 !5 !5)-!5 !5 $(9 !
!! ~ E E E&'CDDDE ty)))+ * * * * * * * * * *M < ! > > > 6C<<16"" ) 4 NN>
F FFHH >
F
F
F"#DEEE
F &&i&88Gwqv666A= < . . .s1vv&&&A- > ; ; ;9::: C
s
6G: G-& G-0F7,E>>F4
"F//F44G-7 GG--G14G1:M AK!I65K6 J0KM K::*M $ MM c j e Zd ZdZdZej dd Zej dd Z e
ej de Z e e d Z
e e d Z e e d Z e e d
Z e e d Z e e d Zd
ZdZeddedd Zed Zededefd Ze d dede defd Z ededefd Z edefd Z ededefd Z ed d Z!dS ) RestCLNzhttps://{domain}/api/im/zcln.cloudlinux.comIM360_CLN_API_BASE_URLzipv6.cln.cloudlinux.comzipv4.cln.cloudlinux.comdomainregister
unregistercheckinzab/credentialsz ab/removezab/checkokzok-trialN)ra r^ rb c r K t j d t |||| d {V S r) )asyncioget_event_looprun_in_executorr )clsr= ra r^ rb s r _requestzRestCLN._request sR +--== -dGW
r. c K t | j | j d }dt d} | || d {V \ }}ns# t $ rf}|j dk rOt | j | j d }| || d {V \ }}n|Y d }~nd }~ww xY w|S )Nr r IPLkeyhostnamera i ) r _URL_PATH_TEMPLATEr0 _IPV4_DOMAIN_NAMEr r r' r _IPV6_DOMAIN_NAME)r v4_license_urlra _token cln_errorv6_license_urls r process_ipl_licencezRestCLN.process_ipl_licence s! " ) )1F ) G G
,..99
\\.t\ D DDDDDDDHAuu 3&&!(*11 " 4 2 " " "% n4 !H!HHHHHHH55 5555 s A$ $
C.A CCr r c K |dk r| d{V S | | j |t d d{V \ }}|S )z
Register server with key
:param key: registration key
:return: license token in case of success
r Nr r )r r
_REGISTER_URLr )r r r r s r r zRestCLN.register s %<< 0022222222 2 ,..99 &
5 r. server_id users_countr c " K |p
t }t d{V }t } | d{V }nH# t $ r;}t
dt | d |j }Y d}~nd}~ww xY w|||||dt d{V idd}t j | } t
d| |
| j | d d
i d{V \ }
} | S ) z
Update license token
:param str server_id: server id
:param int users_count: users count
:param str hostname: current server hostname
:return: dict new license token
Nz Failed to get panel version: %sT)exc_infoIM_EMAIL)userspanel imunifyEmailsupported_features)idr imzCLN checkin: %sr_ zapplication/json)ra r^ )r r% r name Exceptionr r r NAMEr rs dumpsinfor _CHECKIN_URL) r r r r imunify_email_statusr
panel_namer reqra r r s r r zRestCLN.checkin s~ -|~~%=%?%? ? ? ? ? ? ? $ $zz||++++++JJ $ $ $ LL13q66D
JJJJJJ $ $# 4 &@&B&B B B B B B B'
z# %t,,, #%78 &
5
s A
B1BBc X K | | j d|i d{V \ }}|S )zl
Creates Acronis Backup account and get user & password
:param server_id: server id
r r N)r _ACRONIS_CREDENTIALS_URL)r r r credss r acronis_credentialszRestCLN.acronis_credentials< sV (i/@ &
5 r. c R K | | j d|i d{V dS )zT
Removes Acronis Backup account
:param server_id: server id
r r N)r _ACRONIS_REMOVE_URLr r s r acronis_removezRestCLN.acronis_removeG s> ll32$ 9JlKKKKKKKKKKKr. c K | | j d|i d{V \ }}|dk rt d |S )z
If Acronis account exists return backup size in GB or if backups
not exists URL for backups
:param server_id: server id
r r Nre r< )r _ACRONIS_CHECK_URLr: )r r r responses r
acronis_checkzRestCLN.acronis_checkO sq "% "$ ): ". "
"
S== T*** *r. c | K |pt j }| | j d|i d{V dS )z<
Unregister server id
:return: None
r r N)r
get_server_idr _UNREGISTER_URLr s r r zRestCLN.unregister] sQ ;!9!;!; ll3.dI5FlGGGGGGGGGGGr. r) )"r3 r4 r5 r _BASE_DOMAIN_NAMEosenvirongetr r r0 _BASE_URLr r r r r r r STATUS_OK_PAID_LICENSESTATUS_OK_TRIAL_LICENSE classmethod_TIMEOUTr r r rA r intr r r r r r6 r. r r r sk 3,
";
"; #))z~~ 68IJJ * I GIz22M gi 66O79i00L &wy2B C C !')[99 J77 ! ()-tX
[
[, [
+ ++ + + + + [+Z # $ [ LS L L L [L C D [ H H H [H H Hr. r c e Zd Z ee Zed Zed Zed Z ed Z
ed Z ed Z dS )CLNc F | j | | d S r) )
_CALLBACKSrV )r method_name
coro_callbacks r add_callback_forzCLN.add_callback_forj s# {#''
66666r. c K | j | D ]h} | d {V # t j $ r t $ r9}t d ||| Y d }~ad }~ww xY wd S )Nz;Error '{!r}' happened when run callback {} forCLN {} method)r r CancelledErrorr r exceptionr0 )r r callbackr s r run_callbacks_forzCLN.run_callbacks_forn s {3 H
hjj )
$$*F1h $D$D
s $A6/A11A6c , | d S )NIMAVP)rR )r r s r
is_avp_keyzCLN.is_avp_key{ s ~~g&&&r. c K | | rt st d t | d {V }t j | s5t |d d {V t d t j | | d d {V d S )Nz4Imunify360 can not be registered with ImunifyAV+ keyr z"License is invalid for this serverr )
r r
r8 r r r is_validr updater )r r licenses r r z CLN.register s >># ~ %F
((-------- "7++ L$$WT]33 3 3 3 3 3 3 3%&JKK K'"""##J///////////r. c K t d {V t j | d d {V d S )Nr )r r r deleter )r s r r zCLN.unregister se """""""""##L11111111111r. c $ K t j rt j S t j d rt j S t |d t j d{V }t d| | t
d{V nt j | | d d{V t j S )z>Refreshes token and returns new one on success, None otherwiseis_alternativer NzGot new token from CLN: %s
refresh_token)
r is_free get_tokenr r r r r r r r r r )r r new_tokens r r zCLN.refresh_token s * ')) ) ! ! % %&6 7 7 * ')) )!//%+z7MNNNNNNNN 0)<<< .."" " " " " " " " " i ( ( (##O444444444#%%%r. N)
r3 r4 r5 r rO r r r r r r r r r6 r. r r r g s S!!J7 7 [7
[
' ' ['
0
0 [
0 2 2 [2
& & [& & &r. r c H dD ] }t || d S )N)r r r )r )r r )coror s r subscribe_to_license_changesr s7 B > > [ ====> >r. )NNN)0r rs loggingr rv urllib.errorrl urllib.parseurllib.request collectionsr pathlibr r r r r r rM defence360agent.contracts.configr
!defence360agent.contracts.licenser +defence360agent.subsys.panels.hosting_panelr defence360agent.utilsr
r r defence360agent.utils.commonr r r! getLoggerr3 r r boolr r% r r' r8 r: r r r r r6 r. r <module>r s
# # # # # # L L L L L L L L L L L L L L
; ; ; ; ; ; 8 8 8 8 8 8 D D D D D D K K K K K K K K K K 5 5 5 5 5 5 #'4(=#>#> 8 $ $ $ G G G I I I I Iy I I I ) (+ (+ (+ (+ (+X (+ (+ (+VU* U* U* U*pXH XH XH XH XH XH XH XHv@& @& @& @& @& @& @& @&F> > > > >r. defence360agent/internals/__pycache__/deadlock_detecting_lock.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004116 00000000000 025224 0 ustar
r_j D d dl Z G d de Z G d d ZdS ) Nc e Zd ZdZdS )
DeadlockErrorz6Error raised if DeadlockDetectingLock detects deadlockN)__name__
__module__ __qualname____doc__ f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/deadlock_detecting_lock.pyr r s @@@@r
r c * e Zd ZdZd Zd Zd Zd ZdS )DeadlockDetectingLockzp
Lock that detects deadlock when it is about to be
acquired by the same task that already holds it.
c D t j | _ d | _ d S N)asyncioLock_lock_ownerselfs r __init__z DeadlockDetectingLock.__init__ s \^^
r
c 4 | j S r )r lockedr s r r z DeadlockDetectingLock.locked s z """r
c K t j }| j |k rt | j d {V || _ | S r )r current_taskr r r acquire)r curr_tasks r
__aenter__z DeadlockDetectingLock.__aenter__ s] (** ;) # # // !j """"""""" r
c J K d | _ | j d S r )r r release)r exc_typeexctbs r __aexit__z DeadlockDetectingLock.__aexit__ s'
r
N)r r r r r r r r# r r
r r
r
sZ
# # # r
r
)r Exceptionr r
r r
r <module>r% sr A A A A AI A A A r
defence360agent/internals/__pycache__/deadlock_detecting_lock.cpython-311.pyc 0000644 0000000 0000000 00000004116 00000000000 024265 0 ustar
r_j D d dl Z G d de Z G d d ZdS ) Nc e Zd ZdZdS )
DeadlockErrorz6Error raised if DeadlockDetectingLock detects deadlockN)__name__
__module__ __qualname____doc__ f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/deadlock_detecting_lock.pyr r s @@@@r
r c * e Zd ZdZd Zd Zd Zd ZdS )DeadlockDetectingLockzp
Lock that detects deadlock when it is about to be
acquired by the same task that already holds it.
c D t j | _ d | _ d S N)asyncioLock_lock_ownerselfs r __init__z DeadlockDetectingLock.__init__ s \^^
r
c 4 | j S r )r lockedr s r r z DeadlockDetectingLock.locked s z """r
c K t j }| j |k rt | j d {V || _ | S r )r current_taskr r r acquire)r curr_tasks r
__aenter__z DeadlockDetectingLock.__aenter__ s] (** ;) # # // !j """"""""" r
c J K d | _ | j d S r )r r release)r exc_typeexctbs r __aexit__z DeadlockDetectingLock.__aexit__ s'
r
N)r r r r r r r r# r r
r r
r
sZ
# # # r
r
)r Exceptionr r
r r
r <module>r% sr A A A A AI A A A r
defence360agent/internals/__pycache__/delivery_ack.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005142 00000000000 023061 0 ustar
r_j p d Z ddlZddlmZmZ ej e Z G d d Z e Z dS )am In-memory delivery acknowledgements for Reportable messages.
The send-to-server plugins queue messages rather than deliver them, so a
producer that keeps its own copy of the payload cannot tell a delivered
message from one a lost send round dropped. Every send path reports the ids
the transport accepted here, and producers register the ids they care about.
Acknowledgements are deliberately not persisted: one that never arrives
leaves the message unconfirmed and makes the producer send it again. That
costs a duplicate the server may well store twice, whereas a silently
dropped payload cannot be recovered at all.
N)CallableOptionalc f e Zd Zd dZdedeg df ddfdZdeddfdZdee ddfdZ dS )
DeliveryAckRegistryreturnNc i | _ d S N
_callbacks)selfs [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/delivery_ack.py__init__z DeliveryAckRegistry.__init__ s
9;
message_id on_deliveredc " |sd S || j |< d S r r
r r r s r
watchzDeliveryAckRegistry.watch s! F&2
###r c < | j |d d S r )r pop)r r s r
unwatchzDeliveryAckRegistry.unwatch s J-----r c | j |d }|d S | d S # t $ r t d| Y d S w xY w)Nz&Delivery acknowledgement for %s failed)r r Exceptionlogger exceptionr s r
confirmzDeliveryAckRegistry.confirm s **:t<< F LNNNNN
8*
s
- %AA)r N)
__name__
__module__ __qualname__r strr r r r r r r
r r s < < < <3 38BH3E 3$ 3 3 3 3
.# .$ . . . . (3- D r r )
__doc__loggingtypingr r getLoggerr r r registryr! r r
<module>r' s % % % % % % % % 8 $ $ 6 r defence360agent/internals/__pycache__/delivery_ack.cpython-311.pyc 0000644 0000000 0000000 00000005142 00000000000 022122 0 ustar
r_j p d Z ddlZddlmZmZ ej e Z G d d Z e Z dS )am In-memory delivery acknowledgements for Reportable messages.
The send-to-server plugins queue messages rather than deliver them, so a
producer that keeps its own copy of the payload cannot tell a delivered
message from one a lost send round dropped. Every send path reports the ids
the transport accepted here, and producers register the ids they care about.
Acknowledgements are deliberately not persisted: one that never arrives
leaves the message unconfirmed and makes the producer send it again. That
costs a duplicate the server may well store twice, whereas a silently
dropped payload cannot be recovered at all.
N)CallableOptionalc f e Zd Zd dZdedeg df ddfdZdeddfdZdee ddfdZ dS )
DeliveryAckRegistryreturnNc i | _ d S N
_callbacks)selfs [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/delivery_ack.py__init__z DeliveryAckRegistry.__init__ s
9;
message_id on_deliveredc " |sd S || j |< d S r r
r r r s r
watchzDeliveryAckRegistry.watch s! F&2
###r c < | j |d d S r )r pop)r r s r
unwatchzDeliveryAckRegistry.unwatch s J-----r c | j |d }|d S | d S # t $ r t d| Y d S w xY w)Nz&Delivery acknowledgement for %s failed)r r Exceptionlogger exceptionr s r
confirmzDeliveryAckRegistry.confirm s **:t<< F LNNNNN
8*
s
- %AA)r N)
__name__
__module__ __qualname__r strr r r r r r r
r r s < < < <3 38BH3E 3$ 3 3 3 3
.# .$ . . . . (3- D r r )
__doc__loggingtypingr r getLoggerr r r registryr! r r
<module>r' s % % % % % % % % 8 $ $ 6 r defence360agent/internals/__pycache__/feature_flags.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000034475 00000000000 023242 0 ustar
r_j& U d Z ddlmZ ddlZddlZddlZddlmZ dZdZ dZ
dZ i a d e
d
< i ad e
d < e ad
e
d< dade
d< d1dZd2dZd3dZd4dZd5dZd6d Zd7d Zd8d"Zd9d%Zd7d&Zd8d'Z d:d(Z d:d)Z d;d<d.Z d=d/Z d>d0Z!dS )?av
Shared reader for the local feature flags file.
The file is written by:
- Go resident-agent FeatureFlags plugin (IM360 mode)
- Python FeatureFlagsSync plugin (AV mode)
Other subsystems (e.g. message_status_publisher) use this module
to check individual flag values at runtime.
Supported JSON shapes on disk (readers / ``is_enabled`` / ``get_params``):
- New shape ``{"flags": ["mqtt_tracking"], "params": {"flag": ["A", "B"]}}``
(mirrors the sync API response; carries per-flag string-list params).
- Legacy object ``{"mqtt_tracking": true, ...}`` (still accepted).
- JSON array of enabled names ``["mqtt_tracking"]`` (still accepted).
- Legacy wrapper ``{"flags": ["mqtt_tracking", ...]}`` (still accepted).
The sync API checksum collapses to the legacy sorted-names array when no
params are present, so this agent and older agents agree on the bool-only
case. With params, the canonical form expands to ``{"flags": [...], "params":
{...}}`` with all keys and list members sorted.
The sync plugin also writes ``FLAGS_PLAIN_PATH`` (``/var/imunify360/feature_flags``):
plain text, one enabled flag name per line (sorted), for scripts.
) annotationsN)Anyz"/var/imunify360/feature_flags.jsonz /var/imunify360/feature_flagsmqtt_tracked_methodsmessage_loss_observabilitydict[str, Any]
_cached_flagsdict[str, list[str]]_cached_paramsfrozenset[str]_cached_mqtt_methods float
_cached_mtimerawr returnc | i S t | t r#i }| D ] }t |t rd||< |S t | t r;| d }t |t rt | S | S i S )z@Map file JSON to a flat name->value dict for :func:`is_enabled`.NTflags)
isinstanceliststrdictget_normalize_flags_from_file)r outiteminners \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/feature_flags.pyr r 8 s
{ #t ! !D$$$
! D
#t eT " " 5-e44 4
I c @ t | t si S | d }t |t si S i }| D ]C\ }}t |t rt |t
s0d |D }|r|||< D|S )zExtract ``params`` mapping from new-shape file content.
Only the new ``{"flags": [...], "params": {name: [...]}}`` shape carries
params; every other (legacy) shape returns an empty mapping.
paramsc < g | ]}t |t |S r r ).0vs r
<listcomp>z%_params_from_file.<locals>.<listcomp>Y s' ;;;
1c(:(:;1;;;r )r r r itemsr r )r
raw_paramsr namevaluescleaneds r _params_from_filer, J s c4 ""J j$ ' ' "C"((** f$$$ Jvt,D,D ;;f;;; CI Jr +tuple[dict[str, Any], dict[str, list[str]]]c ^ t j t } n2# t $ r% i ai at ada t
t fcY S w xY w| t k rt
t fS t t 5 }t j | }d d d n # 1 swxY w Y t | at | an # t t j f$ r i ai aY nw xY wt t t" d a| a t
t fS )Nr
r" )ospathgetmtime
FLAGS_PATHOSErrorr r
frozensetr r openjsonloadr r, JSONDecodeErrorr MQTT_TRACKED_METHODS_FLAG)mtimefr s r _read_stater< _ sr - ,, - - -
({{
n,,,, -
n,,
*
)A,,C 2377
*3// T) *
%4b99 M . ((sE $' ,AA3C B( C (B,,C /B,0!C C/.C/c ( t \ } }| S Nr< )r _s r _read_flagsrA | s }}HE1 Lr c ( t \ } }|S r> r? )r@ r s r _read_paramsrC s
IAv Mr r list[str]c t | t t f s$t dt | j t
| }t d | D S )a Return sorted enabled flag names for JSON and plain-text sidecar.
Accepts the same shapes as :func:`_normalize_flags_from_file` (array,
flat map, ``{"flags": [...]}``) so checksums and sidecars match Go
``enabledNamesSortedForChecksum`` / :func:`is_enabled`.
z flags must be list or dict, not c 3 $ K | ] \ }}||V d S r> r" r$ kr% s r <genexpr>z,enabled_flag_names_sorted.<locals>.<genexpr> s+ 881a8!888888r ) r r r TypeErrortype__name__r sortedr' )r
normalizeds r enabled_flag_names_sortedrO sx edD\ * *
EtE{{/C E E
,E22J 88
0 0 2 2888 8 88r namesbytesc r t | }t j |dd S )z|JSON array bytes used for sync MD5 when no params are present
(matches correlation_api ``checksum_for_sync_flag_list``).T sort_keysindentrM r6 dumpsencode)rP ordereds r canonical_sync_flag_list_bytesr[ s2 UmmG :ga 8 8 8 ? ? A AAr r c |st | S t | d t | D d}t j |dd S )ae JSON bytes for the sync MD5 over the full response shape.
Mirrors correlation_api ``checksum_for_sync_response``: collapses to
the legacy sorted-names array when ``params`` is empty so old agents
keep matching, otherwise expands to the deterministic
``{"flags": [...], "params": {...}}`` form with all keys and list
members sorted.
c 4 i | ]\ }}|t | S r" rM rG s r
<dictcomp>z1canonical_sync_response_bytes.<locals>.<dictcomp> $ CCCDAq1fQiiCCCr r r TrS rT )r[ rM r' r6 rX rY rP r canonicals r canonical_sync_response_bytesrd su 5-e444 CCF6<<>>,B,BCCC I :i4 : : : A A C CCr r0 r c r t | d 5 }t j | }ddd n # 1 swxY w Y n## t t t j f$ r Y dS w xY wt
| }t | }t || }t j
|d S )zMD5 hex of the canonical sync-response form for ``path``.
Returns "" if the file is missing or invalid. Computes the same MD5
the server returned, so a matching checksum lets the agent skip
the response payload on the next sync.
zutf-8)encodingN F)usedforsecurity) r5 r6 r7 r3 UnicodeDecodeErrorr8 rO r, rd hashlibmd5 hexdigest)r0 r; r rP r payloads r !sync_checksum_hex_from_flags_filern s
$
)
)
) Q)A,,C ')= > rr %c * *E
s
#
#F+E6::G ;w 6 6 6 @ @ B BBs, A 4 A 8A 8A A A c d t d | D D }t j |dd S )z<On-disk legacy JSON: ``{flag: true, ...}`` with sorted keys.c i | ]}|d S )Tr" )r$ ns r r_ z2legacy_feature_flags_map_bytes.<locals>.<dictcomp> s KKKQDKKKr c < h | ]}t |t |S r" r# )r$ xs r <setcomp>z1legacy_feature_flags_map_bytes.<locals>.<setcomp> s' !I!I!IjC6H6H!I!!I!I!Ir TrS rT rW )rP ds r legacy_feature_flags_map_bytesrv sO KK&!I!IU!I!I!IJJKKKA :a4 2 2 2 9 9 ; ;;r c t | d t | D d}t j |dd S )zPersisted form for ``FLAGS_PATH`` carrying both flags and params.
Same canonical shape as ``canonical_sync_response_bytes`` so the file
is self-describing and round-trips through ``sync_checksum_hex_from_flags_file``.
c 4 i | ]\ }}|t | S r" r^ rG s r r_ z,sync_response_file_bytes.<locals>.<dictcomp> r` r ra TrS rT )rM r' r6 rX rY rb s r sync_response_file_bytesry s_ CCF6<<>>,B,BCCC I :i4 : : : A A C CCr c | t | }|sdS d | dz S )zPBody for ``FLAGS_PLAIN_PATH``: one name per line, trailing newline if non-empty.r
)rO joinrY )r rP s r $plain_text_payload_for_enabled_flagsr} s? %e , ,E s IIe t # + + - --r c t | t r)t j | dd S t dt
| j )zBSerialize dict flags for writing ``FLAGS_PATH`` (legacy map only).TrS rT zflags must be dict, not )r r r6 rX rY rJ rK rL )r s r $serialize_feature_flags_file_payloadr sX % Dz%4:::AACCC
EtE{{/CEE
F
FFr F flag_namedefaultboolc n t }| | }||S t | S )zReturn whether *flag_name* is enabled.
If the file is missing, unreadable, or the flag is absent,
*default* is returned. Defaults to False so unknown flags are
treated as disabled unless the caller explicitly opts in.
)rA r r )r r r values r
is_enabledr s4
MME IIi E } ;;r c ` t t | d S )zReturn the per-flag string params from the on-disk file.
Empty list when the file is missing/unreadable, the flag is unknown,
or the value did not come from the new structured shape (legacy
bool-only flags carry no params by definition).
r" )r rC r )r s r
get_paramsr s& ""9b11 2 22r c , t t S )u Frozen set of method names whose status events should be enriched
for MQTT tracing. Driven entirely by the server-side
``mqtt_tracked_methods`` flag's params list — the agent has no
hard-coded list, so adding/removing tracked types is a server-side
config change with no agent rollout.
Cached: ``_read_state`` pre-builds the frozenset and invalidates it
when the flags file's mtime changes. On the hot path — every
Reportable message in ``the_sink._call_unlocked`` — this is a single
``os.stat`` syscall plus an identity-stable frozenset return. Two
consecutive calls within the same mtime window return the same
instance.
)r< r r" r r r r s MMM r )r r r r )r r r r )r r- )r r )r r )r r r rD )rP rD r rQ )rP rD r r r rQ )r0 r r r )r r r rQ )F)r r r r r r )r r r rD )r r )"__doc__
__future__r rj r6 r/ typingr r2 FLAGS_PLAIN_PATHr9 MESSAGE_LOSS_OBSERVABILITY_FLAGr __annotations__r
r4 r r r r, r< rA rC rO r[ rd rn rv ry r} r r r r r" r r <module>r s 4 # " " " " "
1
2 3 #? "
" " " "') ) ) ) ) (1y{{ 2 2 2 2
$ *) ) ) ):
9 9 9 9 B B B BD D D D(C C C C$< < < < D D D D . . . .G G G G 3 3 3 3 r defence360agent/internals/__pycache__/feature_flags.cpython-311.pyc 0000644 0000000 0000000 00000034475 00000000000 022303 0 ustar
r_j& U d Z ddlmZ ddlZddlZddlZddlmZ dZdZ dZ
dZ i a d e
d
< i ad e
d < e ad
e
d< dade
d< d1dZd2dZd3dZd4dZd5dZd6d Zd7d Zd8d"Zd9d%Zd7d&Zd8d'Z d:d(Z d:d)Z d;d<d.Z d=d/Z d>d0Z!dS )?av
Shared reader for the local feature flags file.
The file is written by:
- Go resident-agent FeatureFlags plugin (IM360 mode)
- Python FeatureFlagsSync plugin (AV mode)
Other subsystems (e.g. message_status_publisher) use this module
to check individual flag values at runtime.
Supported JSON shapes on disk (readers / ``is_enabled`` / ``get_params``):
- New shape ``{"flags": ["mqtt_tracking"], "params": {"flag": ["A", "B"]}}``
(mirrors the sync API response; carries per-flag string-list params).
- Legacy object ``{"mqtt_tracking": true, ...}`` (still accepted).
- JSON array of enabled names ``["mqtt_tracking"]`` (still accepted).
- Legacy wrapper ``{"flags": ["mqtt_tracking", ...]}`` (still accepted).
The sync API checksum collapses to the legacy sorted-names array when no
params are present, so this agent and older agents agree on the bool-only
case. With params, the canonical form expands to ``{"flags": [...], "params":
{...}}`` with all keys and list members sorted.
The sync plugin also writes ``FLAGS_PLAIN_PATH`` (``/var/imunify360/feature_flags``):
plain text, one enabled flag name per line (sorted), for scripts.
) annotationsN)Anyz"/var/imunify360/feature_flags.jsonz /var/imunify360/feature_flagsmqtt_tracked_methodsmessage_loss_observabilitydict[str, Any]
_cached_flagsdict[str, list[str]]_cached_paramsfrozenset[str]_cached_mqtt_methods float
_cached_mtimerawr returnc | i S t | t r#i }| D ] }t |t rd||< |S t | t r;| d }t |t rt | S | S i S )z@Map file JSON to a flat name->value dict for :func:`is_enabled`.NTflags)
isinstanceliststrdictget_normalize_flags_from_file)r outiteminners \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/feature_flags.pyr r 8 s
{ #t ! !D$$$
! D
#t eT " " 5-e44 4
I c @ t | t si S | d }t |t si S i }| D ]C\ }}t |t rt |t
s0d |D }|r|||< D|S )zExtract ``params`` mapping from new-shape file content.
Only the new ``{"flags": [...], "params": {name: [...]}}`` shape carries
params; every other (legacy) shape returns an empty mapping.
paramsc < g | ]}t |t |S r r ).0vs r
<listcomp>z%_params_from_file.<locals>.<listcomp>Y s' ;;;
1c(:(:;1;;;r )r r r itemsr r )r
raw_paramsr namevaluescleaneds r _params_from_filer, J s c4 ""J j$ ' ' "C"((** f$$$ Jvt,D,D ;;f;;; CI Jr +tuple[dict[str, Any], dict[str, list[str]]]c ^ t j t } n2# t $ r% i ai at ada t
t fcY S w xY w| t k rt
t fS t t 5 }t j | }d d d n # 1 swxY w Y t | at | an # t t j f$ r i ai aY nw xY wt t t" d a| a t
t fS )Nr
r" )ospathgetmtime
FLAGS_PATHOSErrorr r
frozensetr r openjsonloadr r, JSONDecodeErrorr MQTT_TRACKED_METHODS_FLAG)mtimefr s r _read_stater< _ sr - ,, - - -
({{
n,,,, -
n,,
*
)A,,C 2377
*3// T) *
%4b99 M . ((sE $' ,AA3C B( C (B,,C /B,0!C C/.C/c ( t \ } }| S Nr< )r _s r _read_flagsrA | s }}HE1 Lr c ( t \ } }|S r> r? )r@ r s r _read_paramsrC s
IAv Mr r list[str]c t | t t f s$t dt | j t
| }t d | D S )a Return sorted enabled flag names for JSON and plain-text sidecar.
Accepts the same shapes as :func:`_normalize_flags_from_file` (array,
flat map, ``{"flags": [...]}``) so checksums and sidecars match Go
``enabledNamesSortedForChecksum`` / :func:`is_enabled`.
z flags must be list or dict, not c 3 $ K | ] \ }}||V d S r> r" r$ kr% s r <genexpr>z,enabled_flag_names_sorted.<locals>.<genexpr> s+ 881a8!888888r ) r r r TypeErrortype__name__r sortedr' )r
normalizeds r enabled_flag_names_sortedrO sx edD\ * *
EtE{{/C E E
,E22J 88
0 0 2 2888 8 88r namesbytesc r t | }t j |dd S )z|JSON array bytes used for sync MD5 when no params are present
(matches correlation_api ``checksum_for_sync_flag_list``).T sort_keysindentrM r6 dumpsencode)rP ordereds r canonical_sync_flag_list_bytesr[ s2 UmmG :ga 8 8 8 ? ? A AAr r c |st | S t | d t | D d}t j |dd S )ae JSON bytes for the sync MD5 over the full response shape.
Mirrors correlation_api ``checksum_for_sync_response``: collapses to
the legacy sorted-names array when ``params`` is empty so old agents
keep matching, otherwise expands to the deterministic
``{"flags": [...], "params": {...}}`` form with all keys and list
members sorted.
c 4 i | ]\ }}|t | S r" rM rG s r
<dictcomp>z1canonical_sync_response_bytes.<locals>.<dictcomp> $ CCCDAq1fQiiCCCr r r TrS rT )r[ rM r' r6 rX rY rP r canonicals r canonical_sync_response_bytesrd su 5-e444 CCF6<<>>,B,BCCC I :i4 : : : A A C CCr r0 r c r t | d 5 }t j | }ddd n # 1 swxY w Y n## t t t j f$ r Y dS w xY wt
| }t | }t || }t j
|d S )zMD5 hex of the canonical sync-response form for ``path``.
Returns "" if the file is missing or invalid. Computes the same MD5
the server returned, so a matching checksum lets the agent skip
the response payload on the next sync.
zutf-8)encodingN F)usedforsecurity) r5 r6 r7 r3 UnicodeDecodeErrorr8 rO r, rd hashlibmd5 hexdigest)r0 r; r rP r payloads r !sync_checksum_hex_from_flags_filern s
$
)
)
) Q)A,,C ')= > rr %c * *E
s
#
#F+E6::G ;w 6 6 6 @ @ B BBs, A 4 A 8A 8A A A c d t d | D D }t j |dd S )z<On-disk legacy JSON: ``{flag: true, ...}`` with sorted keys.c i | ]}|d S )Tr" )r$ ns r r_ z2legacy_feature_flags_map_bytes.<locals>.<dictcomp> s KKKQDKKKr c < h | ]}t |t |S r" r# )r$ xs r <setcomp>z1legacy_feature_flags_map_bytes.<locals>.<setcomp> s' !I!I!IjC6H6H!I!!I!I!Ir TrS rT rW )rP ds r legacy_feature_flags_map_bytesrv sO KK&!I!IU!I!I!IJJKKKA :a4 2 2 2 9 9 ; ;;r c t | d t | D d}t j |dd S )zPersisted form for ``FLAGS_PATH`` carrying both flags and params.
Same canonical shape as ``canonical_sync_response_bytes`` so the file
is self-describing and round-trips through ``sync_checksum_hex_from_flags_file``.
c 4 i | ]\ }}|t | S r" r^ rG s r r_ z,sync_response_file_bytes.<locals>.<dictcomp> r` r ra TrS rT )rM r' r6 rX rY rb s r sync_response_file_bytesry s_ CCF6<<>>,B,BCCC I :i4 : : : A A C CCr c | t | }|sdS d | dz S )zPBody for ``FLAGS_PLAIN_PATH``: one name per line, trailing newline if non-empty.r
)rO joinrY )r rP s r $plain_text_payload_for_enabled_flagsr} s? %e , ,E s IIe t # + + - --r c t | t r)t j | dd S t dt
| j )zBSerialize dict flags for writing ``FLAGS_PATH`` (legacy map only).TrS rT zflags must be dict, not )r r r6 rX rY rJ rK rL )r s r $serialize_feature_flags_file_payloadr sX % Dz%4:::AACCC
EtE{{/CEE
F
FFr F flag_namedefaultboolc n t }| | }||S t | S )zReturn whether *flag_name* is enabled.
If the file is missing, unreadable, or the flag is absent,
*default* is returned. Defaults to False so unknown flags are
treated as disabled unless the caller explicitly opts in.
)rA r r )r r r values r
is_enabledr s4
MME IIi E } ;;r c ` t t | d S )zReturn the per-flag string params from the on-disk file.
Empty list when the file is missing/unreadable, the flag is unknown,
or the value did not come from the new structured shape (legacy
bool-only flags carry no params by definition).
r" )r rC r )r s r
get_paramsr s& ""9b11 2 22r c , t t S )u Frozen set of method names whose status events should be enriched
for MQTT tracing. Driven entirely by the server-side
``mqtt_tracked_methods`` flag's params list — the agent has no
hard-coded list, so adding/removing tracked types is a server-side
config change with no agent rollout.
Cached: ``_read_state`` pre-builds the frozenset and invalidates it
when the flags file's mtime changes. On the hot path — every
Reportable message in ``the_sink._call_unlocked`` — this is a single
``os.stat`` syscall plus an identity-stable frozenset return. Two
consecutive calls within the same mtime window return the same
instance.
)r< r r" r r r r s MMM r )r r r r )r r r r )r r- )r r )r r )r r r rD )rP rD r rQ )rP rD r r r rQ )r0 r r r )r r r rQ )F)r r r r r r )r r r rD )r r )"__doc__
__future__r rj r6 r/ typingr r2 FLAGS_PLAIN_PATHr9 MESSAGE_LOSS_OBSERVABILITY_FLAGr __annotations__r
r4 r r r r, r< rA rC rO r[ rd rn rv ry r} r r r r r" r r <module>r s 4 # " " " " "
1
2 3 #? "
" " " "') ) ) ) ) (1y{{ 2 2 2 2
$ *) ) ) ):
9 9 9 9 B B B BD D D D(C C C C$< < < < D D D D . . . .G G G G 3 3 3 3 r defence360agent/internals/__pycache__/geo.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006573 00000000000 021203 0 ustar
r_j ~ d dl mZ d dlmZmZmZmZ d dlmZ d dl m
Z
d dl m Z G d d Z
ed Zd S )
)contextmanager) IPv4Address IPv4Network IPv6Address IPv6Network)Union) CountryInfo)IPc z e Zd Zd Zdeeeeee f fdZ
deeeeee f fdZ deeeeee f fdZ dS )Readerc || _ d S )N)_geoip2_reader)self
geoip2_readers R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/geo.py__init__zReader.__init__
s + addressc ddl m} t j | }n# t $ r Y dS w xY w | j t |j }n # |$ r Y dS w xY w|r|j ndS )z
Returns geo country information from max mind's db request
:param address: ip or network address
e.g. '4.4.4.4, 1.2.0.0/16, 2001:678:4c::/48'
:return: maxmind's geo info
r )AddressNotFoundErrorN)
geoip2.errorsr r
adopt_to_ipvX_network
ValueErrorr countrystrnetwork_address)r r r ipobjs r getz
Reader.get
s 766666 )'22BB 44 %--c"2D.E.EFFCC# 44 "+s{{t+s
++,A A%$A%c B | | }|r|j S dS )za
:param address: valid ipv4 address
:return: maxmind's id of the country
N)r
geoname_idr r country_infos r get_idz
Reader.get_id, s+ xx(( + * *tr c B | | }|r|j S dS )ze
:param address: valid ipv4 address
:return: country code in ISO-3166 format
N)r iso_coder" s r get_codezReader.get_code; s+ xx(( ) ( (tr N)
__name__
__module__ __qualname__r r r r r r r r r$ r' r r r r s , , , , k; C
, , , ,>
k; C
k; C
r r c # K ddl } | j t j 5 }t | V ddd dS # 1 swxY w Y dS )zH
:return Reader obj: instance to be reused to it's method calls
r N)geoip2.databasedatabaser r DB)geoip2r s r readerr1 K s
/ / $=]#####$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $s A
AAN)
contextlibr ipaddressr r r r typingr defence360agent.contracts.configr defence360agent.utils.validater
r r1 r+ r r <module>r7 s % % % % % % H H H H H H H H H H H H 8 8 8 8 8 8 - - - - - -? ? ? ? ? ? ? ?D $ $ $ $ $r defence360agent/internals/__pycache__/geo.cpython-311.pyc 0000644 0000000 0000000 00000006573 00000000000 020244 0 ustar
r_j ~ d dl mZ d dlmZmZmZmZ d dlmZ d dl m
Z
d dl m Z G d d Z
ed Zd S )
)contextmanager) IPv4Address IPv4Network IPv6Address IPv6Network)Union) CountryInfo)IPc z e Zd Zd Zdeeeeee f fdZ
deeeeee f fdZ deeeeee f fdZ dS )Readerc || _ d S )N)_geoip2_reader)self
geoip2_readers R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/geo.py__init__zReader.__init__
s + addressc ddl m} t j | }n# t $ r Y dS w xY w | j t |j }n # |$ r Y dS w xY w|r|j ndS )z
Returns geo country information from max mind's db request
:param address: ip or network address
e.g. '4.4.4.4, 1.2.0.0/16, 2001:678:4c::/48'
:return: maxmind's geo info
r )AddressNotFoundErrorN)
geoip2.errorsr r
adopt_to_ipvX_network
ValueErrorr countrystrnetwork_address)r r r ipobjs r getz
Reader.get
s 766666 )'22BB 44 %--c"2D.E.EFFCC# 44 "+s{{t+s
++,A A%$A%c B | | }|r|j S dS )za
:param address: valid ipv4 address
:return: maxmind's id of the country
N)r
geoname_idr r country_infos r get_idz
Reader.get_id, s+ xx(( + * *tr c B | | }|r|j S dS )ze
:param address: valid ipv4 address
:return: country code in ISO-3166 format
N)r iso_coder" s r get_codezReader.get_code; s+ xx(( ) ( (tr N)
__name__
__module__ __qualname__r r r r r r r r r$ r' r r r r s , , , , k; C
, , , ,>
k; C
k; C
r r c # K ddl } | j t j 5 }t | V ddd dS # 1 swxY w Y dS )zH
:return Reader obj: instance to be reused to it's method calls
r N)geoip2.databasedatabaser r DB)geoip2r s r readerr1 K s
/ / $=]#####$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $s A
AAN)
contextlibr ipaddressr r r r typingr defence360agent.contracts.configr defence360agent.utils.validater
r r1 r+ r r <module>r7 s % % % % % % H H H H H H H H H H H H 8 8 8 8 8 8 - - - - - -? ? ? ? ? ? ? ?D $ $ $ $ $r defence360agent/internals/__pycache__/global_scope.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002376 00000000000 023057 0 ustar
r_j ^ d dl Z e j e Z G d de Z e ZdS ) Nc e Zd Zd Zd ZdS ) GlobalScopec ^ | | S # t $ r}t | d |d }~ww xY w)Nz is not in global scope)KeyErrorAttributeError)selfitemerrs [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/global_scope.py __getattr__zGlobalScope.__getattr__ sN L: L L L D!A!A!ABB K Ls
,',c R || v r t d| d S || |< d S )Nz"Name %s is already in global scope)loggerwarning)r keyvalues r __setattr__zGlobalScope.__setattr__
s3 $;; NN? E E E E E DIII N)__name__
__module__ __qualname__r r r r r r s5 L L L r r )logging getLoggerr r dictr gr r r <module>r s[ 8 $ $ $ KMMr defence360agent/internals/__pycache__/global_scope.cpython-311.pyc 0000644 0000000 0000000 00000002376 00000000000 022120 0 ustar
r_j ^ d dl Z e j e Z G d de Z e ZdS ) Nc e Zd Zd Zd ZdS ) GlobalScopec ^ | | S # t $ r}t | d |d }~ww xY w)Nz is not in global scope)KeyErrorAttributeError)selfitemerrs [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/global_scope.py __getattr__zGlobalScope.__getattr__ sN L: L L L D!A!A!ABB K Ls
,',c R || v r t d| d S || |< d S )Nz"Name %s is already in global scope)loggerwarning)r keyvalues r __setattr__zGlobalScope.__setattr__
s3 $;; NN? E E E E E DIII N)__name__
__module__ __qualname__r r r r r r s5 L L L r r )logging getLoggerr r dictr gr r r <module>r s[ 8 $ $ $ KMMr defence360agent/internals/__pycache__/iaid.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000052253 00000000000 021333 0 ustar
r_jF9 . d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm Z d dl
m Z d dl m
Z
d dlmZ d dlmZ d dlmZmZ d d lmZ d d
lmZmZ d d lmZ d d l m Z d d
l m Z m Z e e! Z"dZ#dZ$ dZ% G d de& Z' G d de Z(dS ) N) dataclass) getLogger)Path)Callable)urljoin)Request)APIAPIError)
LicenseCLN)atomic_rewritesafe_cancel_task)DAY)g)DeadlockDetectingLock
DeadlockError
< c e Zd ZdZdS )IAIDTokenErrorz$Can't get iaid token for any reason.N)__name__
__module__ __qualname____doc__ S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/iaid.pyr r & s ....r r c e Zd ZdZ eej e d Z eej e d Z eej e d Z
eej e d Z e d Z
e
dz Ze
dz Ze
d z Ze
d
z Zg g g d Z e Z ej Z ed
G d d Zedddefd Z e dddefd Z e d Z e d Z ed Z!e d Z"ed)d Z#e d Z$e d Z%e d efd Z&e d Z'e d*d# Z(e d$ Z)e d% Z*e d+d& Z+e d' Z,e d+d( Z-dS ),IndependentAgentIDAPIz/api/auth/agent/{}registeractivateloginz
token-infoz/var/imunify360iaidz
iaid-passwordz
iaid-tokenziaid-activated)r r! r" T)frozenc J e Zd ZU g dZeed< eed< eed< eed< eed< dS ) IndependentAgentIDAPI.TokenInfo)validr# license_status server_id
need_renewr' r# r( r) r* N)r r r __slots__bool__annotations__strr r r TokenInfor& > sX
r r/ r )timeoutcoroc K t j |t j d|z t z z d {V | | d {V d S )N )asynciosleeprandom randrange_TIMEOUT_MULTIPLICATOR)r1 attemptr0 argss r _retry_on_errorz%IndependentAgentIDAPI._retry_on_errorM s} m f&qG|447MM M
dDkr c
f d | j | D | j |< t | j | dk rXt j }| j | | | j |g|R ||d d S t d| d S )Nc : g | ]}| |S r )done).0tasks r
<listcomp>z3IndependentAgentIDAPI._add_task.<locals>.<listcomp>W s5
TYY[[
r r3 r9 r0 z Task %s already in retry queue) _taskslenr4 get_event_loopappend create_taskr; loggerinfo)clstyper1 r9 r0 r: loops r _add_taskz IndependentAgentIDAPI._add_taskU s
Z -
4 sz$ A % %)++D Jt # # 'C' # -4g
KK8$ ? ? ? ? ?r c @ | d| j d d S )Nr! r r9 )rM r! rJ s r add_initial_taskz&IndependentAgentIDAPI.add_initial_taskf s"
j#,
:::::r c K | j D ]N\ }}|D ]F}| s0t | d {V t d| GOd S )NzRetry task %s was canceled.)rC itemsr> r
rH rI )rJ rK tasksr@ s r shutdownz IndependentAgentIDAPI.shutdownj s :++-- E EKD%
E
Eyy{{ E*4000000000KK =tDDD
E E Er c 4 t j d j S )N_imunify)grpgetgrnamgr_gidr r r _gidzIndependentAgentIDAPI._gidr s |J''..r c j | j r| j S d S N) IAID_FILEexists read_textrP s r get_iaidz IndependentAgentIDAPI.get_iaidv s1 = ! ! -=**,, ,tr NPOSTc ddi}|| | t | |||r&t j | nd S )Nz Content-Typezapplication/json)methodheadersdata)updater jsondumpsencode)urlre rd kwargs_headerss r _requestz IndependentAgentIDAPI._request| sh "$67 OOG $ $ $ 06@F##**,,,D
r c L t d | j | j fD S )Nc 3 > K | ]}| V d S r] )r_ )r? iaid_files r <genexpr>z6IndependentAgentIDAPI.is_registered.<locals>.<genexpr> sB
r )allr^ IAID_PASSWORD_FILErP s r
is_registeredz#IndependentAgentIDAPI.is_registered s:
!mS-C D
r c K t rGt d{V t rt d | j d }|st d |S # t $ r}t d| |d}~ww xY w)zWEnsure that iaid token is up to date
Return iaid token or raise IAIDTokenError.NzIAID token is expiredascii)encodingzIAID_TOKEN_FILE is emptyz Can't get iaid token, reason: )r is_token_expiredr" r IAID_TOKEN_FILEr` strip Exception)rJ tokenes r get_tokenz IndependentAgentIDAPI.get_token s ! 1 1 3 3 >'--// / / / / / / /$5577
>$%<=== N'1171CCIIKKE
A$%?@@@L N N N !E!!E!EFFA M Ns $?B$ $
C.CCreturnc l K | d {V }d|i}| | j |d }| | d {V }| d }|t d| | j di |S # t $ r}t d|d| |d }~ww xY w) NzX-AuthGET)re rd
token_infozwrong response %rzincomplete token_info z: r )r rn
TOKEN_INFO
async_requestgetr
r/ TypeError)rJ
iaid_tokenre requestresultr} r~ s r _get_token_infoz%IndependentAgentIDAPI._get_token_info s ==??******
Z(,,s~wu,MM((11111111
<(( =.77 7 O 3=))5)) ) O O O(UUUAAFGGQ N Os B
B3B..B3c t j | j }|j }n# t $ r d}Y nw xY wt j |z
t k S )Ng )osstatrz st_mtimeFileNotFoundErrortimer )rJ r r s r ry z&IndependentAgentIDAPI.is_token_expired sb %73.//D }HH ! HHH y{{X%++s # 22Fr3 c
` K | j } | j 4 d {V | rF|r|r d d d d {V d S |,|| k r d d d d {V d S t }t j }|r||d< | j | j fi |} | | d {V }| j
d t t | j |d | j d| d t t | j |d | j d
| d {V n# t& $ r} t( d | | | j | j d k s | j d
k r/|t. k r$| d| j |||dz | n"t( d|j || Y d } ~ d d d d {V d S d } ~ ww xY w d d d d {V d S # 1 d {V swxY w Y d S # t8 $ r t( d| Y d S w xY w)Nr) T
missing_okr# backupuidgid permissionspasswordi )r r z0Something went wrong on register %r - attempt %s r r3 rO z-Failed to register (%s) after %s attempts: %rz<Received incorrect credentials on register after %s attempts) _register_locklockedru _get_credentials_tsdictr
get_server_idrn REGISTER_URLr IAID_ACTIVATED_FILEunlinkr r. r^ r_ r[ rt r! r
rH warning status_code
_MAX_TRIESrM r errorfull_urlr )
rJ forcetried_credentials_tsr9 was_waitingpayloadr) r r r~ s
r r z IndependentAgentIDAPI.register s (//11 I ) C
) C
) C
) C
) C
) C
) C
) C
)$$&& K C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) -8 033J3J3L3L L L C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) && & 4 6 6 5+4GK(&#,s'7CC7CC.)##4W#=#= = = = = = =F+22d2CCC< #CM** v "} 3 3 5 5 HHJJ$)
#C 233 z* " 5 < < > >$) ,,..((((((((W NNJ
- =C// =C//!J..
& L ! 0 #aK$+
& K # , # FFFgC
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
)0V )GC
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
)H LLN
s~
J I1J I12J ;I16F*7B3I1*
I4B
I>I1J II1 J 1
I;;J >I;?J %J-,J-c P K | j s | d{V dS t j }| d{V }|j | d k s |j | d k r7t
d| | d{V dS | j
}|j r|j |k s|j r | d{V dS dS )z!Check whether the agent activatedNstatusidzGot a corrupted token: %r)r r_ r! r r r r( r r) rH r
reactivater^ r` r' r# r* r" )rJ licr} r# s r ensure_is_activated_and_validz3IndependentAgentIDAPI.ensure_is_activated_and_valid
sJ &--// ,,.. F"$$))++++++++ 377 $
$
_
-
- LL4e < < <.."" " " " " " " " F}&&(({ ejD 0 0E4D 0))++ 1 0r c > | j j S r] )rt r r rP s r r z)IndependentAgentIDAPI._get_credentials_ts s %**,,55r c K | j r | t d< d S | s6t
d | d {V d S t j rL| t d< |
r| d {V d S t j }|s t
d d S | j
4 d {V | j r0| t d< d d d d {V d S | j }| j }| }| | j ||| }|t d< d} | | d {V | j | j d | d {V n# t0 $ r}t
d|| |j r|j d k rd}nr|j rI|j d
k s |j d k r3|t4 k r(| d | j |d
z |t: n"t
d|j || Y d }~nd }~ww xY wd d d d {V n# 1 d {V swxY w Y |r | d| d {V d S d S )Nr# z&need to register first before activatez9Can't continue iaid activation: no valid license is found)r# r licenseFTr z.Something went wrong on activate %r attempt %s r r r! r3 rB z-Failed to activate (%s) after %s attempts: %rr r ) r r_ ra r ru rH r r r is_freery r" r _activate_lockr^ r` rt r rn ACTIVATE_URLr touchrz r r
r r rM r! _ACTIVATE_MINIMUM_TIMEOUTr r ) rJ r9 r r# r credentials_tsr need_to_registerr~ s r r! z IndependentAgentIDAPI.activate! sc " ) ) + + AfI F "" NNC D D D,,.. F AfI##%%
"iikk!!!!!!! F"$$ NNK
F% 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " &--//
LLNN& 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " =**,,D-7799H 4 4 6 6Nll th # G AfI $ $
"''000000000'--///B #**d*;;;iikk!!!!!!!!C
D
= Q]c%9%9'+$$M #-- #1E1E *,,
MM" ! ' 9 " LLG ( 3
#2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 "f P,,T,OO O O O O O O O O O P PsD !7L+A0L 4I6L
K=B#K83L8K==L
L L c t K | j d | d {V d S )NTr )r r r! rP s r r z IndependentAgentIDAPI.reactivatek sF &&$&777llnn r c K | s t d d S | j }| j }| }| | j || } | | d {V }t t | j |d | j
d| d d S # t $ r}t d|| |t" k r]|j |j dk r"| d | j |d
z | nW|j d k r | d
| d {V n(t d|j || Y d }~d S Y d }~d S Y d }~d S d }~ww xY w)Nz#need to register first before login)r# r r} r r r z/Something wrong happened on login %r attempt %sr r" r3 rO r Tr z*Failed to login (%s) after %s attempts: %r)ru rH r r^ r` rt r rn LOGIN_URLr r r. rz r_ r[ r
r r r rM r" r r )rJ r9 r# r r r r r~ s r r" zIndependentAgentIDAPI.loginp sS "" LL> ? ? ? F}&&(()3355 0022,,s}4(,KK ,,W55555555F.
C'((w*1133HHJJ !
- NNA1g
##=(AMS,@,@MM GaK " ]c)) ,, " ' @$ s D
GB&G G)Nrb )FNr3 )r3 ).r r r API_PATHr r _BASE_URLformatr r r r r IAID_DIRr^ rt rz r rC r r r4 Lockr r r/ staticmethodr r; classmethodrM rQ rU r[ ra rn ru r r ry r r r r! r r" r r r r r * s #H73=(//**E*EFFL73=(//**E*EFFL
xw'?'?@@I (E(EFFJt%&&H6!I!O3 -O"%55 F
+*,,N!W\^^NYd FG H \ EF @ @ @8 @ @ @ [@ ; ; [; E E [E / / \/ [
\
[
N
N [
N Oi O O O [ O , , [, P P P [Pd [ $ 6 6 [6 GP GP GP [GPR [ ( ( ( [( ( (r r ))r4 rX rh r r6 r dataclassesr loggingr pathlibr typingr urllib.parser urllib.requestr defence360agent.api.serverr r
!defence360agent.contracts.licenser defence360agent.utilsr r
defence360agent.utils.commonr &defence360agent.internals.global_scoper 1defence360agent.internals.deadlock_detecting_lockr r r rH r r8 r RuntimeErrorr r r r r <module>r s
! ! ! ! ! ! " " " " " " 4 4 4 4 4 4 4 4 8 8 8 8 8 8 B B B B B B B B , , , , , , 4 4 4 4 4 4
8
/ / / / /\ / / /o o o o oC o o o o or defence360agent/internals/__pycache__/iaid.cpython-311.pyc 0000644 0000000 0000000 00000052253 00000000000 020374 0 ustar
r_jF9 . d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm Z d dl
m Z d dl m
Z
d dlmZ d dlmZ d dlmZmZ d d lmZ d d
lmZmZ d d lmZ d d l m Z d d
l m Z m Z e e! Z"dZ#dZ$ dZ% G d de& Z' G d de Z(dS ) N) dataclass) getLogger)Path)Callable)urljoin)Request)APIAPIError)
LicenseCLN)atomic_rewritesafe_cancel_task)DAY)g)DeadlockDetectingLock
DeadlockError
< c e Zd ZdZdS )IAIDTokenErrorz$Can't get iaid token for any reason.N)__name__
__module__ __qualname____doc__ S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/iaid.pyr r & s ....r r c e Zd ZdZ eej e d Z eej e d Z eej e d Z
eej e d Z e d Z
e
dz Ze
dz Ze
d z Ze
d
z Zg g g d Z e Z ej Z ed
G d d Zedddefd Z e dddefd Z e d Z e d Z ed Z!e d Z"ed)d Z#e d Z$e d Z%e d efd Z&e d Z'e d*d# Z(e d$ Z)e d% Z*e d+d& Z+e d' Z,e d+d( Z-dS ),IndependentAgentIDAPIz/api/auth/agent/{}registeractivateloginz
token-infoz/var/imunify360iaidz
iaid-passwordz
iaid-tokenziaid-activated)r r! r" T)frozenc J e Zd ZU g dZeed< eed< eed< eed< eed< dS ) IndependentAgentIDAPI.TokenInfo)validr# license_status server_id
need_renewr' r# r( r) r* N)r r r __slots__bool__annotations__strr r r TokenInfor& > sX
r r/ r )timeoutcoroc K t j |t j d|z t z z d {V | | d {V d S )N )asynciosleeprandom randrange_TIMEOUT_MULTIPLICATOR)r1 attemptr0 argss r _retry_on_errorz%IndependentAgentIDAPI._retry_on_errorM s} m f&qG|447MM M
dDkr c
f d | j | D | j |< t | j | dk rXt j }| j | | | j |g|R ||d d S t d| d S )Nc : g | ]}| |S r )done).0tasks r
<listcomp>z3IndependentAgentIDAPI._add_task.<locals>.<listcomp>W s5
TYY[[
r r3 r9 r0 z Task %s already in retry queue) _taskslenr4 get_event_loopappend create_taskr; loggerinfo)clstyper1 r9 r0 r: loops r _add_taskz IndependentAgentIDAPI._add_taskU s
Z -
4 sz$ A % %)++D Jt # # 'C' # -4g
KK8$ ? ? ? ? ?r c @ | d| j d d S )Nr! r r9 )rM r! rJ s r add_initial_taskz&IndependentAgentIDAPI.add_initial_taskf s"
j#,
:::::r c K | j D ]N\ }}|D ]F}| s0t | d {V t d| GOd S )NzRetry task %s was canceled.)rC itemsr> r
rH rI )rJ rK tasksr@ s r shutdownz IndependentAgentIDAPI.shutdownj s :++-- E EKD%
E
Eyy{{ E*4000000000KK =tDDD
E E Er c 4 t j d j S )N_imunify)grpgetgrnamgr_gidr r r _gidzIndependentAgentIDAPI._gidr s |J''..r c j | j r| j S d S N) IAID_FILEexists read_textrP s r get_iaidz IndependentAgentIDAPI.get_iaidv s1 = ! ! -=**,, ,tr NPOSTc ddi}|| | t | |||r&t j | nd S )Nz Content-Typezapplication/json)methodheadersdata)updater jsondumpsencode)urlre rd kwargs_headerss r _requestz IndependentAgentIDAPI._request| sh "$67 OOG $ $ $ 06@F##**,,,D
r c L t d | j | j fD S )Nc 3 > K | ]}| V d S r] )r_ )r? iaid_files r <genexpr>z6IndependentAgentIDAPI.is_registered.<locals>.<genexpr> sB
r )allr^ IAID_PASSWORD_FILErP s r
is_registeredz#IndependentAgentIDAPI.is_registered s:
!mS-C D
r c K t rGt d{V t rt d | j d }|st d |S # t $ r}t d| |d}~ww xY w)zWEnsure that iaid token is up to date
Return iaid token or raise IAIDTokenError.NzIAID token is expiredascii)encodingzIAID_TOKEN_FILE is emptyz Can't get iaid token, reason: )r is_token_expiredr" r IAID_TOKEN_FILEr` strip Exception)rJ tokenes r get_tokenz IndependentAgentIDAPI.get_token s ! 1 1 3 3 >'--// / / / / / / /$5577
>$%<=== N'1171CCIIKKE
A$%?@@@L N N N !E!!E!EFFA M Ns $?B$ $
C.CCreturnc l K | d {V }d|i}| | j |d }| | d {V }| d }|t d| | j di |S # t $ r}t d|d| |d }~ww xY w) NzX-AuthGET)re rd
token_infozwrong response %rzincomplete token_info z: r )r rn
TOKEN_INFO
async_requestgetr
r/ TypeError)rJ
iaid_tokenre requestresultr} r~ s r _get_token_infoz%IndependentAgentIDAPI._get_token_info s ==??******
Z(,,s~wu,MM((11111111
<(( =.77 7 O 3=))5)) ) O O O(UUUAAFGGQ N Os B
B3B..B3c t j | j }|j }n# t $ r d}Y nw xY wt j |z
t k S )Ng )osstatrz st_mtimeFileNotFoundErrortimer )rJ r r s r ry z&IndependentAgentIDAPI.is_token_expired sb %73.//D }HH ! HHH y{{X%++s # 22Fr3 c
` K | j } | j 4 d {V | rF|r|r d d d d {V d S |,|| k r d d d d {V d S t }t j }|r||d< | j | j fi |} | | d {V }| j
d t t | j |d | j d| d t t | j |d | j d
| d {V n# t& $ r} t( d | | | j | j d k s | j d
k r/|t. k r$| d| j |||dz | n"t( d|j || Y d } ~ d d d d {V d S d } ~ ww xY w d d d d {V d S # 1 d {V swxY w Y d S # t8 $ r t( d| Y d S w xY w)Nr) T
missing_okr# backupuidgid permissionspasswordi )r r z0Something went wrong on register %r - attempt %s r r3 rO z-Failed to register (%s) after %s attempts: %rz<Received incorrect credentials on register after %s attempts) _register_locklockedru _get_credentials_tsdictr
get_server_idrn REGISTER_URLr IAID_ACTIVATED_FILEunlinkr r. r^ r_ r[ rt r! r
rH warning status_code
_MAX_TRIESrM r errorfull_urlr )
rJ forcetried_credentials_tsr9 was_waitingpayloadr) r r r~ s
r r z IndependentAgentIDAPI.register s (//11 I ) C
) C
) C
) C
) C
) C
) C
) C
)$$&& K C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) -8 033J3J3L3L L L C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) && & 4 6 6 5+4GK(&#,s'7CC7CC.)##4W#=#= = = = = = =F+22d2CCC< #CM** v "} 3 3 5 5 HHJJ$)
#C 233 z* " 5 < < > >$) ,,..((((((((W NNJ
- =C// =C//!J..
& L ! 0 #aK$+
& K # , # FFFgC
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
)0V )GC
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
) C
)H LLN
s~
J I1J I12J ;I16F*7B3I1*
I4B
I>I1J II1 J 1
I;;J >I;?J %J-,J-c P K | j s | d{V dS t j }| d{V }|j | d k s |j | d k r7t
d| | d{V dS | j
}|j r|j |k s|j r | d{V dS dS )z!Check whether the agent activatedNstatusidzGot a corrupted token: %r)r r_ r! r r r r( r r) rH r
reactivater^ r` r' r# r* r" )rJ licr} r# s r ensure_is_activated_and_validz3IndependentAgentIDAPI.ensure_is_activated_and_valid
sJ &--// ,,.. F"$$))++++++++ 377 $
$
_
-
- LL4e < < <.."" " " " " " " " F}&&(({ ejD 0 0E4D 0))++ 1 0r c > | j j S r] )rt r r rP s r r z)IndependentAgentIDAPI._get_credentials_ts s %**,,55r c K | j r | t d< d S | s6t
d | d {V d S t j rL| t d< |
r| d {V d S t j }|s t
d d S | j
4 d {V | j r0| t d< d d d d {V d S | j }| j }| }| | j ||| }|t d< d} | | d {V | j | j d | d {V n# t0 $ r}t
d|| |j r|j d k rd}nr|j rI|j d
k s |j d k r3|t4 k r(| d | j |d
z |t: n"t
d|j || Y d }~nd }~ww xY wd d d d {V n# 1 d {V swxY w Y |r | d| d {V d S d S )Nr# z&need to register first before activatez9Can't continue iaid activation: no valid license is found)r# r licenseFTr z.Something went wrong on activate %r attempt %s r r r! r3 rB z-Failed to activate (%s) after %s attempts: %rr r ) r r_ ra r ru rH r r r is_freery r" r _activate_lockr^ r` rt r rn ACTIVATE_URLr touchrz r r
r r rM r! _ACTIVATE_MINIMUM_TIMEOUTr r ) rJ r9 r r# r credentials_tsr need_to_registerr~ s r r! z IndependentAgentIDAPI.activate! sc " ) ) + + AfI F "" NNC D D D,,.. F AfI##%%
"iikk!!!!!!! F"$$ NNK
F% 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " &--//
LLNN& 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " =**,,D-7799H 4 4 6 6Nll th # G AfI $ $
"''000000000'--///B #**d*;;;iikk!!!!!!!!C
D
= Q]c%9%9'+$$M #-- #1E1E *,,
MM" ! ' 9 " LLG ( 3
#2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 " 2 "f P,,T,OO O O O O O O O O O P PsD !7L+A0L 4I6L
K=B#K83L8K==L
L L c t K | j d | d {V d S )NTr )r r r! rP s r r z IndependentAgentIDAPI.reactivatek sF &&$&777llnn r c K | s t d d S | j }| j }| }| | j || } | | d {V }t t | j |d | j
d| d d S # t $ r}t d|| |t" k r]|j |j dk r"| d | j |d
z | nW|j d k r | d
| d {V n(t d|j || Y d }~d S Y d }~d S Y d }~d S d }~ww xY w)Nz#need to register first before login)r# r r} r r r z/Something wrong happened on login %r attempt %sr r" r3 rO r Tr z*Failed to login (%s) after %s attempts: %r)ru rH r r^ r` rt r rn LOGIN_URLr r r. rz r_ r[ r
r r r rM r" r r )rJ r9 r# r r r r r~ s r r" zIndependentAgentIDAPI.loginp sS "" LL> ? ? ? F}&&(()3355 0022,,s}4(,KK ,,W55555555F.
C'((w*1133HHJJ !
- NNA1g
##=(AMS,@,@MM GaK " ]c)) ,, " ' @$ s D
GB&G G)Nrb )FNr3 )r3 ).r r r API_PATHr r _BASE_URLformatr r r r r IAID_DIRr^ rt rz r rC r r r4 Lockr r r/ staticmethodr r; classmethodrM rQ rU r[ ra rn ru r r ry r r r r! r r" r r r r r * s #H73=(//**E*EFFL73=(//**E*EFFL
xw'?'?@@I (E(EFFJt%&&H6!I!O3 -O"%55 F
+*,,N!W\^^NYd FG H \ EF @ @ @8 @ @ @ [@ ; ; [; E E [E / / \/ [
\
[
N
N [
N Oi O O O [ O , , [, P P P [Pd [ $ 6 6 [6 GP GP GP [GPR [ ( ( ( [( ( (r r ))r4 rX rh r r6 r dataclassesr loggingr pathlibr typingr urllib.parser urllib.requestr defence360agent.api.serverr r
!defence360agent.contracts.licenser defence360agent.utilsr r
defence360agent.utils.commonr &defence360agent.internals.global_scoper 1defence360agent.internals.deadlock_detecting_lockr r r rH r r8 r RuntimeErrorr r r r r <module>r s
! ! ! ! ! ! " " " " " " 4 4 4 4 4 4 4 4 8 8 8 8 8 8 B B B B B B B B , , , , , , 4 4 4 4 4 4
8
/ / / / /\ / / /o o o o oC o o o o or defence360agent/internals/__pycache__/lazy_load.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001077 00000000000 022401 0 ustar
r_j G d d Z dS )c e Zd ZdZdZdS )
CoreSource)z"defence360agent.contracts.messages)zdefence360agent.simple_rpcz0defence360agent.feature_management.rpc.endpointsN)__name__
__module__ __qualname__MESSAGES ENDPOINTS X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/lazy_load.pyr r s 6HIIIr
r N)r r r
r <module>r s7 r
defence360agent/internals/__pycache__/lazy_load.cpython-311.pyc 0000644 0000000 0000000 00000001077 00000000000 021442 0 ustar
r_j G d d Z dS )c e Zd ZdZdZdS )
CoreSource)z"defence360agent.contracts.messages)zdefence360agent.simple_rpcz0defence360agent.feature_management.rpc.endpointsN)__name__
__module__ __qualname__MESSAGES ENDPOINTS X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/lazy_load.pyr r s 6HIIIr
r N)r r r
r <module>r s7 r
defence360agent/internals/__pycache__/logger.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000051426 00000000000 021705 0 ustar
r_j"> d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
m Z d dl m
Z
d dlZd dlZd dlmZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d lm Z ej d
d Z ej e! Z"d#d
Z# G d d Z$ e
d d Z%d Z&d Z'd Z(d Z)d Z*d Z+d Z,d Z-de.fdZ/d Z0d Z1e
d e.fd Z2e
d e.fd Z3 G d! d" Z4dS )$ N)contextmanagersuppress) lru_cache)configsentry)
AcronisBackup)Logger)Sentry)antivirus_mode is_root_user)tagsIMUNIFY360_LOGGING_PREFIX Fc t j }n# t t f$ r d}Y nw xY w|rt j t j | t j j d t j
5 }t j
D ]\ }}| || dt j d i|_ d d d n # 1 swxY w Y dddS d d
dS ) NTon)dsndebugreleaseattach_stacktraceid server_idERRORz-sentry_sdk.integrations.logging.SentryHandler)levelclassNOTSETzlogging.NullHandler)r
ENABLEKeyErrorAssertionError
sentry_sdkinitDSNr CoreVERSIONconfigure_scoper r
itemsset_tagtaguser)r error_reportingscoper' values U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/logger.py _sentry_initr- sR - n %
K' "
'
)
) 9U $kmm 1 1 3 3
*
*
U
c5))))
; 7 78EJ 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9
D
*
s %%.A CC Cc H e Zd Zdej j z Zed Zd Z dS )_LoggerDynConfigz /var/log/%sc x dt j j dt j pt j S )Nz /var/log/z _user_logs/)r r" PRODUCTgetpassgetuserosgetuid r,
_user_log_dirz _LoggerDynConfig._user_log_dir: s7
K O , ,
r7 c , t }|r| j n| | _ dg ddg ddg dddt ddd| j z d d
d ddd | j z d d
d ddd
| j z d d
d ddd| j z d d
d ddd| j z d d
d dddddddd| j z d d
dddg ddddd t
d idd t
d idd id!d"d#| _ dg d| j d$ d%< ddt j | j t j d d
d| j d& d'< |s^| j d& D ]@}|
d( d k r#d)|d(< t j |d*< t j |d+< ?d S d S ),NDEBUG)r handlersINFO)network"defence360agent.internals.the_sink
event_hook WARNING abstimestampz %s/error.logzlogging.FileHandlerutf8)r formatterfilenamer encodingz%s/network.logz %s/debug.logz%s/console.log eventhookz %s/hook.logzlogging.StreamHandlerzext://sys.stderr)rD r streamr reltimestampz%s/process_message.log)rD r rE r rF )r error_log network_log debug_log console_loghook_logconsoleprocess_message_logr )rM rJ r logsformatz*%(levelname)-7s [+%(relativeCreated)5dms] z%(name)50s|%(message)sz %(levelname)-7s [%(asctime)s] z%(name)s: %(message)sz%(created)d : %(message)s)rI rB rG F)loggersversionr; rootmkdir
formattersdisable_existing_loggersrS AcronisClientInstallerr; acronis_installer_logr z$logging.handlers.RotatingFileHandlermaxBytes backupCount)r
_ROOT_LOG_DIRr8 log_dirr- PREFIXmutableDictConfigr4 pathjoinr LOG_NAMEvaluesgetConfigMAX_LOG_FILE_SIZE BACKUP_COUNT)selfis_roothandlers r, __init__z_LoggerDynConfig.__init__A s ..-4Nt))$:L:L:N:N
% " % "7 7 $ " &.. &!/ . = 2 & %!/ 04< ? 2 & %!/ . = 2 & $!/ 04< ? 2 & $!, - < 2 & "0 4 0 # "0 % 84< G 2 & ( (W7 7r " :!: : :! ' ' ' '! '(C D ).Gd"
d"
N G
G
y)*BC
( T\=3IJJ* G
G
z*+BC
A 1*=DDFF
A
A;;w''+@@@'MGG$*0*BGJ'-3-@GM*
A
A
A
Ar7 N)
__name__
__module__ __qualname__r r" r1 r] staticmethodr8 rl r6 r7 r, r/ r/ 7 sU !FK$77M
\
BA BA BA BA BAr7 r/ r@ c t S N)r/ r6 r7 r,
_late_initrs s r7 c t t 5 t j d cddd S # 1 swxY w Y dS )ay
:return bool: True if python interpreter is being run in CageFS container,
otherwise False
:raise: never
Current implementation simply checks "/var/.cagefs" presence, as
Anton Volkov consulted us to do.
Placing this function not in 'subsys' package, because 'logger' module
is one of cornerstones dependency for 'subsys' package as well.
z /var/.cagefsN)r OSErrorr4 ra existsr6 r7 r, _we_are_in_cagefsrw s
' . .w~~n--. . . . . . . . . . . . . . . . . .s AAAc d } || | t j | D ]d\ }}}|D ],} |t j || | -|D ],} |t j || | -edS )zChange file/dir modes recursively.
Starting at dirname, change all inner directory permissions to dir_perm,
file permissions to file_perm
Permission errors are logged to stderr and are ignored in any case.
c t j | | d S # t $ r>}t j d | | Y d }~d S d }~ww xY w)Nz [WARNING] cannot chmod on {}: {})r4 chmodPermissionErrorsysstderrwriterR )
file_dir_path
permissiones r, _os_chmodz"_chmod_log_dirs.<locals>._os_chmod s H]J / / / / / J 299-KK
s
A!3A A!N)r4 walkra rb ) dirnamedir_perm file_permr ra dirsfiles directorynames r, _chmod_log_dirsr s Igx WW - - ; ;dE ? ?I Ibgll433X > > > > ; ;D Ibgll4.. : : : : ;; ;r7 c * t j d rdS t j t j } t j | t j d t | t j t j
t j
t j t t _ dS # t$ $ re t' sSt) j t j t j dt j j z Y dS Y dS t4 $ rT t) j t j t j dt j j z Y dS w xY w)z>
Re-catch with _LoggerDynConfig and re-open log files
IMUNIFY360_DISABLE_LOGGINGTexist_ok)filez %s logger is not available.
N)r4 getenvr
cached_fillrs r^ makedirsrf LOG_DIR_PERMr
LOG_FILE_PERMloggingr
dictConfigr` _log_uncaught_exceptionsr|
excepthookru rw traceback print_excr} r~ r" r1 Exception)r^ s r, reconfigurer s
y-.. 6 6 ll*G K!4t D D D D GV%8&:N O O O N % %jll&D E E E, 6CNNN+
%&&
#4444
3fk6II
SZ 0 0 0 0 J /&+2EE
s B C A(F5AFFc t | t rt j | || d S t d| ||f d S )Nzuncaught exception)exc_info)
issubclassKeyboardInterruptr| __excepthook__loggercritical)exc_type exc_value
exc_tracebacks r, r r s` ( -.. 8Y
>>>
OO )]'K r7 c t | 5 }t j | }d d d n # 1 swxY w Y t j | t
d S rr )openyaml safe_loadrs r` updater )rE config_filer s r, update_logging_config_from_filer $ s
h -; ,,- - - - - - - - - - - - - - -LL"))&111MMMMMs 155c t j j } t j d D ].}| t j | j /d | D S )NrS c g | ]C}t |d r1t |j d r |j t j k <|j DS )rH fileno)hasattrrH r| r} ).0hs r,
<listcomp>zget_fds.<locals>.<listcomp>1 s_
1h
AHh ' '
H
" "
# " "r7 )r rU r; rs r` keysextend getLogger)r; _loggers r, get_fdsr , sw |$H <<1)<AACC = =)'22;<<<< r7 c l d t j d D S )Nc , g | ]\ }}d |v |d S )rE r6 )r _rd s r, r z&get_log_file_names.<locals>.<listcomp>; s6 Av z r7 r; )rs r` r% r6 r7 r, get_log_file_namesr : s; # 7
CIIKK r7 c | t j v r,t j dt j | j z S t j d| z S )Nznetwork.)r| modulesr r rm )r s r, getNetworkLoggerr B sE s{ ck$.?.H!HIII d!2333r7 returnc ( t j S )z|
Return base log directory for the product.
Supposed to be used by clients to build the path to their own logs.
)rs r^ r6 r7 r, r^ r^ M s
<< r7 c t j r8t j d d d d | dk r8t j d d d d | dk r8t j d d d d
| d k r2t j d d d
t j d d d d t d S )NrS rY r; rZ r= rK r> rP rU rL r? rN )r disabledrs r` appendr )verboses r, setLogLevelr U s * &y12JK
&(
)
)
)!|| &y1)<
&
!|| &y1 0
f 2333!|| &v.z:AA+NNNLL"9-l;JGNN MMMMMr7 c f | t j d d d< t dS )z'
also results in reconfigure()
r; rO r N)rs r` r ) newloglevels r, setConsoleLogLevelr l s4 LL":.y9 MMMMMr7 scan_idc # J K t j t j d }t |d 5 }| t j d d| d |V | d d d d d S # 1 swxY w Y d S )Nzaibolit_actions.loga%Y-%m-%d %H:%M:%S |
) r4 ra rb rs r^ r r~ timestrftime)r ra fs r, openAibolitActionsLogr x s
7<<
,.C D DD
dC A 4=!455FF'FFFGGG s ABB B c # z K t j }t j |d t j |d }t
|d 5 }| t j d d| d |V | d d d d d S # 1 swxY w Y d S )NTr zmds_actions.logr r r r )
rs r^ r4 r ra rb r r~ r r )r r^ ra r s r, openMdsActionsLogr s ll"GK$''''
7<<!2 3 3D
dC A 4=!455FF'FFFGGG s AB00B47B4c 4 e Zd Z G d d Zd Zd ZdS )EventHookLoggerc B e Zd Z G d d Zd Zd dZd Zd ZdS )
EventHookLogger._EventLoggerc 8 e Zd ZdZd Zd Zd Zd
dZd Zd Z d S ) (EventHookLogger._EventLogger._HookLoggerzD{uuid:s} : {action:s} {native:s}: {event:s} : {subtype:s} : {path:s}c || _ |j | _ |j | _ |j | _ |j | _ || _ d S rr )ra eventsubtypeuuidlognative)ri parentra r s r, rl z1EventHookLogger._EventLogger._HookLogger.__init__ s8 #\
%~ "K !: $ r7 c | S rr r6 ri s r, __enter__z2EventHookLogger._EventLogger._HookLogger.__enter__ s r7 c d S rr r6 ri r exc_valexc_tbs r, __exit__z1EventHookLogger._EventLogger._HookLogger.__exit__ s r7 r c t | j || j rdnd| j | j | j d} | j j di |}|rd ||g }| | d S )Nznative r )r actionr r r ra z : r6 )
strr r r r ra tplrR rb r )ri r messagedatamsgs r, _logz-EventHookLogger._EventLogger._HookLogger._log s NN $+/; >iiB !Z #| I
&dho---- 5 **c7^44C
r7 c 0 | d d S )Nstarted)r r s r, beginz.EventHookLogger._EventLogger._HookLogger.begin s )$$$$$r7 c |dk rdnd}|r$d |t | g }|rBt |t r| d }d ||g }| d| d S ) Nr OKr :backslashreplace)errors
done)rb r
isinstancebytesdecoder )ri exit_codeerrr s r, finishz/EventHookLogger._EventLogger._HookLogger.finish s "+q..$$g B !hhY '@ A AG 8!#u-- D !jj0Bj C C "ii# 7 7G &'*****r7 N)r )
rm rn ro r rl r r r r r r6 r7 r, _HookLoggerr s} 5
%
%
%
%
%
%
+
+
+
+
+r7 r c j || _ || _ t j | _ |j | _ d S rr )r r r uuid4r )ri r r r s r, rl z%EventHookLogger._EventLogger.__init__ s* DJ"DL
DI zDHHHr7 Fc 2 | | || S )N)r )r )ri ra r s r, __call__z%EventHookLogger._EventLogger.__call__ s ##D$v#>> >r7 c | S rr r6 r s r, r z&EventHookLogger._EventLogger.__enter__ s Kr7 c d S rr r6 r s r, r z%EventHookLogger._EventLogger.__exit__ s Dr7 NF)rm rn ro r rl r r r r6 r7 r, _EventLoggerr s~ 0 + 0 + 0 + 0 + 0 + 0 + 0 + 0 +d " " " ? ? ? ? r7 r c F t j d }|j | _ d S )Nr? )r r infor )ri r s r, rl zEventHookLogger.__init__ s "<00;r7 c 0 | | || S rr )r )ri r r s r, r zEventHookLogger.__call__ s ug666r7 N)rm rn ro r rl r r6 r7 r, r r sc @ @ @ @ @ @ @ @D 7 7 7 7 7r7 r r )5r2 r logging.configlogging.handlersr4 r| r r r
contextlibr r functoolsr r r defence360agent.contractsr r defence360agent.contracts.configr r rf r
defence360agent.utilsr r defence360agent.applicationr
environre r_ r rm r r- r/ rs rw r r r r r r r r r^ r r r r r r6 r7 r, <module>r s
/ / / / / / / / 4 4 4 4 4 4 4 4 : : : : : : = = = = = = 3 3 3 3 3 3 > > > > > > > > , , , , , , 3R 8 8 8 $ $
:LA LA LA LA LA LA LA LA^ 1
.
.
. ; ; ;2#6 #6 #6L 4 4 4 . 3 s H7 H7 H7 H7 H7 H7 H7 H7 H7 H7r7 defence360agent/internals/__pycache__/logger.cpython-311.pyc 0000644 0000000 0000000 00000051426 00000000000 020746 0 ustar
r_j"> d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
m Z d dl m
Z
d dlZd dlZd dlmZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d lm Z ej d
d Z ej e! Z"d#d
Z# G d d Z$ e
d d Z%d Z&d Z'd Z(d Z)d Z*d Z+d Z,d Z-de.fdZ/d Z0d Z1e
d e.fd Z2e
d e.fd Z3 G d! d" Z4dS )$ N)contextmanagersuppress) lru_cache)configsentry)
AcronisBackup)Logger)Sentry)antivirus_mode is_root_user)tagsIMUNIFY360_LOGGING_PREFIX Fc t j }n# t t f$ r d}Y nw xY w|rt j t j | t j j d t j
5 }t j
D ]\ }}| || dt j d i|_ d d d n # 1 swxY w Y dddS d d
dS ) NTon)dsndebugreleaseattach_stacktraceid server_idERRORz-sentry_sdk.integrations.logging.SentryHandler)levelclassNOTSETzlogging.NullHandler)r
ENABLEKeyErrorAssertionError
sentry_sdkinitDSNr CoreVERSIONconfigure_scoper r
itemsset_tagtaguser)r error_reportingscoper' values U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/logger.py _sentry_initr- sR - n %
K' "
'
)
) 9U $kmm 1 1 3 3
*
*
U
c5))))
; 7 78EJ 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9
D
*
s %%.A CC Cc H e Zd Zdej j z Zed Zd Z dS )_LoggerDynConfigz /var/log/%sc x dt j j dt j pt j S )Nz /var/log/z _user_logs/)r r" PRODUCTgetpassgetuserosgetuid r,
_user_log_dirz _LoggerDynConfig._user_log_dir: s7
K O , ,
r7 c , t }|r| j n| | _ dg ddg ddg dddt ddd| j z d d
d ddd | j z d d
d ddd
| j z d d
d ddd| j z d d
d ddd| j z d d
d dddddddd| j z d d
dddg ddddd t
d idd t
d idd id!d"d#| _ dg d| j d$ d%< ddt j | j t j d d
d| j d& d'< |s^| j d& D ]@}|
d( d k r#d)|d(< t j |d*< t j |d+< ?d S d S ),NDEBUG)r handlersINFO)network"defence360agent.internals.the_sink
event_hook WARNING abstimestampz %s/error.logzlogging.FileHandlerutf8)r formatterfilenamer encodingz%s/network.logz %s/debug.logz%s/console.log eventhookz %s/hook.logzlogging.StreamHandlerzext://sys.stderr)rD r streamr reltimestampz%s/process_message.log)rD r rE r rF )r error_log network_log debug_log console_loghook_logconsoleprocess_message_logr )rM rJ r logsformatz*%(levelname)-7s [+%(relativeCreated)5dms] z%(name)50s|%(message)sz %(levelname)-7s [%(asctime)s] z%(name)s: %(message)sz%(created)d : %(message)s)rI rB rG F)loggersversionr; rootmkdir
formattersdisable_existing_loggersrS AcronisClientInstallerr; acronis_installer_logr z$logging.handlers.RotatingFileHandlermaxBytes backupCount)r
_ROOT_LOG_DIRr8 log_dirr- PREFIXmutableDictConfigr4 pathjoinr LOG_NAMEvaluesgetConfigMAX_LOG_FILE_SIZE BACKUP_COUNT)selfis_roothandlers r, __init__z_LoggerDynConfig.__init__A s ..-4Nt))$:L:L:N:N
% " % "7 7 $ " &.. &!/ . = 2 & %!/ 04< ? 2 & %!/ . = 2 & $!/ 04< ? 2 & $!, - < 2 & "0 4 0 # "0 % 84< G 2 & ( (W7 7r " :!: : :! ' ' ' '! '(C D ).Gd"
d"
N G
G
y)*BC
( T\=3IJJ* G
G
z*+BC
A 1*=DDFF
A
A;;w''+@@@'MGG$*0*BGJ'-3-@GM*
A
A
A
Ar7 N)
__name__
__module__ __qualname__r r" r1 r] staticmethodr8 rl r6 r7 r, r/ r/ 7 sU !FK$77M
\
BA BA BA BA BAr7 r/ r@ c t S N)r/ r6 r7 r,
_late_initrs s r7 c t t 5 t j d cddd S # 1 swxY w Y dS )ay
:return bool: True if python interpreter is being run in CageFS container,
otherwise False
:raise: never
Current implementation simply checks "/var/.cagefs" presence, as
Anton Volkov consulted us to do.
Placing this function not in 'subsys' package, because 'logger' module
is one of cornerstones dependency for 'subsys' package as well.
z /var/.cagefsN)r OSErrorr4 ra existsr6 r7 r, _we_are_in_cagefsrw s
' . .w~~n--. . . . . . . . . . . . . . . . . .s AAAc d } || | t j | D ]d\ }}}|D ],} |t j || | -|D ],} |t j || | -edS )zChange file/dir modes recursively.
Starting at dirname, change all inner directory permissions to dir_perm,
file permissions to file_perm
Permission errors are logged to stderr and are ignored in any case.
c t j | | d S # t $ r>}t j d | | Y d }~d S d }~ww xY w)Nz [WARNING] cannot chmod on {}: {})r4 chmodPermissionErrorsysstderrwriterR )
file_dir_path
permissiones r, _os_chmodz"_chmod_log_dirs.<locals>._os_chmod s H]J / / / / / J 299-KK
s
A!3A A!N)r4 walkra rb ) dirnamedir_perm file_permr ra dirsfiles directorynames r, _chmod_log_dirsr s Igx WW - - ; ;dE ? ?I Ibgll433X > > > > ; ;D Ibgll4.. : : : : ;; ;r7 c * t j d rdS t j t j } t j | t j d t | t j t j
t j
t j t t _ dS # t$ $ re t' sSt) j t j t j dt j j z Y dS Y dS t4 $ rT t) j t j t j dt j j z Y dS w xY w)z>
Re-catch with _LoggerDynConfig and re-open log files
IMUNIFY360_DISABLE_LOGGINGTexist_ok)filez %s logger is not available.
N)r4 getenvr
cached_fillrs r^ makedirsrf LOG_DIR_PERMr
LOG_FILE_PERMloggingr
dictConfigr` _log_uncaught_exceptionsr|
excepthookru rw traceback print_excr} r~ r" r1 Exception)r^ s r, reconfigurer s
y-.. 6 6 ll*G K!4t D D D D GV%8&:N O O O N % %jll&D E E E, 6CNNN+
%&&
#4444
3fk6II
SZ 0 0 0 0 J /&+2EE
s B C A(F5AFFc t | t rt j | || d S t d| ||f d S )Nzuncaught exception)exc_info)
issubclassKeyboardInterruptr| __excepthook__loggercritical)exc_type exc_value
exc_tracebacks r, r r s` ( -.. 8Y
>>>
OO )]'K r7 c t | 5 }t j | }d d d n # 1 swxY w Y t j | t
d S rr )openyaml safe_loadrs r` updater )rE config_filer s r, update_logging_config_from_filer $ s
h -; ,,- - - - - - - - - - - - - - -LL"))&111MMMMMs 155c t j j } t j d D ].}| t j | j /d | D S )NrS c g | ]C}t |d r1t |j d r |j t j k <|j DS )rH fileno)hasattrrH r| r} ).0hs r,
<listcomp>zget_fds.<locals>.<listcomp>1 s_
1h
AHh ' '
H
" "
# " "r7 )r rU r; rs r` keysextend getLogger)r; _loggers r, get_fdsr , sw |$H <<1)<AACC = =)'22;<<<< r7 c l d t j d D S )Nc , g | ]\ }}d |v |d S )rE r6 )r _rd s r, r z&get_log_file_names.<locals>.<listcomp>; s6 Av z r7 r; )rs r` r% r6 r7 r, get_log_file_namesr : s; # 7
CIIKK r7 c | t j v r,t j dt j | j z S t j d| z S )Nznetwork.)r| modulesr r rm )r s r, getNetworkLoggerr B sE s{ ck$.?.H!HIII d!2333r7 returnc ( t j S )z|
Return base log directory for the product.
Supposed to be used by clients to build the path to their own logs.
)rs r^ r6 r7 r, r^ r^ M s
<< r7 c t j r8t j d d d d | dk r8t j d d d d | dk r8t j d d d d
| d k r2t j d d d
t j d d d d t d S )NrS rY r; rZ r= rK r> rP rU rL r? rN )r disabledrs r` appendr )verboses r, setLogLevelr U s * &y12JK
&(
)
)
)!|| &y1)<
&
!|| &y1 0
f 2333!|| &v.z:AA+NNNLL"9-l;JGNN MMMMMr7 c f | t j d d d< t dS )z'
also results in reconfigure()
r; rO r N)rs r` r ) newloglevels r, setConsoleLogLevelr l s4 LL":.y9 MMMMMr7 scan_idc # J K t j t j d }t |d 5 }| t j d d| d |V | d d d d d S # 1 swxY w Y d S )Nzaibolit_actions.loga%Y-%m-%d %H:%M:%S |
) r4 ra rb rs r^ r r~ timestrftime)r ra fs r, openAibolitActionsLogr x s
7<<
,.C D DD
dC A 4=!455FF'FFFGGG s ABB B c # z K t j }t j |d t j |d }t
|d 5 }| t j d d| d |V | d d d d d S # 1 swxY w Y d S )NTr zmds_actions.logr r r r )
rs r^ r4 r ra rb r r~ r r )r r^ ra r s r, openMdsActionsLogr s ll"GK$''''
7<<!2 3 3D
dC A 4=!455FF'FFFGGG s AB00B47B4c 4 e Zd Z G d d Zd Zd ZdS )EventHookLoggerc B e Zd Z G d d Zd Zd dZd Zd ZdS )
EventHookLogger._EventLoggerc 8 e Zd ZdZd Zd Zd Zd
dZd Zd Z d S ) (EventHookLogger._EventLogger._HookLoggerzD{uuid:s} : {action:s} {native:s}: {event:s} : {subtype:s} : {path:s}c || _ |j | _ |j | _ |j | _ |j | _ || _ d S rr )ra eventsubtypeuuidlognative)ri parentra r s r, rl z1EventHookLogger._EventLogger._HookLogger.__init__ s8 #\
%~ "K !: $ r7 c | S rr r6 ri s r, __enter__z2EventHookLogger._EventLogger._HookLogger.__enter__ s r7 c d S rr r6 ri r exc_valexc_tbs r, __exit__z1EventHookLogger._EventLogger._HookLogger.__exit__ s r7 r c t | j || j rdnd| j | j | j d} | j j di |}|rd ||g }| | d S )Nznative r )r actionr r r ra z : r6 )
strr r r r ra tplrR rb r )ri r messagedatamsgs r, _logz-EventHookLogger._EventLogger._HookLogger._log s NN $+/; >iiB !Z #| I
&dho---- 5 **c7^44C
r7 c 0 | d d S )Nstarted)r r s r, beginz.EventHookLogger._EventLogger._HookLogger.begin s )$$$$$r7 c |dk rdnd}|r$d |t | g }|rBt |t r| d }d ||g }| d| d S ) Nr OKr :backslashreplace)errors
done)rb r
isinstancebytesdecoder )ri exit_codeerrr s r, finishz/EventHookLogger._EventLogger._HookLogger.finish s "+q..$$g B !hhY '@ A AG 8!#u-- D !jj0Bj C C "ii# 7 7G &'*****r7 N)r )
rm rn ro r rl r r r r r r6 r7 r, _HookLoggerr s} 5
%
%
%
%
%
%
+
+
+
+
+r7 r c j || _ || _ t j | _ |j | _ d S rr )r r r uuid4r )ri r r r s r, rl z%EventHookLogger._EventLogger.__init__ s* DJ"DL
DI zDHHHr7 Fc 2 | | || S )N)r )r )ri ra r s r, __call__z%EventHookLogger._EventLogger.__call__ s ##D$v#>> >r7 c | S rr r6 r s r, r z&EventHookLogger._EventLogger.__enter__ s Kr7 c d S rr r6 r s r, r z%EventHookLogger._EventLogger.__exit__ s Dr7 NF)rm rn ro r rl r r r r6 r7 r, _EventLoggerr s~ 0 + 0 + 0 + 0 + 0 + 0 + 0 + 0 +d " " " ? ? ? ? r7 r c F t j d }|j | _ d S )Nr? )r r infor )ri r s r, rl zEventHookLogger.__init__ s "<00;r7 c 0 | | || S rr )r )ri r r s r, r zEventHookLogger.__call__ s ug666r7 N)rm rn ro r rl r r6 r7 r, r r sc @ @ @ @ @ @ @ @D 7 7 7 7 7r7 r r )5r2 r logging.configlogging.handlersr4 r| r r r
contextlibr r functoolsr r r defence360agent.contractsr r defence360agent.contracts.configr r rf r
defence360agent.utilsr r defence360agent.applicationr
environre r_ r rm r r- r/ rs rw r r r r r r r r r^ r r r r r r6 r7 r, <module>r s
/ / / / / / / / 4 4 4 4 4 4 4 4 : : : : : : = = = = = = 3 3 3 3 3 3 > > > > > > > > , , , , , , 3R 8 8 8 $ $
:LA LA LA LA LA LA LA LA^ 1
.
.
. ; ; ;2#6 #6 #6L 4 4 4 . 3 s H7 H7 H7 H7 H7 H7 H7 H7 H7 H7r7 defence360agent/internals/__pycache__/logging_protocol.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007104 00000000000 023767 0 ustar
r_jE 4 d dl Z G d de j ZdS ) Nc 2 e Zd Zd Zd Zd Zd Zd Zd ZdS )LoggingProtocolc 0 || _ || _ || _ d S N)_logger_network_logger_real_protocol)selfloggernetwork_logger
real_protocols _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/logging_protocol.py__init__zLoggingProtocol.__init__ s - + c p j d fd d S )NzConnection made.c 8 j S r )r connection_mader
transports r <lambda>z1LoggingProtocol.connection_made.<locals>.<lambda> s T 0 @ @ K K r r debug_handler s ``r r z LoggingProtocol.connection_made
sA ""#5666 KKKKKLLLLLr c p j d fd d S )NzConnection lost.c 8 j S r )r connection_lost)excr
s r r z1LoggingProtocol.connection_lost.<locals>.<lambda> s T 0 @ @ E E r r )r
r s ``r r z LoggingProtocol.connection_lost sA ""#5666 EEEEEFFFFFr c j d fd d S )Nzdatagram_received: {!r}c : j S r )r datagram_received)addrdatar
s r r z3LoggingProtocol.datagram_received.<locals>.<lambda> s T 0 B B4 N N r r r formatr )r
r" r! s ```r r z!LoggingProtocol.datagram_received sS ""#<#C#CD#I#IJJJ NNNNNNOOOOOr c j d fd d S )Nzdata_received: {!r}c 8 j S r )r
data_received)r" r
s r r z/LoggingProtocol.data_received.<locals>.<lambda> s T 0 > >t D D r r# )r
r" s ``r r' z LoggingProtocol.data_received sO ""#8#?#?#E#EFFF DDDDDEEEEEr c | d S # t $ r2}| j t | Y d }~d S d }~ww xY wr ) Exceptionr exceptionstr)r
imples r r zLoggingProtocol._handle sc + DFFFFF + + + L " "3q66 * * * * * * * * * +s
A
'AA
N) __name__
__module__ __qualname__r r r r r' r r r r r sz , , ,
M M MG G GP P PF F F+ + + + +r r )asyncioProtocolr r1 r r <module>r4 sE + + + + +g& + + + + +r defence360agent/internals/__pycache__/logging_protocol.cpython-311.pyc 0000644 0000000 0000000 00000007104 00000000000 023030 0 ustar
r_jE 4 d dl Z G d de j ZdS ) Nc 2 e Zd Zd Zd Zd Zd Zd Zd ZdS )LoggingProtocolc 0 || _ || _ || _ d S N)_logger_network_logger_real_protocol)selfloggernetwork_logger
real_protocols _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/logging_protocol.py__init__zLoggingProtocol.__init__ s - + c p j d fd d S )NzConnection made.c 8 j S r )r connection_mader
transports r <lambda>z1LoggingProtocol.connection_made.<locals>.<lambda> s T 0 @ @ K K r r debug_handler s ``r r z LoggingProtocol.connection_made
sA ""#5666 KKKKKLLLLLr c p j d fd d S )NzConnection lost.c 8 j S r )r connection_lost)excr
s r r z1LoggingProtocol.connection_lost.<locals>.<lambda> s T 0 @ @ E E r r )r
r s ``r r z LoggingProtocol.connection_lost sA ""#5666 EEEEEFFFFFr c j d fd d S )Nzdatagram_received: {!r}c : j S r )r datagram_received)addrdatar
s r r z3LoggingProtocol.datagram_received.<locals>.<lambda> s T 0 B B4 N N r r r formatr )r
r" r! s ```r r z!LoggingProtocol.datagram_received sS ""#<#C#CD#I#IJJJ NNNNNNOOOOOr c j d fd d S )Nzdata_received: {!r}c 8 j S r )r
data_received)r" r
s r r z/LoggingProtocol.data_received.<locals>.<lambda> s T 0 > >t D D r r# )r
r" s ``r r' z LoggingProtocol.data_received sO ""#8#?#?#E#EFFF DDDDDEEEEEr c | d S # t $ r2}| j t | Y d }~d S d }~ww xY wr ) Exceptionr exceptionstr)r
imples r r zLoggingProtocol._handle sc + DFFFFF + + + L " "3q66 * * * * * * * * * +s
A
'AA
N) __name__
__module__ __qualname__r r r r r' r r r r r sz , , ,
M M MG G GP P PF F F+ + + + +r r )asyncioProtocolr r1 r r <module>r4 sE + + + + +g& + + + + +r defence360agent/internals/__pycache__/message_status_publisher.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000024604 00000000000 025530 0 ustar
r_jR d Z ddlZddlZddlZddlZddlZddlZddlZddl Z
ddl Z
ddl Z ddl
mZmZ ej e ZdZej dd Ze d dz Zej d d
Zd Zd Zd
Z G d d Z de fdZ G d d Z e Z! ej" e!j# e Z$dS )u
Lightweight message status publisher for asyncclient.
Publishes MESSAGE_STATUS events to the local proxy which relays them
to the EMQX broker via MQTT.
Each call to report() submits an HTTP POST to a thread pool — no
batching or internal queue.
Usage::
publisher = MessageStatusPublisher()
message_id_gen = Gen()
msg = {...}
message_id_gen.enrich(msg) # adds message_reporter_id / message_reporter_increment
publisher.report(msg, reporter_id_gen)
N) MESSAGE_LOSS_OBSERVABILITY_FLAG
is_enabledz/var/imunify360/iaidIMUNIFY_PROXY_URLzhttp://127.0.0.1:11234/z/api/v1/mqtt-publishIMUNIFY_PROXY_API_KEY c 6 e Zd ZdZddZdefdZdeddfdZdS ) Genz_ID + monotonic counter generator.
Each instance has its own UUID and its own counter.
returnNc ~ t j j | _ d| _ t j | _ d S )Nr )uuiduuid4hexid_counter threadingLock_lockselfs g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/message_status_publisher.py__init__z Gen.__init__= s, *,,"
^%%
c v | j 5 | j }| xj dz
c_ |cd d d S # 1 swxY w Y d S )N )r r )r values r _nextz Gen._nextB s
Z ME MMQ MM s .22msgc H | j |d< | |d< dS )z>Add message_reporter_id and message_reporter_increment to msg.message_reporter_idmessage_reporter_incrementN)r r )r r! s r enrichz
Gen.enrichH s( %)W !",0JJLL ()))r r N) __name__
__module__ __qualname____doc__r intr dictr% r r r
r
7 so
& & & &
s 9$ 94 9 9 9 9 9 9r r
r c t t 5 } | cd d d S # 1 swxY w Y d S # t $ r Y dS w xY w)Nr )open
_IAID_PATHreadstripOSError)fs r
_read_iaidr5 N s
*
$6688>>## $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ rrs3 A &A A A
A A
A
A$#A$c n e Zd ZddZdefdZdefdZddZdede d e
ddfd
Z d ed e
d e
ddfd
Z ddZ
dS )MessageStatusPublisherr Nc " d| _ t j | _ d| _ t
j t d | _ t j
t | _ d| _
t j | _ d S )Nr Fz
msg-status) max_workersthread_name_prefixr )_iaidr r
_init_lock _initialized
concurrentfuturesThreadPoolExecutor _MAX_WORKERS_poolBoundedSemaphore
_MAX_INFLIGHT _inflight_dropped
_dropped_lockr s r r z MessageStatusPublisher.__init__W sv
#.** ! '::$ + ;
#3MBB
&^ - -r c f | j 5 | j dc}| _ |cddd S # 1 swxY w Y dS )z:Drops since the last call, then reset (delta for metrics).r N)rG rF )r droppeds r pop_droppedz"MessageStatusPublisher.pop_droppedc s
%)]A "GT] s &**c J | j }t d|j |j z
S )z6In-flight reports awaiting completion (gauge, 0..cap).r )rE max_initial_value_value)r sems r queue_depthz"MessageStatusPublisher.queue_depthi s# n1c(3:5666r c | j rd S | j 5 | j r d d d d S t | _ | j s.t dt d d d d S d| _ d d d d S # 1 swxY w Y d S )NzImsg-status: iaid not available yet (file %s missing or empty), will retryT)r= r< r5 r; loggerinfor0 r s r _ensure_initializedz*MessageStatusPublisher._ensure_initializedn s F
_ % %
% % % % % % % % $ DJ:
*
% % % % % % % % !%D % % % % % % % % % % % % % % % % % %s B;B/BB
Br! reporter_genstagec t d sdS | dd }| d sdS j d sat t r/ j 5 xj dz
c_ ddd n # 1 swxY w Y t d || dS t j |j
| | dd | d
d ||d } j
j ||| }n*# t $ r j Y dS w xY w| fd
dS )z3Publish a status record via HTTP POST to the proxy.
mqtt_trackingNmethodr r# F)blockingr z3msg-status: queue full, dropping stage=%s method=%sr$ r ) timestamp reporter_idreporter_incrementr# r$ message_typerV c 6 j S )N)rE release)_r s r <lambda>z/MessageStatusPublisher.report.<locals>.<lambda> s 4>+A+A+C+C r )r getrE acquirer rG rF rR warningtimer r rB submit_do_post RuntimeErrorr` add_done_callback)r r! rU rV rY recordfutures ` r reportz MessageStatusPublisher.report~ s
/** F2&&ww,-- F
~%%u%55 9::
'' ' 'MMQ&MM' ' ' ' ' ' ' ' ' ' ' ' ' ' ' NNE
F '?"."4"4"6"6#&77+@"#E#E*-'',a+ + #
Z&&t}feVLLFF N " " $ $ $ FF !C!C!C!CDDDDDs$ 6BBB"D: :#E! E!rk rY c , | | j sd S | j |d< t j | }ddi}t
r
t
|d< t j t ||d }t j
|t 5 }| d d d d S # 1 swxY w Y d S # t $ r(}t d||| Y d }~d S d }~ww xY w) Niaidz Content-Typezapplication/jsonz X-API-KeyPOST)dataheadersrY )timeoutz.msg-status: POST failed stage=%s method=%s: %r)rT r; jsondumpsencode_PROXY_API_KEYurllibrequestRequest_PUBLISH_ENDPOINTurlopen
_POST_TIMEOUTr1 ExceptionrR re ) r rk rV rY payloadrr reqrespes r rh z MessageStatusPublisher._do_post s} """z F v j((//11G%'9:G
6'5 $.((! ) C '']'CC
t
NN@
s< B C! 2C C! CC! C C! !
D+ DDc < | j d d S )NF)wait)rB shutdownr s r r z MessageStatusPublisher.shutdown s!
'''''r r& )r' r( r) r r+ rJ rP rT r, r
strrm rh r r- r r r7 r7 V s
.
.
.
.S 7S 7 7 7 7
% % % % *E$ *Ec *E# *E$ *E *E *E *EXt C 4( ( ( ( ( (r r7 )%r* atexitconcurrent.futuresr> rt loggingosr rf urllib.errorrx urllib.requestr 'defence360agent.internals.feature_flagsr r getLoggerr' rR r0 environrc
_PROXY_URLrstripr{ rw r} rA rD r
r r5 r7 publisherregisterr message_id_genr- r r <module>r s (
8 $ $
#
Z^^ /1I
J
J
%%c**-CC
7<<
9 9 9 9 9 9 9 9.C o( o( o( o( o( o( o( o(d
# " $ $ " # # #r defence360agent/internals/__pycache__/message_status_publisher.cpython-311.pyc 0000644 0000000 0000000 00000024604 00000000000 024571 0 ustar
r_jR d Z ddlZddlZddlZddlZddlZddlZddlZddl Z
ddl Z
ddl Z ddl
mZmZ ej e ZdZej dd Ze d dz Zej d d
Zd Zd Zd
Z G d d Z de fdZ G d d Z e Z! ej" e!j# e Z$dS )u
Lightweight message status publisher for asyncclient.
Publishes MESSAGE_STATUS events to the local proxy which relays them
to the EMQX broker via MQTT.
Each call to report() submits an HTTP POST to a thread pool — no
batching or internal queue.
Usage::
publisher = MessageStatusPublisher()
message_id_gen = Gen()
msg = {...}
message_id_gen.enrich(msg) # adds message_reporter_id / message_reporter_increment
publisher.report(msg, reporter_id_gen)
N) MESSAGE_LOSS_OBSERVABILITY_FLAG
is_enabledz/var/imunify360/iaidIMUNIFY_PROXY_URLzhttp://127.0.0.1:11234/z/api/v1/mqtt-publishIMUNIFY_PROXY_API_KEY c 6 e Zd ZdZddZdefdZdeddfdZdS ) Genz_ID + monotonic counter generator.
Each instance has its own UUID and its own counter.
returnNc ~ t j j | _ d| _ t j | _ d S )Nr )uuiduuid4hexid_counter threadingLock_lockselfs g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/message_status_publisher.py__init__z Gen.__init__= s, *,,"
^%%
c v | j 5 | j }| xj dz
c_ |cd d d S # 1 swxY w Y d S )N )r r )r values r _nextz Gen._nextB s
Z ME MMQ MM s .22msgc H | j |d< | |d< dS )z>Add message_reporter_id and message_reporter_increment to msg.message_reporter_idmessage_reporter_incrementN)r r )r r! s r enrichz
Gen.enrichH s( %)W !",0JJLL ()))r r N) __name__
__module__ __qualname____doc__r intr dictr% r r r
r
7 so
& & & &
s 9$ 94 9 9 9 9 9 9r r
r c t t 5 } | cd d d S # 1 swxY w Y d S # t $ r Y dS w xY w)Nr )open
_IAID_PATHreadstripOSError)fs r
_read_iaidr5 N s
*
$6688>>## $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ rrs3 A &A A A
A A
A
A$#A$c n e Zd ZddZdefdZdefdZddZdede d e
ddfd
Z d ed e
d e
ddfd
Z ddZ
dS )MessageStatusPublisherr Nc " d| _ t j | _ d| _ t
j t d | _ t j
t | _ d| _
t j | _ d S )Nr Fz
msg-status) max_workersthread_name_prefixr )_iaidr r
_init_lock _initialized
concurrentfuturesThreadPoolExecutor _MAX_WORKERS_poolBoundedSemaphore
_MAX_INFLIGHT _inflight_dropped
_dropped_lockr s r r z MessageStatusPublisher.__init__W sv
#.** ! '::$ + ;
#3MBB
&^ - -r c f | j 5 | j dc}| _ |cddd S # 1 swxY w Y dS )z:Drops since the last call, then reset (delta for metrics).r N)rG rF )r droppeds r pop_droppedz"MessageStatusPublisher.pop_droppedc s
%)]A "GT] s &**c J | j }t d|j |j z
S )z6In-flight reports awaiting completion (gauge, 0..cap).r )rE max_initial_value_value)r sems r queue_depthz"MessageStatusPublisher.queue_depthi s# n1c(3:5666r c | j rd S | j 5 | j r d d d d S t | _ | j s.t dt d d d d S d| _ d d d d S # 1 swxY w Y d S )NzImsg-status: iaid not available yet (file %s missing or empty), will retryT)r= r< r5 r; loggerinfor0 r s r _ensure_initializedz*MessageStatusPublisher._ensure_initializedn s F
_ % %
% % % % % % % % $ DJ:
*
% % % % % % % % !%D % % % % % % % % % % % % % % % % % %s B;B/BB
Br! reporter_genstagec t d sdS | dd }| d sdS j d sat t r/ j 5 xj dz
c_ ddd n # 1 swxY w Y t d || dS t j |j
| | dd | d
d ||d } j
j ||| }n*# t $ r j Y dS w xY w| fd
dS )z3Publish a status record via HTTP POST to the proxy.
mqtt_trackingNmethodr r# F)blockingr z3msg-status: queue full, dropping stage=%s method=%sr$ r ) timestamp reporter_idreporter_incrementr# r$ message_typerV c 6 j S )N)rE release)_r s r <lambda>z/MessageStatusPublisher.report.<locals>.<lambda> s 4>+A+A+C+C r )r getrE acquirer rG rF rR warningtimer r rB submit_do_post RuntimeErrorr` add_done_callback)r r! rU rV rY recordfutures ` r reportz MessageStatusPublisher.report~ s
/** F2&&ww,-- F
~%%u%55 9::
'' ' 'MMQ&MM' ' ' ' ' ' ' ' ' ' ' ' ' ' ' NNE
F '?"."4"4"6"6#&77+@"#E#E*-'',a+ + #
Z&&t}feVLLFF N " " $ $ $ FF !C!C!C!CDDDDDs$ 6BBB"D: :#E! E!rk rY c , | | j sd S | j |d< t j | }ddi}t
r
t
|d< t j t ||d }t j
|t 5 }| d d d d S # 1 swxY w Y d S # t $ r(}t d||| Y d }~d S d }~ww xY w) Niaidz Content-Typezapplication/jsonz X-API-KeyPOST)dataheadersrY )timeoutz.msg-status: POST failed stage=%s method=%s: %r)rT r; jsondumpsencode_PROXY_API_KEYurllibrequestRequest_PUBLISH_ENDPOINTurlopen
_POST_TIMEOUTr1 ExceptionrR re ) r rk rV rY payloadrr reqrespes r rh z MessageStatusPublisher._do_post s} """z F v j((//11G%'9:G
6'5 $.((! ) C '']'CC
t
NN@
s< B C! 2C C! CC! C C! !
D+ DDc < | j d d S )NF)wait)rB shutdownr s r r z MessageStatusPublisher.shutdown s!
'''''r r& )r' r( r) r r+ rJ rP rT r, r
strrm rh r r- r r r7 r7 V s
.
.
.
.S 7S 7 7 7 7
% % % % *E$ *Ec *E# *E$ *E *E *E *EXt C 4( ( ( ( ( (r r7 )%r* atexitconcurrent.futuresr> rt loggingosr rf urllib.errorrx urllib.requestr 'defence360agent.internals.feature_flagsr r getLoggerr' rR r0 environrc
_PROXY_URLrstripr{ rw r} rA rD r
r r5 r7 publisherregisterr message_id_genr- r r <module>r s (
8 $ $
#
Z^^ /1I
J
J
%%c**-CC
7<<
9 9 9 9 9 9 9 9.C o( o( o( o( o( o( o( o(d
# " $ $ " # # #r defence360agent/internals/__pycache__/persistent_message.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000017666 00000000000 024342 0 ustar
r_j" r d dl Z d dlmZ d dlmZmZ d dlmZ d dlm Z ee
Z G d d Z dS ) N) getLogger) MESSAGE_LOSS_OBSERVABILITY_FLAG
is_enabled)db)
MessageToSendc e Zd ZdZddZdefdZddZdefd Z defd
Z
defd Z d eddfd
Z dede
ddfdZdefdZdefdZedefd Zedefd Zdde
fdZdeeee
f ddfdZdS )PersistentMessagesQueuea
The queue to store messages sent to the server if it is unavailable.
- stores more recent data; if a limit is exceeded,
older messages are deleted.
- no duplicate messages are sent
NOTE: it is worth remembering that when writing a large number of messages,
the amount of memory used may increase by the size of the sqlite
cache (this may not be immediately obvious).
https://www.sqlite.org/pragma.html#pragma_cache_size
Nc h || _ || _ g | _ |pt | _ d| _ d| _ d S Nr )
_buffer_limit_storage_limit_bufferr _model
dropped_total_evicted)self buffer_limit
storage_limitmodels a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/persistent_message.py__init__z PersistentMessagesQueue.__init__ s8 ) + ,}
returnc $ | j dc}| _ |S )z>Evictions since the last call, then reset (delta for metrics).r )r )r evicteds r pop_evictedz#PersistentMessagesQueue.pop_evicted# s !% r c | j rt j 5 | j | j | j | j z
}|dk ru| j | }| xj |z
c_ t t r| xj |z
c_ t
d|| j | j g | _ d d d d S # 1 swxY w Y d S d S )Nr zcPersistent message queue overflow: dropped %d oldest message(s), storage_limit=%d, dropped_total=%d)r r atomicr insert_many storage_sizer
delete_oldr r r r loggerwarning)r need_to_removeremoveds r push_buffer_to_storagez.PersistentMessagesQueue.push_buffer_to_storage( s; < "
"
" '' 555!%!2T5H!H!A%% "k 4 4^ D DG &&'1&&!"ABB 1
0
NNJ + * " )
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
" " "s B1CC C c g }t j 5 |t | j | j j | j j z
}| j d d d n # 1 swxY w Y || j
z
}g | _
t | S N) r r listr select timestampmessagetuplesdeleteexecuter sortedr itemss r pop_allz PersistentMessagesQueue.pop_all@ s
Y[[ + + T ""K)4;+> &((
E
K ( ( * * *
+ + + + + + + + + + + + + + + e}} s A=B B#&B#c r t | j S )z~Return stored rows as (id, timestamp, message) oldest-first
without deleting (buffer is neither flushed nor included).)r+ r get_all_orderedr/ r s r peek_storedz#PersistentMessagesQueue.peek_storedM s, DK//1188::;;;r c $ | j g c}| _ |S )z>Return and clear the in-memory buffer as (timestamp, message).)r r3 s r drain_bufferz$PersistentMessagesQueue.drain_bufferR s "lBt| r idsc |rHt j 5 | j | d d d d S # 1 swxY w Y d S d S r* )r r r delete_in)r r< s r r0 z PersistentMessagesQueue.deleteW s +
+
+ %%c***
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ + +s >AA
message_idr. c t j 5 | j || d d d d S # 1 swxY w Y d S r* )r r r set_message)r r? r. s r update_messagez&PersistentMessagesQueue.update_message\ s
Y[[ 9 9 K # #J 8 8 8 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9s =AAc 2 | dk S r
)qsizer8 s r emptyz PersistentMessagesQueue.empty` s zz||q r c : | j t | j z S r* )r" lenr r8 s r rD z PersistentMessagesQueue.qsizec s 3t|#4#444r c * t | j S r* )rG r r8 s r buffer_sizez#PersistentMessagesQueue.buffer_sizef s 4< r c X | j S r* )r r, countr8 s r r" z$PersistentMessagesQueue.storage_sizej s" {!!##))+++r c |t j }| j ||f | j | j k r| d S d S r* )timer appendrI r r( )r r. r- s r putzPersistentMessagesQueue.putn s_ I Y 0111 t 1 1 1 ' ' ) ) ) ) ) 2 1r messagesc | j | | j | j k r| d S d S r* )r extendrI r r( )r rP s r put_manyz PersistentMessagesQueue.put_manyu sI H%%% t 1 1 1 ' ' ) ) ) ) ) 2 1r )r
r N)r Nr* )__name__
__module__ __qualname____doc__r intr r( r+ r5 r9 r; r0 bytesrB boolrE rD propertyrI r" rO tuplefloatrS r r r r s
S
" " " "0 <T < < < <
d
+$ +4 + + + +
9 9u 9 9 9 9 9!t ! ! ! !5s 5 5 5 5 !S ! ! ! X! ,c , , , X,* *5 * * * **eE5L&9!: *t * * * * * *r r )
rM loggingr 'defence360agent.internals.feature_flagsr r defence360agent.model.instancer &defence360agent.model.messages_to_sendr rT r$ r r^ r r <module>rc s . - - - - - @ @ @ @ @ @ 8 j* j* j* j* j* j* j* j* j* j*r defence360agent/internals/__pycache__/persistent_message.cpython-311.pyc 0000644 0000000 0000000 00000017666 00000000000 023403 0 ustar
r_j" r d dl Z d dlmZ d dlmZmZ d dlmZ d dlm Z ee
Z G d d Z dS ) N) getLogger) MESSAGE_LOSS_OBSERVABILITY_FLAG
is_enabled)db)
MessageToSendc e Zd ZdZddZdefdZddZdefd Z defd
Z
defd Z d eddfd
Z dede
ddfdZdefdZdefdZedefd Zedefd Zdde
fdZdeeee
f ddfdZdS )PersistentMessagesQueuea
The queue to store messages sent to the server if it is unavailable.
- stores more recent data; if a limit is exceeded,
older messages are deleted.
- no duplicate messages are sent
NOTE: it is worth remembering that when writing a large number of messages,
the amount of memory used may increase by the size of the sqlite
cache (this may not be immediately obvious).
https://www.sqlite.org/pragma.html#pragma_cache_size
Nc h || _ || _ g | _ |pt | _ d| _ d| _ d S Nr )
_buffer_limit_storage_limit_bufferr _model
dropped_total_evicted)self buffer_limit
storage_limitmodels a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/persistent_message.py__init__z PersistentMessagesQueue.__init__ s8 ) + ,}
returnc $ | j dc}| _ |S )z>Evictions since the last call, then reset (delta for metrics).r )r )r evicteds r pop_evictedz#PersistentMessagesQueue.pop_evicted# s !% r c | j rt j 5 | j | j | j | j z
}|dk ru| j | }| xj |z
c_ t t r| xj |z
c_ t
d|| j | j g | _ d d d d S # 1 swxY w Y d S d S )Nr zcPersistent message queue overflow: dropped %d oldest message(s), storage_limit=%d, dropped_total=%d)r r atomicr insert_many storage_sizer
delete_oldr r r r loggerwarning)r need_to_removeremoveds r push_buffer_to_storagez.PersistentMessagesQueue.push_buffer_to_storage( s; < "
"
" '' 555!%!2T5H!H!A%% "k 4 4^ D DG &&'1&&!"ABB 1
0
NNJ + * " )
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
" " "s B1CC C c g }t j 5 |t | j | j j | j j z
}| j d d d n # 1 swxY w Y || j
z
}g | _
t | S N) r r listr select timestampmessagetuplesdeleteexecuter sortedr itemss r pop_allz PersistentMessagesQueue.pop_all@ s
Y[[ + + T ""K)4;+> &((
E
K ( ( * * *
+ + + + + + + + + + + + + + + e}} s A=B B#&B#c r t | j S )z~Return stored rows as (id, timestamp, message) oldest-first
without deleting (buffer is neither flushed nor included).)r+ r get_all_orderedr/ r s r peek_storedz#PersistentMessagesQueue.peek_storedM s, DK//1188::;;;r c $ | j g c}| _ |S )z>Return and clear the in-memory buffer as (timestamp, message).)r r3 s r drain_bufferz$PersistentMessagesQueue.drain_bufferR s "lBt| r idsc |rHt j 5 | j | d d d d S # 1 swxY w Y d S d S r* )r r r delete_in)r r< s r r0 z PersistentMessagesQueue.deleteW s +
+
+ %%c***
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ + +s >AA
message_idr. c t j 5 | j || d d d d S # 1 swxY w Y d S r* )r r r set_message)r r? r. s r update_messagez&PersistentMessagesQueue.update_message\ s
Y[[ 9 9 K # #J 8 8 8 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9s =AAc 2 | dk S r
)qsizer8 s r emptyz PersistentMessagesQueue.empty` s zz||q r c : | j t | j z S r* )r" lenr r8 s r rD z PersistentMessagesQueue.qsizec s 3t|#4#444r c * t | j S r* )rG r r8 s r buffer_sizez#PersistentMessagesQueue.buffer_sizef s 4< r c X | j S r* )r r, countr8 s r r" z$PersistentMessagesQueue.storage_sizej s" {!!##))+++r c |t j }| j ||f | j | j k r| d S d S r* )timer appendrI r r( )r r. r- s r putzPersistentMessagesQueue.putn s_ I Y 0111 t 1 1 1 ' ' ) ) ) ) ) 2 1r messagesc | j | | j | j k r| d S d S r* )r extendrI r r( )r rP s r put_manyz PersistentMessagesQueue.put_manyu sI H%%% t 1 1 1 ' ' ) ) ) ) ) 2 1r )r
r N)r Nr* )__name__
__module__ __qualname____doc__r intr r( r+ r5 r9 r; r0 bytesrB boolrE rD propertyrI r" rO tuplefloatrS r r r r s
S
" " " "0 <T < < < <
d
+$ +4 + + + +
9 9u 9 9 9 9 9!t ! ! ! !5s 5 5 5 5 !S ! ! ! X! ,c , , , X,* *5 * * * **eE5L&9!: *t * * * * * *r r )
rM loggingr 'defence360agent.internals.feature_flagsr r defence360agent.model.instancer &defence360agent.model.messages_to_sendr rT r$ r r^ r r <module>rc s . - - - - - @ @ @ @ @ @ 8 j* j* j* j* j* j* j* j* j* j*r defence360agent/internals/__pycache__/the_sink.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000047477 00000000000 022245 0 ustar
r_jZ0 d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl m
Z
m Z d dl m
Z
d dlmZmZ d dlmZmZmZ d dlmZ d dlmZmZmZ d d lm Z ej e Z e Z ej! d
d d g Z" G d
de
Z# G d de Z$d Z% G d de& Z' G d de& Z( G d de j) Z*dS ) N)
attrgetter)MessageReject)BaseMessageProcessor)
is_enabledmqtt_tracked_methods)Genmessage_id_gen publisher)safe_cancel_task)DAY ServiceBase
rate_limit)gProcessingMessagemessage
start_timec 2 e Zd Zd Zd Zd Zd Zd Zd ZdS )TheSinkc t |t d | _ || _ t |t | j | _ | t _ d S )NPROCESSING_ORDER)key) sortedr _sinks_ordered_loop TaskManagerMessageProcessor
_task_managerr sink)self sink_listloops W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/the_sink.py__init__zTheSink.__init__# s` $ :&899
( "4#677
c 8 | j j d| j j S )N.) __class__
__module____name__r s r# __repr__zTheSink.__repr__- s .333T^5L5LMMr% c fd| j D }t | dk s
J d t t | d S )ze
introspection: decompose a specific role
:return classobj: instance or None
c 4 g | ]}t | |S )
isinstance).0r classobjs r#
<listcomp>z%TheSink.decompose.<locals>.<listcomp>5 s8
JtX4N4N
r% zAmbiguous requestN)r lennextiter)r r2 optionss ` r# decomposezTheSink.decompose0 sf
! 0
7||q "5 DMM4(((r% c 8 | j dS )z
Make sure to run message processing bus only
when every MessageSource (or MessageSource+MessageSink mix)
got initialized
N)r startr+ s r# r; z
TheSink.start; s
"""""r% c X K t d | j t d | j d d {V t d | j d {V d S )Nzshutdown the sink startedzwait for current tasks timeoutzfinish wait task)loggerinfor should_stopwait_current_taskswaitr+ s r# shutdownzTheSink.shutdownC s /000 &&((( ,--- 33A3>>>>>>>>> &''' %%'''''''''''r% c J K | j | d {V d S N)r push_msg)r r s r# process_messagezTheSink.process_messageK s5 ))'22222222222r% N) r* r) __qualname__r$ r, r9 r; rE rI r/ r% r# r r " sq N N N ) ) )# # #( ( (3 3 3 3 3r% r c p e Zd ZdZdZdZ fdZd Zed Z d dZ
d Z d
Z e
d Z xZS )
r i r= c ~ t | t | j | _ | j | _ | j | _ || _ t j | _ t t t j | _ | t j | _ d S )N)maxsize)periodon_drop)superr$ MessageQueueMAXSIZE_queue CONCURRENCY _concurrencyTIMEOUT_process_message_timeout_msg_processorweakrefWeakSettasksr r
r@ warning_throttled_loggererrorthrottled_log_error)r r"
msg_processorr( s r# r$ zTaskManager.__init__W s
"4<888 ,(, % + _&&
!+3!O!O!O #'#9#9&,#G#G r% c , K | j s/| j t | d{V dS | j j rd| j | j |f}n"d| j | j |f} | j | dS )z&Push message unless the queue is full.NzNMessage queue is full %s. Current processing messages: %s. Message ignored: %szZMessage queue is full. Queue size: %s Current processing messages: %s. Message ignored: %s) rT fullputMessageComparabler^ should_be_calledcurrent_processing_messagesqsizer` )r msgargss r# rH zTaskManager.push_msga s { !! ,+//"3C"8"899 9 9 9 9 9 9 9 9 9%6
O K4O K%%''4
%D $d + + + +r% c > t d | j D S )Nc 3 K | ]R}| |j j t t j |j j z
d fV SdS ) N)doneprocessing_msgr roundtime monotonicr )r1 tasks r# <genexpr>z:TaskManager.current_processing_messages.<locals>.<genexpr> sq
99;;
#+dn&&)<)GGKK
r% )tupler\ r+ s r# rg z'TaskManager.current_processing_messages| s6
r% Nc K | j rOd | j D }t d| t j | j | d {V d S d S )Nc j g | ]0\ }}| d | d |f1S )method
message_id)get)r1 mlastings r# r3 z2TaskManager.wait_current_tasks.<locals>.<listcomp> sI Aw x !%% "5"5w? r% z#Waiting for %r processing to finishr> )r\ rg r@ rA asynciorD )r r? msg_to_processs r# rC z TaskManager.wait_current_tasks s : < "&"B N
KK5
,tz7;;; ; ; ; ; ; ; ; ; ; < <r% c K t j | j | j s4t d| j | d {V | j d {V }n# t j
$ r Y nw xY w| j |
|j }t |j t! j |_ | fd | | j | j | | j 4| j }|r4t d| j d S d S # t d Y d S xY w)NzMessage queue size: %sc , S rG )release)_ semaphores r# <lambda>z"TaskManager._run.<locals>.<lambda> s i.?.?.A.A r% z3There is still %s unprocessed messages in the queue Error during message processing:)r} BoundedSemaphorerV _should_stopr@ debugrT rh _TaskManager__limit_concurrencyrz CancelledErrorr create_taskrY ri r rq rr ro add_done_callback_on_msg_processedr\ addr] exception)r msg_comparablet unprocessedr s @r# _runzTaskManager._run s ,T->?? A'
" 5t{7H7H7J7JKKK 229=========+/;??+<+<%<%<%<%<%<%<NN - EJ**''(:;; $5"&(8(8$ $ ##$A$A$A$ABBB##D$:;;;
q!!! '
" +++--K
IK%%''
A ? @ @ @ @ @ @s0 :F+ :B F+ B&#F+ %B&&DF+ + G
c K t j | | j d{V S # t j $ r | d| j Y nw xY we)z;Try to acquire *semaphore* in a loop, log error on timeout.Tr> Nz+Message hasn't been processed in %s seconds)r} wait_foracquirerX TimeoutErrorr` )r r s r# __limit_concurrencyz TaskManager.__limit_concurrency s
$ - %%'' 9 '
((A1
s 28 *A%$A%c n | }|r t d| d S d S )Nr )exc_info)r r@ )futurees r# r z TaskManager._on_msg_processed sH M ?! L L L L L M Mr% rG )r* r) rJ rS rU rW r$ rH propertyrg rC r r staticmethodr
__classcell__r( s @r# r r O s GKGH H H H H, , ,6
X
<
<
<
<A A A8 M M \M M M M Mr% r c ` K | st | d {V d S d S rG )rn r )rs s r# cancel_taskr sF 99;; % t$$$$$$$$$$$% %r% c $ e Zd ZdZd Zd Zd ZdS )r rL c || _ t j | _ t d t
j | _ d S )NrL )rO )sinksrZ WeakValueDictionarylocksr r@ r_ r` )r r s r# r$ zMessageProcessor.__init__ sC
022
#=:W#=#=#= L$
$
r% c Z K | d }|rv| j |t j }|4 d {V | | d {V d d d d {V d S # 1 d {V swxY w Y d S | | d {V d S )N attackers_ip)rz r
setdefaultr} Lock_call_unlocked)r ri iplocks r# __call__zMessageProcessor.__call__ sT
WW^
$
$
+:((W\^^<<D
/
/
/
/
/
/
/
/))#.........
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/ %%c** * * * * * * * * *s A==
B
Bc
K t d r;| d t v rd|vrt j | t j |t d t j }| j
D ]} t j |
| }t j t j | | j d {V }t# |t$ r|}nV# t j $ r Y t) | d {V n_t* $ rJ}t, dt1 | | Y d }~t) | d {V d S d }~wt j $ r t5 j }| | | d t, d
||| j | Y t) | d {V d S t@ $ r6 t, ! d || Y t) | d {V d S w xY wt) | d {V # t) | d {V w xY wt j |z
}t, d || ||j" k r | # d
|||j" d S d S )N
mqtt_trackingrx message_reporter_idzagent-sink-received)stager> zRejected: %s -> %r)filer zCMessage %r was not processed in the %r plugin in %ss; Traceback: %szError processing %r in %rz %s processed in %.4f secondszE%s message took longer to process than expected (%.4f sec > %.4f sec))$r rz r r
enrichr report_reporter_gen_sinkrq rr r r} r rI r shieldTIMEOUT_TO_SINK_PROCESSr0 r r r r r@ rA strr ioStringIO print_stackseekr_ read Exceptionr PROCESSING_TIME_THRESHOLDr` ) r ri r; r process_message_task processedr stackprocessing_times r# r z MessageProcessor._call_unlocked s
' ' '!!%9%;%;;;%S00 !# & & & 08MNNNN J * 8 * 8D)
8'.':((--( ($ #*"2
N#788 8
# # # D i11 $#C7 )
8 ""6777777777777
0#a&&#>>>2 ""67777777777771 '
$00e0<<<
1
$0JJLL
""6777777777777
!<c4HHH
""6777777777777
""67777777777k"67777777777 .**U2 2C III S : : : $ $( -
; :sV AC:!I':I
I'" I
+)E0I'0BI
5I'%I
3I' I
I''I>N)r* r) rJ r r$ r r r/ r% r# r r sL "
+ + +E E E E Er% r c B e Zd ZdZdZe fd Zd Zd Z xZ S )re z#Wrapper to make message comparable.c | xj dz
c_ t | }|j | j f|_ ||_ |S Nr4 )indexrQ __new__PRIORITYpriorityri )clsri rvr( s r# r zMessageComparable.__new__/ sC Q
WW__S
!
!lCI- r% c @ | j |j S rG )r __lt__)r others r# r zMessageComparable.__lt__7 s }##EN333r% c Z d | j j | j | j S )Nz'<{klass}({msg!r}), priority={priority}>)klassri r )formatr( r* ri r r+ s r# r, zMessageComparable.__repr__: s2 8??.)] @
r% )
r* r) rJ __doc__r r r r r, r r s @r# re re ) sm --
E \4 4 4
r% re c 4 e Zd Z fdZdef fd Zd Z xZS )rR c t j |i | t j | _ d| j _ d| j _ d S )N2 i )rQ r$ reprlibRepr_repr maxstringmaxtuple)r rj kwargsr( s r# r$ zMessageQueue.__init__C sF $)&))) \^^
!
"
r% itemc V K t | d {V S rG )rQ rd )r r r( s r# rd zMessageQueue.putI s/ WW[[&&&&&&&&&r% c t t j d | j D d d }d| j d| d| j | dS ) Nc 0 g | ]}|j j j S r/ )ri r( rJ )r1 r s r# r3 z(MessageQueue.__str__.<locals>.<listcomp>P s IIIT#0IIIr% c | d S r r/ )r s r# r z&MessageQueue.__str__.<locals>.<lambda>R s
T!W r% T)r reversez<PriorityQueue maxsize=z
; queue_size=z queue_counter=>) r collectionsCounterrT itemsrN rh r repr)r
msg_countss r# __str__zMessageQueue.__str__L s IIT[III
egg$$
<dl
<
< **,,
<
< !Z__Z 8 8
<
<
<
r% )r* r) rJ r$ re rd r r r s @r# rR rR B sm # # # # # ' / ' ' ' ' ' '
r% rR )+r} r r r rq rZ loggingoperatorr "defence360agent.contracts.messagesr r !defence360agent.contracts.pluginsr 'defence360agent.internals.feature_flagsr r 2defence360agent.internals.message_status_publisherr r
r defence360agent.utilsr defence360agent.utils.commonr
r r &defence360agent.internals.global_scoper getLoggerr* r@ r
namedtupler r r r objectr re
PriorityQueuerR r/ r% r# <module>r sh > > > > > > > > B B B B B B
3 2 2 2 2 2 E E E E E E E E E E 4 4 4 4 4 4 8 $ $SUU *K*)\2
*3 *3 *3 *3 *3" *3 *3 *3ZwM wM wM wM wM+ wM wM wMt% % %
X X X X Xv X X Xv
2
7(
r% defence360agent/internals/__pycache__/the_sink.cpython-311.pyc 0000644 0000000 0000000 00000047477 00000000000 021306 0 ustar
r_jZ0 d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl m
Z
m Z d dl m
Z
d dlmZmZ d dlmZmZmZ d dlmZ d dlmZmZmZ d d lm Z ej e Z e Z ej! d
d d g Z" G d
de
Z# G d de Z$d Z% G d de& Z' G d de& Z( G d de j) Z*dS ) N)
attrgetter)MessageReject)BaseMessageProcessor)
is_enabledmqtt_tracked_methods)Genmessage_id_gen publisher)safe_cancel_task)DAY ServiceBase
rate_limit)gProcessingMessagemessage
start_timec 2 e Zd Zd Zd Zd Zd Zd Zd ZdS )TheSinkc t |t d | _ || _ t |t | j | _ | t _ d S )NPROCESSING_ORDER)key) sortedr _sinks_ordered_loop TaskManagerMessageProcessor
_task_managerr sink)self sink_listloops W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/the_sink.py__init__zTheSink.__init__# s` $ :&899
( "4#677
c 8 | j j d| j j S )N.) __class__
__module____name__r s r# __repr__zTheSink.__repr__- s .333T^5L5LMMr% c fd| j D }t | dk s
J d t t | d S )ze
introspection: decompose a specific role
:return classobj: instance or None
c 4 g | ]}t | |S )
isinstance).0r classobjs r#
<listcomp>z%TheSink.decompose.<locals>.<listcomp>5 s8
JtX4N4N
r% zAmbiguous requestN)r lennextiter)r r2 optionss ` r# decomposezTheSink.decompose0 sf
! 0
7||q "5 DMM4(((r% c 8 | j dS )z
Make sure to run message processing bus only
when every MessageSource (or MessageSource+MessageSink mix)
got initialized
N)r startr+ s r# r; z
TheSink.start; s
"""""r% c X K t d | j t d | j d d {V t d | j d {V d S )Nzshutdown the sink startedzwait for current tasks timeoutzfinish wait task)loggerinfor should_stopwait_current_taskswaitr+ s r# shutdownzTheSink.shutdownC s /000 &&((( ,--- 33A3>>>>>>>>> &''' %%'''''''''''r% c J K | j | d {V d S N)r push_msg)r r s r# process_messagezTheSink.process_messageK s5 ))'22222222222r% N) r* r) __qualname__r$ r, r9 r; rE rI r/ r% r# r r " sq N N N ) ) )# # #( ( (3 3 3 3 3r% r c p e Zd ZdZdZdZ fdZd Zed Z d dZ
d Z d
Z e
d Z xZS )
r i r= c ~ t | t | j | _ | j | _ | j | _ || _ t j | _ t t t j | _ | t j | _ d S )N)maxsize)periodon_drop)superr$ MessageQueueMAXSIZE_queue CONCURRENCY _concurrencyTIMEOUT_process_message_timeout_msg_processorweakrefWeakSettasksr r
r@ warning_throttled_loggererrorthrottled_log_error)r r"
msg_processorr( s r# r$ zTaskManager.__init__W s
"4<888 ,(, % + _&&
!+3!O!O!O #'#9#9&,#G#G r% c , K | j s/| j t | d{V dS | j j rd| j | j |f}n"d| j | j |f} | j | dS )z&Push message unless the queue is full.NzNMessage queue is full %s. Current processing messages: %s. Message ignored: %szZMessage queue is full. Queue size: %s Current processing messages: %s. Message ignored: %s) rT fullputMessageComparabler^ should_be_calledcurrent_processing_messagesqsizer` )r msgargss r# rH zTaskManager.push_msga s { !! ,+//"3C"8"899 9 9 9 9 9 9 9 9 9%6
O K4O K%%''4
%D $d + + + +r% c > t d | j D S )Nc 3 K | ]R}| |j j t t j |j j z
d fV SdS ) N)doneprocessing_msgr roundtime monotonicr )r1 tasks r# <genexpr>z:TaskManager.current_processing_messages.<locals>.<genexpr> sq
99;;
#+dn&&)<)GGKK
r% )tupler\ r+ s r# rg z'TaskManager.current_processing_messages| s6
r% Nc K | j rOd | j D }t d| t j | j | d {V d S d S )Nc j g | ]0\ }}| d | d |f1S )method
message_id)get)r1 mlastings r# r3 z2TaskManager.wait_current_tasks.<locals>.<listcomp> sI Aw x !%% "5"5w? r% z#Waiting for %r processing to finishr> )r\ rg r@ rA asynciorD )r r? msg_to_processs r# rC z TaskManager.wait_current_tasks s : < "&"B N
KK5
,tz7;;; ; ; ; ; ; ; ; ; ; < <r% c K t j | j | j s4t d| j | d {V | j d {V }n# t j
$ r Y nw xY w| j |
|j }t |j t! j |_ | fd | | j | j | | j 4| j }|r4t d| j d S d S # t d Y d S xY w)NzMessage queue size: %sc , S rG )release)_ semaphores r# <lambda>z"TaskManager._run.<locals>.<lambda> s i.?.?.A.A r% z3There is still %s unprocessed messages in the queue Error during message processing:)r} BoundedSemaphorerV _should_stopr@ debugrT rh _TaskManager__limit_concurrencyrz CancelledErrorr create_taskrY ri r rq rr ro add_done_callback_on_msg_processedr\ addr] exception)r msg_comparablet unprocessedr s @r# _runzTaskManager._run s ,T->?? A'
" 5t{7H7H7J7JKKK 229=========+/;??+<+<%<%<%<%<%<%<NN - EJ**''(:;; $5"&(8(8$ $ ##$A$A$A$ABBB##D$:;;;
q!!! '
" +++--K
IK%%''
A ? @ @ @ @ @ @s0 :F+ :B F+ B&#F+ %B&&DF+ + G
c K t j | | j d{V S # t j $ r | d| j Y nw xY we)z;Try to acquire *semaphore* in a loop, log error on timeout.Tr> Nz+Message hasn't been processed in %s seconds)r} wait_foracquirerX TimeoutErrorr` )r r s r# __limit_concurrencyz TaskManager.__limit_concurrency s
$ - %%'' 9 '
((A1
s 28 *A%$A%c n | }|r t d| d S d S )Nr )exc_info)r r@ )futurees r# r z TaskManager._on_msg_processed sH M ?! L L L L L M Mr% rG )r* r) rJ rS rU rW r$ rH propertyrg rC r r staticmethodr
__classcell__r( s @r# r r O s GKGH H H H H, , ,6
X
<
<
<
<A A A8 M M \M M M M Mr% r c ` K | st | d {V d S d S rG )rn r )rs s r# cancel_taskr sF 99;; % t$$$$$$$$$$$% %r% c $ e Zd ZdZd Zd Zd ZdS )r rL c || _ t j | _ t d t
j | _ d S )NrL )rO )sinksrZ WeakValueDictionarylocksr r@ r_ r` )r r s r# r$ zMessageProcessor.__init__ sC
022
#=:W#=#=#= L$
$
r% c Z K | d }|rv| j |t j }|4 d {V | | d {V d d d d {V d S # 1 d {V swxY w Y d S | | d {V d S )N attackers_ip)rz r
setdefaultr} Lock_call_unlocked)r ri iplocks r# __call__zMessageProcessor.__call__ sT
WW^
$
$
+:((W\^^<<D
/
/
/
/
/
/
/
/))#.........
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/ %%c** * * * * * * * * *s A==
B
Bc
K t d r;| d t v rd|vrt j | t j |t d t j }| j
D ]} t j |
| }t j t j | | j d {V }t# |t$ r|}nV# t j $ r Y t) | d {V n_t* $ rJ}t, dt1 | | Y d }~t) | d {V d S d }~wt j $ r t5 j }| | | d t, d
||| j | Y t) | d {V d S t@ $ r6 t, ! d || Y t) | d {V d S w xY wt) | d {V # t) | d {V w xY wt j |z
}t, d || ||j" k r | # d
|||j" d S d S )N
mqtt_trackingrx message_reporter_idzagent-sink-received)stager> zRejected: %s -> %r)filer zCMessage %r was not processed in the %r plugin in %ss; Traceback: %szError processing %r in %rz %s processed in %.4f secondszE%s message took longer to process than expected (%.4f sec > %.4f sec))$r rz r r
enrichr report_reporter_gen_sinkrq rr r r} r rI r shieldTIMEOUT_TO_SINK_PROCESSr0 r r r r r@ rA strr ioStringIO print_stackseekr_ read Exceptionr PROCESSING_TIME_THRESHOLDr` ) r ri r; r process_message_task processedr stackprocessing_times r# r z MessageProcessor._call_unlocked s
' ' '!!%9%;%;;;%S00 !# & & & 08MNNNN J * 8 * 8D)
8'.':((--( ($ #*"2
N#788 8
# # # D i11 $#C7 )
8 ""6777777777777
0#a&&#>>>2 ""67777777777771 '
$00e0<<<
1
$0JJLL
""6777777777777
!<c4HHH
""6777777777777
""67777777777k"67777777777 .**U2 2C III S : : : $ $( -
; :sV AC:!I':I
I'" I
+)E0I'0BI
5I'%I
3I' I
I''I>N)r* r) rJ r r$ r r r/ r% r# r r sL "
+ + +E E E E Er% r c B e Zd ZdZdZe fd Zd Zd Z xZ S )re z#Wrapper to make message comparable.c | xj dz
c_ t | }|j | j f|_ ||_ |S Nr4 )indexrQ __new__PRIORITYpriorityri )clsri rvr( s r# r zMessageComparable.__new__/ sC Q
WW__S
!
!lCI- r% c @ | j |j S rG )r __lt__)r others r# r zMessageComparable.__lt__7 s }##EN333r% c Z d | j j | j | j S )Nz'<{klass}({msg!r}), priority={priority}>)klassri r )formatr( r* ri r r+ s r# r, zMessageComparable.__repr__: s2 8??.)] @
r% )
r* r) rJ __doc__r r r r r, r r s @r# re re ) sm --
E \4 4 4
r% re c 4 e Zd Z fdZdef fd Zd Z xZS )rR c t j |i | t j | _ d| j _ d| j _ d S )N2 i )rQ r$ reprlibRepr_repr maxstringmaxtuple)r rj kwargsr( s r# r$ zMessageQueue.__init__C sF $)&))) \^^
!
"
r% itemc V K t | d {V S rG )rQ rd )r r r( s r# rd zMessageQueue.putI s/ WW[[&&&&&&&&&r% c t t j d | j D d d }d| j d| d| j | dS ) Nc 0 g | ]}|j j j S r/ )ri r( rJ )r1 r s r# r3 z(MessageQueue.__str__.<locals>.<listcomp>P s IIIT#0IIIr% c | d S r r/ )r s r# r z&MessageQueue.__str__.<locals>.<lambda>R s
T!W r% T)r reversez<PriorityQueue maxsize=z
; queue_size=z queue_counter=>) r collectionsCounterrT itemsrN rh r repr)r
msg_countss r# __str__zMessageQueue.__str__L s IIT[III
egg$$
<dl
<
< **,,
<
< !Z__Z 8 8
<
<
<
r% )r* r) rJ r$ re rd r r r s @r# rR rR B sm # # # # # ' / ' ' ' ' ' '
r% rR )+r} r r r rq rZ loggingoperatorr "defence360agent.contracts.messagesr r !defence360agent.contracts.pluginsr 'defence360agent.internals.feature_flagsr r 2defence360agent.internals.message_status_publisherr r
r defence360agent.utilsr defence360agent.utils.commonr
r r &defence360agent.internals.global_scoper getLoggerr* r@ r
namedtupler r r r objectr re
PriorityQueuerR r/ r% r# <module>r sh > > > > > > > > B B B B B B
3 2 2 2 2 2 E E E E E E E E E E 4 4 4 4 4 4 8 $ $SUU *K*)\2
*3 *3 *3 *3 *3" *3 *3 *3ZwM wM wM wM wM+ wM wM wMt% % %
X X X X Xv X X Xv
2
7(
r% defence360agent/internals/auth_protocol.py 0000644 0000000 0000000 00000002266 00000000000 016007 0 ustar import asyncio
import socket
import logging
import struct
logger = logging.getLogger(__name__)
class UnixSocketAuthProtocol(asyncio.Protocol):
"""
This protocol uses SO_PEERCRED attribute of unix socket
to get authentication data (pid, uid, gid)
After connect, this values are stored in object's
_pid, _uid, _gid attributes
"""
# ucred struct format (3 integers)
# struct ucred
# {
# pid_t pid; /* PID of sending process. */
# uid_t uid; /* UID of sending process. */
# gid_t gid; /* GID of sending process. */
# };
#
STRUCT_FORMAT = "3i"
def connection_made(self, transport):
self._transport = transport
conn = self._transport.get_extra_info("socket")
creds = conn.getsockopt(
socket.SOL_SOCKET,
socket.SO_PEERCRED,
struct.calcsize(self.STRUCT_FORMAT),
)
self._pid, self._uid, self._gid = struct.unpack(
self.STRUCT_FORMAT, creds
)
logger.debug(
"New socket connection from pid=%s, uid=%s, gid=%s",
self._pid,
self._uid,
self._gid,
)
defence360agent/internals/cln.py 0000644 0000000 0000000 00000033031 00000000000 013673 0 ustar import asyncio
import json
import logging
import os
import socket
import urllib.error
import urllib.parse
import urllib.request
from collections import defaultdict
from pathlib import Path
from urllib.parse import parse_qsl, urlencode, urljoin, urlparse, urlunparse
import psutil
from defence360agent.contracts.config import ANTIVIRUS_MODE
from defence360agent.contracts.license import LicenseCLN
from defence360agent.subsys.panels.hosting_panel import HostingPanel
from defence360agent.utils import CheckRunError, async_lru_cache, check_run
from defence360agent.utils.common import get_hostname
_TIMEOUT = 300 # timeout for network operations
_IMUNIFY_EMAIL_CONFIG_EXECUTABLE = Path("/usr/sbin/ie-config")
logger = logging.getLogger(__name__)
IE_SUPPORTED_CMD = (
"wget -qq -O -"
" https://repo.imunify360.cloudlinux.com/defence360/imunifyemail-deploy.sh"
" | bash -s 'is-supported'"
)
@async_lru_cache(maxsize=1)
async def is_imunify_email_supported() -> bool:
try:
await check_run(IE_SUPPORTED_CMD, shell=True)
except CheckRunError as e:
if e.returncode != 100:
logger.error(f"imunify-email check failed {str(e)}")
return False
return True
async def get_imunify_email_status():
"""Try to get imunify-email status"""
if ANTIVIRUS_MODE:
return False
if not _IMUNIFY_EMAIL_CONFIG_EXECUTABLE.exists():
return False
try:
output = await check_run(
[str(_IMUNIFY_EMAIL_CONFIG_EXECUTABLE), "status"]
)
except CheckRunError:
return False
return "spamfilter exim configuration: enabled" in output.decode()
class CLNError(Exception):
def __init__(self, status=None, message=None):
self.message = message
self.status = status
def __str__(self):
if self.message:
return self.message
return "Unexpected status code from CLN: {}".format(self.status)
class InvalidLicenseError(Exception):
pass
class BackupNotFound(CLNError):
GB = 1024 * 1024 * 1024
def __init__(self, url):
self.url = url
def __str__(self):
return "Backup not found in CLN"
def add_used_space(self):
if self.url is None:
return
pu = urlparse(self.url)
query = dict(parse_qsl(pu.query))
query["used_space"] = self._disk_usage()
return urlunparse(
(
pu.scheme,
pu.netloc,
pu.path,
pu.params,
urlencode(query),
pu.fragment,
)
)
def _disk_usage(self):
total_used = 0
partitions = psutil.disk_partitions()
processed = set()
for p in partitions:
if (
(p.device not in processed)
and ("noauto" not in p.opts)
and (not p.device.startswith("/dev/loop"))
):
total_used += psutil.disk_usage(p.mountpoint).used
processed.add(p.device)
return round(total_used / self.GB)
def _post_request(url, data=None, headers=None, timeout=None):
"""To be used by RestCLN._request()."""
kwargs = {}
if headers is not None:
kwargs["headers"] = headers
if data is not None:
if isinstance(data, bytes):
kwargs.setdefault(
"headers", {"Content-type": "application/octet-stream"}
)
elif isinstance(data, str):
data = data.encode("utf-8")
kwargs.setdefault(
"headers", {"Content-type": "text/plain; charset=utf-8"}
)
else: # dict
data = urllib.parse.urlencode(data).encode("ascii")
kwargs.setdefault(
"headers",
{"Content-type": "application/x-www-form-urlencoded"},
)
kwargs["data"] = data
try:
resp = urllib.request.urlopen(
urllib.request.Request(url, **kwargs), timeout=timeout
)
except urllib.error.HTTPError as e:
# Handle HTTP errors (400, 500, etc.)
if e.code < 400:
raise CLNError(e.code) from e
# e.code >= 400
message = None
if e.fp is not None:
logger.warning(
"CLN.post(url=%r, data=%r, headers=%r): %d %s",
url,
data,
headers,
e.code,
e.reason,
)
try:
resp_data = e.read()
except socket.timeout:
raise TimeoutError("Timed out reading error message")
# the response may be non-json
message = resp_data.decode(errors="replace")
raise CLNError(message=message, status=e.code) from e
except urllib.error.URLError as e:
# consider this as a network error (DNS resolution failed)
raise CLNError(message=str(e)) from e
except socket.timeout:
raise TimeoutError("Timed out receiving response")
except OSError as e:
logger.warning(
"CLN.post(url=%r, data=%r, headers=%r, timeout=%r): %s",
url,
data,
headers,
timeout,
e,
)
raise
else:
with resp:
if resp.code == 204:
return resp.code, None
elif resp.code in (200, 244):
# 244 - /im/ab/check returns link for backup buy page
try:
content = resp.read()
except socket.timeout:
raise TimeoutError("Timed out reading response")
else:
try:
return resp.code, json.loads(content.decode())
except json.JSONDecodeError as e:
raise CLNError(
message=(
f"Non-json data from CLN: {content} for"
f" code={resp.code}"
),
status=resp.code,
) from e
else:
raise CLNError(resp.code)
class RestCLN:
_URL_PATH_TEMPLATE = "https://{domain}/api/im/"
_BASE_DOMAIN_NAME = "cln.cloudlinux.com"
_IPV6_DOMAIN_NAME = os.environ.get(
"IM360_CLN_API_BASE_URL", "ipv6.cln.cloudlinux.com"
)
_IPV4_DOMAIN_NAME = os.environ.get(
"IM360_CLN_API_BASE_URL", "ipv4.cln.cloudlinux.com"
)
_BASE_URL = _URL_PATH_TEMPLATE.format(
domain=os.environ.get("IM360_CLN_API_BASE_URL", _BASE_DOMAIN_NAME)
)
_REGISTER_URL = urljoin(_BASE_URL, "register")
_UNREGISTER_URL = urljoin(_BASE_URL, "unregister")
_CHECKIN_URL = urljoin(_BASE_URL, "checkin")
_ACRONIS_CREDENTIALS_URL = urljoin(_BASE_URL, "ab/credentials")
_ACRONIS_REMOVE_URL = urljoin(_BASE_URL, "ab/remove")
_ACRONIS_CHECK_URL = urljoin(_BASE_URL, "ab/check")
STATUS_OK_PAID_LICENSE = "ok"
STATUS_OK_TRIAL_LICENSE = "ok-trial"
@classmethod
async def _request(cls, url, *, data=None, headers=None, timeout=_TIMEOUT):
return await asyncio.get_event_loop().run_in_executor(
None, _post_request, url, data, headers, timeout
)
@classmethod
async def process_ipl_licence(cls):
v4_license_url = urljoin(
cls._URL_PATH_TEMPLATE.format(domain=cls._IPV4_DOMAIN_NAME),
"register",
)
data = {"key": "IPL", "hostname": get_hostname()}
try:
_, token = await cls._request(v4_license_url, data=data)
except CLNError as cln_error:
if cln_error.status == 404:
v6_license_url = urljoin(
cls._URL_PATH_TEMPLATE.format(
domain=cls._IPV6_DOMAIN_NAME
),
"register",
)
_, token = await cls._request(v6_license_url, data=data)
else:
raise cln_error
return token
@classmethod
async def register(cls, key: str) -> dict:
"""
Register server with key
:param key: registration key
:return: license token in case of success
"""
if key == "IPL":
return await cls.process_ipl_licence()
_, token = await cls._request(
cls._REGISTER_URL,
data={"key": key, "hostname": get_hostname()},
)
return token
@classmethod
async def checkin(
cls,
server_id: str,
users_count: int,
hostname: str = None,
):
"""
Update license token
:param str server_id: server id
:param int users_count: users count
:param str hostname: current server hostname
:return: dict new license token
"""
hostname = hostname or get_hostname()
imunify_email_status = await get_imunify_email_status()
panel = HostingPanel()
try:
panel_name = await panel.name()
except Exception as e:
logger.error(
"Failed to get panel version: %s", str(e), exc_info=True
)
panel_name = panel.NAME
req = {
"id": server_id,
"hostname": hostname,
"im": {
"users": users_count,
"panel": panel_name,
"imunifyEmail": imunify_email_status,
"supported_features": {
"IM_EMAIL": await is_imunify_email_supported(),
},
},
}
data = json.dumps(req)
logger.info("CLN checkin: %s", data)
_, token = await cls._request(
cls._CHECKIN_URL,
data=data,
headers={"Content-type": "application/json"},
)
return token
@classmethod
async def acronis_credentials(cls, server_id: str) -> dict:
"""
Creates Acronis Backup account and get user & password
:param server_id: server id
"""
_, creds = await cls._request(
cls._ACRONIS_CREDENTIALS_URL, data={"id": server_id}
)
return creds
@classmethod
async def acronis_remove(cls, server_id: str):
"""
Removes Acronis Backup account
:param server_id: server id
"""
await cls._request(cls._ACRONIS_REMOVE_URL, data={"id": server_id})
@classmethod
async def acronis_check(cls, server_id: str) -> dict:
"""
If Acronis account exists return backup size in GB or if backups
not exists URL for backups
:param server_id: server id
"""
status, response = await cls._request(
cls._ACRONIS_CHECK_URL, data={"id": server_id}
)
if status == 244: # Backup not found
raise BackupNotFound(url=None) # Prohibit purchasing a new backup
return response
@classmethod
async def unregister(cls, server_id=None):
"""
Unregister server id
:return: None
"""
server_id = server_id or LicenseCLN.get_server_id()
await cls._request(cls._UNREGISTER_URL, data={"id": server_id})
class CLN:
_CALLBACKS = defaultdict(set)
@classmethod
def add_callback_for(cls, method_name, coro_callback):
cls._CALLBACKS[method_name].add(coro_callback)
@classmethod
async def run_callbacks_for(cls, method_name):
for callback in cls._CALLBACKS[method_name]:
try:
await callback()
except asyncio.CancelledError:
raise
except Exception as e:
logger.exception(
"Error '{!r}' happened when run callback {} for"
"CLN {} method".format(e, callback, method_name)
)
@classmethod
def is_avp_key(cls, key):
return key.startswith("IMAVP")
@classmethod
async def register(cls, key):
if cls.is_avp_key(key) and not ANTIVIRUS_MODE:
raise InvalidLicenseError(
"Imunify360 can not be registered with ImunifyAV+ key"
)
license = await RestCLN.register(key)
# in case of IP license, we have to register to know if license is
# valid for server (i.e. Imunify360 license is used for Imunify360)
if not LicenseCLN.is_valid(license):
# release registered server id
await RestCLN.unregister(license["id"])
raise InvalidLicenseError("License is invalid for this server")
LicenseCLN.update(license)
await cls.run_callbacks_for("register")
@classmethod
async def unregister(cls):
await RestCLN.unregister()
LicenseCLN.delete()
await cls.run_callbacks_for("unregister")
@classmethod
async def refresh_token(cls, token):
"""Refreshes token and returns new one on success, None otherwise"""
if LicenseCLN.is_free():
# noop: free license can not be refreshed
return LicenseCLN.get_token()
if LicenseCLN.get_token().get("is_alternative"):
# self-signed licenses are refreshed by customer
return LicenseCLN.get_token()
new_token = await RestCLN.checkin(token["id"], LicenseCLN.users_count)
logger.info("Got new token from CLN: %s", new_token)
if new_token is None:
await CLN.unregister()
else:
LicenseCLN.update(new_token)
await cls.run_callbacks_for("refresh_token")
return LicenseCLN.get_token()
def subscribe_to_license_changes(coro):
for method_name in ["register", "unregister", "refresh_token"]:
CLN.add_callback_for(method_name, coro_callback=coro)
defence360agent/internals/deadlock_detecting_lock.py 0000644 0000000 0000000 00000001363 00000000000 017726 0 ustar import asyncio
class DeadlockError(Exception):
"""Error raised if DeadlockDetectingLock detects deadlock"""
class DeadlockDetectingLock:
"""
Lock that detects deadlock when it is about to be
acquired by the same task that already holds it.
"""
def __init__(self):
self._lock = asyncio.Lock()
self._owner = None
def locked(self):
return self._lock.locked()
async def __aenter__(self):
curr_task = asyncio.current_task()
if self._owner == curr_task:
raise DeadlockError()
await self._lock.acquire()
self._owner = curr_task
return self
async def __aexit__(self, exc_type, exc, tb):
self._owner = None
self._lock.release()
defence360agent/internals/delivery_ack.py 0000644 0000000 0000000 00000003255 00000000000 015565 0 ustar """In-memory delivery acknowledgements for Reportable messages.
The send-to-server plugins queue messages rather than deliver them, so a
producer that keeps its own copy of the payload cannot tell a delivered
message from one a lost send round dropped. Every send path reports the ids
the transport accepted here, and producers register the ids they care about.
Acknowledgements are deliberately not persisted: one that never arrives
leaves the message unconfirmed and makes the producer send it again. That
costs a duplicate the server may well store twice, whereas a silently
dropped payload cannot be recovered at all.
"""
import logging
from typing import Callable, Optional
logger = logging.getLogger(__name__)
class DeliveryAckRegistry:
def __init__(self) -> None:
self._callbacks: dict[str, Callable[[], None]] = {}
def watch(self, message_id: str, on_delivered: Callable[[], None]) -> None:
if not message_id:
return
self._callbacks[message_id] = on_delivered
def unwatch(self, message_id: str) -> None:
self._callbacks.pop(message_id, None)
def confirm(self, message_id: Optional[str]) -> None:
on_delivered = self._callbacks.pop(message_id, None)
if on_delivered is None:
return
try:
on_delivered()
except Exception:
# a producer's bookkeeping must never break a send round, but it
# failing means the producer will re-send forever: log the
# traceback, this is the only place that sees it
logger.exception(
"Delivery acknowledgement for %s failed", message_id
)
registry = DeliveryAckRegistry()
defence360agent/internals/feature_flags.py 0000644 0000000 0000000 00000023267 00000000000 015740 0 ustar """
Shared reader for the local feature flags file.
The file is written by:
- Go resident-agent FeatureFlags plugin (IM360 mode)
- Python FeatureFlagsSync plugin (AV mode)
Other subsystems (e.g. message_status_publisher) use this module
to check individual flag values at runtime.
Supported JSON shapes on disk (readers / ``is_enabled`` / ``get_params``):
- New shape ``{"flags": ["mqtt_tracking"], "params": {"flag": ["A", "B"]}}``
(mirrors the sync API response; carries per-flag string-list params).
- Legacy object ``{"mqtt_tracking": true, ...}`` (still accepted).
- JSON array of enabled names ``["mqtt_tracking"]`` (still accepted).
- Legacy wrapper ``{"flags": ["mqtt_tracking", ...]}`` (still accepted).
The sync API checksum collapses to the legacy sorted-names array when no
params are present, so this agent and older agents agree on the bool-only
case. With params, the canonical form expands to ``{"flags": [...], "params":
{...}}`` with all keys and list members sorted.
The sync plugin also writes ``FLAGS_PLAIN_PATH`` (``/var/imunify360/feature_flags``):
plain text, one enabled flag name per line (sorted), for scripts.
"""
from __future__ import annotations
import hashlib
import json
import os
from typing import Any
FLAGS_PATH = "/var/imunify360/feature_flags.json"
# Plain list of enabled flag names (one per line), same order as sorted JSON array.
FLAGS_PLAIN_PATH = "/var/imunify360/feature_flags"
# Flag name whose params list drives MQTT message-status enrichment.
MQTT_TRACKED_METHODS_FLAG = "mqtt_tracked_methods"
# Gates message-loss observability (drop counters, eviction warnings, loss
# metric emission). Same name in the Go resident-agent and the proxy.
MESSAGE_LOSS_OBSERVABILITY_FLAG = "message_loss_observability"
_cached_flags: dict[str, Any] = {}
_cached_params: dict[str, list[str]] = {}
# Pre-built frozenset for the MQTT tracked-methods allow-list. Cached
# alongside the raw params dict so the hot path (every Reportable message
# in the_sink._call_unlocked) avoids re-allocating a fresh frozenset and
# the list copy that get_params() would do. Invalidated by the same
# file-mtime trigger that invalidates _cached_params.
_cached_mqtt_methods: frozenset[str] = frozenset()
_cached_mtime: float = 0.0
def _normalize_flags_from_file(raw: Any) -> dict[str, Any]:
"""Map file JSON to a flat name->value dict for :func:`is_enabled`."""
if raw is None:
return {}
if isinstance(raw, list):
out: dict[str, Any] = {}
for item in raw:
if isinstance(item, str):
out[item] = True
return out
if isinstance(raw, dict):
inner = raw.get("flags")
if isinstance(inner, list):
return _normalize_flags_from_file(inner)
return raw
return {}
def _params_from_file(raw: Any) -> dict[str, list[str]]:
"""Extract ``params`` mapping from new-shape file content.
Only the new ``{"flags": [...], "params": {name: [...]}}`` shape carries
params; every other (legacy) shape returns an empty mapping.
"""
if not isinstance(raw, dict):
return {}
raw_params = raw.get("params")
if not isinstance(raw_params, dict):
return {}
out: dict[str, list[str]] = {}
for name, values in raw_params.items():
if not isinstance(name, str) or not isinstance(values, list):
continue
cleaned = [v for v in values if isinstance(v, str)]
if cleaned:
out[name] = cleaned
return out
def _read_state() -> tuple[dict[str, Any], dict[str, list[str]]]:
global _cached_flags, _cached_params, _cached_mqtt_methods, _cached_mtime
try:
mtime = os.path.getmtime(FLAGS_PATH)
except OSError:
_cached_flags = {}
_cached_params = {}
_cached_mqtt_methods = frozenset()
_cached_mtime = 0.0
return _cached_flags, _cached_params
if mtime == _cached_mtime:
return _cached_flags, _cached_params
try:
with open(FLAGS_PATH) as f:
raw = json.load(f)
_cached_flags = _normalize_flags_from_file(raw)
_cached_params = _params_from_file(raw)
except (OSError, json.JSONDecodeError):
_cached_flags = {}
_cached_params = {}
_cached_mqtt_methods = frozenset(
_cached_params.get(MQTT_TRACKED_METHODS_FLAG, ())
)
_cached_mtime = mtime
return _cached_flags, _cached_params
def _read_flags() -> dict[str, Any]:
flags, _ = _read_state()
return flags
def _read_params() -> dict[str, list[str]]:
_, params = _read_state()
return params
def enabled_flag_names_sorted(flags: Any) -> list[str]:
"""Return sorted enabled flag names for JSON and plain-text sidecar.
Accepts the same shapes as :func:`_normalize_flags_from_file` (array,
flat map, ``{"flags": [...]}``) so checksums and sidecars match Go
``enabledNamesSortedForChecksum`` / :func:`is_enabled`.
"""
if not isinstance(flags, (list, dict)):
raise TypeError(
f"flags must be list or dict, not {type(flags).__name__}"
)
normalized = _normalize_flags_from_file(flags)
return sorted(k for k, v in normalized.items() if v)
def canonical_sync_flag_list_bytes(names: list[str]) -> bytes:
"""JSON array bytes used for sync MD5 when no params are present
(matches correlation_api ``checksum_for_sync_flag_list``)."""
ordered = sorted(names)
return json.dumps(ordered, sort_keys=True, indent=2).encode()
def canonical_sync_response_bytes(
names: list[str], params: dict[str, list[str]]
) -> bytes:
"""JSON bytes for the sync MD5 over the full response shape.
Mirrors correlation_api ``checksum_for_sync_response``: collapses to
the legacy sorted-names array when ``params`` is empty so old agents
keep matching, otherwise expands to the deterministic
``{"flags": [...], "params": {...}}`` form with all keys and list
members sorted.
"""
if not params:
return canonical_sync_flag_list_bytes(names)
canonical = {
"flags": sorted(names),
"params": {k: sorted(v) for k, v in sorted(params.items())},
}
return json.dumps(canonical, sort_keys=True, indent=2).encode()
def sync_checksum_hex_from_flags_file(path: str) -> str:
"""MD5 hex of the canonical sync-response form for ``path``.
Returns "" if the file is missing or invalid. Computes the same MD5
the server returned, so a matching checksum lets the agent skip
the response payload on the next sync.
"""
try:
with open(path, encoding="utf-8") as f:
raw = json.load(f)
except (OSError, UnicodeDecodeError, json.JSONDecodeError):
return ""
names = enabled_flag_names_sorted(raw)
params = _params_from_file(raw)
payload = canonical_sync_response_bytes(names, params)
return hashlib.md5(payload, usedforsecurity=False).hexdigest()
def legacy_feature_flags_map_bytes(names: list[str]) -> bytes:
"""On-disk legacy JSON: ``{flag: true, ...}`` with sorted keys."""
d = {n: True for n in sorted({x for x in names if isinstance(x, str)})}
return json.dumps(d, sort_keys=True, indent=2).encode()
def sync_response_file_bytes(
names: list[str], params: dict[str, list[str]]
) -> bytes:
"""Persisted form for ``FLAGS_PATH`` carrying both flags and params.
Same canonical shape as ``canonical_sync_response_bytes`` so the file
is self-describing and round-trips through ``sync_checksum_hex_from_flags_file``.
"""
canonical = {
"flags": sorted(names),
"params": {k: sorted(v) for k, v in sorted(params.items())},
}
return json.dumps(canonical, sort_keys=True, indent=2).encode()
def plain_text_payload_for_enabled_flags(flags: Any) -> bytes:
"""Body for ``FLAGS_PLAIN_PATH``: one name per line, trailing newline if non-empty."""
names = enabled_flag_names_sorted(flags)
if not names:
return b""
return ("\n".join(names) + "\n").encode()
def serialize_feature_flags_file_payload(flags: Any) -> bytes:
"""Serialize dict flags for writing ``FLAGS_PATH`` (legacy map only)."""
if isinstance(flags, dict):
return json.dumps(flags, sort_keys=True, indent=2).encode()
raise TypeError(f"flags must be dict, not {type(flags).__name__}")
def is_enabled(flag_name: str, default: bool = False) -> bool:
"""Return whether *flag_name* is enabled.
If the file is missing, unreadable, or the flag is absent,
*default* is returned. Defaults to False so unknown flags are
treated as disabled unless the caller explicitly opts in.
"""
flags = _read_flags()
value = flags.get(flag_name)
if value is None:
return default
return bool(value)
def get_params(flag_name: str) -> list[str]:
"""Return the per-flag string params from the on-disk file.
Empty list when the file is missing/unreadable, the flag is unknown,
or the value did not come from the new structured shape (legacy
bool-only flags carry no params by definition).
"""
return list(_read_params().get(flag_name, ()))
def mqtt_tracked_methods() -> frozenset[str]:
"""Frozen set of method names whose status events should be enriched
for MQTT tracing. Driven entirely by the server-side
``mqtt_tracked_methods`` flag's params list — the agent has no
hard-coded list, so adding/removing tracked types is a server-side
config change with no agent rollout.
Cached: ``_read_state`` pre-builds the frozenset and invalidates it
when the flags file's mtime changes. On the hot path — every
Reportable message in ``the_sink._call_unlocked`` — this is a single
``os.stat`` syscall plus an identity-stable frozenset return. Two
consecutive calls within the same mtime window return the same
instance.
"""
_read_state()
return _cached_mqtt_methods
defence360agent/internals/geo.py 0000644 0000000 0000000 00000004620 00000000000 013673 0 ustar from contextlib import contextmanager
from ipaddress import IPv4Address, IPv4Network, IPv6Address, IPv6Network
from typing import Union
from defence360agent.contracts.config import CountryInfo
from defence360agent.utils.validate import IP
class Reader:
def __init__(self, geoip2_reader):
self._geoip2_reader = geoip2_reader
def get(
self,
address: Union[
str, IPv4Address, IPv4Network, IPv6Address, IPv6Network
],
):
"""
Returns geo country information from max mind's db request
:param address: ip or network address
e.g. '4.4.4.4, 1.2.0.0/16, 2001:678:4c::/48'
:return: maxmind's geo info
"""
from geoip2.errors import AddressNotFoundError
try:
ip = IP.adopt_to_ipvX_network(address)
except ValueError:
return None
try:
obj = self._geoip2_reader.country(str(ip.network_address))
except AddressNotFoundError:
return None
# According to documentation:
# https://geoip2.readthedocs.io/en/latest/#what-data-is-returned
# (...) MaxMind does not always have every piece of data for any given
# IP address. Because of these factors, it is possible for any request
# to return a record where some or all of the attributes are
# unpopulated. (...)
return obj.country if obj else None
def get_id(
self,
address: Union[
str, IPv4Address, IPv4Network, IPv6Address, IPv6Network
],
):
"""
:param address: valid ipv4 address
:return: maxmind's id of the country
"""
country_info = self.get(address)
if country_info:
return country_info.geoname_id
return None
def get_code(
self,
address: Union[
str, IPv4Address, IPv4Network, IPv6Address, IPv6Network
],
):
"""
:param address: valid ipv4 address
:return: country code in ISO-3166 format
"""
country_info = self.get(address)
if country_info:
return country_info.iso_code
return None
@contextmanager
def reader():
"""
:return Reader obj: instance to be reused to it's method calls
"""
import geoip2.database
with geoip2.database.Reader(CountryInfo.DB) as geoip2_reader:
yield Reader(geoip2_reader)
defence360agent/internals/global_scope.py 0000644 0000000 0000000 00000000716 00000000000 015554 0 ustar import logging
logger = logging.getLogger(__name__)
class GlobalScope(dict):
def __getattr__(self, item):
try:
return self[item]
except KeyError as err:
raise AttributeError(f"{item} is not in global scope") from err
def __setattr__(self, key, value):
if key in self:
logger.warning("Name %s is already in global scope", key)
else:
self[key] = value
g = GlobalScope()
defence360agent/internals/iaid.py 0000644 0000000 0000000 00000034506 00000000000 014035 0 ustar import asyncio
import grp
import json
import os
import random
import time
from dataclasses import dataclass
from logging import getLogger
from pathlib import Path
from typing import Callable
from urllib.parse import urljoin
from urllib.request import Request
from defence360agent.api.server import API, APIError
from defence360agent.contracts.license import LicenseCLN
from defence360agent.utils import atomic_rewrite, safe_cancel_task
from defence360agent.utils.common import DAY
from defence360agent.internals.global_scope import g
from defence360agent.internals.deadlock_detecting_lock import (
DeadlockDetectingLock,
DeadlockError,
)
logger = getLogger(__name__)
_MAX_TRIES = 10
_TIMEOUT_MULTIPLICATOR = 2
"""
>>> _MAX_TRIES_FOR_DOWNLOAD = 10
>>> _TIMEOUT_MULTIPLICATOR = 2
>>> [(1 << i) * _TIMEOUT_MULTIPLICATOR for i in range(1, _MAX_TRIES_FOR_DOWNLOAD)] # noqa
[4, 8, 16, 32, 64, 128, 256, 512, 1024]
"""
_ACTIVATE_MINIMUM_TIMEOUT = 60
class IAIDTokenError(RuntimeError):
"""Can't get iaid token for any reason."""
class IndependentAgentIDAPI(API):
API_PATH = "/api/auth/agent/{}"
REGISTER_URL = urljoin(API._BASE_URL, API_PATH.format("register"))
ACTIVATE_URL = urljoin(API._BASE_URL, API_PATH.format("activate"))
LOGIN_URL = urljoin(API._BASE_URL, API_PATH.format("login"))
TOKEN_INFO = urljoin(API._BASE_URL, API_PATH.format("token-info"))
IAID_DIR = Path("/var/imunify360")
IAID_FILE = IAID_DIR / "iaid"
IAID_PASSWORD_FILE = IAID_DIR / "iaid-password"
IAID_TOKEN_FILE = IAID_DIR / "iaid-token"
IAID_ACTIVATED_FILE = IAID_DIR / "iaid-activated"
_tasks = {
"register": [],
"activate": [],
"login": [],
}
_register_lock = DeadlockDetectingLock()
_activate_lock = asyncio.Lock()
@dataclass(frozen=True)
class TokenInfo:
__slots__ = [
"valid",
"iaid",
"license_status",
"server_id",
"need_renew",
]
valid: bool
iaid: str
license_status: str # "ok", "ok-av", "ok-avp", "ok-trial"
server_id: str
need_renew: bool
@staticmethod
async def _retry_on_error(coro: Callable, *args, attempt, timeout=0):
# Exponential backoff retry
await asyncio.sleep(
timeout + random.randrange(1 << attempt) * _TIMEOUT_MULTIPLICATOR
)
await coro(*args)
@classmethod
def _add_task(cls, type, coro: Callable, *args, attempt, timeout=0):
cls._tasks[type] = [
task for task in cls._tasks[type] if not task.done()
]
if len(cls._tasks[type]) <= 1:
loop = asyncio.get_event_loop()
cls._tasks[type].append(
loop.create_task(
cls._retry_on_error(
coro, *args, attempt=attempt, timeout=timeout
)
)
)
else:
logger.info("Task %s already in retry queue", type)
@classmethod
def add_initial_task(cls):
cls._add_task("activate", cls.activate, attempt=0)
@classmethod
async def shutdown(cls):
for type, tasks in cls._tasks.items():
for task in tasks:
if not task.done():
await safe_cancel_task(task)
logger.info("Retry task %s was canceled.", type)
@staticmethod
def _gid():
return grp.getgrnam("_imunify").gr_gid
@classmethod
def get_iaid(cls):
if cls.IAID_FILE.exists():
return cls.IAID_FILE.read_text()
return None
@staticmethod
def _request(url, headers=None, method="POST", **kwargs):
_headers = {"Content-Type": "application/json"}
if headers is not None:
_headers.update(headers)
return Request(
url,
method=method,
headers=_headers,
data=json.dumps(kwargs).encode() if kwargs else None,
)
@classmethod
def is_registered(cls):
return all(
iaid_file.exists()
for iaid_file in (cls.IAID_FILE, cls.IAID_PASSWORD_FILE)
)
@classmethod
async def get_token(cls):
"""Ensure that iaid token is up to date
Return iaid token or raise IAIDTokenError."""
if IndependentAgentIDAPI.is_token_expired():
await IndependentAgentIDAPI.login()
if IndependentAgentIDAPI.is_token_expired():
raise IAIDTokenError("IAID token is expired")
try:
token = cls.IAID_TOKEN_FILE.read_text(encoding="ascii").strip()
if not token:
raise IAIDTokenError("IAID_TOKEN_FILE is empty")
return token
except Exception as e:
raise IAIDTokenError(f"Can't get iaid token, reason: {e}") from e
@classmethod
async def _get_token_info(cls) -> TokenInfo:
iaid_token = await cls.get_token()
headers = {"X-Auth": iaid_token}
request = cls._request(cls.TOKEN_INFO, headers=headers, method="GET")
result = await cls.async_request(request)
token = result.get("token_info")
if token is None:
raise APIError("wrong response %r", result)
try:
return cls.TokenInfo(**token)
except TypeError as e:
raise APIError("incomplete token_info %r: %s" % (token, e)) from e
@classmethod
def is_token_expired(cls):
try:
stat = os.stat(cls.IAID_TOKEN_FILE)
except FileNotFoundError:
st_mtime = 0.0
else:
st_mtime = stat.st_mtime
return time.time() - st_mtime > DAY
@classmethod
async def register(cls, force=False, tried_credentials_ts=None, attempt=1):
# In case of Unauthorized 401 for login/activate, iaid initiates force registration.
# Prevent multiple force registrations by checking if the lock was already acquired.
# This approach also works if the lock was already acquired by non-force registration,
# as the non-force registration is currently only triggered if iaid wasn't registered.
was_waiting = cls._register_lock.locked()
try:
async with cls._register_lock:
if cls.is_registered():
if not force or was_waiting:
return
# If credentials were already updated - no need to register again.
# This check makes the above `was_waiting` check obsolete in most cases,
# but some old filesystems have second precision of for a file mtime.
# Both checks are kept to decrease a chance of race conditions.
if (
tried_credentials_ts is not None
and tried_credentials_ts < cls._get_credentials_ts()
):
return
payload = dict()
server_id = LicenseCLN.get_server_id()
if server_id:
payload["server_id"] = server_id
request = cls._request(cls.REGISTER_URL, **payload)
try:
result = await cls.async_request(request)
cls.IAID_ACTIVATED_FILE.unlink(missing_ok=True)
except APIError as e:
logger.warning(
"Something went wrong on register %r - attempt %s",
e,
attempt,
)
if (
e.status_code is None
or e.status_code >= 500
or e.status_code == 402
) and attempt < _MAX_TRIES:
# internal error we may try again
cls._add_task(
"register",
cls.register,
force,
tried_credentials_ts,
attempt + 1,
attempt=attempt,
)
else:
logger.error(
"Failed to register (%s) after %s attempts: %r",
request.full_url,
attempt,
e,
)
return
else:
atomic_rewrite(
str(cls.IAID_FILE),
result["iaid"],
backup=cls.IAID_FILE.exists(),
uid=-1,
gid=cls._gid(),
permissions=0o640,
)
atomic_rewrite(
str(cls.IAID_PASSWORD_FILE),
result["password"],
backup=cls.IAID_PASSWORD_FILE.exists(),
permissions=0o600,
)
await cls.activate()
except DeadlockError:
logger.error(
"Received incorrect credentials on register after %s attempts",
attempt,
)
@classmethod
async def ensure_is_activated_and_valid(cls):
"""Check whether the agent activated"""
if not cls.IAID_ACTIVATED_FILE.exists():
await cls.activate()
return
lic = LicenseCLN.get_token()
token = await cls._get_token_info()
if token.license_status != lic.get(
"status"
) or token.server_id != lic.get("id"):
logger.error("Got a corrupted token: %r", token)
await cls.reactivate()
return
iaid = cls.IAID_FILE.read_text()
if not token.valid or token.iaid != iaid or token.need_renew:
await cls.login()
@classmethod
def _get_credentials_ts(cls):
return cls.IAID_PASSWORD_FILE.stat().st_mtime
@classmethod
async def activate(cls, attempt=1):
if cls.IAID_ACTIVATED_FILE.exists():
g["iaid"] = cls.get_iaid()
return
if not cls.is_registered():
logger.warning("need to register first before activate")
await cls.register()
return
if LicenseCLN.is_free():
g["iaid"] = cls.get_iaid()
if cls.is_token_expired():
await cls.login()
return
lic = LicenseCLN.get_token()
if not lic:
logger.warning(
"Can't continue iaid activation: no valid license is found"
)
return
async with cls._activate_lock:
# A concurrent activate() may have already completed
# while we were waiting for the lock.
if cls.IAID_ACTIVATED_FILE.exists():
g["iaid"] = cls.get_iaid()
return
iaid = cls.IAID_FILE.read_text()
password = cls.IAID_PASSWORD_FILE.read_text()
credentials_ts = cls._get_credentials_ts()
request = cls._request(
cls.ACTIVATE_URL, iaid=iaid, password=password, license=lic
)
g["iaid"] = iaid
need_to_register = False
try:
await cls.async_request(request)
cls.IAID_ACTIVATED_FILE.touch()
except APIError as e:
logger.warning(
"Something went wrong on activate %r attempt %s",
e,
attempt,
)
if e.status_code and e.status_code == 401:
# need to register again, do it outside of lock
need_to_register = True
elif (
e.status_code
and (e.status_code >= 500 or e.status_code == 402)
and attempt < _MAX_TRIES
):
# internal error we may try again
# 402 - if it is fresh registration it may take
# time to sync CLN db
cls._add_task(
"activate",
cls.activate,
attempt + 1,
attempt=attempt,
timeout=_ACTIVATE_MINIMUM_TIMEOUT,
)
else:
logger.error(
"Failed to activate (%s) after %s attempts: %r",
request.full_url,
attempt,
e,
)
else:
cls.IAID_TOKEN_FILE.unlink(missing_ok=True)
await cls.login()
if need_to_register:
await cls.register(force=True, tried_credentials_ts=credentials_ts)
@classmethod
async def reactivate(cls):
cls.IAID_ACTIVATED_FILE.unlink(missing_ok=True)
await cls.activate()
@classmethod
async def login(cls, attempt=1):
if not cls.is_registered():
logger.error("need to register first before login")
return
iaid = cls.IAID_FILE.read_text()
password = cls.IAID_PASSWORD_FILE.read_text()
credentials_ts = cls._get_credentials_ts()
request = cls._request(cls.LOGIN_URL, iaid=iaid, password=password)
try:
result = await cls.async_request(request)
except APIError as e:
logger.warning(
"Something wrong happened on login %r attempt %s", e, attempt
)
if attempt < _MAX_TRIES:
if e.status_code is None or e.status_code >= 500:
# internal error we may try again
cls._add_task(
"login", cls.login, attempt + 1, attempt=attempt
)
elif e.status_code == 401:
await cls.register(
force=True, tried_credentials_ts=credentials_ts
)
else:
logger.error(
"Failed to login (%s) after %s attempts: %r",
request.full_url,
attempt,
e,
)
else:
atomic_rewrite(
str(cls.IAID_TOKEN_FILE),
result["token"],
backup=cls.IAID_TOKEN_FILE.exists(),
uid=-1,
gid=cls._gid(),
permissions=0o640,
)
defence360agent/internals/lazy_load.py 0000644 0000000 0000000 00000000303 00000000000 015071 0 ustar class CoreSource:
MESSAGES = ("defence360agent.contracts.messages",)
ENDPOINTS = (
"defence360agent.simple_rpc",
"defence360agent.feature_management.rpc.endpoints",
)
defence360agent/internals/logger.py 0000644 0000000 0000000 00000037042 00000000000 014404 0 ustar import getpass
import logging
import logging.config
import logging.handlers
import os
import sys
import time
import traceback
import uuid
from contextlib import contextmanager, suppress
from functools import lru_cache
import sentry_sdk
import yaml
from defence360agent.contracts import config, sentry
from defence360agent.contracts.config import AcronisBackup
from defence360agent.contracts.config import Logger as Config
from defence360agent.contracts.config import Sentry
from defence360agent.utils import antivirus_mode, is_root_user
from defence360agent.application import tags
PREFIX = os.environ.get("IMUNIFY360_LOGGING_PREFIX", "")
logger = logging.getLogger(__name__)
def _sentry_init(debug=False):
# if config invalid, we still need to be able to configure logging
try:
error_reporting = Sentry.ENABLE
except (KeyError, AssertionError):
error_reporting = True
if error_reporting:
sentry_sdk.init(
dsn=Sentry.DSN,
debug=debug,
release=config.Core.VERSION,
attach_stacktrace="on",
)
with sentry_sdk.configure_scope() as scope:
for tag, value in sentry.tags().items():
scope.set_tag(tag, value)
scope.user = {"id": sentry.tag("server_id")}
return {
"level": "ERROR",
"class": "sentry_sdk.integrations.logging.SentryHandler",
}
else:
return {
"level": "NOTSET",
"class": "logging.NullHandler",
}
class _LoggerDynConfig:
_ROOT_LOG_DIR = "/var/log/%s" % config.Core.PRODUCT
@staticmethod
def _user_log_dir():
return "/var/log/%s_user_logs/%s" % (
config.Core.PRODUCT,
getpass.getuser() or os.getuid(),
)
def __init__(self):
is_root = is_root_user()
self.log_dir = self._ROOT_LOG_DIR if is_root else self._user_log_dir()
self.mutableDictConfig = {
"loggers": {
"network": {
"level": "DEBUG",
# network_log is disabled by default'
"handlers": [],
},
"defence360agent.internals.the_sink": {
"level": "DEBUG",
# process_message_log is disabled by default'
"handlers": [],
},
"event_hook": {
"level": "INFO",
"handlers": [],
},
},
"version": 1,
"handlers": {
"sentry": _sentry_init(),
"error_log": {
"level": "WARNING",
"formatter": "abstimestamp",
"filename": "%s/error.log" % self.log_dir,
"class": "logging.FileHandler",
"encoding": "utf8",
},
"network_log": {
"level": "DEBUG",
"formatter": "abstimestamp",
"filename": "%s/network.log" % self.log_dir,
"class": "logging.FileHandler",
"encoding": "utf8",
},
"debug_log": {
"level": "DEBUG",
"formatter": "abstimestamp",
"filename": "%s/debug.log" % self.log_dir,
"class": "logging.FileHandler",
"encoding": "utf8",
},
"console_log": {
"level": "INFO",
"formatter": "abstimestamp",
"filename": "%s/console.log" % self.log_dir,
"class": "logging.FileHandler",
"encoding": "utf8",
},
"hook_log": {
"level": "INFO",
"formatter": "eventhook",
"filename": "%s/hook.log" % self.log_dir,
"class": "logging.FileHandler",
"encoding": "utf8",
},
"console": {
"formatter": "abstimestamp",
"class": "logging.StreamHandler",
"stream": "ext://sys.stderr",
"level": "INFO",
},
"process_message_log": {
"formatter": "reltimestamp",
# DEF-26794: append mode (default). With logrotate's
# copytruncate, mode="w" would leave the fd offset past
# EOF after truncation and re-inflate the file with
# sparse zeros. O_APPEND seeks to the (now-zero) end
# before each write, so the file size resets cleanly.
"level": "DEBUG",
"filename": "%s/process_message.log" % self.log_dir,
"class": "logging.FileHandler",
"encoding": "utf8",
},
},
"root": {
"level": "NOTSET",
"handlers": [
"console_log",
# 'debug_log' is disabled by default,
"error_log",
"sentry",
],
},
"mkdir": "logs",
"formatters": {
"reltimestamp": {
"format": (
"%(levelname)-7s [+%(relativeCreated)5dms] "
f"{PREFIX}%(name)50s|%(message)s"
)
},
"abstimestamp": {
"format": (
f"%(levelname)-7s [%(asctime)s] {PREFIX}%(name)s:"
" %(message)s"
)
},
"eventhook": {"format": "%(created)d : %(message)s"},
},
"disable_existing_loggers": False,
}
self.mutableDictConfig["loggers"]["AcronisClientInstaller"] = {
"level": "INFO",
"handlers": [],
}
self.mutableDictConfig["handlers"]["acronis_installer_log"] = {
"formatter": "abstimestamp",
# DEF-26794: append mode (default). See process_message_log
# comment above for why mode="w" is unsafe with copytruncate.
"level": "INFO",
"filename": os.path.join(self.log_dir, AcronisBackup.LOG_NAME),
"class": "logging.FileHandler",
"encoding": "utf8",
}
if not is_root:
# The per-user log dir is owned by the unprivileged user, so root's
# logrotate must not rotate it (it would let the user redirect
# root's create/copy/truncate via a symlink). Bound these logs
# in-process instead — as the owning user — mirroring the size
# policy logrotate applies to the root logs.
for handler in self.mutableDictConfig["handlers"].values():
if handler.get("class") == "logging.FileHandler":
handler["class"] = "logging.handlers.RotatingFileHandler"
handler["maxBytes"] = Config.MAX_LOG_FILE_SIZE
handler["backupCount"] = Config.BACKUP_COUNT
@lru_cache(1)
def _late_init():
return _LoggerDynConfig()
def _we_are_in_cagefs():
"""
:return bool: True if python interpreter is being run in CageFS container,
otherwise False
:raise: never
Current implementation simply checks "/var/.cagefs" presence, as
Anton Volkov consulted us to do.
Placing this function not in 'subsys' package, because 'logger' module
is one of cornerstones dependency for 'subsys' package as well.
"""
with suppress(OSError):
return os.path.exists("/var/.cagefs")
def _chmod_log_dirs(dirname, dir_perm, file_perm):
"""Change file/dir modes recursively.
Starting at dirname, change all inner directory permissions to dir_perm,
file permissions to file_perm
Permission errors are logged to stderr and are ignored in any case.
"""
def _os_chmod(file_dir_path, permission):
try:
os.chmod(file_dir_path, permission)
except PermissionError as e:
sys.stderr.write(
"[WARNING] cannot chmod on {}: {}".format(file_dir_path, e)
)
_os_chmod(dirname, dir_perm)
for path, dirs, files in os.walk(dirname):
for directory in dirs:
_os_chmod(os.path.join(path, directory), dir_perm)
for name in files:
_os_chmod(os.path.join(path, name), file_perm)
def reconfigure():
"""
Re-catch with _LoggerDynConfig and re-open log files
"""
if os.getenv("IMUNIFY360_DISABLE_LOGGING"):
pass
else:
try:
# Set sentry.TAGS from saved file
tags.cached_fill()
log_dir = _late_init().log_dir
os.makedirs(log_dir, Config.LOG_DIR_PERM, exist_ok=True)
_chmod_log_dirs(log_dir, Config.LOG_DIR_PERM, Config.LOG_FILE_PERM)
logging.config.dictConfig(_late_init().mutableDictConfig)
except OSError:
# We do not create user logs to keep user isolation
# level high.
#
# Another alternative is
# cagefs.mp:%/var/log/imunify360_user_log
# but it is not working for some reason, we need to find out
# later why.
if not _we_are_in_cagefs():
traceback.print_exc(file=sys.stderr)
sys.stderr.write(
"%s logger is not available.\n" % config.Core.PRODUCT
)
except Exception:
# be robust: do not die if dictConfig fails
traceback.print_exc(file=sys.stderr)
sys.stderr.write(
"%s logger is not available.\n" % config.Core.PRODUCT
)
else: # logging is configured successfully
sys.excepthook = _log_uncaught_exceptions
def _log_uncaught_exceptions(exc_type, exc_value, exc_traceback):
if issubclass(exc_type, KeyboardInterrupt):
sys.__excepthook__(exc_type, exc_value, exc_traceback)
return
logger.critical(
"uncaught exception", exc_info=(exc_type, exc_value, exc_traceback)
)
def update_logging_config_from_file(filename):
with open(filename) as config_file:
config = yaml.safe_load(config_file)
_late_init().mutableDictConfig.update(config)
reconfigure()
def get_fds():
handlers = logging.root.handlers
for _logger in _late_init().mutableDictConfig["loggers"].keys():
handlers.extend(logging.getLogger(_logger).handlers)
return [
h.stream
for h in handlers
if hasattr(h, "stream")
and hasattr(h.stream, "fileno")
and h.stream != sys.stderr
]
def get_log_file_names():
return [
values["filename"]
for _, values in _late_init().mutableDictConfig["handlers"].items()
if "filename" in values
]
def getNetworkLogger(name):
if name in sys.modules:
return logging.getLogger("network." + sys.modules[name].__name__)
else:
return logging.getLogger("network." + name)
# NOTE: client expects that this function will return
# the same value always - /var/log/imunify360. They base their logrotate
# configs on this value. In case of some updates, corresponding teams
# should be notified before update to update their logrotate configs.
def log_dir() -> str:
"""
Return base log directory for the product.
Supposed to be used by clients to build the path to their own logs.
"""
return _late_init().log_dir
def setLogLevel(verbose):
# FIXME
if antivirus_mode.disabled:
_late_init().mutableDictConfig["loggers"]["AcronisClientInstaller"][
"handlers"
].append("acronis_installer_log")
if verbose >= 2:
_late_init().mutableDictConfig["loggers"]["network"][
"handlers"
].append("network_log")
if verbose >= 3:
_late_init().mutableDictConfig["loggers"][
"defence360agent.internals.the_sink"
]["handlers"].append("process_message_log")
if verbose >= 4:
_late_init().mutableDictConfig["root"]["handlers"].append("debug_log")
_late_init().mutableDictConfig["loggers"]["event_hook"]["handlers"].append(
"hook_log"
)
reconfigure()
def setConsoleLogLevel(newloglevel):
"""
also results in reconfigure()
"""
_late_init().mutableDictConfig["handlers"]["console"][
"level"
] = newloglevel
reconfigure()
# openAibolitActionsLog and openMdsActionsLog are deprecated and should be removed
# after release of https://gerrit.cloudlinux.com/c/defence360/+/225868
@contextmanager
def openAibolitActionsLog(scan_id: str):
path = os.path.join(_late_init().log_dir, "aibolit_actions.log")
with open(path, "a") as f:
f.write(f'{time.strftime("%Y-%m-%d %H:%M:%S")} | {scan_id} | ')
yield f
f.write("\n\n")
# openAibolitActionsLog and openMdsActionsLog are deprecated and should be removed
# after release of https://gerrit.cloudlinux.com/c/defence360/+/225868
@contextmanager
def openMdsActionsLog(scan_id: str):
log_dir = _late_init().log_dir
os.makedirs(log_dir, exist_ok=True)
path = os.path.join(log_dir, "mds_actions.log")
with open(path, "a") as f:
f.write(f'{time.strftime("%Y-%m-%d %H:%M:%S")} | {scan_id} | ')
yield f
f.write("\n\n")
class EventHookLogger:
class _EventLogger:
class _HookLogger:
tpl = (
"{uuid:s} : {action:s} {native:s}: "
"{event:s} : {subtype:s} : {path:s}"
)
def __init__(self, parent, path, native):
self.path = path
self.event = parent.event
self.subtype = parent.subtype
self.uuid = parent.uuid
self.log = parent.log
self.native = native
def __enter__(self):
return self
def __exit__(self, exc_type, exc_val, exc_tb):
pass
def _log(self, action, message=""):
data = {
"uuid": str(self.uuid),
"action": action,
"native": "native " if self.native else "",
"event": self.event,
"subtype": self.subtype,
"path": self.path,
}
msg = self.tpl.format(**data)
if message:
msg = " : ".join([msg, message])
self.log(msg)
def begin(self):
self._log("started")
def finish(self, exit_code, err):
message = "OK" if exit_code == 0 else "ERROR"
if exit_code:
message = ":".join([message, str(exit_code)])
if err:
if isinstance(err, bytes):
err = err.decode(errors="backslashreplace")
message = "\n".join([message, err])
self._log("done", message)
def __init__(self, parent, event, subtype):
self.event = event
self.subtype = subtype
self.uuid = uuid.uuid4()
self.log = parent.log
def __call__(self, path, native=False):
return self._HookLogger(self, path, native=native)
def __enter__(self):
return self
def __exit__(self, exc_type, exc_val, exc_tb):
pass
def __init__(self):
logger = logging.getLogger("event_hook")
self.log = logger.info
def __call__(self, event, subtype):
return self._EventLogger(self, event, subtype)
defence360agent/internals/logging_protocol.py 0000644 0000000 0000000 00000002105 00000000000 016464 0 ustar import asyncio
class LoggingProtocol(asyncio.Protocol):
def __init__(self, logger, network_logger, real_protocol):
self._logger = logger
self._network_logger = network_logger
self._real_protocol = real_protocol
def connection_made(self, transport):
self._network_logger.debug("Connection made.")
self._handle(lambda: self._real_protocol.connection_made(transport))
def connection_lost(self, exc):
self._network_logger.debug("Connection lost.")
self._handle(lambda: self._real_protocol.connection_lost(exc))
def datagram_received(self, data, addr):
self._network_logger.debug("datagram_received: {!r}".format(data))
self._handle(lambda: self._real_protocol.datagram_received(data, addr))
def data_received(self, data):
self._network_logger.debug("data_received: {!r}".format(data))
self._handle(lambda: self._real_protocol.data_received(data))
def _handle(self, impl):
try:
impl()
except Exception as e:
self._logger.exception(str(e))
defence360agent/internals/message_status_publisher.py 0000644 0000000 0000000 00000014522 00000000000 020227 0 ustar """
Lightweight message status publisher for asyncclient.
Publishes MESSAGE_STATUS events to the local proxy which relays them
to the EMQX broker via MQTT.
Each call to report() submits an HTTP POST to a thread pool — no
batching or internal queue.
Usage::
publisher = MessageStatusPublisher()
message_id_gen = Gen()
msg = {...}
message_id_gen.enrich(msg) # adds message_reporter_id / message_reporter_increment
publisher.report(msg, reporter_id_gen)
"""
import atexit
import concurrent.futures
import json
import logging
import os
import threading
import time
import urllib.error
import urllib.request
import uuid
from defence360agent.internals.feature_flags import (
MESSAGE_LOSS_OBSERVABILITY_FLAG,
is_enabled,
)
logger = logging.getLogger(__name__)
_IAID_PATH = "/var/imunify360/iaid"
_PROXY_URL = os.environ.get("IMUNIFY_PROXY_URL", "http://127.0.0.1:11234")
_PUBLISH_ENDPOINT = _PROXY_URL.rstrip("/") + "/api/v1/mqtt-publish"
# Shared secret for proxy APIKey middleware; must match
# IMUNIFY_PROXY_API_KEY on the proxy side (see src/proxy/auth/jwt.go).
# When unset (e.g. in tests or pre-deploy) the proxy logs a WARN and
# passes requests through.
_PROXY_API_KEY = os.environ.get("IMUNIFY_PROXY_API_KEY", "")
_POST_TIMEOUT = 5
_MAX_WORKERS = 4
# Cap on concurrently queued+in-flight POSTs. Matches the Go publisher's
# statusPublisherQueueSize; when the broker or proxy is slow we prefer
# dropping new events over unbounded memory growth.
_MAX_INFLIGHT = 128
class Gen:
"""ID + monotonic counter generator.
Each instance has its own UUID and its own counter.
"""
def __init__(self) -> None:
self.id = uuid.uuid4().hex
self._counter = 0
self._lock = threading.Lock()
def _next(self) -> int:
with self._lock:
value = self._counter
self._counter += 1
return value
def enrich(self, msg: dict) -> None:
"""Add message_reporter_id and message_reporter_increment to msg."""
msg["message_reporter_id"] = self.id
msg["message_reporter_increment"] = self._next()
def _read_iaid() -> str:
try:
with open(_IAID_PATH) as f:
return f.read().strip()
except OSError:
return ""
class MessageStatusPublisher:
def __init__(self) -> None:
self._iaid: str = ""
self._init_lock = threading.Lock()
self._initialized = False
self._pool = concurrent.futures.ThreadPoolExecutor(
max_workers=_MAX_WORKERS,
thread_name_prefix="msg-status",
)
self._inflight = threading.BoundedSemaphore(_MAX_INFLIGHT)
self._dropped = 0
self._dropped_lock = threading.Lock()
def pop_dropped(self) -> int:
"""Drops since the last call, then reset (delta for metrics)."""
with self._dropped_lock:
dropped, self._dropped = self._dropped, 0
return dropped
def queue_depth(self) -> int:
"""In-flight reports awaiting completion (gauge, 0..cap)."""
sem = self._inflight
return max(0, sem._initial_value - sem._value)
def _ensure_initialized(self) -> None:
if self._initialized:
return
with self._init_lock:
if self._initialized:
return
self._iaid = _read_iaid()
if not self._iaid:
logger.info(
"msg-status: iaid not available yet (file %s missing or"
" empty), will retry",
_IAID_PATH,
)
return
self._initialized = True
def report(self, msg: dict, reporter_gen: Gen, stage: str) -> None:
"""Publish a status record via HTTP POST to the proxy."""
# Gate the feature flag before any allocation: report() is called
# per message and when tracking is disabled (default) we want zero
# dict/pool overhead.
if not is_enabled("mqtt_tracking"):
return
method = msg.get("method", "")
if not msg.get("message_reporter_id"):
return
# Bounded queue: drop new events when we're already at capacity so
# a slow proxy/broker can't grow our memory unboundedly. Mirrors
# the Go publisher's fire-and-drop channel pattern.
if not self._inflight.acquire(blocking=False):
if is_enabled(MESSAGE_LOSS_OBSERVABILITY_FLAG):
with self._dropped_lock:
self._dropped += 1
logger.warning(
"msg-status: queue full, dropping stage=%s method=%s",
stage,
method,
)
return
record = {
"timestamp": time.time(),
"reporter_id": reporter_gen.id,
"reporter_increment": reporter_gen._next(),
"message_reporter_id": msg.get("message_reporter_id", ""),
"message_reporter_increment": msg.get(
"message_reporter_increment", 0
),
"message_type": method,
"stage": stage,
}
try:
future = self._pool.submit(self._do_post, record, stage, method)
except RuntimeError:
# Pool already shut down.
self._inflight.release()
return
future.add_done_callback(lambda _: self._inflight.release())
def _do_post(self, record: dict, stage: str, method: str) -> None:
self._ensure_initialized()
if not self._iaid:
return
record["iaid"] = self._iaid
try:
payload = json.dumps(record).encode()
headers = {"Content-Type": "application/json"}
if _PROXY_API_KEY:
headers["X-API-Key"] = _PROXY_API_KEY
req = urllib.request.Request(
_PUBLISH_ENDPOINT,
data=payload,
headers=headers,
method="POST",
)
with urllib.request.urlopen(req, timeout=_POST_TIMEOUT) as resp:
resp.read()
except Exception as e:
logger.warning(
"msg-status: POST failed stage=%s method=%s: %r",
stage,
method,
e,
)
def shutdown(self) -> None:
self._pool.shutdown(wait=False)
publisher = MessageStatusPublisher()
atexit.register(publisher.shutdown)
message_id_gen = Gen()
defence360agent/internals/persistent_message.py 0000644 0000000 0000000 00000010442 00000000000 017024 0 ustar import time
from logging import getLogger
from defence360agent.internals.feature_flags import (
MESSAGE_LOSS_OBSERVABILITY_FLAG,
is_enabled,
)
from defence360agent.model.instance import db
from defence360agent.model.messages_to_send import MessageToSend
logger = getLogger(__name__)
class PersistentMessagesQueue:
"""
The queue to store messages sent to the server if it is unavailable.
- stores more recent data; if a limit is exceeded,
older messages are deleted.
- no duplicate messages are sent
NOTE: it is worth remembering that when writing a large number of messages,
the amount of memory used may increase by the size of the sqlite
cache (this may not be immediately obvious).
https://www.sqlite.org/pragma.html#pragma_cache_size
"""
def __init__(self, buffer_limit=20, storage_limit=1000, model=None):
self._buffer_limit = buffer_limit
self._storage_limit = storage_limit
self._buffer = [] # [(timestamp, message),...]
self._model = model or MessageToSend
self.dropped_total = 0
self._evicted = 0
def pop_evicted(self) -> int:
"""Evictions since the last call, then reset (delta for metrics)."""
evicted, self._evicted = self._evicted, 0
return evicted
def push_buffer_to_storage(self) -> None:
if self._buffer:
with db.atomic():
# buffer may contain older messages than db,
# so remove oldest items after insert
self._model.insert_many(self._buffer)
need_to_remove = self.storage_size - self._storage_limit
if need_to_remove > 0:
# keep only the most recent messages
removed = self._model.delete_old(need_to_remove)
# This is the last point at which the messages exist, so it
# is the only place their loss can be reported.
self.dropped_total += removed
if is_enabled(MESSAGE_LOSS_OBSERVABILITY_FLAG):
self._evicted += removed
logger.warning(
"Persistent message queue overflow: dropped %d oldest"
" message(s), storage_limit=%d, dropped_total=%d",
removed,
self._storage_limit,
self.dropped_total,
)
self._buffer = []
def pop_all(self) -> list:
items = []
with db.atomic():
items += list(
self._model.select(
self._model.timestamp, self._model.message
).tuples()
)
self._model.delete().execute()
items += self._buffer
self._buffer = []
return sorted(items) # older first
def peek_stored(self) -> list:
"""Return stored rows as (id, timestamp, message) oldest-first
without deleting (buffer is neither flushed nor included)."""
return list(self._model.get_all_ordered().tuples())
def drain_buffer(self) -> list:
"""Return and clear the in-memory buffer as (timestamp, message)."""
items, self._buffer = self._buffer, []
return items
def delete(self, ids: list) -> None:
if ids:
with db.atomic():
self._model.delete_in(ids)
def update_message(self, message_id: int, message: bytes) -> None:
with db.atomic():
self._model.set_message(message_id, message)
def empty(self) -> bool:
return self.qsize() == 0
def qsize(self) -> int:
return self.storage_size + len(self._buffer)
@property
def buffer_size(self) -> int:
return len(self._buffer)
@property
def storage_size(self) -> int:
return self._model.select().count()
def put(self, message: bytes, timestamp=None):
if timestamp is None:
timestamp = time.time()
self._buffer.append((timestamp, message))
if self.buffer_size >= self._buffer_limit:
self.push_buffer_to_storage()
def put_many(self, messages: list[tuple[float, bytes]]) -> None:
self._buffer.extend(messages)
if self.buffer_size >= self._buffer_limit:
self.push_buffer_to_storage()
defence360agent/internals/the_sink.py 0000644 0000000 0000000 00000030132 00000000000 014722 0 ustar import asyncio
import collections
import io
import reprlib
import time
import weakref
import logging
from operator import attrgetter
from defence360agent.contracts.messages import Message, Reject
from defence360agent.contracts.plugins import BaseMessageProcessor
from defence360agent.internals.feature_flags import (
is_enabled,
mqtt_tracked_methods,
)
from defence360agent.internals.message_status_publisher import (
Gen,
message_id_gen,
publisher,
)
from defence360agent.utils import safe_cancel_task
from defence360agent.utils.common import DAY, ServiceBase, rate_limit
from defence360agent.internals.global_scope import g
logger = logging.getLogger(__name__)
_reporter_gen_sink = Gen()
ProcessingMessage = collections.namedtuple(
"ProcessingMessage", ["message", "start_time"]
)
class TheSink(BaseMessageProcessor):
def __init__(self, sink_list, loop):
self._sinks_ordered = sorted(
sink_list, key=attrgetter("PROCESSING_ORDER")
)
self._loop = loop
self._task_manager = TaskManager(
loop, MessageProcessor(self._sinks_ordered)
)
g.sink = self
def __repr__(self):
return "%s.%s" % (self.__class__.__module__, self.__class__.__name__)
def decompose(self, classobj):
"""
introspection: decompose a specific role
:return classobj: instance or None
"""
options = [
sink for sink in self._sinks_ordered if isinstance(sink, classobj)
]
assert len(options) <= 1, "Ambiguous request"
return next(iter(options), None)
def start(self):
"""
Make sure to run message processing bus only
when every MessageSource (or MessageSource+MessageSink mix)
got initialized
"""
self._task_manager.start()
async def shutdown(self):
logger.info("shutdown the sink started")
self._task_manager.should_stop()
logger.info("wait for current tasks")
await self._task_manager.wait_current_tasks(timeout=5)
logger.info("finish wait task")
await self._task_manager.wait()
async def process_message(self, message):
await self._task_manager.push_msg(message)
class TaskManager(ServiceBase):
# max queue message size
MAXSIZE = 100000
# number of concurrently processed messages
CONCURRENCY = 5
# how long an individual message may be processed
TIMEOUT = 3600 # seconds
def __init__(self, loop, msg_processor):
super().__init__(loop)
self._queue = MessageQueue(maxsize=self.MAXSIZE)
self._concurrency = self.CONCURRENCY
self._process_message_timeout = self.TIMEOUT
self._msg_processor = msg_processor
self.tasks = weakref.WeakSet()
self._throttled_logger = rate_limit(period=DAY, on_drop=logger.warning)
self.throttled_log_error = self._throttled_logger(logger.error)
async def push_msg(self, msg):
"""Push message unless the queue is full."""
if not self._queue.full():
await self._queue.put(MessageComparable(msg))
else:
if self._throttled_logger.should_be_called: # send to Sentry
args = (
(
"Message queue is full %s. "
"Current processing messages: %s. Message ignored: %s"
),
self._queue,
self.current_processing_messages,
msg,
)
else: # don't serialize the queue on each log warning entry
args = (
(
"Message queue is full. Queue size: %s "
"Current processing messages: %s. Message ignored: %s"
),
self._queue.qsize(),
self.current_processing_messages,
msg,
)
self.throttled_log_error(*args)
@property
def current_processing_messages(self):
# the loop should be safe (no ref should be removed from the weak
# set while iterating)
# https://stackoverflow.com/questions/12428026/safely-iterating-over-weakkeydictionary-and-weakvaluedictionary # noqa
# the loop is constant time because
# len(self.tasks) == self._concurrency (fixed & small)
return tuple(
(
task.processing_msg.message,
round(time.monotonic() - task.processing_msg.start_time, 4),
)
for task in self.tasks
if not task.done()
)
async def wait_current_tasks(self, timeout=None):
if self.tasks:
msg_to_process = [
(m.get("method"), m.get("message_id"), lasting)
for m, lasting in self.current_processing_messages
]
logger.info(
"Waiting for %r processing to finish",
msg_to_process,
)
await asyncio.wait(self.tasks, timeout=timeout)
async def _run(self):
semaphore = asyncio.BoundedSemaphore(self._concurrency)
try:
while not self._should_stop:
logger.debug("Message queue size: %s", self._queue.qsize())
try:
await self.__limit_concurrency(semaphore)
msg_comparable = await self._queue.get()
except asyncio.CancelledError:
break
t = self._loop.create_task(
self._msg_processor(msg_comparable.msg)
) # type: asyncio.Task
t.processing_msg = ProcessingMessage(
msg_comparable.msg, time.monotonic()
)
t.add_done_callback(lambda _: semaphore.release())
t.add_done_callback(self._on_msg_processed)
self.tasks.add(t)
unprocessed = self._queue.qsize()
if unprocessed:
logger.warning(
"There is still %s unprocessed messages in the queue",
self._queue.qsize(),
)
except: # NOQA
logger.exception("Error during message processing:")
async def __limit_concurrency(self, semaphore):
"""Try to acquire *semaphore* in a loop, log error on timeout."""
while True:
try:
return await asyncio.wait_for(
semaphore.acquire(),
timeout=self._process_message_timeout,
)
except asyncio.TimeoutError:
self.throttled_log_error(
"Message hasn't been processed in %s seconds",
self._process_message_timeout,
)
@staticmethod
def _on_msg_processed(future):
e = future.exception()
if e:
logger.exception("Error during message processing:", exc_info=e)
async def cancel_task(task):
if not task.done():
await safe_cancel_task(task)
class MessageProcessor(object):
TIMEOUT_TO_SINK_PROCESS = 3600
def __init__(self, sinks):
self.sinks = sinks
self.locks = weakref.WeakValueDictionary()
self.throttled_log_error = rate_limit(period=60 * 60)(
logger.error
) # send event to Sentry once an hour
async def __call__(self, msg):
ip = msg.get("attackers_ip")
if ip:
lock = self.locks.setdefault(ip, asyncio.Lock())
async with lock:
await self._call_unlocked(msg)
else:
await self._call_unlocked(msg)
async def _call_unlocked(self, msg):
# MQTT message-status tracing chokepoint. Enrich first so every
# downstream stage (sink-received → queued → sending → sent) carries
# the same message_reporter_id; otherwise sink-received fires before
# the id exists and gets silently dropped by publisher.report's
# missing-id guard. Two gates, both required: the master kill-switch
# and the server-driven per-method allow-list. Adding a new tracked
# type is a server-side config change — no agent rollout.
if (
is_enabled("mqtt_tracking")
and msg.get("method") in mqtt_tracked_methods()
and "message_reporter_id" not in msg
):
message_id_gen.enrich(msg)
publisher.report(msg, _reporter_gen_sink, stage="agent-sink-received")
start = time.monotonic()
for sink in self.sinks:
try:
process_message_task = asyncio.create_task(
sink.process_message(msg)
)
processed = await asyncio.wait_for(
# shielded only for debug DEF-18627,
# it should intercept `CancelledError` that
# `asyncio.wait_for` send to `process_message_task`
# in case timeout
asyncio.shield(process_message_task),
timeout=self.TIMEOUT_TO_SINK_PROCESS,
)
except asyncio.CancelledError:
break
except Reject as e:
logger.info("Rejected: %s -> %r", str(e), msg)
return
except asyncio.TimeoutError:
# debug for DEF-18627, it's supposed that during this exception
# handling we will get call stack in logs and see last await
# that hang out coroutine was made,
# may be it's give us some hint about problem
stack = io.StringIO()
process_message_task.print_stack(file=stack)
stack.seek(0)
logger.error(
"Message %r was not processed in the %r plugin in %ss; "
"Traceback: %s",
msg,
sink,
self.TIMEOUT_TO_SINK_PROCESS,
stack.read(),
)
return
except Exception:
logger.exception("Error processing %r in %r", msg, sink)
return
else:
if isinstance(processed, Message):
msg = processed
finally:
await cancel_task(process_message_task)
processing_time = time.monotonic() - start
logger.info("%s processed in %.4f seconds", msg, processing_time)
if processing_time > msg.PROCESSING_TIME_THRESHOLD:
# send to Sentry
self.throttled_log_error(
"%s message took longer to process than expected "
"(%.4f sec > %.4f sec)",
msg,
processing_time,
msg.PROCESSING_TIME_THRESHOLD,
)
class MessageComparable(object):
"""Wrapper to make message comparable."""
# needed to keep order
index = -1
@staticmethod
def __new__(cls, msg):
cls.index += 1
rv = super().__new__(cls)
rv.priority = msg.PRIORITY, cls.index
rv.msg = msg
return rv
def __lt__(self, other):
return self.priority.__lt__(other.priority)
def __repr__(self):
return "<{klass}({msg!r}), priority={priority}>".format(
klass=self.__class__.__name__,
msg=self.msg,
priority=self.priority,
)
class MessageQueue(asyncio.PriorityQueue):
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
self._repr = reprlib.Repr()
self._repr.maxstring = 50
self._repr.maxtuple = 2000
async def put(self, item: MessageComparable):
return await super().put(item)
def __str__(self):
# NOTE: do not flood console.log with full queue
msg_counts = sorted(
collections.Counter(
[item.msg.__class__.__qualname__ for item in self._queue]
).items(),
key=lambda item: item[1], # sorted by number of messages
reverse=True,
)
return (
f"<PriorityQueue maxsize={self.maxsize}; "
f"queue_size={self.qsize()} "
f"queue_counter={self._repr.repr(msg_counts)}>"
)
defence360agent/migrate.py 0000644 0000000 0000000 00000014015 00000000000 012551 0 ustar #!/opt/imunify360/venv/bin/python3
"""This module import peewee_migrate and apply migrations, for Imunify-AV
it's entrypoint for service"""
import contextlib
import os
import sys
import signal
import threading
import time
from collections.abc import Iterable
from logging import getLogger
from peewee_migrate import migrator
from playhouse.sqlite_ext import SqliteExtDatabase
import defence360agent.internals.logger
from defence360agent.application import app
from defence360agent.application.settings import configure
from defence360agent.contracts.config import Core
from defence360agent.contracts.config import Model
from defence360agent.router import Router
from defence360agent.subsys import systemd_notifier
from defence360agent.model.instance import db as db_instance
from defence360agent.model import tls_check
from defence360agent.utils import (
write_pid_file,
IM360_RESIDENT_PID_PATH,
cleanup_pid_file,
)
from defence360agent.utils.check_db import (
recreate_schema_models,
)
logger = getLogger(__name__)
GO_SERVICE_NAME = "/usr/bin/imunify-resident"
@contextlib.contextmanager
def exc_handler(log_msg: str, reraise: bool):
"""
Logs error in case of exception.
Depending on `reraise`:
- re-raise exception and don't include exception info in the log operation
- do not re-raise exception and include exception info in the log operation
"""
try:
yield
except Exception:
logger.error(log_msg, exc_info=not reraise)
if reraise:
raise
def apply_migrations(db: SqliteExtDatabase, migrations_dirs: Iterable[str]):
"""Apply migrations: restructure db, config files, etc."""
router = Router(
db,
migrations_dirs=migrations_dirs,
logger=logger,
)
# HACK: Migrator uses global unconfigurable LOGGER,
# overrride it, to use our logging settings
migrator.LOGGER = logger
router.run()
def prepare_databases(
migrations_dirs: Iterable[str],
attached_dbs: tuple[tuple[str, str], ...] = tuple(),
):
"""
Apply migrations and recreate attached databases.
The workflow:
1. Apply migrations
2. Regardless whether the migrations were applied - recreate attached databases
3. If the recreation of the attached databases was successful - apply migrations again
- this is done to verify that migrations will successfully apply in future for the recreated databases
- the recreation + the migrations in this step are within the same transaction,
so databases will only be recreated if the migrations can applied after the recreation.
"""
# prepare database to operate in WAL journal_mode and run migrations
tls_check.reset()
db_instance.init(Model.PATH)
attached_schemas = []
for db_path, schema_name in attached_dbs:
db_instance.execute_sql("ATTACH ? AS ?", (db_path, schema_name))
attached_schemas.append(schema_name)
try:
logger.info("Applying database migrations...")
systemd_notifier.notify(systemd_notifier.AgentState.MIGRATING)
with db_instance.atomic("EXCLUSIVE"), exc_handler(
"Error applying migrations", reraise=False
):
apply_migrations(db_instance, migrations_dirs)
logger.info("Recreating attached databases...")
with db_instance.atomic("EXCLUSIVE"), exc_handler(
"Error recreating attached databases", reraise=True
):
# Migration history is stored in main db, so to automatically recreate
# attached dbs it is required to recreate schema for them from models
recreate_schema_models(db_instance, attached_schemas)
# verify migrations can be applied after the attached dbs recreation
with exc_handler(
"Error applying migrations after recreating attached"
" databases",
reraise=True,
):
apply_migrations(db_instance, migrations_dirs)
finally:
# close connection immediately since later this process
# will be replaced by execv
db_instance.close()
# required in case package manager or user sends signals while migrations are still running
def signal_handler(sig, _):
logger.warning("Received signal %s in signal_handler", sig)
logger.warning(
"waiting %d seconds so that migrations can finish",
Core.SIGNAL_HANDLER_MIGRATION_TIMEOUT_SECS,
)
time.sleep(Core.SIGNAL_HANDLER_MIGRATION_TIMEOUT_SECS)
logger.info("Exiting")
sys.exit(0)
def run(*, start_pkg="defence360agent", configure=configure):
"""Entry point for Imunify-AV service. Apply migrations,
and then replace process with {start_pkg}.run module."""
for sig in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
signal.signal(sig, signal_handler)
try:
if start_pkg == "im360.run_resident":
write_pid_file(IM360_RESIDENT_PID_PATH)
os.umask(Core.FILE_UMASK)
configure()
defence360agent.internals.logger.reconfigure()
migration_thread = threading.Thread(
target=prepare_databases,
args=(app.MIGRATIONS_DIRS, app.MIGRATIONS_ATTACHED_DBS),
)
migration_thread.start()
migration_thread.join()
systemd_notifier.notify(systemd_notifier.AgentState.READY)
logger.info("Starting main process...")
systemd_notifier.notify(systemd_notifier.AgentState.STARTING)
if start_pkg == "im360.run_resident":
Core.GO_FLAG_FILE.touch(exist_ok=True)
logger.info("Run imunify-resident service")
os.execv(
GO_SERVICE_NAME,
[
GO_SERVICE_NAME,
]
+ sys.argv[1:],
)
else:
os.execv(
sys.executable,
[sys.executable, "-m", "{}".format(start_pkg)] + sys.argv[1:],
)
except Exception:
if start_pkg == "im360.run_resident":
cleanup_pid_file(IM360_RESIDENT_PID_PATH)
if __name__ == "__main__":
run()
defence360agent/migrations/ 0000755 0000000 0000000 00000000000 00000000000 012722 5 ustar defence360agent/migrations/001_initial.py 0000644 0000000 0000000 00000004370 00000000000 015311 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
import peewee as pw
class Incident(pw.Model):
id = pw.IntegerField(primary_key=True, null=True)
plugin = pw.CharField(null=True)
rule = pw.CharField(null=True)
timestamp = pw.FloatField(null=True)
retries = pw.IntegerField(null=True)
severity = pw.IntegerField(null=True)
name = pw.CharField(null=True)
description = pw.CharField(null=True)
abuser = pw.CharField(null=True)
class Meta:
db_table = "incident"
class IPList(pw.Model):
ip = pw.CharField(primary_key=True, null=False)
listname = pw.CharField(
null=False,
constraints=[pw.Check("listname in ('WHITE','BLACK','GRAY')")],
)
expiration = pw.IntegerField(default=0, null=True)
class Meta:
db_table = "iplist"
class BlocklistHistory(pw.Model):
id = pw.IntegerField(primary_key=True, null=True)
plugin = pw.CharField(null=True)
rule = pw.CharField(null=True)
timestamp = pw.FloatField(null=True)
ip = pw.CharField(null=True)
class Meta:
db_table = "blocklist_history"
class LastSynclist(pw.Model):
timestamp = pw.FloatField(primary_key=True, null=True)
class Meta:
db_table = "last_synclist"
def migrate(migrator, database, fake=False, **kwargs):
"""In memory of former create_db() (RIP)"""
migrator.create_model(Incident)
migrator.create_model(IPList)
migrator.create_model(BlocklistHistory)
migrator.create_model(LastSynclist)
def rollback(migrator, database, fake=False, **kwargs):
"""Nothing to rollback."""
defence360agent/migrations/002_infected_domain_list.py 0000644 0000000 0000000 00000002313 00000000000 020017 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
import peewee as pw
class InfectedDomainList(pw.Model):
id = pw.IntegerField(primary_key=True)
name = pw.CharField(null=False)
threat_type = pw.CharField(null=False)
timestamp = pw.FloatField()
class Meta:
db_table = "infected_domain_list"
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(InfectedDomainList)
def rollback(migrator, database, fake=False, **kwargs):
migrator.remove_model(InfectedDomainList)
defence360agent/migrations/003_import_from_list.py 0000644 0000000 0000000 00000002447 00000000000 017255 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
import time
import peewee as pw
from peewee import IntegerField
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
IPList = migrator.orm["iplist"]
migrator.add_fields(
IPList,
imported_from=pw.CharField(null=True),
ctime=IntegerField(null=True, default=lambda: int(time.time())),
)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
IPList = migrator.orm["iplist"]
migrator.remove_fields(IPList, "imported_from", "created")
defence360agent/migrations/004_add_username_to_infected_domain_list.py 0000644 0000000 0000000 00000002173 00000000000 023236 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
InfectedDomainList = migrator.orm["infected_domain_list"]
migrator.add_fields(InfectedDomainList, username=pw.CharField(null=True))
def rollback(migrator, database, fake=False, **kwargs):
InfectedDomainList = migrator.orm["infected_domain_list"]
migrator.remove_fields(InfectedDomainList, "username")
defence360agent/migrations/005_timeout_in_iplist.py 0000644 0000000 0000000 00000002177 00000000000 017427 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
IPList = migrator.orm["iplist"]
migrator.add_fields(IPList, deep=pw.IntegerField(null=True))
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
IPList = migrator.orm["iplist"]
migrator.remove_fields(IPList, "deep")
defence360agent/migrations/006_comment_in_plist.py 0000644 0000000 0000000 00000002202 00000000000 017220 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
IPList = migrator.orm["iplist"]
migrator.add_fields(IPList, comment=pw.CharField(null=True))
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
IPList = migrator.orm["iplist"]
migrator.remove_fields(IPList, "comment")
defence360agent/migrations/007_add_country_code_fields.py 0000644 0000000 0000000 00000003152 00000000000 020516 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
import peewee as pw
class Country(pw.Model):
code = pw.CharField(max_length=2, primary_key=True, null=False)
name = pw.CharField(null=False)
class Meta:
db_table = "country"
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
IPList = migrator.orm["iplist"]
Incident = migrator.orm["incident"]
migrator.create_model(Country)
migrator.add_fields(IPList, country=pw.ForeignKeyField(Country, null=True))
migrator.add_fields(
Incident, country=pw.ForeignKeyField(Country, null=True)
)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
IPList = migrator.orm["iplist"]
Incident = migrator.orm["incident"]
migrator.remove_fields(IPList, "country")
migrator.remove_fields(Incident, "country")
migrator.remove_model(Country)
defence360agent/migrations/008_fill_countries.py 0000644 0000000 0000000 00000000636 00000000000 016711 0 ustar # Data migration, currently not actual
# Earlier it creates data for Country, add link to Incident.country
# and Iplist.country
# Now it uses in the 0012 migration after fix the FK in the Country
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
pass
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/009_drop_blocklist_history.py 0000644 0000000 0000000 00000002575 00000000000 020470 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
import peewee as pw
class BlocklistHistory(pw.Model):
id = pw.IntegerField(primary_key=True, null=True)
plugin = pw.CharField(null=True)
rule = pw.CharField(null=True)
timestamp = pw.FloatField(null=True)
ip = pw.CharField(null=True)
class Meta:
db_table = "blocklist_history"
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
BlocklistHistory = migrator.orm["blocklist_history"]
migrator.remove_model(BlocklistHistory)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
migrator.create_model(BlocklistHistory)
defence360agent/migrations/010_drop_country_entities.py 0000644 0000000 0000000 00000002413 00000000000 020307 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
IPList = migrator.orm["iplist"]
Incident = migrator.orm["incident"]
Country = migrator.orm["country"]
migrator.drop_index(IPList, "country")
migrator.drop_index(Incident, "country")
migrator.remove_fields(IPList, "country")
migrator.remove_fields(Incident, "country")
migrator.remove_model(Country)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/011_create_new_country_entities.py 0000644 0000000 0000000 00000005257 00000000000 021471 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
from time import time
import peewee as pw
class Country(pw.Model):
id = pw.CharField(primary_key=True, null=False)
code = pw.CharField(max_length=2, unique=True, null=False)
name = pw.CharField(null=False)
class Meta:
db_table = "country"
class CountrySubnets(pw.Model):
country = pw.ForeignKeyField(Country, null=False)
# 255.255.255.255/32 - max 18 symbols
ip_net = pw.CharField(max_length=18, null=False)
class Meta:
db_table = "country_subnets"
class CountryList(pw.Model):
# available list names
WHITE = "WHITE"
BLACK = "BLACK"
IP_LISTS = (WHITE, BLACK)
country = pw.ForeignKeyField(Country, primary_key=True, null=False)
listname = pw.CharField(
null=False, constraints=[pw.Check("listname in ('WHITE','BLACK')")]
)
ctime = pw.IntegerField(null=True, default=lambda: int(time())) # are OK
comment = pw.CharField(null=True)
class Meta:
db_table = "country_list"
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
IPList = migrator.orm["iplist"]
Incident = migrator.orm["incident"]
migrator.create_model(Country)
migrator.add_fields(IPList, country=pw.ForeignKeyField(Country, null=True))
migrator.add_fields(
Incident, country=pw.ForeignKeyField(Country, null=True)
)
migrator.create_model(CountrySubnets)
migrator.create_model(CountryList)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
Country = migrator.orm["country"]
CountrySubnets = migrator.orm["country_subnets"]
CountryList = migrator.orm["country_list"]
IPList = migrator.orm["iplist"]
Incident = migrator.orm["incident"]
migrator.remove_fields(IPList, "country")
migrator.remove_fields(Incident, "country")
migrator.remove_model(CountrySubnets)
migrator.remove_model(CountryList)
migrator.remove_model(Country)
defence360agent/migrations/012_fill_countries_and_subnets.py 0000644 0000000 0000000 00000000374 00000000000 021270 0 ustar """Peewee migrations: ::
UPD: migration not needed anymore, countries and subnets are loaded after
files update.
"""
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/013_add_indexes_to_iplist.py 0000644 0000000 0000000 00000002123 00000000000 020212 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
IPList = migrator.orm["iplist"]
migrator.add_index(IPList, "listname")
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
IPList = migrator.orm["iplist"]
migrator.drop_index(IPList, "listname")
defence360agent/migrations/014_add_malware_hits.py 0000644 0000000 0000000 00000004507 00000000000 017155 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
import peewee as pw
class MalwareScan(pw.Model):
class Meta:
db_table = "malware_scans"
scanid = pw.CharField(primary_key=True)
started = pw.IntegerField(null=False)
completed = pw.IntegerField(null=False)
type = pw.CharField(
null=False, constraints=[pw.Check("type in ('on-demand', 'realtime')")]
)
path = pw.CharField(null=False)
total_files = pw.IntegerField(null=False, default=0)
class MalwareHit(pw.Model):
class Meta:
db_table = "malware_hits"
id = pw.IntegerField(primary_key=True)
scanid = pw.ForeignKeyField(MalwareScan, null=False)
user = pw.CharField(null=False)
orig_file = pw.CharField(null=False)
type = pw.CharField(null=False)
restored = pw.BooleanField(null=False, default=False)
class MalwareIgnorePath(pw.Model):
class Meta:
db_table = "malware_ignore_path"
path = pw.CharField(primary_key=True)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
migrator.create_model(MalwareScan)
migrator.create_model(MalwareHit)
migrator.create_model(MalwareIgnorePath)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
MalwareScan = migrator.orm["malware_scans"]
MalwareHit = migrator.orm["malware_hits"]
MalwareIgnorePath = migrator.orm["malware_ignore_path"]
MalwareScannedStat = migrator.orm["malware_stanned_stat"]
migrator.drop_model(MalwareHit)
migrator.drop_model(MalwareScan)
migrator.drop_model(MalwareIgnorePath)
migrator.drop_model(MalwareScannedStat)
defence360agent/migrations/015_add_iplist_expiration_index.py 0000644 0000000 0000000 00000000551 00000000000 021427 0 ustar def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
IPList = migrator.orm["iplist"]
migrator.add_index(IPList, "expiration")
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
IPList = migrator.orm["iplist"]
migrator.drop_index(IPList, "expiration")
defence360agent/migrations/016_fix_autowhitelist_expiration.py 0000644 0000000 0000000 00000000713 00000000000 021700 0 ustar from time import time
_MAX_TIMEOUT = 4294967
def migrate(migrator, database, fake=False, **kwargs):
IPListModel = migrator.orm["iplist"]
# if expiration more that ipset limit, setting max available expiration
IPListModel.update(expiration=_MAX_TIMEOUT).where(
(IPListModel.listname == "WHITE")
& (IPListModel.expiration - time() > _MAX_TIMEOUT)
).execute()
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/017_remove_sensor_prefix.py 0000644 0000000 0000000 00000000545 00000000000 020132 0 ustar """
Migrate server-id w/ prefix inside imunify360.id to server-id w/o prefix
into i360.id file
UPD: migration not needed yet, as far as, the majority of the servers already
converted their server-id to w/0 prefix form.
"""
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/018_license_info.py 0000644 0000000 0000000 00000001110 00000000000 016312 0 ustar import peewee as pw
class License(pw.Model):
class Meta:
db_table = "license"
status = pw.BooleanField(primary_key=True)
expiration = pw.IntegerField(null=False, default=0)
limit = pw.IntegerField(null=True)
redirect_url = pw.CharField(null=True)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
migrator.create_model(License)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
License = migrator.orm["license"]
migrator.drop_model(License)
defence360agent/migrations/019_purge_old_configs.py 0000644 0000000 0000000 00000000455 00000000000 017361 0 ustar """
Purge old configs from config file to prevent of "Unknown field" errors.
UPD: Not actual yet
"""
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
defence360agent/migrations/020_malware_scan_types.py 0000644 0000000 0000000 00000002410 00000000000 017532 0 ustar """Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
"""
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
# Here was a migration to add additional values to MalwareScan.type fiend
# constraint. As we do not use this new values anymore, we dropped this
# migrations because of problems caused by remove_model
pass
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
# it's safe not to do any rollback actions because
# this migration only changes Check() constraint
pass
defence360agent/migrations/021_add_testing_repo.py 0000644 0000000 0000000 00000003144 00000000000 017172 0 ustar import logging
import os
from pathlib import Path
from defence360agent.utils import os_version, OsReleaseInfo
logger = logging.getLogger(__name__)
TEST_REPO_PATH = Path("/etc/yum.repos.d/imunify360-testing.repo")
CHECKSITE = "https://repo.imunify360.cloudlinux.com/defense360"
RPM_KEY = "{}/RPM-GPG-KEY-CloudLinux".format(CHECKSITE)
# disabled by default
TEMPLATE_REPO = r"""
[imunify360-testing]
name=EL-{version} - Imunify360
baseurl={CHECKSITE}/el/{version}/updates-testing/x86_64/
username=defense360
password=nraW!F@\$x4Xd6HHQ
enabled=0
gpgcheck=1
gpgkey={RPM_KEY}
"""
def install_repo(version):
if version in (6, 7):
if not TEST_REPO_PATH.exists():
TEST_REPO_PATH.write_text(
TEMPLATE_REPO.format(
version=version, CHECKSITE=CHECKSITE, RPM_KEY=RPM_KEY
)
)
else:
logger.info("Version {} is not supported".format(version))
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
if OsReleaseInfo.id_like() & OsReleaseInfo.RHEL_FEDORA_CENTOS:
version = None
full_version = os_version()
if full_version.startswith("6"):
version = 6
elif full_version.startswith("7"):
version = 7
install_repo(version)
except Exception as e:
logger.warning("Unable to add imunify360-testing repo: %s", e)
def rollback(migrator, database, fake=False, **kwargs):
if fake:
return
try:
os.remove(TEST_REPO_PATH)
except Exception as e:
logger.warning(str(e))
defence360agent/migrations/022_mod_security_vendors_migrations.py 0000644 0000000 0000000 00000000241 00000000000 022356 0 ustar """
No need to user now
"""
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/023_add_default_rule_in_modsec_custom_conf.py 0000644 0000000 0000000 00000002211 00000000000 023556 0 ustar """Using ModSecurity 'WordPress login attempt' rule instead of OSSEC one.
This migration is needed in order to add new rule to config after update,
because config is non replaceable.
"""
import os
import shutil
from defence360agent.contracts.config import IConfigFile, LocalConfig
SECTION = "MOD_SEC_BLOCK_BY_CUSTOM_RULE"
RULE_ID = "33332" # WordPress login attempt
RULE_VALUES = {"max_incident_repetition": 10, "check_period": 120}
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
local_config: IConfigFile = LocalConfig()
if not os.path.exists(local_config.path):
return
if not os.path.isfile(local_config.path):
return
shutil.copyfile(local_config.path, local_config.path + ".old")
new_conf = local_config.config_to_dict()
new_conf.setdefault(SECTION, {})[RULE_ID] = RULE_VALUES
local_config.dict_to_config(new_conf, validate=False)
def rollback(migrator, database, fake=False, **kwargs):
if fake:
return
local_config: IConfigFile = LocalConfig()
old = local_config.path + ".old"
if os.path.isfile(old):
shutil.move(old, local_config.path)
defence360agent/migrations/024_ignore_from_graylist.py 0000644 0000000 0000000 00000000727 00000000000 020113 0 ustar import peewee as pw
class IgnoreList(pw.Model):
ip = pw.CharField(primary_key=True, null=False)
class Meta:
db_table = "ignore_list"
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
migrator.create_model(IgnoreList)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
IgnoreList = migrator.orm["ignore_list"]
migrator.drop_model(IgnoreList)
defence360agent/migrations/025_malware_config_realtime.py 0000644 0000000 0000000 00000001267 00000000000 020527 0 ustar import os
import yaml
from defence360agent.contracts.config import LocalConfig
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
local_config = LocalConfig()
if not os.path.exists(local_config.path):
return
with open(local_config.path) as f:
conf = yaml.safe_load(f)
malware_settings = conf.setdefault("MALWARE_SCANNING", {})
value = malware_settings.pop("enable_scan_uploaded_files", True)
malware_settings["enable_scan_pure_ftpd"] = value
malware_settings["enable_scan_modsec"] = value
local_config.dict_to_config(conf, validate=False)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/026_remove_old_temporary_file.py 0000644 0000000 0000000 00000001071 00000000000 021116 0 ustar import glob
import os
import tempfile
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
tmp_dir = tempfile.gettempdir()
# fix bugs of 2.1 version
path = os.path.join(tmp_dir, "predict_model_description.json")
if os.path.isfile(path):
os.remove(path)
# fix bugs of 2.2 version
pattern = os.path.join(tmp_dir, "imunify360*")
for filename in glob.glob(pattern):
if os.path.isfile(filename):
os.remove(filename)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/027_disable_comdo_fp_rules.py 0000644 0000000 0000000 00000000350 00000000000 020345 0 ustar """
Current migration doesn't needed,
because apache will be restarted in the other migrations
"""
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/028_set_permanent_ttl_for_blacklist.py 0000644 0000000 0000000 00000000536 00000000000 022316 0 ustar PERMANENT_TTL = 0
def migrate(migrator, database, fake=False, **kwargs):
IPListModel = migrator.orm["iplist"]
IPListModel.update(expiration=PERMANENT_TTL).where(
(IPListModel.listname == "BLACK")
& (IPListModel.expiration != PERMANENT_TTL)
).execute()
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/029_custom_quarantine.py 0000644 0000000 0000000 00000000157 00000000000 017432 0 ustar """ Quarantine is removed in DEF-15234"""
def migrate(*_, **__):
pass
def rollback(*_, **__):
pass
defence360agent/migrations/030_rename_max_incident_repetition.py 0000644 0000000 0000000 00000002563 00000000000 022117 0 ustar from defence360agent.contracts.config import IConfig, LocalConfig
from defence360agent.utils import log_error_and_ignore
@log_error_and_ignore()
def migrate(
migrator,
database,
fake=False,
config_file: IConfig = LocalConfig(),
**kwargs
):
if fake:
return
config = config_file.config_to_dict()
if not config:
return
# rename `max_incident_repetition` to `max_incidents`
block_by_severity = config.setdefault("MOD_SEC_BLOCK_BY_SEVERITY", {})
value = block_by_severity.pop("max_incident_repetition", None)
if value:
block_by_severity["max_incidents"] = value
custom_rule_list = config.setdefault("MOD_SEC_BLOCK_BY_CUSTOM_RULE", {})
for custom_rule_conf in custom_rule_list.values():
value = custom_rule_conf.pop("max_incident_repetition", None)
if value:
custom_rule_conf["max_incidents"] = value
if config.get("INCIDENT_LIST"):
# rename section `INCIDENT_LIST` to `INCIDENT_LOGGING`
config["INCIDENT_LOGGING"] = config.pop("INCIDENT_LIST", {})
# move fields
auto_cleanup_conf = config.pop("AUTOCLEANUP", None)
if auto_cleanup_conf:
config["INCIDENT_LOGGING"].update(**auto_cleanup_conf)
config_file.dict_to_config(config, validate=False, overwrite=True)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/031_add_mode_field.py 0000644 0000000 0000000 00000000750 00000000000 016560 0 ustar import logging
import peewee as pw
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
MalwareHits = migrator.orm["malware_hits"]
migrator.add_fields(MalwareHits, mode=pw.IntegerField(null=True))
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
MalwareHits = migrator.orm["malware_hits"]
migrator.remove_fields(MalwareHits, "mode")
defence360agent/migrations/031_modsec_config_for_plesk_include.py 0000644 0000000 0000000 00000002720 00000000000 022226 0 ustar from logging import getLogger
from defence360agent.utils import run_coro
from defence360agent.utils import antivirus_mode
logger = getLogger(__name__)
@antivirus_mode.skip
def migrate(migrator, database, fake=False, **kwargs):
try:
from im360.subsys.panels.plesk import Plesk
from im360.subsys.panels.plesk.mod_security import ModSecSettings
except ImportError:
return
try:
if (
fake
or not Plesk.is_installed()
or not run_coro(Plesk.installed_modsec())
):
return
ModSecSettings.include_modsec_conf()
from defence360agent.subsys.web_server import graceful_restart_sync
graceful_restart_sync()
except Exception as e:
logger.warning("Error during web-server update: %s", str(e))
@antivirus_mode.skip
def rollback(migrator, database, fake=False, **kwargs):
try:
from im360.subsys.panels.plesk import Plesk
from im360.subsys.panels.plesk.mod_security import ModSecSettings
except ImportError:
return
try:
if (
fake
or not Plesk.is_installed()
or not run_coro(Plesk.installed_modsec())
):
return
ModSecSettings.revert_conf_include()
from defence360agent.subsys.web_server import graceful_restart_sync
graceful_restart_sync()
except Exception as e:
logger.warning("Error during web-server update: %s", str(e))
defence360agent/migrations/032_chmod_quarantine.py 0000644 0000000 0000000 00000000157 00000000000 017204 0 ustar """ Quarantine is removed in DEF-15234"""
def migrate(*_, **__):
pass
def rollback(*_, **__):
pass
defence360agent/migrations/033_disable_cphulk.py 0000644 0000000 0000000 00000001175 00000000000 016636 0 ustar import os
import subprocess
from defence360agent.contracts.config import Packaging
from logging import getLogger
logger = getLogger(__name__)
def disable_3rdparty():
try:
subprocess.check_call(
[
"%s/scripts/disable_3rd_party_ids" % Packaging.DATADIR,
"--nocheck",
]
)
except subprocess.CalledProcessError as e:
logger.error(e)
def migrate(migrator, database, fake=False, **kwargs):
if fake or not os.path.isfile(Packaging.DATADIR):
return
disable_3rdparty()
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/034_hits_extras.py 0000644 0000000 0000000 00000001411 00000000000 016214 0 ustar import logging
import peewee as pw
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
MalwareHit = migrator.orm["malware_hits"]
class MalwareHitExtra(pw.Model):
class Meta:
db_table = "malware_hit_extras"
id = pw.IntegerField(primary_key=True)
hit = pw.ForeignKeyField(MalwareHit, null=False, related_name="extras")
name = pw.CharField(null=False)
value = pw.CharField(null=False)
migrator.create_model(MalwareHitExtra)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
MalwareHitExtra = migrator.orm["malware_hit_extras"]
migrator.remove_model(MalwareHitExtra)
defence360agent/migrations/035_add_dos_expiration_field.py 0000644 0000000 0000000 00000000550 00000000000 020665 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
migrator.add_fields(
IPList, dos_expiration=pw.IntegerField(default=0, null=True)
)
def rollback(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
migrator.remove_fields(IPList, "dos_expiration")
defence360agent/migrations/036_add_block_port.py 0000644 0000000 0000000 00000002706 00000000000 016637 0 ustar import peewee as pw
class BlockedPort(pw.Model):
"""
Port + protocol for blocking data
"""
port = pw.IntegerField(null=False)
proto = pw.CharField(
null=False, constraints=[pw.Check("proto in ('tcp', 'udp', 'all')")]
)
comment = pw.CharField(null=True)
class Meta:
db_table = "blocked_port"
indexes = (
# create an unique on port/proto
(("port", "proto"), True),
)
class IgnoredByPort(pw.Model):
"""
Ignored IPs for port + protocol
"""
port_proto = pw.ForeignKeyField(
BlockedPort, null=False, on_delete="CASCADE", related_name="ips"
)
ip = pw.CharField(null=False)
comment = pw.CharField(null=True)
class Meta:
db_table = "ignored_by_port_proto"
indexes = (
# create an unique on port/ip
(("port_proto", "ip"), True),
)
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(BlockedPort)
migrator.create_model(IgnoredByPort)
IPList = migrator.orm["iplist"]
migrator.add_fields(IPList, full_access=pw.BooleanField(null=True))
def rollback(migrator, database, fake=False, **kwargs):
BlockedPort = migrator.orm["blocked_port"]
IgnoredByPort = migrator.orm["blocked_port_ip"]
IPList = migrator.orm["iplist"]
migrator.remove_model(BlockedPort)
migrator.remove_model(IgnoredByPort)
migrator.remove_fields(IPList, "full_access")
defence360agent/migrations/037_disabled_rules.py 0000644 0000000 0000000 00000002174 00000000000 016652 0 ustar import logging
import peewee as pw
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
class DisabledRule(pw.Model):
class Meta:
db_table = "disabled_rules"
indexes = ((("plugin", "rule_id"), True),)
id = pw.PrimaryKeyField()
plugin = pw.CharField(null=False)
rule_id = pw.CharField(null=False)
name = pw.TextField(null=False)
class DisabledRuleDomain(pw.Model):
disabled_rule_id_id = pw.ForeignKeyField(
DisabledRule, backref="domains", on_delete="CASCADE"
)
domain = pw.CharField(null=False)
class Meta:
db_table = "disabled_rules_domains"
primary_key = pw.CompositeKey("disabled_rule_id_id", "domain")
migrator.create_model(DisabledRule)
migrator.create_model(DisabledRuleDomain)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
migrator.remove_model(migrator.orm["disabled_rules_domains"])
migrator.remove_model(migrator.orm["disabled_rules"])
defence360agent/migrations/038_disabled_rules_import.py 0000644 0000000 0000000 00000001355 00000000000 020245 0 ustar import logging
from defence360agent.contracts.config import IConfig, LocalConfig
logger = logging.getLogger(__name__)
def migrate(
migrator,
database,
fake=False,
config_file: IConfig = LocalConfig(),
**kwargs
):
"""Write your migrations here."""
if fake:
return
config = config_file.config_to_dict()
if not config:
return
# deleting "OSSEC" section
config.pop("OSSEC", {})
# deleting "MOD_SEC_BLOCK_BY_SEVERITY:ignore" field
config.get("MOD_SEC_BLOCK_BY_SEVERITY", {}).pop("ignore", [])
config_file.dict_to_config(config, overwrite=True, validate=False)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/039_fix_malware_hits.py 0000644 0000000 0000000 00000001621 00000000000 017214 0 ustar import logging
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
migrator.sql(
"""
CREATE TABLE "malware_hits_new" (
"id" INTEGER NOT NULL PRIMARY KEY,
"scanid_id" VARCHAR(255) NOT NULL,
"user" VARCHAR(255) NOT NULL,
"orig_file" VARCHAR(255) NOT NULL,
"type" VARCHAR(255) NOT NULL,
"restored" INTEGER NOT NULL,
"mode" INTEGER,
FOREIGN KEY ("scanid_id") REFERENCES "malware_scans" ("scanid"))
"""
)
migrator.sql("INSERT INTO malware_hits_new SELECT * FROM malware_hits")
migrator.sql("DROP TABLE malware_hits")
migrator.sql("ALTER TABLE malware_hits_new RENAME TO malware_hits")
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/040_ignore_mod_sec_rule_214920.py 0000644 0000000 0000000 00000000257 00000000000 020507 0 ustar """Migration was buggy, so skipping it"""
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/041_fix_invalid_ignore_filed.py 0000644 0000000 0000000 00000000322 00000000000 020657 0 ustar """Adding 214920 rule to ignored on disabled rules level in 038 migration"""
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/042_rebuildinstalledssldb.py 0000644 0000000 0000000 00000001165 00000000000 020242 0 ustar import logging
import subprocess
from defence360agent.utils import antivirus_mode
logger = logging.getLogger(__name__)
@antivirus_mode.skip
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
from im360.subsys.panels.cpanel import cPanel
except ImportError:
return
if cPanel.is_installed():
try:
subprocess.run(["/scripts/rebuildinstalledssldb"])
except Exception as e:
logger.warning("Failed to rebuild cpanel ssl db: %s", str(e))
@antivirus_mode.skip
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/043_disable_dos_scan_by_default.py 0000644 0000000 0000000 00000000707 00000000000 021340 0 ustar from defence360agent.contracts.config import ConfigFile
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
config_file = ConfigFile()
config = config_file.config_to_dict()
if not config:
return
dos_settings = config.setdefault("DOS", {})
dos_settings["enabled"] = False
config_file.dict_to_config(config, validate=False)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/044_ignore_virtfs_on_cpanel.py 0000644 0000000 0000000 00000000700 00000000000 020556 0 ustar """
This migration adds cpanel virtfs directory (/home/virtfs) to ignore
for malware scanning
"""
from defence360agent.subsys.panels.cpanel import cPanel
def migrate(migrator, database, fake=False, **kwargs):
if (not fake) and cPanel.is_installed():
MalwareIgnorePath = migrator.orm["malware_ignore_path"]
MalwareIgnorePath.get_or_create(path="/home/virtfs")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/045_ignore_vdserver_dir_in_csf.py 0000644 0000000 0000000 00000000523 00000000000 021246 0 ustar import os
from defence360agent.utils import append_with_newline
CSF_FIGNORE = "/etc/csf/csf.fignore"
def migrate(migrator, database, fake=False, **kwargs):
if (not fake) and os.path.isfile(CSF_FIGNORE):
append_with_newline(CSF_FIGNORE, "/tmp/.vdserver\n")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/046_foreign_key_fix.py 0000644 0000000 0000000 00000001553 00000000000 017040 0 ustar import logging
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
migrator.sql(
"""
CREATE TABLE "malware_hit_extras_new" (
"id" INTEGER NOT NULL PRIMARY KEY,
"hit_id" INTEGER NOT NULL,
"name" VARCHAR(255) NOT NULL,
"value" VARCHAR(255) NOT NULL,
FOREIGN KEY ("hit_id")
REFERENCES "malware_hits" ("id") ON DELETE CASCADE
)
"""
)
migrator.sql(
"INSERT INTO malware_hit_extras_new SELECT * FROM malware_hit_extras"
)
migrator.sql("DROP TABLE malware_hit_extras")
migrator.sql(
"ALTER TABLE malware_hit_extras_new RENAME TO malware_hit_extras"
)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/047_license_in_file.py 0000644 0000000 0000000 00000001100 00000000000 016765 0 ustar import json
from playhouse.shortcuts import model_to_dict
FALLBACK_LICENSE_FILE = "/var/imunify360/license_old.json"
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
LicenseModel = migrator.orm["license"]
lic, _ = LicenseModel.get_or_create(
defaults={
"status": True,
"expiration": 0,
}
)
with open(FALLBACK_LICENSE_FILE, "w") as f:
json.dump(model_to_dict(lic), f)
migrator.remove_model(LicenseModel)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/048_malware_hits_vendor_field.py 0000644 0000000 0000000 00000000664 00000000000 021074 0 ustar import logging
import peewee as pw
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
MalwareHits = migrator.orm["malware_hits"]
migrator.add_fields(
MalwareHits, vendor=pw.CharField(null=False, default="clamav")
)
def rollback(migrator, database, fake=False, **kwargs):
MalwareHits = migrator.orm["malware_hits"]
migrator.remove_fields(MalwareHits, "vendor")
defence360agent/migrations/049_add_auto_added_field_to_iplist.py 0000644 0000000 0000000 00000001033 00000000000 022017 0 ustar """
Introducing new filed `auto_whitelisted` in order to mark IPs that were
autowhitelied during `--remote-addr` flag.
This will help to differentiate such IPs in UI.
"""
import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
migrator.add_fields(
IPList, auto_whitelisted=pw.BooleanField(default=False, null=True)
)
def rollback(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
migrator.remove_fields(IPList, "auto_whitelisted")
defence360agent/migrations/050_fill_auto_whitelisted.py 0000644 0000000 0000000 00000000702 00000000000 020242 0 ustar """
Filling `auto_whitelisted` filed that was added in previous 049 migration.
Matching IPs that were auto added earlier.
"""
def migrate(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
# mark previously autowhitelisted
IPList.update(auto_whitelisted=True).where(
IPList.comment.startswith("IP auto-whitelisted with")
).execute()
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/051_cleanup_vd_license.py 0000644 0000000 0000000 00000001632 00000000000 017505 0 ustar import json
import logging
from contextlib import suppress
logger = logging.getLogger(__name__)
class VirusdieLicense:
CONFIG_FILE = "/usr/local/vdserver/config.json"
def unregister(self):
self._write_key("")
def _write_key(self, key):
with open(self.CONFIG_FILE) as read_file:
content = json.load(read_file)
content["vdbApiKey"] = key
with open(self.CONFIG_FILE, "w") as write_file:
json.dump(
content,
write_file,
sort_keys=True,
indent=2,
separators=(",", ": "),
)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
with suppress(FileNotFoundError):
VirusdieLicense().unregister()
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/052_whitelisted_crawlers.py 0000644 0000000 0000000 00000002054 00000000000 020112 0 ustar import logging
import peewee as pw
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
class WhitelistedCrawler(pw.Model):
class Meta:
db_table = "whitelisted_crawlers"
id = pw.PrimaryKeyField()
description = pw.TextField(null=False)
class WhitelistedCrawlerDomain(pw.Model):
class Meta:
db_table = "whitelisted_crawler_domains"
id = pw.PrimaryKeyField()
crawler = pw.ForeignKeyField(
WhitelistedCrawler,
null=False,
on_delete="CASCADE",
related_name="domains",
)
domain = pw.TextField(null=False)
migrator.create_model(WhitelistedCrawler)
migrator.create_model(WhitelistedCrawlerDomain)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
migrator.remove_model(migrator.orm["whitelisted_crawlers"])
migrator.remove_model(migrator.orm["whitelisted_crawler_domains"])
defence360agent/migrations/053_populate_whitelisted_crawlers.py 0000644 0000000 0000000 00000002513 00000000000 022024 0 ustar import logging
logger = logging.getLogger(__name__)
DATA = [
(
"Google (https://support.google.com/webmasters/answer/80553?hl=ru)", # noqa
[".google.com", ".googlebot.com"],
),
(
( # noqa
"Yandex"
" (https://yandex.ru/support/webmaster/robot-workings/check-yandex-robots.xml?lang=ru)" # NOQA E501
),
[".yandex.ru", ".yandex.com", ".yandex.net"],
),
(
( # noqa
"Bing (https://www.bing.com/webmaster/help/how-to-verify-bingbot-3905dc26)" # NOQA E501
),
[".search.msn.com"],
),
(
( # noqa
"Baidu"
" (http://help.baidu.com/question?prod_en=master&class=Baiduspider)"
),
[".baidu.com", ".baidu.jp"],
),
]
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
if fake:
return
wc = migrator.orm["whitelisted_crawlers"]
wcd = migrator.orm["whitelisted_crawler_domains"]
with database.atomic():
for descr, domains in DATA:
inserted_id = wc.insert(description=descr).execute()
for d in domains:
wcd.insert(crawler=inserted_id, domain=d).execute()
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/054_add_malicious_and_added_date_fileds.py 0000644 0000000 0000000 00000001352 00000000000 022750 0 ustar from time import time
from peewee import BooleanField, IntegerField
def migrate(migrator, database, fake=False, **kwargs):
MalwareHits = migrator.orm["malware_hits"]
migrator.add_fields(
MalwareHits, malicious=BooleanField(null=False, default=False)
)
MalwareIgnorePath = migrator.orm["malware_ignore_path"]
migrator.add_fields(
MalwareIgnorePath,
added_date=IntegerField(null=False, default=lambda: int(time())),
)
def rollback(migrator, database, fake=False, **kwargs):
MalwareHits = migrator.orm["malware_hits"]
migrator.remove_fields(MalwareHits, "malicious")
MalwareIgnorePath = migrator.orm["malware_ignore_path"]
migrator.remove_fields(MalwareIgnorePath, "added_date")
defence360agent/migrations/055_migrate_move_to_quar_option.py 0000644 0000000 0000000 00000001062 00000000000 021464 0 ustar from defence360agent.contracts.config import ConfigFile, IConfig
def migrate(*_, fake=False, config_file: IConfig = ConfigFile(), **__):
if fake:
return
if not (config := config_file.config_to_dict()):
return
malware_settings = config.get("MALWARE_SCANNING", {})
malware_settings.pop("leave_suspicious", None)
malware_settings.pop("max_days_in_quarantine", None)
malware_settings.pop("move_to_quarantine", False)
config_file.dict_to_config(config, overwrite=True, validate=False)
def rollback(*_, **__):
pass
defence360agent/migrations/056_populate_malicious_with_quarantined.py 0000644 0000000 0000000 00000000157 00000000000 023215 0 ustar """ Quarantine is removed in DEF-15234"""
def migrate(*_, **__):
pass
def rollback(*_, **__):
pass
defence360agent/migrations/057_filename_is_blob.py 0000644 0000000 0000000 00000002043 00000000000 017137 0 ustar import logging
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""
This migration os only for consistency, actually all works
with CharField as well
"""
migrator.sql(
"""
CREATE TABLE "malware_hits_new" (
"id" INTEGER NOT NULL PRIMARY KEY,
"scanid_id" VARCHAR(255) NOT NULL,
"user" VARCHAR(255) NOT NULL,
"orig_file" BLOB NOT NULL,
"type" VARCHAR(255) NOT NULL,
"restored" INTEGER NOT NULL,
"mode" INTEGER,
"vendor" VARCHAR(255) NOT NULL,
"malicious" INTEGER NOT NULL,
FOREIGN KEY ("scanid_id") REFERENCES "malware_scans" ("scanid"))
"""
)
migrator.sql("INSERT INTO malware_hits_new SELECT * FROM malware_hits")
migrator.sql("DROP TABLE malware_hits")
migrator.sql("ALTER TABLE malware_hits_new RENAME TO malware_hits")
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/058_convert_license_last_attempt.py 0000644 0000000 0000000 00000000205 00000000000 021630 0 ustar # Removed, because we do not have customers with old-style license
def migrate(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/059_scans_error_field.py 0000644 0000000 0000000 00000000574 00000000000 017362 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
MalwareScans = migrator.orm["malware_scans"]
migrator.add_fields(
MalwareScans, error=pw.TextField(default=None, null=True)
)
def rollback(migrator, database, fake=False, **kwargs):
MalwareScans = migrator.orm["malware_scans"]
migrator.remove_fields(MalwareScans, "error")
defence360agent/migrations/061_migrate_backup_system_conf.py 0000644 0000000 0000000 00000002505 00000000000 021252 0 ustar """
Migrate backup config from user oriented config file
to the separate internal file
"""
import os
from typing import Optional
from defence360agent.contracts.config import (
BackupConfig,
IConfig,
IConfigFile,
LocalConfig,
)
from defence360agent.utils import antivirus_mode
@antivirus_mode.skip
def migrate(
migrator,
database,
fake=False,
config_file: IConfig = LocalConfig(),
backup_config_file: Optional[IConfigFile] = None,
**kwargs,
):
if fake:
return
if backup_config_file is None:
backup_config_file = BackupConfig()
if not (config_from := config_file.config_to_dict()):
return
# Do not overwrite existing config file
if os.path.exists(backup_config_file.path):
return
backup_conf_current = config_from.get("BACKUP_RESTORE", {})
config_to = {
"BACKUP_SYSTEM": {
"enabled": backup_conf_current.pop("enabled", False),
"backup_system": backup_conf_current.pop("backup_system", None),
}
}
backup_config_file.dict_to_config(
config_to, overwrite=True, validate=False
)
config_file.dict_to_config(config_from, overwrite=True, validate=False)
@antivirus_mode.skip
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/062_drop_malware_extra_data.py 0000644 0000000 0000000 00000000465 00000000000 020540 0 ustar def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
MalwareExtraData = migrator.orm["malware_hit_extras"]
migrator.remove_model(MalwareExtraData)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/062_fix_null_expiration.py 0000644 0000000 0000000 00000000612 00000000000 017744 0 ustar """
Fix IPs that were added with NULL expiration to the WB lists
"""
def migrate(migrator, database, fake=False, **kwargs):
IPListModel = migrator.orm["iplist"]
IPListModel.update(expiration=0).where(
(IPListModel.listname.in_(["WHITE", "BLACK"]))
& (IPListModel.expiration.is_null())
).execute()
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/063_fix_graylist_doslist_expiration_discrepancy.py 0000644 0000000 0000000 00000000541 00000000000 024757 0 ustar def migrate(migrator, database, fake=False, **kwargs):
IPListModel = migrator.orm["iplist"]
IPListModel.update(expiration=IPListModel.dos_expiration).where(
(IPListModel.listname == "GRAY")
& (IPListModel.expiration < IPListModel.dos_expiration)
).execute()
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/064_chmod_i360deploy_log.py 0000644 0000000 0000000 00000000440 00000000000 017574 0 ustar from contextlib import suppress
import os
I360DEPLOY_LOG = "/var/log/i360deploy.log"
def migrate(migrator, database, fake=False, **kwargs):
with suppress(FileNotFoundError):
os.chmod(I360DEPLOY_LOG, 0o600)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/065_remove_capture_csf_lock_from_config.py 0000644 0000000 0000000 00000001141 00000000000 023116 0 ustar import logging
import os
from defence360agent.contracts.config import LocalConfig
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
local_config = LocalConfig()
if not os.path.exists(local_config.path):
return
config = local_config.config_to_dict()
if "CSF_COOPERATION" in config:
config.pop("CSF_COOPERATION")
local_config.dict_to_config(config, overwrite=True, validate=False)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/066_eula_table.py 0000644 0000000 0000000 00000000617 00000000000 015770 0 ustar import peewee as pw
class Eula(pw.Model):
class Meta:
db_table = "eula"
updated = pw.DateField(primary_key=True)
accepted = pw.IntegerField(null=True, default=None)
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(Eula)
def rollback(migrator, database, fake=False, **kwargs):
Eula = migrator.orm["eula"]
migrator.remove_model(Eula)
defence360agent/migrations/067_drop_fields_from_modsec_conf.py 0000644 0000000 0000000 00000001074 00000000000 021546 0 ustar from defence360agent.contracts.config import IConfig, LocalConfig
def migrate(
migrator,
database,
fake=False,
config_file: IConfig = LocalConfig(),
**kwargs
):
if fake:
return
conf = config_file.config_to_dict()
if not conf:
return
mod_sec_settings = conf.setdefault("MOD_SEC", {})
mod_sec_settings.pop("was_installed", None)
mod_sec_settings.pop("OWASP_deleted", None)
config_file.dict_to_config(conf, validate=False, overwrite=True)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/068_remove_rules_check_interval_from_config.py 0000644 0000000 0000000 00000001077 00000000000 024016 0 ustar import logging
from defence360agent.contracts.config import ConfigFile
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
config_file = ConfigFile()
config = config_file.config_to_dict()
if not config:
return
if "IPTABLES_RULE_CHECK" in config:
config.pop("IPTABLES_RULE_CHECK")
config_file.dict_to_config(config, overwrite=True, validate=False)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/069_incidents_domain_field.py 0000644 0000000 0000000 00000000526 00000000000 020347 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
Incident = migrator.orm["incident"]
migrator.add_fields(Incident, domain=pw.TextField(default=None, null=True))
def rollback(migrator, database, fake=False, **kwargs):
Incident = migrator.orm["incident"]
migrator.remove_fields(Incident, "domain")
defence360agent/migrations/070_modsec_incident_names.py 0000644 0000000 0000000 00000002504 00000000000 020175 0 ustar from tempfile import TemporaryFile
def extract_name(description):
return description.split("||", maxsplit=1)[0]
def migrate(migrator, database, fake=False, **kwargs):
"""
This migration extracts incident name from whole mod_security message
Centos6 version of sqlite does not have instr(), using slow python-based
way
"""
incident = migrator.orm["incident"]
# FIXME: after migrating to peewee 3 remove the try..except block
def select_incidents():
try:
yield from (
incident.select(incident.id, incident.description)
.where(incident.plugin == "modsec")
.where(incident.description.contains("||"))
.tuples()
.iterator()
)
except RuntimeError:
return
with TemporaryFile(mode="w+") as f:
for id_, desc in select_incidents():
f.write("{},{}\n".format(id_, extract_name(desc)))
f.seek(0)
with database.atomic():
for line in f:
id_, name = line.split(",", maxsplit=1)
incident.update(name=name.strip()).where(
incident.id == int(id_)
).execute()
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/071_malware_hits_hash_size_fields.py 0000644 0000000 0000000 00000001027 00000000000 021725 0 ustar import logging
import peewee as pw
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
MalwareHits = migrator.orm["malware_hits"]
migrator.add_fields(
MalwareHits, size=pw.CharField(null=True), hash=pw.CharField(null=True)
)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
MalwareHits = migrator.orm["malware_hits"]
migrator.remove_fields(MalwareHits, "hash", "size")
defence360agent/migrations/072_add_malware_history_table.py 0000644 0000000 0000000 00000001304 00000000000 021052 0 ustar from time import time
import peewee as pw
from defence360agent.model.simplification import FilenameField
class MalwareHistory(pw.Model):
class Meta:
db_table = "malware_history"
path = FilenameField(null=False)
event = pw.CharField(null=False)
initiator = pw.CharField(null=False)
cause = pw.CharField(null=False)
file_owner = pw.CharField(null=True)
ctime = pw.IntegerField(null=True, default=lambda: int(time()))
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(MalwareHistory)
def rollback(migrator, database, fake=False, **kwargs):
MalwareHistory = migrator.orm["malware_history"]
migrator.remove_model(MalwareHistory)
defence360agent/migrations/072_captcha_stat.py 0000644 0000000 0000000 00000001673 00000000000 016331 0 ustar import peewee as pw
class Country(pw.Model):
"""
Contains country code and name
"""
id = pw.CharField(primary_key=True, null=False)
code = pw.CharField(max_length=2, unique=True, null=False)
name = pw.CharField(null=False)
class Meta:
db_table = "country"
class CaptchaStat(pw.Model):
class Meta:
db_table = "captcha_stat"
primary_key = pw.CompositeKey(
"event", "ip", "country", "domain", "timestamp"
)
event = pw.TextField(null=False)
ip = pw.TextField(null=False)
country = pw.ForeignKeyField(Country, null=True)
domain = pw.TextField(null=True)
timestamp = pw.IntegerField(null=False)
count = pw.IntegerField(null=False)
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(CaptchaStat)
def rollback(migrator, database, fake=False, **kwargs):
cs = migrator.orm["captcha_stat"]
migrator.remove_model(cs)
defence360agent/migrations/072_extend_last_synclist.py 0000644 0000000 0000000 00000001200 00000000000 020117 0 ustar def migrate(migrator, database, fake=False, **kwargs):
"""Recreating DB in order to make `name` as primary key"""
migrator.sql(
"""
CREATE TABLE "last_synclist_new" (
"timestamp" REAL,
"name" VARCHAR(255) NOT NULL PRIMARY KEY
)"""
)
migrator.sql(
"INSERT INTO last_synclist_new "
'SELECT timestamp, "ip" AS name FROM last_synclist LIMIT 1'
)
migrator.sql("DROP TABLE last_synclist")
migrator.sql("ALTER TABLE last_synclist_new RENAME TO last_synclist")
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
defence360agent/migrations/073_drop_dos_expiration.py 0000644 0000000 0000000 00000001127 00000000000 017741 0 ustar import logging
import peewee as pw
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
IPList = migrator.orm["iplist"]
migrator.add_fields(
IPList,
no_captcha=pw.BooleanField(null=False, default=False),
)
migrator.sql(
"UPDATE iplist SET no_captcha=1 "
"WHERE listname='GRAY' AND dos_expiration"
)
migrator.remove_fields(IPList, "dos_expiration")
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/074_ip_as_int.py 0000644 0000000 0000000 00000003011 00000000000 015626 0 ustar import logging
from time import time
import peewee as pw
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
Country = migrator.orm["country"]
class IPListNew(pw.Model):
# available list names
ip = pw.CharField(null=False)
listname = pw.CharField(
null=False,
constraints=[pw.Check("listname in ('WHITE','BLACK','GRAY')")],
)
expiration = pw.IntegerField(
default=0, null=True # 0 - never
) # null - the same :(
imported_from = pw.CharField(null=True)
ctime = pw.IntegerField(
null=True, default=lambda: int(time()) # those
) # are OK
deep = pw.IntegerField(null=True)
comment = pw.CharField(null=True)
country = pw.ForeignKeyField(Country, null=True)
no_captcha = pw.BooleanField(null=False, default=False)
full_access = pw.BooleanField(null=True)
auto_whitelisted = pw.BooleanField(null=True, default=False)
network_address = pw.IntegerField(null=False)
netmask = pw.IntegerField(null=False)
version = pw.IntegerField(null=False)
class Meta:
db_table = "iplist_new"
primary_key = pw.CompositeKey(
"network_address", "netmask", "version"
)
migrator.create_model(IPListNew)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/075_ips_as_int.py 0000644 0000000 0000000 00000003330 00000000000 016016 0 ustar import logging
import peewee as pw
import ipaddress
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
IPListNew = migrator.orm["iplist_new"]
IPList = migrator.orm["iplist"]
def iplist_select():
# FIXME: remove this function after migrating to peewee 3
try:
yield from IPList.select(IPList).dicts().iterator()
except RuntimeError:
return
try:
from im360.utils.net import pack_ip_network
except ImportError:
pass
else:
with database.atomic():
for ip_obj in iplist_select():
try:
ip = ipaddress.ip_network(ip_obj["ip"])
except ValueError:
# malformed ip
continue
net, mask, version = pack_ip_network(ip)
ip_obj.update(
{
"network_address": net,
"netmask": mask,
"version": version,
}
)
try:
IPListNew.insert(ip_obj).execute()
except pw.IntegrityError as e:
logger.warning("Error inserting IP: %s", e)
migrator.sql("DROP TABLE iplist")
migrator.sql("ALTER TABLE iplist_new RENAME TO iplist")
migrator.sql('CREATE INDEX "iplist_listname" ON "iplist" ("listname")')
migrator.sql('CREATE INDEX "iplist_expiration" ON "iplist" ("expiration")')
migrator.sql('CREATE INDEX "iplist_ip" ON "iplist" ("ip")')
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/076_hash_model.py 0000644 0000000 0000000 00000000203 00000000000 015766 0 ustar def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/077_alter_malware_scan.py 0000644 0000000 0000000 00000001456 00000000000 017522 0 ustar """
Altering MalwareScan.type in order to add ability to support
'malware-response' scan type
"""
import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
MalwareScan = migrator.orm["malware_scans"]
MalwareScan.update(type="realtime").where(
MalwareScan.type == "inotify"
).execute()
migrator.change_fields(
MalwareScan, path=pw.CharField(null=True, default="")
)
migrator.change_fields(
MalwareScan,
type=pw.CharField(
null=False,
constraints=[
pw.Check(
"type in ('on-demand', 'realtime', 'malware-response')"
)
],
),
)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/078_fix_signatures_permissions.py 0000644 0000000 0000000 00000000415 00000000000 021357 0 ustar """Removed, as DEF-11611 will fix folder creations so it will not be needed
anymore.
"""
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/079_add_uid_gid_fields.py 0000644 0000000 0000000 00000000722 00000000000 017436 0 ustar import logging
import peewee as pw
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
MalwareHit = migrator.orm["malware_hits"]
migrator.add_fields(
MalwareHit,
uid=pw.IntegerField(null=True),
gid=pw.IntegerField(null=True),
)
def rollback(migrator, database, fake=False, **kwargs):
MalwareHit = migrator.orm["malware_hits"]
migrator.remove_fields(MalwareHit, "uid", "gid")
defence360agent/migrations/080_populate_uid_gid_size_hash_fields.py 0000644 0000000 0000000 00000004413 00000000000 022565 0 ustar import errno
import hashlib
import logging
import os
import stat
logger = logging.getLogger(__name__)
def _hash_and_size_from_fd(fd, hash_func, chunksize=4096):
"""Read an open file descriptor in chunks; return (hexdigest, size)."""
hash_ = hash_func()
size = 0
while True:
chunk = os.read(fd, chunksize)
if not chunk:
break
hash_.update(chunk)
size += len(chunk)
return hash_.hexdigest(), size
def migrate(migrator, database, fake=False, **kwargs):
MalwareHit = migrator.orm["malware_hits"]
try:
for hit in MalwareHit.select():
path = hit.orig_file.encode("utf-8", errors="surrogateescape")
# Open with O_NOFOLLOW so a symlinked malware path cannot redirect
# the subsequent fchown/read to an attacker-chosen target file.
# O_NONBLOCK guards against accidentally hanging on a FIFO that
# an attacker may have substituted for the recorded file.
try:
fd = os.open(
path,
os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK,
)
except FileNotFoundError:
logger.warning(
"Malware file %s does not exist, skipping", path
)
continue
except OSError as e:
if e.errno == errno.ELOOP:
logger.warning(
"Malware file %s is a symlink, skipping", path
)
continue
raise
try:
st = os.fstat(fd)
if not stat.S_ISREG(st.st_mode):
logger.warning(
"Malware file %s is not a regular file, skipping",
path,
)
continue
if hit.mode is not None and not hit.restored:
os.fchown(fd, 0, 0)
hit.uid, hit.gid = st.st_uid, st.st_gid
hit.hash, hit.size = _hash_and_size_from_fd(fd, hashlib.sha256)
finally:
os.close(fd)
hit.save()
except Exception as e:
logger.exception(e)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/081_fix_clamscan_broken_symlink.py 0000644 0000000 0000000 00000000203 00000000000 021414 0 ustar def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/082_add_cl_on_premise_backup_option.py 0000644 0000000 0000000 00000001024 00000000000 022225 0 ustar # This migration was used to add `cl_on_premise_backup_allowed` option
# to config file with the default value. The only purpose of this
# migration was to display new option in the config file. Now we have a
# separate file for this purpose stored at
# /etc/sysconfig/imunify360/imunify360.config.defaults.example
# It is created dynamically with
# src/asyncclient/scripts/create_default_config.py
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/082_add_manual_flag.py 0000644 0000000 0000000 00000000534 00000000000 016745 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
migrator.add_fields(
IPList, manual=pw.BooleanField(null=False, default=True)
)
def rollback(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
migrator.remove_fields(IPList, "manual")
defence360agent/migrations/083_drop_no_captcha_field.py 0000644 0000000 0000000 00000001541 00000000000 020155 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
migrator.sql("UPDATE iplist SET manual=0 WHERE listname='GRAY'")
migrator.sql("UPDATE iplist SET manual=1 WHERE listname='WHITE'")
migrator.sql("UPDATE iplist SET manual=1 WHERE listname='BLACK'")
migrator.sql(
"UPDATE iplist SET listname='BLACK'"
"WHERE listname='GRAY' AND no_captcha=1"
)
migrator.sql(
"UPDATE iplist SET "
"comment='Automatically blocked due to distributed attack', "
"imported_from='Imunify360'"
" WHERE listname='BLACK' AND manual=0"
)
migrator.remove_fields(IPList, "no_captcha")
def rollback(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
migrator.add_fields(IPList, no_captcha=pw.BooleanField(default=False))
defence360agent/migrations/084_country_subnets_fields.py 0000644 0000000 0000000 00000001212 00000000000 020457 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
CountrySubnets = migrator.orm["country_subnets"]
migrator.rename_field(CountrySubnets, "ip_net", "ip")
migrator.add_fields(
CountrySubnets,
network_address=pw.IntegerField(null=True),
netmask=pw.IntegerField(null=True),
version=pw.IntegerField(null=True),
)
def rollback(migrator, database, fake=False, **kwargs):
CountrySubnets = migrator.orm["country_subnets"]
migrator.rename_field(CountrySubnets, "ip", "ip_net")
migrator.remove_fields(
CountrySubnets, "network_address", "netmask", "version"
)
defence360agent/migrations/085_country_subnets_fields.py 0000644 0000000 0000000 00000001177 00000000000 020472 0 ustar import logging
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
CountrySubnets = migrator.orm["country_subnets"]
migrator.sql("DELETE FROM country_subnets")
migrator.add_not_null(CountrySubnets, "network_address")
migrator.add_not_null(
CountrySubnets,
"netmask",
)
migrator.add_not_null(CountrySubnets, "version")
def rollback(migrator, database, fake=False, **kwargs):
CountrySubnets = migrator.orm["country_subnets"]
migrator.drop_not_null(
CountrySubnets, "network_address", "netmask", "version"
)
defence360agent/migrations/086_ignored_by_port_fields.py 0000644 0000000 0000000 00000001207 00000000000 020404 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
IgnoredByPort = migrator.orm["ignored_by_port_proto"]
Country = migrator.orm["country"]
migrator.add_fields(
IgnoredByPort,
network_address=pw.IntegerField(null=True),
netmask=pw.IntegerField(null=True),
version=pw.IntegerField(null=True),
country=pw.ForeignKeyField(Country, null=True),
)
def rollback(migrator, database, fake=False, **kwargs):
IgnoredByPort = migrator.orm["ignored_by_port_proto"]
migrator.remove_fields(
IgnoredByPort, "network_address", "netmask", "version", "country"
)
defence360agent/migrations/087_ignored_by_port_fields.py 0000644 0000000 0000000 00000003344 00000000000 020411 0 ustar import logging
from ipaddress import ip_network
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
IgnoredByPort = migrator.orm["ignored_by_port_proto"]
try:
from im360.utils.net import pack_ip_network
except ImportError:
ips = [] # keep database structure in AV too
else:
q = IgnoredByPort.select(IgnoredByPort.ip).distinct().tuples()
ips = [ip for ip, in q]
for ip in ips:
try:
net, mask, version = pack_ip_network(ip_network(ip))
except ValueError:
logger.warning("Invalid IP network %s", ip)
IgnoredByPort.delete().where(IgnoredByPort.ip == ip).execute()
else:
IgnoredByPort.update(
network_address=net, netmask=mask, version=version
).where(IgnoredByPort.ip == ip).execute()
if ips:
from defence360agent.internals import geo
try:
with geo.reader() as geo_reader:
for ip in ips:
country = geo_reader.get_id(ip)
IgnoredByPort.update(
country=country,
).where(IgnoredByPort.ip == ip).execute()
except OSError:
logger.warning(
"Failed to update countries data in ignored_by_port"
)
migrator.add_not_null(IgnoredByPort, "network_address")
migrator.add_not_null(
IgnoredByPort,
"netmask",
)
migrator.add_not_null(IgnoredByPort, "version")
def rollback(migrator, database, fake=False, **kwargs):
IgnoredByPort = migrator.orm["ignored_by_port_proto"]
migrator.drop_not_null(
IgnoredByPort, "network_address", "netmask", "version"
)
defence360agent/migrations/088_add_malware_i360_clamd_scan_option.py 0000644 0000000 0000000 00000000203 00000000000 022423 0 ustar def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/089_proactive_tables.py 0000644 0000000 0000000 00000002755 00000000000 017233 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
Country = migrator.orm["country"]
class Proactive(pw.Model):
class Meta:
db_table = "proactive"
id = pw.PrimaryKeyField()
timestamp = pw.IntegerField(null=False)
ip = pw.TextField(null=True)
ip_int = pw.IntegerField(null=True)
ip_version = pw.IntegerField(null=True)
ip_country = pw.ForeignKeyField(Country, null=True)
reason = pw.TextField(null=False)
description = pw.TextField(null=True)
action = pw.TextField(null=False)
host = pw.TextField(null=True)
path = pw.TextField(null=False)
url = pw.TextField(null=True)
count = pw.IntegerField(null=False)
uid = pw.IntegerField(null=False)
gid = pw.IntegerField(null=False)
class ProactiveEnv(pw.Model):
event = pw.ForeignKeyField(
Proactive, null=False, on_delete="CASCADE", related_name="env"
)
name = pw.TextField(null=False)
value = pw.TextField(null=True)
class Meta:
db_table = "proactive_env"
primary_key = pw.CompositeKey("event", "name", "value")
migrator.create_model(Proactive)
migrator.create_model(ProactiveEnv)
def rollback(migrator, database, fake=False, **kwargs):
ProactiveEnv = migrator.orm["proactive_env"]
Proactive = migrator.orm["proactive"]
migrator.remove_model(ProactiveEnv)
migrator.remove_model(Proactive)
defence360agent/migrations/090_safe_user_config.py 0000644 0000000 0000000 00000002171 00000000000 017166 0 ustar import pwd
import shutil
import os
import logging
from defence360agent.contracts.config import Core
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
try:
for user in pwd.getpwall():
try:
src = os.path.join(user.pw_dir, Core.USER_CONFIG_FILE_NAME)
if os.path.isfile(src) and not os.path.islink(src):
dst_dir = os.path.join(Core.USER_CONFDIR, user.pw_name)
os.mkdir(dst_dir)
os.chown(dst_dir, 0, user.pw_gid)
os.chmod(dst_dir, 0o750)
dst_file = os.path.join(
dst_dir, Core.USER_CONFIG_FILE_NAME
)
shutil.move(src, dst_file)
os.chown(dst_file, 0, user.pw_gid)
os.chmod(dst_file, 0o640)
except OSError as e:
logger.warning("Something went wrong: %s", str(e))
except Exception:
logger.exception("Failed to migrate config for %s", user)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/091_compress_old_logs.py 0000644 0000000 0000000 00000001730 00000000000 017403 0 ustar import logging
import shutil
import gzip
import os
from defence360agent.contracts.config import Logger
from defence360agent.internals.logger import get_log_file_names
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
for filename in get_log_file_names():
for i in range(1, Logger.BACKUP_COUNT + 1):
source = f"{filename}.{i}"
dest = f"{source}.gz"
try:
if os.path.exists(source):
with open(source, "rb") as f_in, gzip.open(
dest, "wb"
) as f_out:
shutil.copyfileobj(f_in, f_out)
os.remove(source)
except Exception as e:
logger.exception(
"Failed file %s compression with %s", source, e
)
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/092_ignore_proc_sys_dirs.py 0000644 0000000 0000000 00000000607 00000000000 020116 0 ustar """
This migration adds /proc and /sys to ignore for malware scanning
"""
def migrate(migrator, database, fake=False, **kwargs):
if not fake:
for ignored_dir in ["/proc", "/sys"]:
MalwareIgnorePath = migrator.orm["malware_ignore_path"]
MalwareIgnorePath.get_or_create(path=ignored_dir)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/092_remove_old_disabled_rules.py 0000644 0000000 0000000 00000000517 00000000000 021065 0 ustar """
Moves disabled rules from the cPanel-specific user data directory to the centralized Apache
configuration directory.
No longer required running due to age and causing issues with the Coraza WAF
"""
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/093_make_quarantined_files_immutable.py 0000644 0000000 0000000 00000000203 00000000000 022413 0 ustar def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/094_ignore_cagefs_proc.py 0000644 0000000 0000000 00000000571 00000000000 017511 0 ustar """
This migration adds /usr/share/cagefs-skeleton/proc/
to ignore for malware scanning
"""
def migrate(migrator, database, fake=False, **kwargs):
if not fake:
MalwareIgnorePath = migrator.orm["malware_ignore_path"]
MalwareIgnorePath.get_or_create(path="/usr/share/cagefs-skeleton/proc")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/095_add_total_malicious_field.py 0000644 0000000 0000000 00000000626 00000000000 021040 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
MalwareScan = migrator.orm["malware_scans"]
migrator.add_fields(
MalwareScan,
total_malicious=pw.IntegerField(null=False, default=0),
)
def rollback(migrator, database, fake=False, **kwargs):
MalwareScan = migrator.orm["malware_scans"]
migrator.remove_fields(MalwareScan, "total_malicious")
defence360agent/migrations/096_populate_total_malicious_field.py 0000644 0000000 0000000 00000000711 00000000000 022135 0 ustar def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
MalwareScan = migrator.orm["malware_scans"]
MalwareHit = migrator.orm["malware_hits"]
for scan in MalwareScan:
total_malicious = (
scan.malwarehit_set.select().where(MalwareHit.malicious).count()
)
scan.total_malicious = total_malicious
scan.save()
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/097_remove_uid_and_gid.py 0000644 0000000 0000000 00000000530 00000000000 017474 0 ustar import logging
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
MalwareHit = migrator.orm["malware_hits"]
try:
migrator.remove_fields(MalwareHit, "uid", "gid")
except Exception as e:
logger.exception(e)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/098_remote_proxy_tables.py 0000644 0000000 0000000 00000002234 00000000000 017763 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
class RemoteProxyGroup(pw.Model):
"""Groups multiple remote proxies together with common data."""
MANUAL = "manual"
IMUNIFY360 = "imunify360"
name = pw.CharField(null=False)
source = pw.CharField(
null=False,
constraints=[
pw.Check("source in ('{}', '{}')".format(MANUAL, IMUNIFY360))
],
)
enabled = pw.BooleanField(null=False, default=True)
class Meta:
db_table = "remote_proxy_group"
indexes = ((("name", "source"), True),)
class RemoteProxy(pw.Model):
group = pw.ForeignKeyField(RemoteProxyGroup, null=False)
network = pw.TextField(null=False)
class Meta:
db_table = "remote_proxy"
migrator.create_model(RemoteProxyGroup)
migrator.create_model(RemoteProxy)
def rollback(migrator, database, fake=False, **kwargs):
RemoteProxy = migrator.orm["remote_proxy"]
RemoteProxyGroup = migrator.orm["remote_proxy_group"]
migrator.remove_model(RemoteProxy)
migrator.remove_model(RemoteProxyGroup)
defence360agent/migrations/099_remove_old_disabled_rules.py 0000644 0000000 0000000 00000002140 00000000000 021066 0 ustar import logging
import os
import shutil
import subprocess
from defence360agent.utils import antivirus_mode, run_coro
logger = logging.getLogger(__name__)
OLD_DISABLED_RULES_CONFIG = "/etc/apache2/conf.d/i360_modsec_disable.conf"
@antivirus_mode.skip
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
from im360.subsys.panels.cpanel import cPanel
except ImportError:
return
try:
if not cPanel.is_installed() or not run_coro(
cPanel.installed_modsec()
):
return
hp = cPanel()
if os.path.exists(OLD_DISABLED_RULES_CONFIG):
shutil.move(
OLD_DISABLED_RULES_CONFIG,
os.path.join(
hp.DISABLED_RULES_CONFIG_DIR,
hp.GLOBAL_DISABLED_RULES_CONFIG_FILENAME,
),
)
subprocess.check_call(hp.REBUILD_HTTPDCONF_CMD)
except Exception as e:
logger.exception("Failed to delete old rules config with %s", e)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/100_remove_captcha_ports_from_csf.py 0000644 0000000 0000000 00000001073 00000000000 021742 0 ustar import os
import logging
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
from im360.subsys import csf
from im360.utils.net import IN, TCP
except ImportError:
return
if not os.path.isfile(csf.CSF_CONFIG):
return
try:
csf.remove_ports(TCP, IN, 52223, 52224, 52225, 52226)
except Exception:
logger.exception("Failed to remove captcha ports from csf config")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/101_remove_unneeded_acronis_ports_from_csf.py 0000644 0000000 0000000 00000001461 00000000000 023646 0 ustar import os
import logging
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
from im360.subsys import csf
from im360.utils.net import IN, OUT, TCP
except ImportError:
return
if not os.path.isfile(csf.CSF_CONFIG):
return
try:
csf.remove_ports(
TCP,
IN,
44445,
55556,
6109,
25001,
445,
5060,
ranges={(7770, 7800)},
)
csf.remove_ports(TCP, OUT, 6109, 25001, 445, 5060)
except Exception:
logger.exception(
"Failed to remove unused Arconis ports from csf config"
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/102_proactive_ignore_list.py 0000644 0000000 0000000 00000003114 00000000000 020247 0 ustar from time import time
import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
class ProactiveIgnoredPath(pw.Model):
"""
Ignore list for proactive defence
"""
path = pw.TextField(null=False, primary_key=True)
timestamp = pw.IntegerField(null=False, default=time)
class Meta:
db_table = "proactive_ignored_path"
class ProactiveIgnoredRule(pw.Model):
"""
Specific rules ignored
"""
path = pw.ForeignKeyField(
ProactiveIgnoredPath,
null=False,
on_delete="CASCADE",
related_name="rules",
)
rule_id = pw.IntegerField(null=False)
rule_name = pw.TextField(null=False)
class Meta:
db_table = "proactive_ignored_rule"
indexes = ((("path", "rule_id"), True),)
migrator.create_model(ProactiveIgnoredPath)
migrator.create_model(ProactiveIgnoredRule)
Proactive = migrator.orm["proactive"]
migrator.add_fields(
Proactive,
rule_id=pw.IntegerField(null=True),
)
migrator.rename_field(Proactive, "reason", "rule_name")
def rollback(migrator, database, fake=False, **kwargs):
ProactiveIgnoredPath = migrator.orm["proactive_ignored_path"]
ProactiveIgnoredRule = migrator.orm["proactive_ignored_rule"]
migrator.remove_model(ProactiveIgnoredRule)
migrator.remove_model(ProactiveIgnoredPath)
Proactive = migrator.orm["proactive"]
migrator.remove_fields(Proactive, "rule_id")
migrator.rename_field(Proactive, "rule_name", "reason")
defence360agent/migrations/102_replace_comodo.py 0000644 0000000 0000000 00000000646 00000000000 016637 0 ustar def migrate(migrator, database, fake=False, **kwargs):
migrator.sql(
"UPDATE incident "
"SET name=replace(name, 'COMODO WAF', 'IM360 WAF'), "
"description=replace(description, 'COMODO WAF', 'IM360 WAF')"
)
migrator.sql(
"UPDATE disabled_rules "
"SET name=replace(name, 'COMODO WAF', 'IM360 WAF')"
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/103_remove_vd_license.py 0000644 0000000 0000000 00000000360 00000000000 017346 0 ustar """
Remove Virusdie registration from CLN
"""
from logging import getLogger
logger = getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/104_add_feature_management_permissions.py 0000644 0000000 0000000 00000001016 00000000000 022750 0 ustar from peewee import BooleanField, CharField, Model
class FeatureManagementPerms(Model):
class Meta:
db_table = "feature_management_permissions"
user = CharField(unique=True)
proactive = BooleanField(default=True)
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(FeatureManagementPerms)
def rollback(migrator, database, fake=False, **kwargs):
FeatureManagementPerms = migrator.orm["feature_management_permissions"]
migrator.remove_model(FeatureManagementPerms)
defence360agent/migrations/105_populate_default_feature_management_permissions.py 0000644 0000000 0000000 00000000452 00000000000 025561 0 ustar DEFAULT = ""
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
FeatureManagementPerms = migrator.orm["feature_management_permissions"]
FeatureManagementPerms.get_or_create(user=DEFAULT)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/106_add_malware_cleanup_in_config.py 0000644 0000000 0000000 00000001057 00000000000 021647 0 ustar from defence360agent.contracts.config import ConfigFile
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
config_file = ConfigFile()
conf = config_file.config_to_dict()
if not conf:
return
malware_cleanup = conf.setdefault("MALWARE_CLEANUP", {})
malware_cleanup.setdefault("trim_file_instead_of_removal", True)
malware_cleanup.setdefault("keep_original_files_days", 14)
config_file.dict_to_config(conf, validate=False)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/106_malware_hit_status_field_add.py 0000644 0000000 0000000 00000001241 00000000000 021532 0 ustar import logging
from peewee import CharField, FloatField
from defence360agent.utils import importer
MalwareHitStatus = importer.get(
module="imav.malwarelib.config", name="MalwareHitStatus", default=None
)
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
MalwareHit = migrator.orm["malware_hits"]
migrator.add_fields(
MalwareHit,
status=CharField(default=MalwareHitStatus.FOUND),
cleaned_at=FloatField(null=True),
)
def rollback(migrator, database, fake=False, **kwargs):
MalwareHit = migrator.orm["malware_hits"]
migrator.remove_fields(MalwareHit, "status", "cleaned_at")
defence360agent/migrations/107_add_bruteforce_rule_33339.py 0000644 0000000 0000000 00000001464 00000000000 020433 0 ustar import logging
from defence360agent.contracts.config import ConfigFile
KEY = "MOD_SEC_BLOCK_BY_CUSTOM_RULE"
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
# adding brute-force rule to existing config
# this is needed until DEFA-689 is done
try:
config_file = ConfigFile()
config = config_file.config_to_dict(normalize=False)
mod_sec_block_rules = config.setdefault(KEY, {})
mod_sec_block_rules["33339"] = {
"check_period": 120,
"max_incidents": 10,
}
config_file.dict_to_config({KEY: mod_sec_block_rules})
except Exception:
logger.exception("Failed to create rule for 33339")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/107_malware_hit_status_field_populate.py 0000644 0000000 0000000 00000000673 00000000000 022644 0 ustar import logging
from peewee import BooleanField
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if not fake:
MalwareHit = migrator.orm["malware_hits"]
migrator.remove_fields(MalwareHit, "restored")
def rollback(migrator, database, fake=False, **kwargs):
MalwareHit = migrator.orm["malware_hits"]
migrator.add_fields(MalwareHit, restored=BooleanField(default=False))
defence360agent/migrations/108_feature_management_cleanup_add.py 0000644 0000000 0000000 00000001002 00000000000 022023 0 ustar import logging
from peewee import BooleanField
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
FeatureManagementPerms = migrator.orm["feature_management_permissions"]
migrator.add_fields(
FeatureManagementPerms, cleanup=BooleanField(default=False)
)
def rollback(migrator, database, fake=False, **kwargs):
FeatureManagementPerms = migrator.orm["feature_management_permissions"]
migrator.remove_fields(FeatureManagementPerms, "cleanup")
defence360agent/migrations/108_validate_config.py 0000644 0000000 0000000 00000002315 00000000000 017003 0 ustar import logging
import os
from defence360agent.contracts.config import (
ConfigsValidator,
ConfigsValidatorError,
LocalConfig,
)
logger = logging.getLogger(__name__)
# NOTE:
# "MOD_SEC_BLOCK_BY_CUSTOM_RULE" keys are validated even if they are strings.
# This migration is probably not needed anymore anyway.
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
# adding brute-force rule to existing config
# this is needed until DEFA-689 is done
try:
try:
ConfigsValidator.validate_system_config()
except ConfigsValidatorError:
local_config = LocalConfig()
backup_config = local_config.path + ".invalid"
os.rename(local_config.path, backup_config)
default_config = local_config.config_to_dict()
local_config.dict_to_config(default_config)
logger.warning(
"Invalid config replaced with default one."
" Old config save in %s",
backup_config,
)
except Exception:
logger.exception("Failed to replace invalid config with default one")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/109_dos_detector.py 0000644 0000000 0000000 00000002026 00000000000 016343 0 ustar import logging
from defence360agent.contracts.config import (
_DOS_DETECTOR_MIN_LIMIT,
ConfigFile,
)
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
config_file = ConfigFile()
config = config_file.config_to_dict(False)
if "DOS" not in config:
return
if "max_connections" in config["DOS"] and isinstance(
config["DOS"]["max_connections"], int
):
config["DOS"]["default_limit"] = max(
config["DOS"]["max_connections"], _DOS_DETECTOR_MIN_LIMIT
)
del config["DOS"]["max_connections"]
if "timeout" in config["DOS"]:
config["DOS"]["interval"] = config["DOS"]["timeout"]
del config["DOS"]["timeout"]
config_file.dict_to_config(config, overwrite=True)
except Exception:
logger.exception("Failed to replace DOS settings")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/110_ignore_list_ip_as_int.py 0000644 0000000 0000000 00000001141 00000000000 020215 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
class IgnoreListNew(pw.Model):
ip = pw.CharField(null=False)
network_address = pw.IntegerField(null=False)
netmask = pw.IntegerField(null=False)
version = pw.IntegerField(null=False)
class Meta:
db_table = "ignore_list_new"
primary_key = pw.CompositeKey(
"network_address", "netmask", "version"
)
migrator.create_model(IgnoreListNew)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/111_ignore_list_ip_as_int.py 0000644 0000000 0000000 00000002455 00000000000 020227 0 ustar import ipaddress
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
IgnoreListNew = migrator.orm["ignore_list_new"]
IgnoreList = migrator.orm["ignore_list"]
try:
from defence360agent.utils.validate import IP
from im360.utils.net import pack_ip_network
except ImportError:
pass
else:
with database.atomic():
# FIXME: after migrating to peewee 3 add .iterator()
ip_strings = [item["ip"] for item in IgnoreList.select().dicts()]
ips = set()
for item in ip_strings:
try:
ip = ipaddress.ip_network(item)
except ValueError:
# malformed ip
continue
ips.add(ip)
for ip in ips:
net, mask, version = pack_ip_network(ip)
IgnoreListNew.create(
ip=IP.ip_net_to_string(ip),
network_address=net,
netmask=mask,
version=version,
)
migrator.sql("DROP TABLE ignore_list")
migrator.sql("ALTER TABLE ignore_list_new RENAME TO ignore_list")
def rollback(migrator, database, fake=False, **kwargs):
"""Write your rollback migrations here."""
pass
defence360agent/migrations/112_hardened_php.py 0000644 0000000 0000000 00000003534 00000000000 016305 0 ustar import contextlib
import logging
import os
import os.path
from defence360agent.utils import importer
subtract_flags = importer.get(
module="imav.malwarelib.utils.chattr", name="subtract_flags", default=None
)
FS_IMMUTABLE_FL = importer.get(
module="imav.malwarelib.utils.chattr", name="FS_IMMUTABLE_FL", default=None
)
logger = logging.getLogger(__name__)
ALT_PHP = "imunify360-alt-php.repo"
EA_PHP = "imunify360-ea-php-hardened.repo"
REPOS_DIR = "/etc/yum.repos.d/"
def irrelevant_repos(release):
if "cloudlinux" in release:
# CloudLinux doesn't need either
return {ALT_PHP, EA_PHP}
elif os.path.exists("/usr/local/cpanel/cpanel"):
# cPanel does not need alt-php
return set([ALT_PHP])
else:
# ea-php is only for cPanel
return set([EA_PHP])
def fix_permissions():
# we don't expect that it can be None with in a way how it imported
if subtract_flags is None:
return
for repo_name in [ALT_PHP, EA_PHP]:
path = REPOS_DIR + repo_name
if not os.path.exists(path):
continue
with open(path) as f:
subtract_flags(f.fileno(), FS_IMMUTABLE_FL)
os.chmod(f.fileno(), 0o644)
def do_migrate():
if not os.path.exists("/etc/redhat-release"):
# we do not have to do anything on Ubuntu systems
return
with open("/etc/redhat-release") as f:
release = f.read().lower()
fix_permissions()
for repo_name in irrelevant_repos(release):
with contextlib.suppress(FileNotFoundError):
os.unlink(REPOS_DIR + repo_name)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
do_migrate()
except Exception:
logger.exception("Failed to clean up HardenedPHP repositories")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/113_move_quarantined_files.py 0000644 0000000 0000000 00000000157 00000000000 020406 0 ustar """ Quarantine is removed in DEF-15234"""
def migrate(*_, **__):
pass
def rollback(*_, **__):
pass
defence360agent/migrations/114_disable_auto-quarantine.py 0000644 0000000 0000000 00000001775 00000000000 020473 0 ustar import logging
import os
from defence360agent.contracts.config import ConfigFile, Core
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
"""Write your migrations here."""
if fake:
return
usernames = [None]
if os.path.exists(Core.USER_CONFDIR):
usernames.extend(os.listdir(Core.USER_CONFDIR))
for username in usernames:
config_file = ConfigFile(username=username)
config = config_file.config_to_dict()
if not config:
continue
default_action = config.setdefault("MALWARE_SCANNING", {}).get(
"default_action"
)
if default_action == "quarantine":
config["MALWARE_SCANNING"]["default_action"] = "notify"
try:
config_file.dict_to_config(
config, overwrite=True, validate=False
)
except Exception:
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/115_feature_management_fields.py 0000644 0000000 0000000 00000002516 00000000000 021043 0 ustar import peewee as pw
from defence360agent.feature_management.constants import NA, FULL, AV_REPORT
def migrate(migrator, database, fake=False, **kwargs):
permissions_model = migrator.orm["feature_management_permissions"]
migrator.add_fields(
permissions_model,
proactive_new=pw.TextField(
default=FULL,
null=False,
constraints=[
pw.Check("proactive_new in ('{}','{}')".format(NA, FULL))
],
),
av=pw.TextField(
default=AV_REPORT,
null=False,
constraints=[
pw.Check("av in ('{}','{}','{}')".format(NA, AV_REPORT, FULL))
],
),
)
migrator.sql(
"UPDATE feature_management_permissions SET av=? WHERE cleanup=1",
(FULL,),
)
migrator.sql(
"UPDATE feature_management_permissions SET av=? WHERE cleanup=0",
(AV_REPORT,),
)
migrator.sql(
"UPDATE feature_management_permissions SET proactive_new=? "
"WHERE proactive=1",
(FULL,),
)
migrator.sql(
"UPDATE feature_management_permissions SET proactive_new=? "
"WHERE proactive=0",
(NA,),
)
migrator.remove_fields(permissions_model, "cleanup", "proactive")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/116_feature_management_fields.py 0000644 0000000 0000000 00000000622 00000000000 021040 0 ustar def migrate(migrator, database, fake=False, **kwargs):
"""
This is final accions for migration 115. For some reason,
it does not work if executed in the same migration
"""
permissions_model = migrator.orm["feature_management_permissions"]
migrator.rename_field(permissions_model, "proactive_new", "proactive")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/117_remove_incorrect_fields.py 0000644 0000000 0000000 00000001371 00000000000 020561 0 ustar import logging
from defence360agent.contracts.config import IConfig, LocalConfig
logger = logging.getLogger(__name__)
def _fix_config(config_file):
try:
config = config_file.config_to_dict(normalize=False)
if "DOS" not in config:
return
config["DOS"].pop("timeout", None)
config["DOS"].pop("max_connections", None)
config_file.dict_to_config(config, overwrite=True, validate=False)
except Exception:
logger.exception("Failed to remove fields")
def migrate(
migrator,
database,
fake=False,
config_file: IConfig = LocalConfig(),
**kwargs
):
if fake:
return
_fix_config(config_file)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/118_add_malware_user_infected.py 0000644 0000000 0000000 00000000203 00000000000 021017 0 ustar def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/118_remove_country_subnets.py 0000644 0000000 0000000 00000000420 00000000000 020504 0 ustar import logging
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
CountrySubnets = migrator.orm["country_subnets"]
migrator.remove_model(CountrySubnets)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/119_populate_malware_user_infected.py 0000644 0000000 0000000 00000000203 00000000000 022121 0 ustar def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/120_scheduled_scan.py 0000644 0000000 0000000 00000002324 00000000000 016623 0 ustar import logging
from datetime import date, timedelta
import peewee as pw
from defence360agent.contracts.config import ConfigFile
from defence360agent.utils import importer
MalwareScanType = importer.get(
module="imav.malwarelib.config", name="MalwareScanType", default=None
)
logger = logging.getLogger(__name__)
types = (
MalwareScanType.ON_DEMAND,
MalwareScanType.REALTIME,
MalwareScanType.MALWARE_RESPONSE,
MalwareScanType.BACKGROUND,
)
def _update_config(path=None):
tomorrow = date.today() + timedelta(days=1)
config = {
"MALWARE_SCAN_SCHEDULE": {
"day_of_month": tomorrow.day,
}
}
try:
config_file = ConfigFile(path=path)
config_file.dict_to_config(config)
except Exception:
logger.exception("Failed to set malware scan schedule config")
def migrate(migrator, database, fake=False, **kwargs):
MalwareScan = migrator.orm["malware_scans"]
migrator.change_fields(
MalwareScan,
type=pw.CharField(
null=False, constraints=[pw.Check("type in {}".format(types))]
),
)
if fake:
return
_update_config()
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/121_drop_captcha_stat.py 0000644 0000000 0000000 00000000262 00000000000 017341 0 ustar def migrate(migrator, database, fake=False, **kwargs):
migrator.remove_model(migrator.orm["captcha_stat"])
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/122_cagefs_unmount.py 0000644 0000000 0000000 00000000424 00000000000 016675 0 ustar def migrate(migrator, database, fake=False, **kwargs):
# We have moved all content from this migration to 123_fixed_cagefs_unmount
# in order to re-run this migration because it was corrupted
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/123_add_last_user_scan.py 0000644 0000000 0000000 00000000640 00000000000 017476 0 ustar import peewee as pw
class LastUserScan(pw.Model):
class Meta:
db_table = "last_user_scans"
last_scanid = pw.CharField(primary_key=True)
started = pw.IntegerField(null=False)
uid = pw.IntegerField(null=False)
def migrate(migrator, database, fake=False, **kwargs):
pass # dropped in DEF-11278
def rollback(migrator, database, fake=False, **kwargs):
pass # dropped in DEF-11278
defence360agent/migrations/123_disable_scheduled_scan.py 0000644 0000000 0000000 00000001702 00000000000 020310 0 ustar import contextlib
import logging
import os
from defence360agent.contracts.config import ConfigFile, NONE
logger = logging.getLogger(__name__)
# Before DEF-35627 the cron file was defined in MalwareScanSchedule.CRON_PATH and was located here
CRON_PATH = "/etc/cron.d/imunify_scan_schedule"
def _update_config(path=None):
config = {
"MALWARE_SCAN_SCHEDULE": {
"interval": NONE,
}
}
try:
config_file = ConfigFile(path=path)
config_file.dict_to_config(config)
except Exception:
logger.exception("Failed to set malware scan schedule config")
def _remove_cron(path=CRON_PATH):
with contextlib.suppress(FileNotFoundError):
os.unlink(path)
def migrate(migrator, database, fake=False, **kwargs):
# Stubbed in DEF-11010
# if fake:
# return
#
# _update_config()
# _remove_cron()
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/123_rename_plesk_vendor.py 0000644 0000000 0000000 00000001607 00000000000 017707 0 ustar import logging
from defence360agent.utils import run_coro, antivirus_mode
logger = logging.getLogger(__name__)
@antivirus_mode.skip
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
from im360.subsys.panels.plesk import Plesk
from im360.subsys.panels.plesk.mod_security import (
plesk_supports_custom_vendors,
)
except ImportError:
return
try:
if Plesk.is_installed() and run_coro(plesk_supports_custom_vendors()):
panel = Plesk()
installed_vendors = run_coro(panel.modsec_vendor_list())
if "imunify360" in " ".join(installed_vendors):
run_coro(panel.install_settings())
except Exception as e:
logger.warning('Unable to reinstall modsec "custom" ruleset: %s', e)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/124_add_hook_management_functionality.py 0000644 0000000 0000000 00000001176 00000000000 022603 0 ustar from time import time
from peewee import Model, CharField, IntegerField, BooleanField
from defence360agent.model.simplification import FilenameField
class EventHook(Model):
class Meta:
db_table = "event_hook"
path = FilenameField(null=False)
event = CharField(null=False)
created = IntegerField(null=False, default=lambda: int(time()))
native = BooleanField(default=False)
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(EventHook)
def rollback(migrator, database, fake=False, **kwargs):
EventHook = migrator.orm["event_hook"]
migrator.remove_model(EventHook)
defence360agent/migrations/124_add_infected_domains_vendor.py 0000644 0000000 0000000 00000000651 00000000000 021344 0 ustar import logging
import peewee as pw
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
InfectedDomains = migrator.orm["infected_domain_list"]
migrator.add_fields(
InfectedDomains,
vendor=pw.TextField(null=False, default="google-safe-browsing"),
)
InfectedDomains.delete().execute()
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/125_rescan_scan_type.py 0000644 0000000 0000000 00000002517 00000000000 017210 0 ustar import logging
from datetime import datetime, timedelta
import peewee as pw
from defence360agent.utils import importer
from defence360agent.utils import split_for_chunk
MalwareScanType = importer.get(
module="imav.malwarelib.config", name="MalwareScanType", default=None
)
logger = logging.getLogger(__name__)
types = (
MalwareScanType.ON_DEMAND,
MalwareScanType.REALTIME,
MalwareScanType.MALWARE_RESPONSE,
MalwareScanType.BACKGROUND,
MalwareScanType.RESCAN,
)
def migrate(migrator, database, fake=False, **kwargs):
MalwareHit = migrator.orm["malware_hits"]
MalwareScan = migrator.orm["malware_scans"]
date = (datetime.now() - timedelta(days=30)).timestamp()
hits_to_delete = list(
MalwareHit.select(MalwareHit.id)
.join(MalwareScan)
.where(MalwareScan.started < date)
)
for chunk in split_for_chunk(hits_to_delete):
sql, params = MalwareHit.delete().where(MalwareHit.id.in_(chunk)).sql()
migrator.sql(sql, params)
sql, params = MalwareScan.delete().where(MalwareScan.started < date).sql()
migrator.sql(sql, params)
migrator.change_fields(
MalwareScan,
type=pw.CharField(
null=False, constraints=[pw.Check("type in {}".format(types))]
),
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/126_add_malware_scan_modified_files_option.py 0000644 0000000 0000000 00000001362 00000000000 023544 0 ustar import os
import yaml
from defence360agent.contracts.config import IConfigFile, LocalConfig
from defence360agent.utils import log_error_and_ignore
@log_error_and_ignore()
def migrate(
migrator,
database,
fake=False,
config_file: IConfigFile = LocalConfig(),
**kwargs
):
if fake:
return
if not os.path.exists(config_file.path):
return
with open(config_file.path) as f:
conf = yaml.safe_load(f)
malware_settings = conf.setdefault("MALWARE_SCANNING", {})
value = malware_settings.pop("scan_modified_files", None)
malware_settings["scan_modified_files"] = value
config_file.dict_to_config(conf, validate=False)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/126_move_malware_hits_list.py 0000644 0000000 0000000 00000002072 00000000000 020425 0 ustar import logging
import shutil
from defence360agent.files import FILES_DIR
from defence360agent.utils import importer, antivirus_mode
logger = logging.getLogger(__name__)
def _move(src, dst):
try:
shutil.move(src, dst)
except FileNotFoundError:
pass
except Exception as err:
logger.error(
"Failed to move HackerTrap list to the new location: %r", err
)
@antivirus_mode.skip
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
from defence360agent.contracts.config import HackerTrap
HackerTrapHitsSaver = importer.get(
module="imav.malwarelib.subsys.malware",
name="HackerTrapHitsSaver",
default=None,
)
except ImportError:
return
HackerTrapHitsSaver.BASE_DIR = str(FILES_DIR)
src1 = HackerTrapHitsSaver._filepath()
src2 = HackerTrapHitsSaver._clean_filepath()
for src in src1, src2:
_move(str(src), HackerTrap.DIR)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/127_remove_malware_hit_mode.py 0000644 0000000 0000000 00000000327 00000000000 020544 0 ustar def migrate(migrator, database, fake=False, **kwargs):
MalwareHit = migrator.orm["malware_hits"]
migrator.remove_fields(MalwareHit, "mode")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/128_move_cleanup_storage_files.py 0000644 0000000 0000000 00000003372 00000000000 021256 0 ustar import logging
import os
import shutil
from peewee import CharField, Model
from defence360agent.utils import importer
from defence360agent.model.simplification import FilenameField
CleanupStorage = importer.get(
module="imav.malwarelib.cleanup.storage",
name="CleanupStorage",
default=None,
)
logger = logging.getLogger(__name__)
def get_model(db):
"""
Model stub for migration because we can't use migrator.orm[] due to
custom field FilenameField
"""
class MalwareHit(Model):
class Meta:
db_table = "malware_hits"
database = db
user = CharField(null=False)
orig_file = FilenameField(null=False)
hash = CharField(null=True)
size = CharField(null=True)
@property
def storage_name(self) -> str:
"""
Get file name for cleanup storage
:return: file name
"""
try:
return os.path.extsep.join([self.user, self.hash, self.size])
except TypeError:
return None
return MalwareHit
def _move(src, dst):
src, dst = map(CleanupStorage.path.joinpath, (src, dst))
src, dst = map(str, (src, dst))
try:
shutil.move(src, dst)
except FileNotFoundError:
pass
except Exception as err:
logger.error("Failed to move stored file to the new location: %r", err)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
MalwareHit = get_model(database)
for hit in MalwareHit:
src = hit.storage_name
if src is None:
continue
dst = CleanupStorage.storage_name(hit.orig_file)
_move(src, dst)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/129_fixed_cagefs_unmount.py 0000644 0000000 0000000 00000002554 00000000000 020071 0 ustar import subprocess
import time
import os
from functools import lru_cache
from defence360agent.utils import retry_on, run_with_umask
_SERVICE_NAME = "cagefs"
_COMMAND = "restart"
_CAGEFSCTL_TOOL = "/usr/sbin/cagefsctl"
_WAIT_LOCK = "--wait-lock"
@lru_cache(1)
def systemctl_present(paths=["/usr/bin", "/bin"]):
"""Return whether we can find systemctl in given *paths*."""
return any(os.path.isfile(os.path.join(p, "systemctl")) for p in paths)
def _restart_cagefs(exc, i):
if systemctl_present():
cmd = ["systemctl", _COMMAND, _SERVICE_NAME]
else:
cmd = ["service", _SERVICE_NAME, _COMMAND]
try:
subprocess.check_call(cmd)
except Exception:
pass
time.sleep(5)
@retry_on(
subprocess.CalledProcessError,
max_tries=3,
on_error=_restart_cagefs,
silent=True,
)
def _execute_command(cmd):
subprocess.check_output(cmd, shell=False, stderr=subprocess.STDOUT)
def migrate(migrator, database, fake=False, umask=0o022, **kwargs):
if fake:
return
cmd_list = [
[_CAGEFSCTL_TOOL, _WAIT_LOCK, "--force-update-etc"],
[_CAGEFSCTL_TOOL, _WAIT_LOCK, "--remount-all"],
]
with run_with_umask(umask):
if os.path.exists(_CAGEFSCTL_TOOL):
for cmd in cmd_list:
_execute_command(cmd)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/130_add_messages_to_send.py 0000644 0000000 0000000 00000000710 00000000000 020007 0 ustar from peewee import FloatField, Model, BlobField
class MessageToSend(Model):
class Meta:
db_table = "messages_to_send"
timestamp = FloatField(null=False)
message = BlobField(null=False)
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(MessageToSend)
def rollback(migrator, database, fake=False, **kwargs):
MessageToSend = migrator.orm["messages_to_send"]
migrator.drop_model(MessageToSend)
defence360agent/migrations/131_incident_timestamp_index.py 0000644 0000000 0000000 00000000461 00000000000 020730 0 ustar # Add index on timestamp field to incident table. Helps to speed up queries.
def migrate(migrator, database, fake=False, **kwargs):
migrator.sql(
"CREATE INDEX IF NOT EXISTS incident_timestamp ON incident (timestamp)"
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/132_add_timestamp_field.py 0000644 0000000 0000000 00000000632 00000000000 017640 0 ustar import logging
import peewee as pw
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
MalwareHits = migrator.orm["malware_hits"]
migrator.add_fields(MalwareHits, timestamp=pw.FloatField(null=True))
def rollback(migrator, database, fake=False, **kwargs):
MalwareHits = migrator.orm["malware_hits"]
migrator.remove_fields(MalwareHits, "timestamp")
defence360agent/migrations/133_add_scope_field_to_iplist.py 0000644 0000000 0000000 00000001107 00000000000 021033 0 ustar import logging
import peewee as pw
logger = logging.getLogger(__name__)
SCOPE_LOCAL, SCOPE_GROUP = "local", "group"
def migrate(migrator, database, fake=False, **kwargs):
ip_list = migrator.orm["iplist"]
migrator.add_fields(
ip_list,
scope=pw.CharField(
null=True,
constraints=[
pw.Check("scope in ('%s','%s')" % (SCOPE_LOCAL, SCOPE_GROUP))
],
),
)
def rollback(migrator, database, fake=False, **kwargs):
ip_list = migrator.orm["iplist"]
migrator.remove_fields(ip_list, "scope")
defence360agent/migrations/134_change_default_of_intensity_ram.py 0000644 0000000 0000000 00000001127 00000000000 022246 0 ustar import logging
from defence360agent.contracts.config import ConfigFile
logger = logging.getLogger(__name__)
def _update_config(path=None):
config = {
"MALWARE_SCAN_INTENSITY": {
"ram": 2048,
}
}
try:
config_file = ConfigFile(path=path)
config_file.dict_to_config(config)
except Exception:
logger.exception("Failed to set malware scan schedule config")
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
_update_config()
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/135_export_proactive.py 0000644 0000000 0000000 00000002641 00000000000 017264 0 ustar import csv
import os
import logging
logger = logging.getLogger(__name__)
PROACTIVE_CSV, PROACTIVE_ENV_CSV = "proactive.csv", "proactive_env.csv"
PROACTIVE_SQL = """SELECT
id, timestamp, ip, ip_int, ip_version, ip_country_id, description, action,
host, path, url, count, uid, gid, rule_id, rule_name
FROM proactive ORDER BY timestamp DESC LIMIT ?"""
PROACTIVE_ENV_SQL = """
SELECT proactive_env.event_id, proactive_env.name, proactive_env.value
FROM proactive_env INNER JOIN ({}) pa ON proactive_env.event_id=pa.id
""".format(
PROACTIVE_SQL
)
EXPORT_DIR = "/var/lib/imunify360-php-daemon/export"
def export(database, target_dir, events_num):
for filename, query in [
(PROACTIVE_CSV, PROACTIVE_SQL),
(PROACTIVE_ENV_CSV, PROACTIVE_ENV_SQL),
]:
cur = database.execute_sql(query, (events_num,))
with open(
os.path.join(target_dir, filename),
"w",
newline="",
encoding="utf-8",
) as csvfile:
csv_writer = csv.writer(csvfile)
csv_writer.writerows(cur)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
os.makedirs(EXPORT_DIR, exist_ok=True)
export(database, EXPORT_DIR, 1000)
except Exception:
# not critical
logger.exception("Failed to export proactive defence data")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/135_make_completed_nullable.py 0000644 0000000 0000000 00000000472 00000000000 020516 0 ustar def migrate(migrator, database, fake=False, **kwargs):
MalwareScan = migrator.orm["malware_scans"]
migrator.drop_not_null(MalwareScan, "completed")
def rollback(migrator, database, fake=False, **kwargs):
MalwareScan = migrator.orm["malware_scans"]
migrator.add_not_null(MalwareScan, "completed")
defence360agent/migrations/136_drop_proactive.py 0000644 0000000 0000000 00000000350 00000000000 016703 0 ustar def migrate(migrator, database, fake=False, **kwargs):
migrator.remove_model(migrator.orm["proactive"])
migrator.remove_model(migrator.orm["proactive_env"])
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/137_swap_initiator_and_cause.py 0000644 0000000 0000000 00000001000 00000000000 020713 0 ustar import logging
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
MalwareHistory = migrator.orm["malware_history"]
try:
for entry in MalwareHistory.select():
if entry.initiator in ["manual", "on-demand", "realtime"]:
entry.cause, entry.initiator = entry.initiator, entry.cause
entry.save()
except Exception as e:
logger.exception(e)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/138_move_rapid_scan_dir.py 0000644 0000000 0000000 00000003126 00000000000 017660 0 ustar import asyncio
import pathlib
import shutil
from defence360agent.subsys.panels import hosting_panel
from defence360agent.utils import importer
panel_users = importer.get(
module="imav.malwarelib.utils.user_list", name="panel_users", default=None
)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
loop = asyncio.new_event_loop()
asyncio.set_event_loop(loop)
users = loop.run_until_complete(panel_users())
for user in users:
path_obj = pathlib.Path(user["home"])
old_path = str(path_obj.parent / ".rapid-scan-db" / path_obj.name)
try:
new_path = hosting_panel.HostingPanel().get_rapid_scan_db_dir(
user["home"]
)
except OSError:
continue
if new_path is None or old_path == new_path:
continue
try:
shutil.move(old_path, new_path)
except OSError:
pass
def rollback(migrator, database, fake=False, **kwargs):
loop = asyncio.new_event_loop()
asyncio.set_event_loop(loop)
users = loop.run_until_complete(panel_users())
for user in users:
path_obj = pathlib.Path(user["home"])
old_path = str(path_obj.parent / ".rapid-scan-db" / path_obj.name)
try:
new_path = hosting_panel.HostingPanel().get_rapid_scan_db_dir(
user["home"]
)
except OSError:
continue
if new_path is None or old_path == new_path:
continue
try:
shutil.move(new_path, old_path)
except OSError:
pass
defence360agent/migrations/139_generic_modsec_config.py 0000644 0000000 0000000 00000000435 00000000000 020165 0 ustar def migrate(migrator, database, fake=False, **kwargs):
"""
Rely on install-vendors to update modsec.conf on the 1st install.
Drop support for updating old imunify360 versions without modsec.conf.d/
"""
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/140_cast_malware_hit_orig_file_as_blob.py 0000644 0000000 0000000 00000000443 00000000000 022667 0 ustar def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
migrator.sql(
"UPDATE malware_hits SET orig_file = CAST(orig_file AS BLOB) "
'WHERE typeof(orig_file) != "blob";'
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/141_drop_last_user_scans.py 0000644 0000000 0000000 00000000343 00000000000 020075 0 ustar def migrate(migrator, database, fake=False, **kwargs):
if "last_user_scans" in migrator.orm:
migrator.remove_model(migrator.orm["last_user_scans"])
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/143_malware_hit_cascade_delete.py 0000644 0000000 0000000 00000002773 00000000000 021155 0 ustar import peewee
class MalwareScan(peewee.Model):
class Meta:
db_table = "malware_scans"
scanid = peewee.CharField(primary_key=True)
class MalwareHit(peewee.Model):
class Meta:
db_table = "malware_hits"
id = peewee.PrimaryKeyField()
scanid = peewee.ForeignKeyField(
MalwareScan, null=False, related_name="hits", on_delete="CASCADE"
)
user = peewee.CharField(null=False)
orig_file = peewee.BlobField(null=False)
type = peewee.CharField(null=False)
malicious = peewee.BooleanField(null=False, default=False)
vendor = peewee.CharField(null=False, default="ai-bolit")
hash = peewee.CharField(null=True)
size = peewee.CharField(null=True)
timestamp = peewee.FloatField(null=True)
status = peewee.CharField(default="found")
cleaned_at = peewee.FloatField(null=True)
@classmethod
def get_field_names(cls):
return map(lambda field: field.column_name, cls._meta.sorted_fields)
def migrate(migrator, database, fake=False, **kwargs):
migrator.sql("ALTER TABLE malware_hits RENAME TO malware_hits_old;")
migrator.create_model(MalwareHit)
# specify fields order directly, because '*' doesnt guarantee order
malware_hit_fields = ",".join(MalwareHit.get_field_names())
migrator.sql(
"INSERT INTO malware_hits ({0}) SELECT {0} FROM malware_hits_old;"
.format(malware_hit_fields)
)
migrator.sql("DROP TABLE malware_hits_old;")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/144_remove_clamav_config_options.py 0000644 0000000 0000000 00000001465 00000000000 021612 0 ustar import logging
from defence360agent.contracts.config import IConfig, ConfigFile
logger = logging.getLogger(__name__)
def migrate(
migrator,
database,
fake=False,
config_file: IConfig = ConfigFile(),
**kwargs
):
if fake:
return
try:
config = config_file.config_to_dict(normalize=False)
if "MALWARE_SCANNING" not in config:
return
config["MALWARE_SCANNING"].pop("i360_clamd", None)
config["MALWARE_SCANNING"].pop("show_clamav_results", None)
config["MALWARE_SCANNING"].pop("clamav_binary", None)
config_file.dict_to_config(config, overwrite=True, validate=False)
except Exception:
logger.exception("Failed to remove clamav config options")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/144_remove_hash_table.py 0000644 0000000 0000000 00000000261 00000000000 017332 0 ustar def migrate(migrator, database, fake=False, **kwargs):
migrator.sql("DROP TABLE IF EXISTS malware_hash;")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/145_move_quarantine.py 0000644 0000000 0000000 00000000157 00000000000 017065 0 ustar """ Quarantine is removed in DEF-15234"""
def migrate(*_, **__):
pass
def rollback(*_, **__):
pass
defence360agent/migrations/146_malware_user_infected_cascade_delete.py 0000644 0000000 0000000 00000000203 00000000000 023175 0 ustar def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/147_remove_vendor_field.py 0000644 0000000 0000000 00000000601 00000000000 017701 0 ustar import peewee
def migrate(migrator, database, fake=False, **kwargs):
malware_hits = migrator.orm["malware_hits"]
migrator.remove_fields(malware_hits, "vendor")
def rollback(migrator, database, fake=False, **kwargs):
malware_hits = migrator.orm["malware_hits"]
migrator.add_fields(
malware_hits, vendor=peewee.CharField(null=False, default="ai-bolit")
)
defence360agent/migrations/147_user_scan_type.py 0000644 0000000 0000000 00000001307 00000000000 016713 0 ustar import peewee as pw
from defence360agent.utils import importer
MalwareScanType = importer.get(
module="imav.malwarelib.config", name="MalwareScanType", default=None
)
types = (
MalwareScanType.ON_DEMAND,
MalwareScanType.REALTIME,
MalwareScanType.MALWARE_RESPONSE,
MalwareScanType.BACKGROUND,
MalwareScanType.RESCAN,
MalwareScanType.USER,
)
def migrate(migrator, database, fake=False, **kwargs):
MalwareScan = migrator.orm["malware_scans"]
migrator.change_fields(
MalwareScan,
type=pw.CharField(
null=False, constraints=[pw.Check("type in {}".format(types))]
),
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/148_reconstruct_pickled_scan_queue.py 0000644 0000000 0000000 00000000406 00000000000 022146 0 ustar def migrate(*_, **__):
"""
Backward compatibility for reconstruction of pickled scan queue
is done in the imav.malwarelib.scan.queue.py module.
Migration is no longer needed.
"""
def rollback(*_, **__):
"""Downgrade is not supported"""
defence360agent/migrations/148_remove_malware_user_infected.py 0000644 0000000 0000000 00000000271 00000000000 021574 0 ustar def migrate(migrator, database, fake=False, **kwargs):
migrator.sql("DROP TABLE IF EXISTS malware_user_infected")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/149_add_captcha_passed_field_to_iplist.py 0000644 0000000 0000000 00000000555 00000000000 022701 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
migrator.add_fields(
IPList, captcha_passed=pw.BooleanField(null=False, default=False)
)
def rollback(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
migrator.remove_fields(IPList, "captcha_passed")
defence360agent/migrations/149_make_config_inactive.py 0000644 0000000 0000000 00000001613 00000000000 020016 0 ustar """
This migration is needed to cleanup modsec config on cPanel
by removing includes for modsec2.imunify.conf
File is automatically included from /etc/apache2/conf.d, thus no
explicit includes are needed
"""
import logging
import subprocess
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
for conf in ["includes/modsec2.imunify.conf", "modsec2.imunify.conf"]:
try:
subprocess.run(
[
"/usr/sbin/whmapi1",
"modsec_make_config_inactive",
"config={}".format(conf),
],
check=True,
)
except FileNotFoundError:
pass
except Exception:
logger.exception("Failed to make %s inactive", conf)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/150_update_captcha_passed_field_for_iplist_entries.py 0000644 0000000 0000000 00000001202 00000000000 025306 0 ustar import logging
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
IPList = migrator.orm["iplist"]
captcha_pass_condition = (
(IPList.listname == "WHITE")
& (~IPList.full_access)
& (~IPList.manual)
& (IPList.comment.contains("due to successful captcha pass"))
)
try:
q = IPList.update({IPList.captcha_passed: True}).where(
captcha_pass_condition
)
q.execute()
except Exception:
logger.exception("Failed update to captcha_passed field")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/151_change_constraint_for_iplist.py 0000644 0000000 0000000 00000000744 00000000000 021612 0 ustar import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
orm_IPList = migrator.orm["iplist"]
IP_LISTS = ("WHITE", "BLACK", "GRAY", "GRAY_SPLASHSCREEN")
migrator.change_fields(
orm_IPList,
listname=pw.CharField(
null=False,
constraints=[
pw.Check("listname in ('{}')".format("','".join(IP_LISTS)))
],
),
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/152_add_listname_to_primary_key.py 0000644 0000000 0000000 00000006317 00000000000 021433 0 ustar from peewee import (
BooleanField,
CharField,
Check,
CompositeKey,
ForeignKeyField,
IntegerField,
Model,
)
import time
def migrate(migrator, database, fake=False, **kwargs):
orm_IPList = migrator.orm["iplist"]
Country = migrator.orm["country"]
class TMP_IPList(Model):
"""'iplist' db table."""
#: field name
ACTION_TYPE = "action_type"
#: available list names
IP_LISTS = [WHITE, BLACK, GRAY, GRAY_SPLASHSCREEN] = (
"WHITE",
"BLACK",
"GRAY",
"GRAY_SPLASHSCREEN",
)
SCOPE_LOCAL, SCOPE_GROUP = "local", "group"
ip = CharField(null=False)
listname = CharField(
null=False,
constraints=[
Check("listname in ('{}')".format("','".join(IP_LISTS)))
],
)
# null=True to be consistent
# with previously used create table sql
expiration = IntegerField(
default=0, null=True # 0 - never
) # null - the same :(
imported_from = CharField(null=True)
ctime = IntegerField(
null=True, default=lambda: int(time.time()) # those
) # are OK
deep = IntegerField(null=True)
comment = CharField(null=True)
country = ForeignKeyField(Country, null=True)
# actual for not manually whitelisted ips only
# should be ignored for others
captcha_passed = BooleanField(null=False, default=False)
# available only for graylist
manual = BooleanField(null=False, default=True)
# available only for whitelist
full_access = BooleanField(null=True)
# was IP autowhitelisted with `--remote-addr` flag or not
auto_whitelisted = BooleanField(null=True, default=False)
network_address = IntegerField(null=False)
netmask = IntegerField(null=False)
version = IntegerField(null=False)
scope = CharField(
null=True,
constraints=[
Check("scope in ('%s','%s')" % (SCOPE_LOCAL, SCOPE_GROUP))
],
)
class Meta:
db_table = "tmpiplist"
primary_key = CompositeKey(
"network_address", "netmask", "version", "listname"
)
migrator.create_model(TMP_IPList)
# we can't use migrator.rename_table due to bug in peewee_migrate
# https://github.com/klen/peewee_migrate/pull/158
#
# Also, sqlite could mix fields in command
# insert into table select * from other_table
# https://stackoverflow.com/questions/56682520/copy-sqlite-table-with-mixed-column-order
#
fields = [
name
for name in TMP_IPList._meta.sorted_field_names
if name != "country"
] + ["country_id"]
migrator.sql(
"INSERT INTO tmpiplist ({fields}) SELECT {fields} FROM iplist".format(
fields=",".join(fields)
)
)
migrator.sql("DROP TABLE iplist")
migrator.sql("ALTER TABLE tmpiplist RENAME TO iplist")
migrator.add_index(orm_IPList, "listname")
migrator.add_index(orm_IPList, "expiration")
migrator.add_index(orm_IPList, "ip")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/153_migrate_config_default_action.py 0000644 0000000 0000000 00000003106 00000000000 021702 0 ustar import logging
import os
from defence360agent.contracts.config import ConfigFile, IConfig
from defence360agent.utils import log_error_and_ignore
logger = logging.getLogger(__name__)
def migrate(
migrator,
database,
user_config_dir="/etc/imunify360/user_config",
config_file: IConfig = ConfigFile(),
fake=False,
**kwargs
):
if fake:
return
# Migrate root config
migrate_config(config_file)
if not os.path.exists(user_config_dir):
return
# Migrate user configs
for username in os.listdir(user_config_dir):
migrate_config(ConfigFile(username=username))
@log_error_and_ignore()
def migrate_config(config_file: IConfig):
config = config_file.config_to_dict(normalize=False)
if not config:
return
malware_settings = config.setdefault("MALWARE_SCANNING", {})
default_action = malware_settings.get("default_action")
if default_action == "quarantine":
malware_settings["default_action"] = "cleanup"
cleanup_settings = config.setdefault("MALWARE_CLEANUP", {})
keep_original_files = cleanup_settings.get("keep_original_files_days")
if keep_original_files is not None and keep_original_files < 180:
cleanup_settings["keep_original_files_days"] = 180
elif default_action in ("cleanup_or_quarantine", "delete"):
malware_settings["default_action"] = "cleanup"
else:
return
config_file.dict_to_config(
config, overwrite=True, validate=False, normalize=False
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/153_update_incident_name.py 0000644 0000000 0000000 00000000374 00000000000 020027 0 ustar def migrate(migrator, database, fake=False, **kwargs):
migrator.sql(
"UPDATE incident SET name='Login Blocked by cpHulk'"
" where plugin='cphulk' and name=''"
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/154_migrate_config_user_override_malware_actions.py 0000644 0000000 0000000 00000001435 00000000000 025032 0 ustar from defence360agent.contracts.config import (
IConfig,
LocalConfig,
NonBaseMerger,
)
def migrate(*_, config_file: IConfig = LocalConfig(), fake=False, **__):
if fake:
return
config = NonBaseMerger(
names=(NonBaseMerger.get_layer_names())
).configs_to_dict(force_read=True)
permission_settings = config.setdefault("PERMISSIONS", {})
user_override_malware_actions = permission_settings.get(
"user_override_malware_actions"
)
if user_override_malware_actions is None:
permission_settings["user_override_malware_actions"] = True
config_file.dict_to_config(
{"PERMISSIONS": permission_settings},
validate=False,
without_defaults=True,
)
def rollback(*_, **__):
pass
defence360agent/migrations/155_migrate_config_user_override_proactive_defense.py 0000644 0000000 0000000 00000001441 00000000000 025345 0 ustar from defence360agent.contracts.config import (
IConfig,
LocalConfig,
NonBaseMerger,
)
def migrate(*_, config_file: IConfig = LocalConfig(), fake=False, **__):
if fake:
return
config = NonBaseMerger(
names=(NonBaseMerger.get_layer_names())
).configs_to_dict(force_read=True)
permission_settings = config.setdefault("PERMISSIONS", {})
user_override_malware_actions = permission_settings.get(
"user_override_proactive_defense"
)
if user_override_malware_actions is None:
permission_settings["user_override_proactive_defense"] = True
config_file.dict_to_config(
{"PERMISSIONS": permission_settings},
validate=False,
without_defaults=True,
)
def rollback(*_, **__):
pass
defence360agent/migrations/156_remove_default_values_from_config.py 0000644 0000000 0000000 00000001131 00000000000 022613 0 ustar """
Remove values from imunify360.config that are the same as in
imunify360-base.config.
Use stub migration, since for new installations imunify360-base.config
is absent, so this migration is no longer needed in this case.
Otherwise, when the migration has already been applied, no need to reapply.
Keep the migration itself, since it was already released.
To remove schema defaults from imunify360.config
159_remove_defaults_from_local_config migration is used.
"""
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/157_move_i360_modsec_disable_conf.py 0000644 0000000 0000000 00000002231 00000000000 021417 0 ustar import logging
import os
import shutil
from defence360agent.utils import OsReleaseInfo
logger = logging.getLogger(__name__)
_DEBIAN_NEW_MODSEC_DISABLE_FILENAME = (
"/etc/apache2/conf/plesk.conf.d/i360_modsec_disable.conf"
)
_DEBIAN_OLD_MODSEC_DISABLE_FILENAME = (
"/etc/apache2/conf/plesk.conf.d/vhosts/i360_modsec_disable.conf"
)
_NEW_MODSEC_DISABLE_FILENAME = (
"/etc/httpd/conf/plesk.conf.d/i360_modsec_disable.conf"
)
_OLD_MODSEC_DISABLE_FILENAME = (
"/etc/httpd/conf/plesk.conf.d/vhosts/i360_modsec_disable.conf"
)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
if OsReleaseInfo.id_like() & OsReleaseInfo.DEBIAN:
old_file_name = _DEBIAN_OLD_MODSEC_DISABLE_FILENAME
new_file_name = _DEBIAN_NEW_MODSEC_DISABLE_FILENAME
else:
old_file_name = _OLD_MODSEC_DISABLE_FILENAME
new_file_name = _NEW_MODSEC_DISABLE_FILENAME
if os.path.exists(old_file_name):
try:
shutil.move(old_file_name, new_file_name)
except Exception:
logger.exception("Failed move %s", old_file_name)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/158_move_i360_modsec_disable_conf_symlink.py 0000644 0000000 0000000 00000003306 00000000000 023172 0 ustar import logging
import os
import shutil
from defence360agent.utils import OsReleaseInfo
logger = logging.getLogger(__name__)
_DEBIAN_MODSEC_DISABLE_SYMLINK_PATH = (
"/etc/apache2/plesk.conf.d/i360_modsec_disable.conf"
)
_DEBIAN_MODSEC_DISABLE_SYMLINK = (
"/etc/apache2/conf-enabled/zz999_modsec2.imunify_disable.conf"
)
_MODSEC_DISABLE_SYMLINK_PATH = (
"/etc/httpd/conf/plesk.conf.d/i360_modsec_disable.conf"
)
_MODSEC_DISABLE_SYMLINK = (
"/etc/httpd/conf.d/zz999_modsec2.imunify_disable.conf"
)
_DEBIAN_NEW_MODSEC_DISABLE_FILENAME = (
"/etc/apache2/plesk.conf.d/i360_modsec_disable.conf"
)
_DEBIAN_OLD_MODSEC_DISABLE_FILENAME = (
"/etc/apache2/conf/plesk.conf.d/i360_modsec_disable.conf"
)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
old_file_name = None
new_file_name = None
if OsReleaseInfo.id_like() & OsReleaseInfo.DEBIAN:
old_file_name = _DEBIAN_OLD_MODSEC_DISABLE_FILENAME
new_file_name = _DEBIAN_NEW_MODSEC_DISABLE_FILENAME
symlink_path = _DEBIAN_MODSEC_DISABLE_SYMLINK_PATH
symlink = _DEBIAN_MODSEC_DISABLE_SYMLINK
else:
symlink_path = _MODSEC_DISABLE_SYMLINK_PATH
symlink = _MODSEC_DISABLE_SYMLINK
if old_file_name and os.path.exists(old_file_name):
try:
shutil.move(old_file_name, new_file_name)
except Exception:
logger.exception("Failed move %s", old_file_name)
if os.path.islink(symlink):
try:
os.unlink(symlink)
os.symlink(symlink_path, symlink)
except Exception:
logger.exception("Failed change symlink %s", symlink)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/159_remove_defaults_from_local_config.py 0000644 0000000 0000000 00000001625 00000000000 022604 0 ustar """
Remove all default values from main config
(/etc/sysconfig/imunify360/imunify360.config).
See DEF-17214 for details.
"""
import logging
from defence360agent.contracts.config import LocalConfig
from defence360agent.contracts.config_provider import exclude_equals
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
local_config = LocalConfig()
local_conf = local_config.config_to_dict(force_read=True)
defaults = local_config.normalize({}, without_defaults=False)
non_default_conf = exclude_equals(
main_conf=local_conf, base_conf=defaults
)
local_config.dict_to_config(non_default_conf, overwrite=True)
except Exception as exc:
logger.error("Can't overwrite local config, reason: %s", exc)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/160_remove_quarantine.py 0000644 0000000 0000000 00000005750 00000000000 017415 0 ustar import logging
import os
import pwd
import shutil
from glob import glob
from pathlib import Path
from typing import Tuple, Union
from peewee import CharField, Model
# Avoiding imav.malwarelib.utils.quar_fileops imports
from defence360agent.model.simplification import FilenameField
from defence360agent.subsys.panels.hosting_panel import HostingPanel
logger = logging.getLogger(__name__)
QUAR_NAME = ".imunify.quarantined"
DEF_QUAR = "/var/imunify360"
QUARANTINED = "quarantined"
QUARANTINE_PARENTS = [DEF_QUAR, "/var/www", "/home*"]
def get_model(db):
"""
Model stub for migration because we can't use migrator.orm[] due to
custom field FilenameField
"""
class MalwareHit(Model):
class Meta:
db_table = "malware_hits"
database = db
orig_file = FilenameField(null=False)
status = CharField()
return MalwareHit
def migrate(_migrator, database, fake=False, delete_function=None, *_, **__):
if fake:
return
# For unit-tests
delete_function = delete_function or delete_quarantine_folder
model = get_model(database)
quarantined = model.select().where(model.status == QUARANTINED)
# Remove all known quarantine storages
for hit in quarantined:
path_to_delete, _ = find_quar(hit.orig_file)
delete_function(path_to_delete)
hit.delete_instance()
# Remove possible quarantine storages
for parent in QUARANTINE_PARENTS:
for path_to_delete in glob(os.path.join(parent, QUAR_NAME)):
delete_function(path_to_delete)
def rollback(*_, **__):
pass
def delete_quarantine_folder(quarantine_path: Union[str, Path]):
quarantine_path = Path(quarantine_path)
if (
quarantine_path.name == QUAR_NAME
and quarantine_path == quarantine_path.resolve()
):
logger.info("Deleting quarantine folder %s", quarantine_path)
shutil.rmtree(quarantine_path, ignore_errors=True)
def find_quar(source: str) -> Tuple[Path, Path]:
"""
Find file in quarantine by source path.
This function is copied from agent code since it is to be removed.
"""
file = Path(source)
default_result = Path(DEF_QUAR) / QUAR_NAME, file.relative_to(Path("/"))
user = None
parent = None
for path in file.parents:
try:
user = pwd.getpwuid(path.stat().st_uid)
except FileNotFoundError:
continue
except KeyError:
return default_result
else:
parent = path
break
# Prevent storing quarantine in '/'
if user is None or user.pw_name == "root":
return default_result
resolved_place = parent.resolve() / file.relative_to(parent)
try:
base_dir = HostingPanel().base_home_dir(user.pw_dir)
except (FileNotFoundError, RuntimeError):
return default_result
try:
relative = resolved_place.relative_to(base_dir)
except ValueError:
return default_result
return base_dir / QUAR_NAME, relative
defence360agent/migrations/160_unmount_sigs_v1.py 0000644 0000000 0000000 00000002736 00000000000 017032 0 ustar """Unmount sigs/v1 from CageFS."""
import logging
import subprocess
from pathlib import Path
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs): # NOSONAR python:S1142
if fake:
return
try:
from defence360agent.subsys import clcagefs
filename = clcagefs.CAGEFS_MP_FILENAME
except ImportError:
filename = "/etc/cagefs/cagefs.mp"
try:
text = Path(filename).read_text()
except FileNotFoundError: # indication of a non-cagefs system
return # nothing to do
except Exception as e: # NOSONAR pylint:W0703
logger.exception("Can't read %s, reason: %s", filename, e)
return
else:
if "/var/imunify360/files/sigs/v1" not in text:
return # nothing to do
try:
subprocess.check_call(
r"sed -i.im360-bak '\:/var/imunify360/files/sigs/v1:d' %s"
" && grep /var/imunify360/files/sigs/v1 /proc/mounts"
" | awk '{ print $2 }' | xargs -rn1 umount"
" && /usr/sbin/cagefsctl --wait-lock --unmount-all"
" && /usr/sbin/cagefsctl --wait-lock --force-update-etc"
" && /usr/sbin/cagefsctl --wait-lock --remount-all" % (filename,),
shell=True,
executable="/bin/bash",
)
except Exception as e: # NOSONAR pylint:W0703
logger.exception("Can't unmount sigs/v1, reason: %s", e)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/161_remove_ea4_main_local_conf.py 0000644 0000000 0000000 00000003203 00000000000 021072 0 ustar """
Remove /var/cpanel/templates/apache2_4/ea4_main.local file
introduced by imunify360. This file was used to change apache log format
(%h->%a), when imunify360 installed remote_ip apache module.
Since this file is created once it can be outdated after updating cPanel (
in case if /var/cpanel/templates/apache2_4/ea4_main.default also updated).
See DEF-9641 for details.
"""
import logging
from pathlib import Path
import subprocess
from defence360agent.utils import antivirus_mode
logger = logging.getLogger(__name__)
EA4_MAIN_LOCAL_PATH = Path("/var/cpanel/templates/apache2_4/ea4_main.local")
EA4_MAIN_DEFAULT_PATH = Path(
"/var/cpanel/templates/apache2_4/ea4_main.default"
)
NEW = "%a "
OLD = "%h "
@antivirus_mode.skip
def migrate(
migrator,
database,
fake=False,
default_conf_path=EA4_MAIN_DEFAULT_PATH,
local_conf_path=EA4_MAIN_LOCAL_PATH,
**kwargs
):
if fake:
return
try:
from im360.subsys.panels.cpanel import cPanel
except ImportError:
return
try:
if cPanel.is_installed() and local_conf_path.exists():
origin_text = default_conf_path.read_text()
restored_text = local_conf_path.read_text().replace(NEW, OLD)
# assume that these changes were made by imunify360
if restored_text == origin_text:
# remove file and rebuild confs
local_conf_path.unlink()
subprocess.check_call(cPanel.REBUILD_HTTPDCONF_CMD)
except Exception as exc:
logger.error("Can't remove %s, reason: %s", local_conf_path, exc)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/162_add_resource_type.py 0000644 0000000 0000000 00000003450 00000000000 017366 0 ustar import logging
import peewee as pw
from defence360agent.utils import importer
MalwareScanResourceType = importer.get(
module="imav.malwarelib.config",
name="MalwareScanResourceType",
default=None,
)
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
MalwareHits = migrator.orm["malware_hits"]
migrator.add_fields(
MalwareHits,
resource_type=pw.CharField(
null=False,
default=MalwareScanResourceType.FILE.value,
constraints=[
pw.Check(
"resource_type in {}".format(
(
MalwareScanResourceType.DB.value,
MalwareScanResourceType.FILE.value,
)
)
)
],
),
app_name=pw.CharField(null=True),
db_host=pw.CharField(null=True),
db_port=pw.CharField(null=True),
db_name=pw.CharField(null=True),
)
MalwareScan = migrator.orm["malware_scans"]
migrator.add_fields(
MalwareScan,
resource_type=pw.CharField(
null=False,
default=MalwareScanResourceType.FILE.value,
constraints=[
pw.Check(
"resource_type in {}".format(
(
MalwareScanResourceType.DB.value,
MalwareScanResourceType.FILE.value,
)
)
)
],
),
)
migrator.rename_field(MalwareScan, "total_files", "total_resources")
def rollback(migrator, database, fake=False, **kwargs):
MalwareHits = migrator.orm["malware_hits"]
migrator.remove_fields(MalwareHits, "resource_type")
defence360agent/migrations/163_drop_malware_scanned_stat.py 0000644 0000000 0000000 00000000377 00000000000 021076 0 ustar def migrate(migrator, database, fake=False, **kwargs):
try:
model = migrator.orm["malware_scanned_stat"]
migrator.remove_model(model)
except KeyError:
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/164_add_resource_type_to_ignore.py 0000644 0000000 0000000 00000002173 00000000000 021436 0 ustar import time
from peewee import CharField, Check, CompositeKey, IntegerField, Model
class TMPMalwareIgnorePath(Model):
class Meta:
db_table = "tmp_malware_ignore_path"
primary_key = CompositeKey("path", "resource_type")
CACHE = None
path = CharField()
resource_type = CharField(
null=False, constraints=[Check("resource_type in ('file','db')")]
)
added_date = IntegerField(null=False, default=lambda: int(time.time()))
def migrate(migrator, *_, fake=False, **__):
change_malware_ignore_path_model(migrator)
def change_malware_ignore_path_model(migrator):
migrator.create_model(TMPMalwareIgnorePath)
migrator.sql(
"INSERT INTO tmp_malware_ignore_path(path,added_date,resource_type) "
"SELECT path,added_date,'file' FROM malware_ignore_path"
)
migrator.sql("DROP TABLE malware_ignore_path")
migrator.sql(
"ALTER TABLE tmp_malware_ignore_path RENAME TO malware_ignore_path"
)
migrator.sql(
"CREATE INDEX malware_ignore_path_resource_type "
"ON malware_ignore_path (resource_type)"
)
def rollback(*_, **__):
pass
defence360agent/migrations/165_add_db_fields_to_malware_history.py 0000644 0000000 0000000 00000002021 00000000000 022400 0 ustar from peewee import CharField, Check
from defence360agent.utils import importer
MalwareScanResourceType = importer.get(
module="imav.malwarelib.config",
name="MalwareScanResourceType",
default=None,
)
def migrate(migrator, *_, fake=False, **__):
malware_history = migrator.orm["malware_history"]
migrator.add_fields(
malware_history,
app_name=CharField(null=True),
resource_type=CharField(
null=False,
constraints=[
Check(
"resource_type in {}".format(
(
MalwareScanResourceType.DB.value,
MalwareScanResourceType.FILE.value,
)
)
)
],
default=MalwareScanResourceType.FILE.value,
),
)
def rollback(migrator, *_, fake=False, **__):
malware_history = migrator.orm["malware_history"]
migrator.remove_fields(malware_history, "app_name", "resource_type")
defence360agent/migrations/166_add_id_field_to_malware_ignore_path.py 0000644 0000000 0000000 00000001721 00000000000 023031 0 ustar from time import time
from peewee import CharField, Check, IntegerField, Model, PrimaryKeyField
class MalwareIgnorePath(Model):
class Meta:
db_table = "malware_ignore_path"
indexes = ((("path", "resource_type"), True),) # True refers to unique
CACHE = None
id = PrimaryKeyField()
path = CharField()
resource_type = CharField(
null=False, constraints=[Check("resource_type in ('file','db')")]
)
added_date = IntegerField(null=False, default=lambda: int(time()))
def migrate(migrator, *_, fake=False, **__):
migrator.sql(
"ALTER TABLE malware_ignore_path RENAME TO malware_ignore_path_old;"
)
migrator.create_model(MalwareIgnorePath)
migrator.sql(
"INSERT INTO malware_ignore_path(path,added_date,resource_type) "
"SELECT path,added_date,resource_type FROM malware_ignore_path_old"
)
migrator.sql("DROP TABLE malware_ignore_path_old;")
def rollback(*_, **__):
pass
defence360agent/migrations/167_remote_iplist.py 0000644 0000000 0000000 00000001766 00000000000 016562 0 ustar from peewee import CharField, Model, IntegerField, CompositeKey
class IPListRecord(Model):
network_address = IntegerField(null=False)
netmask = IntegerField(null=False)
version = IntegerField(null=False)
iplist_id = IntegerField(null=False)
class Meta:
db_table = "iplistrecord"
primary_key = CompositeKey(
"network_address", "netmask", "version", "iplist_id"
)
class IPListPurpose(Model):
purpose = CharField(null=False)
iplist_id = IntegerField(null=False)
class Meta:
db_table = "iplistpurpose"
primary_key = CompositeKey("purpose", "iplist_id")
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(IPListRecord)
migrator.create_model(IPListPurpose)
def rollback(migrator, database, fake=False, **kwargs):
IPListRecord = migrator.orm["iplistrecord"]
migrator.remove_model(IPListRecord)
IPListPurpose = migrator.orm["iplistpurpose"]
migrator.remove_model(IPListPurpose)
defence360agent/migrations/168_add_icontact_throttle.py 0000644 0000000 0000000 00000001560 00000000000 020235 0 ustar from peewee import CharField, Check, IntegerField, Model
from defence360agent.contracts.config import IContactMessageType
class IContactThrottle(Model):
class Meta:
db_table = "icontact_throttle"
message_type = CharField(
primary_key=True,
constraints=[
Check(
"message_type in {}".format(
(
str(IContactMessageType.MALWARE_FOUND),
str(IContactMessageType.SCAN_NOT_SCHEDULED),
)
)
)
],
)
timestamp = IntegerField(default=0)
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(IContactThrottle)
def rollback(migrator, database, fake=False, **kwargs):
IContactThrottle = migrator.orm["icontact_throttle"]
migrator.remove_model(IContactThrottle)
defence360agent/migrations/169_add_record_to_throttle_scan_not_schedule_events.py 0000644 0000000 0000000 00000001173 00000000000 025536 0 ustar import time
from defence360agent.contracts.config import IContactMessageType
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
IContactThrotle = migrator.orm["icontact_throttle"]
IContactThrotle.create(
message_type=IContactMessageType.SCAN_NOT_SCHEDULED,
timestamp=time.time() + (7 * 86400),
)
def rollback(migrator, database, fake=False, **kwargs):
if fake:
return
IContactThrottle = migrator.orm["icontact_throttle"]
IContactThrottle.delete().where(
IContactThrottle.message_type == IContactMessageType.SCAN_NOT_SCHEDULED
).execute()
defence360agent/migrations/170_add_db_fields_to_malware_history.py 0000644 0000000 0000000 00000000737 00000000000 022410 0 ustar from peewee import CharField
def migrate(migrator, *_, fake=False, **__):
malware_history = migrator.orm["malware_history"]
migrator.add_fields(
malware_history,
db_host=CharField(null=True),
db_port=CharField(null=True),
db_name=CharField(null=True),
)
def rollback(migrator, *_, fake=False, **__):
malware_history = migrator.orm["malware_history"]
migrator.remove_fields(malware_history, "db_host", "db_port", "db_name")
defence360agent/migrations/180_move_captcha_configs.py 0000644 0000000 0000000 00000000430 00000000000 020022 0 ustar """
No need to rollback captcha keys config because WebshieldCaptchaKeys plugin
recreates it on the agent start so just stubbing the migration
"""
def migrate(migrator, database, fake=False, **kwargs):
pass
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/182_remove_constraints_from_icontact_throttle.py 0000644 0000000 0000000 00000001621 00000000000 024446 0 ustar """
Drop constrains for icontact_throttle.message_type, since correlation server
can set any type (DEF-19971).
"""
from peewee import CharField, IntegerField, Model
class IContactThrottle(Model):
class Meta:
db_table = "icontact_throttle"
message_type = CharField(primary_key=True)
#: The last time we sent a notification about :attr:`message_type`
timestamp = IntegerField(default=0)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
migrator.sql(
"ALTER TABLE icontact_throttle RENAME TO icontact_throttle_old"
)
migrator.create_model(IContactThrottle)
migrator.sql(
"INSERT INTO icontact_throttle(message_type,timestamp) "
"SELECT message_type,timestamp FROM icontact_throttle_old"
)
migrator.sql("DROP TABLE icontact_throttle_old")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/183_add_user_field_to_malware_scans.py 0000644 0000000 0000000 00000000657 00000000000 022231 0 ustar from peewee import CharField
def migrate(migrator, *_, fake=False, **__):
if fake:
return
malware_scans = migrator.orm["malware_scans"]
migrator.add_fields(
malware_scans,
initiator=CharField(null=True),
)
def rollback(migrator, *_, fake=False, **__):
if fake:
return
malware_scans = migrator.orm["malware_scans"]
migrator.remove_fields(malware_scans, "initiator")
defence360agent/migrations/184_create_a_table_for_secure_site_permissions.py 0000644 0000000 0000000 00000000717 00000000000 024502 0 ustar import peewee as pw
class SecureSite(pw.Model):
class Meta:
db_table = "secure_site"
user = pw.CharField(unique=True)
subscription_type = pw.TextField(
null=False,
constraints=[pw.Check("subscription_type in ('basic','pro')")],
default="basic",
)
def migrate(migrator, _db, fake=False, **__):
if fake:
return
migrator.create_model(SecureSite)
def rollback(*_, **__):
"""Not supported"""
defence360agent/migrations/185_delete_all_secure_site_id.py 0000644 0000000 0000000 00000001017 00000000000 021030 0 ustar import logging
from pathlib import Path
logger = logging.getLogger(__name__)
def migrate(migrator, _db, fake=False, **__):
if fake:
return
try:
id_files = Path("/").glob("home*/*/.secure_site_id")
for id_file in id_files:
if not id_file.is_symlink():
id_file.unlink(missing_ok=True)
except Exception:
logger.exception(
"An exception occurred while deleting .secure_site_id files"
)
def rollback(*_, **__):
"""Not supported"""
defence360agent/migrations/186_add_user_field_to_icontact_throttle.py 0000644 0000000 0000000 00000003076 00000000000 023144 0 ustar from peewee import CompositeKey, Model, CharField, IntegerField
def migrate(migrator, *_, fake=False, **__):
if fake:
return
icontact_throttle = migrator.orm["icontact_throttle"]
class TmpIContactThrottle(Model):
class Meta:
db_table = "tmp_icontact_throttle"
primary_key = CompositeKey("message_type", "user")
message_type = CharField()
user = CharField(null=True)
timestamp = IntegerField(default=0)
migrator.add_fields(
icontact_throttle,
user=CharField(null=True),
)
# change the primary key
migrator.create_model(TmpIContactThrottle)
migrator.sql(
"INSERT INTO tmp_icontact_throttle (message_type, user, timestamp) "
"SELECT message_type, user, timestamp FROM icontact_throttle"
)
migrator.sql("DROP TABLE icontact_throttle")
migrator.sql(
"ALTER TABLE tmp_icontact_throttle RENAME TO icontact_throttle",
)
def rollback(migrator, *_, fake=False, **__):
if fake:
return
class TmpIContactThrottle(Model):
class Meta:
db_table = "icontact_throttle"
message_type = CharField(primary_key=True)
timestamp = IntegerField(default=0)
migrator.create_model(TmpIContactThrottle)
migrator.sql(
"INSERT INTO tmp_icontact_throttle (message_type, timestamp) "
"SELECT message_type, timestamp FROM icontact_throttle"
)
migrator.sql("DROP TABLE icontact_throttle")
migrator.sql(
"ALTER TABLE tmp_icontact_throttle RENAME TO icontact_throttle",
)
defence360agent/migrations/187_fix_scan_unserialization.py 0000644 0000000 0000000 00000003017 00000000000 020766 0 ustar """
Used to fix issue with inability to unserialize stored scans.
See DEF-23121 for details.
"""
import importlib
import logging
import pickle
from pathlib import Path
logger = logging.getLogger(__name__)
SCANS_PATH = Path("/var/imunify360/aibolit/scans.pickle")
IM360_MALWARELIB = "im360.malwarelib"
AV_MALWARELIB = "imav.malwarelib"
class AVUnpickler(pickle.Unpickler):
def find_class(self, module, name):
try:
return super().find_class(module, name)
except ModuleNotFoundError:
if module.startswith(IM360_MALWARELIB):
av_module = importlib.import_module(
module.replace(IM360_MALWARELIB, AV_MALWARELIB)
)
return getattr(av_module, name)
raise
def dump(obj, path):
temp_path = path.with_name(path.name + ".temp")
with temp_path.open("wb") as f:
pickle.dump(obj, f)
# to avoid the possibility of leaving a broken file,
# if any errors occurred above
temp_path.replace(path)
def migrate(migrator, *_, fake=False, **__):
if fake or not SCANS_PATH.exists():
return
if IM360_MALWARELIB.encode() in SCANS_PATH.read_bytes():
try:
with SCANS_PATH.open("rb") as f:
obj = AVUnpickler(f).load()
except Exception as exc:
logger.exception(
"Failed to load pickle scans %s: %s", SCANS_PATH, exc
)
else:
dump(obj, SCANS_PATH)
def rollback(migrator, *_, fake=False, **__):
pass
defence360agent/migrations/188_add_protection_status_field_myimunify.py 0000644 0000000 0000000 00000000672 00000000000 023553 0 ustar from peewee import BooleanField, CharField, Model
class MyImunify(Model):
class Meta:
db_table = "myimunify"
user = CharField(unique=True)
protection = BooleanField(null=False, default=False)
def migrate(migrator, _db, fake=False, **__):
if fake:
return
migrator.create_model(MyImunify)
def rollback(migrator, _db, fake=False, **__):
if fake:
return
migrator.remove_model(MyImunify)
defence360agent/migrations/189_add_messages_to_send_nr.py 0000644 0000000 0000000 00000000713 00000000000 020527 0 ustar from peewee import FloatField, Model, BlobField
class MessageToSend(Model):
class Meta:
db_table = "messages_to_send_nr"
timestamp = FloatField(null=False)
message = BlobField(null=False)
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(MessageToSend)
def rollback(migrator, database, fake=False, **kwargs):
MessageToSend = migrator.orm["messages_to_send"]
migrator.drop_model(MessageToSend)
defence360agent/migrations/190_add_analyst_cleanup_request_table.py 0000644 0000000 0000000 00000002170 00000000000 022576 0 ustar from peewee import (
Model,
AutoField,
CharField,
TextField,
TimestampField,
Check,
)
from datetime import datetime, timezone
class AnalystCleanupRequest(Model):
"""
Model for storing analyst cleanup requests.
Tracks request details and status for each cleanup request submitted.
"""
class Meta:
db_table = "analyst_cleanup_requests"
id = AutoField()
username = CharField(null=False)
zendesk_id = CharField(null=False)
ticket_link = TextField(null=False)
created_at = TimestampField(null=False, default=datetime.now(timezone.utc))
status = CharField(
null=False,
default="pending",
constraints=[Check("status in ('pending','in_progress','completed')")],
)
last_updated = TimestampField(
null=False, default=datetime.now(timezone.utc)
)
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(AnalystCleanupRequest)
def rollback(migrator, database, fake=False, **kwargs):
analyst_cleanup_request = migrator.orm["analyst_cleanup_requests"]
migrator.drop_model(analyst_cleanup_request)
defence360agent/migrations/191_create_wordpress_incident_table.py 0000644 0000000 0000000 00000002466 00000000000 022275 0 ustar """Create wordpress_incident table for WordPress CVE protection incidents.
This migration creates a dedicated table for WordPress incidents rather than
using the generic incident table. This allows for better separation of concerns
and cleaner data model.
"""
import peewee as pw
from playhouse.sqlite_ext import JSONField
class WordpressIncident(pw.Model):
id = pw.IntegerField(primary_key=True, null=True)
plugin = pw.CharField(null=True)
rule = pw.CharField(null=True)
timestamp = pw.FloatField(null=True)
retries = pw.IntegerField(null=True)
severity = pw.IntegerField(null=True)
name = pw.CharField(null=True)
description = pw.TextField(null=True)
abuser = pw.CharField(null=True)
country = pw.CharField(null=True, column_name="country_id")
domain = pw.TextField(null=True, default=None)
extra_info = JSONField(null=True)
sent_to_server = pw.BooleanField(null=False, default=False)
class Meta:
db_table = "wordpress_incident"
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(WordpressIncident)
# Add index on timestamp for performance
migrator.add_index(WordpressIncident, "timestamp", unique=False)
def rollback(migrator, database, fake=False, **kwargs):
migrator.remove_model(WordpressIncident, cascade=True)
defence360agent/migrations/192_add_wordpress_incident_unique_index.py 0000644 0000000 0000000 00000002123 00000000000 023157 0 ustar """Add unique composite index to wordpress_incident table for deduplication.
This migration adds a unique index on the fields used to identify duplicate
incidents (abuser, name, plugin, rule, severity, domain), similar to the
aggregation key used in the resident agent's aggregate plugin.
"""
def migrate(migrator, database, fake=False, **kwargs):
"""Add unique composite index for incident deduplication."""
WordpressIncident = migrator.orm["wordpress_incident"]
# Create unique index on the aggregate key fields
# This allows ON CONFLICT handling for incident deduplication
migrator.add_index(
WordpressIncident,
"abuser",
"name",
"plugin",
"rule",
"severity",
"domain",
unique=True,
)
def rollback(migrator, database, fake=False, **kwargs):
"""Remove the unique composite index."""
WordpressIncident = migrator.orm["wordpress_incident"]
migrator.drop_index(
WordpressIncident,
"abuser",
"name",
"plugin",
"rule",
"severity",
"domain",
)
defence360agent/migrations/193_remove_sent_to_server_from_wordpress_incident.py 0000644 0000000 0000000 00000001115 00000000000 025314 0 ustar """Remove sent_to_server column from wordpress_incident table.
The sent_to_server field is no longer needed for WordPress incident tracking.
"""
import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
WordpressIncident = migrator.orm["wordpress_incident"]
migrator.remove_fields(WordpressIncident, "sent_to_server")
def rollback(migrator, database, fake=False, **kwargs):
WordpressIncident = migrator.orm["wordpress_incident"]
migrator.add_fields(
WordpressIncident,
sent_to_server=pw.BooleanField(null=False, default=False),
)
defence360agent/migrations/194_add_wp_disabled_rules.py 0000644 0000000 0000000 00000001674 00000000000 020200 0 ustar """Add wp_disabled_rules table for WordPress-specific disabled rules.
This table stores disabled WordPress protection rules with a scope-based design
supporting global and domain-level disables.
"""
import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
class WPDisabledRule(pw.Model):
class Meta:
db_table = "wp_disabled_rules"
indexes = ((("rule_id", "scope", "scope_value"), True),)
id = pw.PrimaryKeyField()
rule_id = pw.CharField(null=False)
scope = pw.CharField(null=False)
scope_value = pw.CharField(null=True)
disabled_at = pw.FloatField(null=False)
source = pw.CharField(null=False)
created_by_user_id = pw.IntegerField(null=False)
migrator.create_model(WPDisabledRule)
def rollback(migrator, database, fake=False, **kwargs):
WPDisabledRule = migrator.orm["wp_disabled_rules"]
migrator.remove_model(WPDisabledRule)
defence360agent/migrations/194_create_nonprivileged_config.py 0000644 0000000 0000000 00000001434 00000000000 021410 0 ustar """
Create imunify360-merged-nonprivileged.config with settings needed by non-root processes.
"""
import logging
from defence360agent.contracts.config import Merger
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
# Trigger a full config merge which will:
# - Write nonprivileged settings to imunify360-merged-nonprivileged.config
# - Write all settings to imunify360-merged.config
Merger.update_merged_config()
logger.info("Successfully created nonprivileged config")
except Exception as exc:
logger.error(
"Failed to create nonprivileged config: %s",
exc,
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/195_create_wordpress_site.py 0000644 0000000 0000000 00000001155 00000000000 020273 0 ustar """Create wordpress_site table.
migrator.create_model() emits CREATE TABLE IF NOT EXISTS, so this is a
no-op on installs where imav/014 (now retained as a no-op) had already
created the table.
"""
from peewee import IntegerField, CharField, Model
class WordpressSite(Model):
class Meta:
db_table = "wordpress_site"
docroot = CharField(primary_key=True, null=False)
domain = CharField(null=False)
uid = IntegerField(null=False)
def migrate(migrator, database, fake=False, **kwargs):
migrator.create_model(WordpressSite)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/196_add_disabled_rules_sync_ts.py 0000644 0000000 0000000 00000001067 00000000000 021232 0 ustar """Add disabled_rules_sync_ts field to wordpress_site table.
Tracks when disabled-rules.php was last written for each site.
"""
from peewee import FloatField
def migrate(migrator, database, fake=False, **kwargs):
WordpressSite = migrator.orm["wordpress_site"]
migrator.add_fields(
WordpressSite,
disabled_rules_sync_ts=FloatField(null=True, default=None),
)
def rollback(migrator, database, fake=False, **kwargs):
WordpressSite = migrator.orm["wordpress_site"]
migrator.remove_fields(WordpressSite, "disabled_rules_sync_ts")
defence360agent/migrations/197_add_wordpress_site_manually_deleted_at.py 0000644 0000000 0000000 00000001245 00000000000 023636 0 ustar """Add manually_deleted_at column to wordpress_site table.
The database.get_columns() guard makes this idempotent on installs where
imav/015 (now retained as a no-op) had already added the column.
"""
from peewee import TimestampField
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
columns = [col.name for col in database.get_columns("wordpress_site")]
if "manually_deleted_at" not in columns:
WordpressSite = migrator.orm["wordpress_site"]
migrator.add_columns(
WordpressSite, manually_deleted_at=TimestampField(null=True)
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/198_add_wordpress_site_version.py 0000644 0000000 0000000 00000001211 00000000000 021321 0 ustar """Add version column to wordpress_site table.
The database.get_columns() guard makes this idempotent on installs where
imav/017 (now retained as a no-op) had already added the column.
"""
from peewee import CharField
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
columns = [col.name for col in database.get_columns("wordpress_site")]
if "version" not in columns:
WordpressSite = migrator.orm["wordpress_site"]
migrator.add_columns(
WordpressSite, version=CharField(default="1.0.0", null=False)
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/199_proactive_log_permission.py 0000644 0000000 0000000 00000002754 00000000000 021013 0 ustar """Allow `log` as a proactive feature-management permission value.
Relaxes the CHECK constraint on
``feature_management_permissions.proactive`` from
``(NA, FULL)`` to ``(NA, LOG, FULL)``. SQLite cannot alter CHECK
constraints in place, so the table is recreated.
DEF-42523.
"""
from peewee import CharField, Check, Model, TextField
from defence360agent.feature_management.constants import (
AV_REPORT,
FULL,
LOG,
NA,
)
class FeatureManagementPerms(Model):
class Meta:
db_table = "feature_management_permissions"
user = CharField(unique=True)
proactive = TextField(
null=False,
constraints=[
Check("proactive in ('{}','{}','{}')".format(NA, LOG, FULL))
],
default=FULL,
)
av = TextField(
null=False,
constraints=[
Check("av in ('{}','{}','{}')".format(NA, AV_REPORT, FULL))
],
default=AV_REPORT,
)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
migrator.sql(
"ALTER TABLE feature_management_permissions "
"RENAME TO feature_management_permissions_old"
)
migrator.create_model(FeatureManagementPerms)
migrator.sql(
"INSERT INTO feature_management_permissions(user, proactive, av) "
"SELECT user, proactive, av FROM feature_management_permissions_old"
)
migrator.sql("DROP TABLE feature_management_permissions_old")
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/200_seed_per_user_waf_enabled.py 0000644 0000000 0000000 00000004147 00000000000 021016 0 ustar import asyncio
import logging
from defence360agent.contracts.config import (
UserConfig,
UserType,
choose_value_from_config,
)
from defence360agent.utils import importer
panel_users = importer.get(
module="imav.malwarelib.utils.user_list",
name="panel_users",
default=None,
)
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake or panel_users is None:
return
loop = asyncio.new_event_loop()
asyncio.set_event_loop(loop)
try:
try:
users = loop.run_until_complete(panel_users())
except Exception:
logger.exception(
"Failed to enumerate panel users for waf_enabled seed"
)
return
for entry in users:
try:
username = entry["user"]
except (KeyError, TypeError) as e:
logger.warning(
"Skipping malformed panel entry %r during waf_enabled"
" seed: %s",
entry,
e,
)
continue
try:
_, source = choose_value_from_config(
"WORDPRESS",
"waf_enabled",
username=username,
)
if source != UserType.ROOT:
continue
except Exception as e:
logger.warning(
"Failed to read waf_enabled for user %s while seeding: %s",
username,
e,
)
continue
try:
UserConfig(username=username).dict_to_config(
{"WORDPRESS": {"waf_enabled": True}},
without_defaults=True,
)
except Exception as e:
logger.warning(
"Failed to seed WORDPRESS.waf_enabled for user %s: %s",
username,
e,
)
finally:
loop.close()
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/201_rerender_nonprivileged_config.py 0000644 0000000 0000000 00000001102 00000000000 021730 0 ustar """
Re-render imunify360-merged-nonprivileged.config so the newly-split
MALWARE_SCANNING.enable_scan_modsec key lands on upgrade.
"""
import logging
from defence360agent.contracts.config import Merger
logger = logging.getLogger(__name__)
def migrate(migrator, database, fake=False, **kwargs):
if fake:
return
try:
Merger.update_merged_config()
except Exception as exc:
logger.error(
"Failed to re-render nonprivileged config: %s",
exc,
)
def rollback(migrator, database, fake=False, **kwargs):
pass
defence360agent/migrations/202_add_wordpress_incident_bucket.py 0000644 0000000 0000000 00000004132 00000000000 021731 0 ustar """Aggregate WordPress incidents per minute instead of forever."""
import peewee as pw
OLD_UNIQUE_KEY = ("abuser", "name", "plugin", "rule", "severity", "domain")
NEW_UNIQUE_KEY = OLD_UNIQUE_KEY + ("bucket",)
def migrate(migrator, database, fake=False, **kwargs):
WordpressIncident = migrator.orm["wordpress_incident"]
migrator.add_fields(WordpressIncident, bucket=pw.IntegerField(null=True))
# A NULL bucket is distinct from every other NULL, which would opt
# existing rows out of deduplication entirely.
migrator.sql(
"UPDATE wordpress_incident SET bucket = CAST(timestamp / 60 AS"
" INTEGER) WHERE bucket IS NULL AND timestamp IS NOT NULL"
)
migrator.drop_index(WordpressIncident, *OLD_UNIQUE_KEY)
migrator.add_index(WordpressIncident, *NEW_UNIQUE_KEY, unique=True)
# Duplicate of wordpress_incident_timestamp, left behind by migration 191.
migrator.sql("DROP INDEX IF EXISTS wordpressincident_timestamp")
def rollback(migrator, database, fake=False, **kwargs):
WordpressIncident = migrator.orm["wordpress_incident"]
key = ", ".join(OLD_UNIQUE_KEY)
same_key = " AND ".join(
f"dup.{column} IS wordpress_incident.{column}"
for column in OLD_UNIQUE_KEY
)
migrator.sql(
"CREATE INDEX IF NOT EXISTS wordpressincident_timestamp"
" ON wordpress_incident (timestamp)"
)
migrator.drop_index(WordpressIncident, *NEW_UNIQUE_KEY)
# Windows of the same attack are separate rows now, which the old index
# forbids. Fold them back into one before it is restored.
migrator.sql(
"UPDATE wordpress_incident SET"
" retries = (SELECT SUM(dup.retries) FROM wordpress_incident dup"
f" WHERE {same_key}),"
" timestamp = (SELECT MIN(dup.timestamp) FROM wordpress_incident dup"
f" WHERE {same_key})"
)
migrator.sql(
"DELETE FROM wordpress_incident WHERE id NOT IN"
f" (SELECT MIN(id) FROM wordpress_incident GROUP BY {key})"
)
migrator.remove_fields(WordpressIncident, "bucket")
migrator.add_index(WordpressIncident, *OLD_UNIQUE_KEY, unique=True)
defence360agent/migrations/203_add_wordpress_incident_unsent_retries.py 0000644 0000000 0000000 00000002514 00000000000 023530 0 ustar """Track how many occurrences of each wordpress_incident correlation owes.
The counter is decremented only once the transport acknowledges the message
that carried them, so the periodic task can re-send incidents whose message
was lost. A counter rather than a flag: occurrences merged into a row that
was already reported still have to reach correlation.
Rows that already exist when the column is added take the DEFAULT of 0 and
are therefore treated as fully reported. Their delivery was never tracked,
and re-sending a whole retention window of history on upgrade would be worse
than leaving them alone.
"""
import peewee as pw
def migrate(migrator, database, fake=False, **kwargs):
WordpressIncident = migrator.orm["wordpress_incident"]
migrator.add_fields(
WordpressIncident,
# the DEFAULT belongs in the schema, not just in peewee:
# src/rpm-tests/test_wordpress/test_list_incidents.py inserts rows
# with raw SQL that names its columns explicitly
unsent_retries=pw.IntegerField(
null=False,
default=0,
index=True,
constraints=[pw.SQL("DEFAULT 0")],
),
)
def rollback(migrator, database, fake=False, **kwargs):
WordpressIncident = migrator.orm["wordpress_incident"]
migrator.remove_fields(WordpressIncident, "unsent_retries")
defence360agent/migrations/__init__.py 0000644 0000000 0000000 00000000000 00000000000 015021 0 ustar defence360agent/migrations/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 015132 5 ustar defence360agent/migrations/__pycache__/001_initial.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000011442 00000000000 022606 0 ustar
r_j d Z ddlZ G d dej Z G d dej Z G d dej Z G d d
ej Zdd Zdd
Z dS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Nc \ e Zd Z ej dd Z ej d Z ej d Z ej d Z
ej d Z ej d Z ej d Z
ej d Z ej d Z G d d ZdS )IncidentT primary_keynullr c e Zd ZdZdS )
Incident.MetaincidentN__name__
__module__ __qualname__db_table [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/001_initial.pyMetar
# s r r N)r
r r pw IntegerFieldid CharFieldpluginrule
FloatField timestampretriesseverityname descriptionabuserr r r r r r s T 5 5 5B
R\t
$
$
$F 2<T " " "D
4(((I bo4(((G rD)))H 2<T " " "D ",D)))K
R\t
$
$
$F r r c e Zd Z ej dd Z ej d ej d g Z ej dd Z G d d Z
d
S ) IPListTFr z$listname in ('WHITE','BLACK','GRAY'))r constraintsr )defaultr c e Zd ZdZdS ) IPList.MetaiplistNr r r r r r' / s r r N) r
r r r r ipChecklistnamer
expirationr r r r r# r# ' s $U 3 3 3Br|
RX DEEF H ! 666J r r# c e Zd Z ej dd Z ej d Z ej d Z ej d Z
ej d Z G d d Z dS )BlocklistHistoryTr r c e Zd ZdZdS )BlocklistHistory.Metablocklist_historyNr r r r r r0 : s &r r N)
r
r r r r r r r r r r r) r r r r r. r. 3 s T 5 5 5B
R\t
$
$
$F 2<T " " "D
4(((I 4 B' ' ' ' ' ' ' ' ' 'r r. c L e Zd Z ej dd Z G d d ZdS ) LastSynclistTr c e Zd ZdZdS )LastSynclist.Meta
last_synclistNr r r r r r5 A s "r r N)r
r r r r r r r r r r3 r3 > sR
$T:::I# # # # # # # # # #r r3 Fc | t | t | t | t dS )z%In memory of former create_db() (RIP)N) create_modelr r# r. r3 migratordatabasefakekwargss r migrater> E s[
(### &!!! *+++ ,'''''r c dS )zNothing to rollback.Nr r9 s r rollbackr@ N s r )F)
__doc__peeweer Modelr r# r. r3 r> r@ r r r <module>rD s ( rx RX ' ' ' ' 'rx ' ' '# # # # #28 # # #( ( ( ( r defence360agent/migrations/__pycache__/001_initial.cpython-311.pyc 0000644 0000000 0000000 00000011442 00000000000 021647 0 ustar
r_j d Z ddlZ G d dej Z G d dej Z G d dej Z G d d
ej Zdd Zdd
Z dS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Nc \ e Zd Z ej dd Z ej d Z ej d Z ej d Z
ej d Z ej d Z ej d Z
ej d Z ej d Z G d d ZdS )IncidentT primary_keynullr c e Zd ZdZdS )
Incident.MetaincidentN__name__
__module__ __qualname__db_table [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/001_initial.pyMetar
# s r r N)r
r r pw IntegerFieldid CharFieldpluginrule
FloatField timestampretriesseverityname descriptionabuserr r r r r r s T 5 5 5B
R\t
$
$
$F 2<T " " "D
4(((I bo4(((G rD)))H 2<T " " "D ",D)))K
R\t
$
$
$F r r c e Zd Z ej dd Z ej d ej d g Z ej dd Z G d d Z
d
S ) IPListTFr z$listname in ('WHITE','BLACK','GRAY'))r constraintsr )defaultr c e Zd ZdZdS ) IPList.MetaiplistNr r r r r r' / s r r N) r
r r r r ipChecklistnamer
expirationr r r r r# r# ' s $U 3 3 3Br|
RX DEEF H ! 666J r r# c e Zd Z ej dd Z ej d Z ej d Z ej d Z
ej d Z G d d Z dS )BlocklistHistoryTr r c e Zd ZdZdS )BlocklistHistory.Metablocklist_historyNr r r r r r0 : s &r r N)
r
r r r r r r r r r r r) r r r r r. r. 3 s T 5 5 5B
R\t
$
$
$F 2<T " " "D
4(((I 4 B' ' ' ' ' ' ' ' ' 'r r. c L e Zd Z ej dd Z G d d ZdS ) LastSynclistTr c e Zd ZdZdS )LastSynclist.Meta
last_synclistNr r r r r r5 A s "r r N)r
r r r r r r r r r r3 r3 > sR
$T:::I# # # # # # # # # #r r3 Fc | t | t | t | t dS )z%In memory of former create_db() (RIP)N) create_modelr r# r. r3 migratordatabasefakekwargss r migrater> E s[
(### &!!! *+++ ,'''''r c dS )zNothing to rollback.Nr r9 s r rollbackr@ N s r )F)
__doc__peeweer Modelr r# r. r3 r> r@ r r r <module>rD s ( rx RX ' ' ' ' 'rx ' ' '# # # # #28 # # #( ( ( ( r defence360agent/migrations/__pycache__/002_infected_domain_list.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004352 00000000000 025323 0 ustar
r_j H d Z ddlZ G d dej ZddZddZdS ) a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Nc e Zd Z ej d Z ej d Z ej d Z ej Z
G d d Z dS )InfectedDomainListT) primary_keyF)nullc e Zd ZdZdS )InfectedDomainList.Metainfected_domain_listN)__name__
__module__ __qualname__db_table h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/002_infected_domain_list.pyMetar s )r r N) r
r r pw IntegerFieldid CharFieldname threat_type
FloatField timestampr r r r r r s T * * *B 2<U # # #D ",E***K
I* * * * * * * * * *r r Fc : | t d S N) create_modelr migratordatabasefakekwargss r migrater" # ,-----r c : | t d S r ) remove_modelr r s r rollbackr& ' r# r )F)__doc__peeweer Modelr r" r& r r r <module>r* s{ * * * * * * * * *. . . .. . . . . .r defence360agent/migrations/__pycache__/002_infected_domain_list.cpython-311.pyc 0000644 0000000 0000000 00000004352 00000000000 024364 0 ustar
r_j H d Z ddlZ G d dej ZddZddZdS ) a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Nc e Zd Z ej d Z ej d Z ej d Z ej Z
G d d Z dS )InfectedDomainListT) primary_keyF)nullc e Zd ZdZdS )InfectedDomainList.Metainfected_domain_listN)__name__
__module__ __qualname__db_table h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/002_infected_domain_list.pyMetar s )r r N) r
r r pw IntegerFieldid CharFieldname threat_type
FloatField timestampr r r r r r s T * * *B 2<U # # #D ",E***K
I* * * * * * * * * *r r Fc : | t d S N) create_modelr migratordatabasefakekwargss r migrater" # ,-----r c : | t d S r ) remove_modelr r s r rollbackr& ' r# r )F)__doc__peeweer Modelr r" r& r r r <module>r* s{ * * * * * * * * *. . . .. . . . . .r defence360agent/migrations/__pycache__/003_import_from_list.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004106 00000000000 024546 0 ustar
r_j' 6 d Z ddlZddlZddlmZ ddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
N) IntegerFieldFc | j d }| |t j d t dd dS )zWrite your migrations here.iplistT)nullc B t t j S )N)inttime d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/003_import_from_list.py<lambda>zmigrate.<locals>.<lambda># s c$)++6F6F r )r default)
imported_fromctimeN)orm
add_fieldspw CharFieldr migratordatabasefakekwargsIPLists r migrater s^ \(
#F l---.F.FGGG r c N | j d }| |dd dS )z$Write your rollback migrations here.r r createdN)r
remove_fieldsr s r rollbackr ' s. \(
#F 6?I>>>>>r )F)__doc__r peeweer r r r r
r r <module>r" sj ( ? ? ? ? ? ?r defence360agent/migrations/__pycache__/003_import_from_list.cpython-311.pyc 0000644 0000000 0000000 00000004106 00000000000 023607 0 ustar
r_j' 6 d Z ddlZddlZddlmZ ddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
N) IntegerFieldFc | j d }| |t j d t dd dS )zWrite your migrations here.iplistT)nullc B t t j S )N)inttime d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/003_import_from_list.py<lambda>zmigrate.<locals>.<lambda># s c$)++6F6F r )r default)
imported_fromctimeN)orm
add_fieldspw CharFieldr migratordatabasefakekwargsIPLists r migrater s^ \(
#F l---.F.FGGG r c N | j d }| |dd dS )z$Write your rollback migrations here.r r createdN)r
remove_fieldsr s r rollbackr ' s. \(
#F 6?I>>>>>r )F)__doc__r peeweer r r r r
r r <module>r" sj ( ? ? ? ? ? ?r ././@LongLink 0000000 0000000 0000000 00000000146 00000000000 011566 L ustar root root defence360agent/migrations/__pycache__/004_add_username_to_infected_domain_list.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/004_add_username_to_infected_domain_list.cpython-311.opt-1.py0000644 0000000 0000000 00000003272 00000000000 030373 0 ustar
r_j{ " d Z ddlZddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
NFc t | j d }| |t j d d S )Ninfected_domain_listT)null)username)orm
add_fieldspw CharFieldmigratordatabasefakekwargsInfectedDomainLists x/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/004_add_username_to_infected_domain_list.pymigrater s= ! &<= *R\t5L5L5LMMMMM c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s- ! &<= -z:::::r )F)__doc__peeweer r r r r <module>r sS * N N N N ; ; ; ; ; ;r defence360agent/migrations/__pycache__/004_add_username_to_infected_domain_list.cpython-311.pyc 0000644 0000000 0000000 00000003272 00000000000 027577 0 ustar
r_j{ " d Z ddlZddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
NFc t | j d }| |t j d d S )Ninfected_domain_listT)null)username)orm
add_fieldspw CharFieldmigratordatabasefakekwargsInfectedDomainLists x/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/004_add_username_to_infected_domain_list.pymigrater s= ! &<= *R\t5L5L5LMMMMM c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s- ! &<= -z:::::r )F)__doc__peeweer r r r r <module>r sS * N N N N ; ; ; ; ; ;r defence360agent/migrations/__pycache__/005_timeout_in_iplist.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003311 00000000000 024715 0 ustar
r_j " d Z ddlZddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
NFc t | j d }| |t j d dS )zWrite your migrations here.iplistT)null)deepN)orm
add_fieldspw IntegerFieldmigratordatabasefakekwargsIPLists e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/005_timeout_in_iplist.pymigrater s:
\(
#F R_$%?%?%?@@@@@ c L | j d }| |d dS )z$Write your rollback migrations here.r r N)r
remove_fieldsr s r rollbackr s*
\(
#F 66*****r )F)__doc__peeweer r r r r <module>r sS * A A A A+ + + + + +r defence360agent/migrations/__pycache__/005_timeout_in_iplist.cpython-311.pyc 0000644 0000000 0000000 00000003311 00000000000 023756 0 ustar
r_j " d Z ddlZddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
NFc t | j d }| |t j d dS )zWrite your migrations here.iplistT)null)deepN)orm
add_fieldspw IntegerFieldmigratordatabasefakekwargsIPLists e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/005_timeout_in_iplist.pymigrater s:
\(
#F R_$%?%?%?@@@@@ c L | j d }| |d dS )z$Write your rollback migrations here.r r N)r
remove_fieldsr s r rollbackr s*
\(
#F 66*****r )F)__doc__peeweer r r r r <module>r sS * A A A A+ + + + + +r defence360agent/migrations/__pycache__/006_comment_in_plist.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003310 00000000000 024520 0 ustar
r_j " d Z ddlZddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
NFc t | j d }| |t j d dS )zWrite your migrations here.iplistT)null)commentN)orm
add_fieldspw CharFieldmigratordatabasefakekwargsIPLists d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/006_comment_in_plist.pymigrater s:
\(
#F $(?(?(?@@@@@ c L | j d }| |d dS )z$Write your rollback migrations here.r r N)r
remove_fieldsr s r rollbackr s*
\(
#F 69-----r )F)__doc__peeweer r r r r <module>r sS * A A A A. . . . . .r defence360agent/migrations/__pycache__/006_comment_in_plist.cpython-311.pyc 0000644 0000000 0000000 00000003310 00000000000 023561 0 ustar
r_j " d Z ddlZddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
NFc t | j d }| |t j d dS )zWrite your migrations here.iplistT)null)commentN)orm
add_fieldspw CharFieldmigratordatabasefakekwargsIPLists d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/006_comment_in_plist.pymigrater s:
\(
#F $(?(?(?@@@@@ c L | j d }| |d dS )z$Write your rollback migrations here.r r N)r
remove_fieldsr s r rollbackr s*
\(
#F 69-----r )F)__doc__peeweer r r r r <module>r sS * A A A A. . . . . .r defence360agent/migrations/__pycache__/007_add_country_code_fields.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005557 00000000000 026030 0 ustar
r_jj H d Z ddlZ G d dej ZddZddZdS ) a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Nc p e Zd Z ej ddd Z ej d Z G d d ZdS ) Country TF)
max_length primary_keynullr c e Zd ZdZdS ) Country.MetacountryN)__name__
__module__ __qualname__db_table k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/007_add_country_code_fields.pyMetar s r r N)r
r r pw CharFieldcodenamer r r r r r sh 2<1$U C C CD 2<U # # #D r r Fc . | j d }| j d }| t | |t j t d | |t j t d dS )zWrite your migrations here.iplistincidentTr )r N)orm create_modelr
add_fieldsr ForeignKeyFieldmigratordatabasefakekwargsIPListIncidents r migrater' ! s \(
#F|J'H '""" (:7(N(N(NOOO ",W4@@@ r c | j d }| j d }| |d | |d | t dS )z$Write your rollback migrations here.r r r N)r
remove_fields remove_modelr r s r rollbackr+ / s`
\(
#F|J'H 69--- 8Y/// '"""""r )F)__doc__peeweer Modelr r' r+ r r r <module>r/ s{ * bh # # # # # #r defence360agent/migrations/__pycache__/007_add_country_code_fields.cpython-311.pyc 0000644 0000000 0000000 00000005557 00000000000 025071 0 ustar
r_jj H d Z ddlZ G d dej ZddZddZdS ) a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Nc p e Zd Z ej ddd Z ej d Z G d d ZdS ) Country TF)
max_length primary_keynullr c e Zd ZdZdS ) Country.MetacountryN)__name__
__module__ __qualname__db_table k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/007_add_country_code_fields.pyMetar s r r N)r
r r pw CharFieldcodenamer r r r r r sh 2<1$U C C CD 2<U # # #D r r Fc . | j d }| j d }| t | |t j t d | |t j t d dS )zWrite your migrations here.iplistincidentTr )r N)orm create_modelr
add_fieldsr ForeignKeyFieldmigratordatabasefakekwargsIPListIncidents r migrater' ! s \(
#F|J'H '""" (:7(N(N(NOOO ",W4@@@ r c | j d }| j d }| |d | |d | t dS )z$Write your rollback migrations here.r r r N)r
remove_fields remove_modelr r s r rollbackr+ / s`
\(
#F|J'H 69--- 8Y/// '"""""r )F)__doc__peeweer Modelr r' r+ r r r <module>r/ s{ * bh # # # # # #r defence360agent/migrations/__pycache__/008_fill_countries.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001052 00000000000 024201 0 ustar
r_j ddZ ddZdS )Fc dS )zWrite your migrations here.N migratordatabasefakekwargss b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/008_fill_countries.pymigrater
D c dS )z$Write your rollback migrations here.Nr r s r rollbackr r r N)F)r
r r r r <module>r s7
r defence360agent/migrations/__pycache__/008_fill_countries.cpython-311.pyc 0000644 0000000 0000000 00000001052 00000000000 023242 0 ustar
r_j ddZ ddZdS )Fc dS )zWrite your migrations here.N migratordatabasefakekwargss b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/008_fill_countries.pymigrater
D c dS )z$Write your rollback migrations here.Nr r s r rollbackr r r N)F)r
r r r r <module>r s7
r defence360agent/migrations/__pycache__/009_drop_blocklist_history.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004705 00000000000 025764 0 ustar
r_j} H d Z ddlZ G d dej ZddZddZdS ) a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Nc e Zd Z ej dd Z ej d Z ej d Z ej d Z
ej d Z G d d Z dS )BlocklistHistoryT) primary_keynull)r c e Zd ZdZdS )BlocklistHistory.Metablocklist_historyN)__name__
__module__ __qualname__db_table j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/009_drop_blocklist_history.pyMetar s &r r N)
r
r r pw IntegerFieldid CharFieldpluginrule
FloatField timestampipr r r r r r s T 5 5 5B
R\t
$
$
$F 2<T " " "D
4(((I 4 B' ' ' ' ' ' ' ' ' 'r r Fc J | j d }| | dS )zWrite your migrations here.r N)orm remove_model)migratordatabasefakekwargsr s r migrater" # s+ |$78 *+++++r c : | t dS )z$Write your rollback migrations here.N) create_modelr )r r r r! s r rollbackr% ) s *+++++r )F)__doc__peeweer Modelr r" r% r r r <module>r) s{ ( ' ' ' ' 'rx ' ' ', , , , , , , , , ,r defence360agent/migrations/__pycache__/009_drop_blocklist_history.cpython-311.pyc 0000644 0000000 0000000 00000004705 00000000000 025025 0 ustar
r_j} H d Z ddlZ G d dej ZddZddZdS ) a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Nc e Zd Z ej dd Z ej d Z ej d Z ej d Z
ej d Z G d d Z dS )BlocklistHistoryT) primary_keynull)r c e Zd ZdZdS )BlocklistHistory.Metablocklist_historyN)__name__
__module__ __qualname__db_table j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/009_drop_blocklist_history.pyMetar s &r r N)
r
r r pw IntegerFieldid CharFieldpluginrule
FloatField timestampipr r r r r r s T 5 5 5B
R\t
$
$
$F 2<T " " "D
4(((I 4 B' ' ' ' ' ' ' ' ' 'r r Fc J | j d }| | dS )zWrite your migrations here.r N)orm remove_model)migratordatabasefakekwargsr s r migrater" # s+ |$78 *+++++r c : | t dS )z$Write your rollback migrations here.N) create_modelr )r r r r! s r rollbackr% ) s *+++++r )F)__doc__peeweer Modelr r" r% r r r <module>r) s{ ( ' ' ' ' 'rx ' ' ', , , , , , , , , ,r defence360agent/migrations/__pycache__/010_drop_country_entities.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003551 00000000000 025612 0 ustar
r_j d Z ddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Fc . | j d }| j d }| j d }| |d | |d | |d | |d | | dS )zWrite your migrations here.iplistincidentcountryN)orm
drop_index
remove_fields remove_model)migratordatabasefakekwargsIPListIncidentCountrys i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/010_drop_country_entities.pymigrater s \(
#F|J'Hl9%G *** ),,, 69--- 8Y/// '""""" c dS )z$Write your rollback migrations here.N )r
r r r
s r rollbackr & s Dr N)F)__doc__r r r r r <module>r sA , # # # # r defence360agent/migrations/__pycache__/010_drop_country_entities.cpython-311.pyc 0000644 0000000 0000000 00000003551 00000000000 024653 0 ustar
r_j d Z ddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Fc . | j d }| j d }| j d }| |d | |d | |d | |d | | dS )zWrite your migrations here.iplistincidentcountryN)orm
drop_index
remove_fields remove_model)migratordatabasefakekwargsIPListIncidentCountrys i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/010_drop_country_entities.pymigrater s \(
#F|J'Hl9%G *** ),,, 69--- 8Y/// '""""" c dS )z$Write your rollback migrations here.N )r
r r r
s r rollbackr & s Dr N)F)__doc__r r r r r <module>r sA , # # # # r defence360agent/migrations/__pycache__/011_create_new_country_entities.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000012166 00000000000 026765 0 ustar
r_j
d Z ddlmZ ddlZ G d dej Z G d dej Z G d d ej Zd
d Zd
d Z dS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
)timeNc e Zd Z ej dd Z ej ddd Z ej d Z G d d Zd S )
CountryTF primary_keynull )
max_lengthuniquer r c e Zd ZdZdS ) Country.MetacountryN__name__
__module__ __qualname__db_table o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/011_create_new_country_entities.pyMetar s r r N) r r r pw CharFieldidcodenamer r r r r r s~ $U 3 3 3B 2<1T > > >D 2<U # # #D r r c p e Zd Z ej ed Z ej dd Z G d d Z dS )CountrySubnetsFr )r
r c e Zd ZdZdS )CountrySubnets.Metacountry_subnetsNr r r r r r" * s $r r N)
r r r r ForeignKeyFieldr r r ip_netr r r r r r $ sk b u555G R\Re
4
4
4F% % % % % % % % % %r r c e Zd ZdZdZeefZ ej edd Z ej
d ej d g Z ej
dd Z ej
d
Z G d d Zd
S ) CountryListWHITEBLACKTFr z listname in ('WHITE','BLACK'))r constraintsc 8 t t S )N)intr r r r <lambda>zCountryList.<lambda>: s s466{{ r )r defaultr c e Zd ZdZdS )CountryList.Meta country_listNr r r r r r0 > s !r r N)r r r r( r) IP_LISTSr r$ r r r Checklistname IntegerFieldctimecommentr r r r r' r' . s E Eu~H b dGGGGr|
*I!J!J K H
BO/B/B C C CEbl%%%G" " " " " " " " " "r r' Fc | j d }| j d }| t | |t j t d | |t j t d | t | t dS )zWrite your migrations here.iplistincidentTr )r N)orm create_modelr
add_fieldsr r$ r r' )migratordatabasefakekwargsIPListIncidents r migraterD B s \(
#F|J'H '""" (:7(N(N(NOOO ",W4@@@
.))) +&&&&&r c ^ | j d }| j d }| j d }| j d }| j d }| |d | |d | | | | | | dS )z$Write your rollback migrations here.r r# r1 r9 r: N)r;
remove_fields remove_model) r> r? r@ rA r r r' rB rC s r rollbackrH T s l9%G \"34N,~.K
\(
#F|J'H 69--- 8Y/// .))) +&&& '"""""r )F)
__doc__r peeweer Modelr r r' rD rH r r r <module>rL s * bh % % % % %RX % % %" " " " ""( " " "(' ' ' '$
#
#
#
#
#
#r defence360agent/migrations/__pycache__/011_create_new_country_entities.cpython-311.pyc 0000644 0000000 0000000 00000012166 00000000000 026026 0 ustar
r_j
d Z ddlmZ ddlZ G d dej Z G d dej Z G d d ej Zd
d Zd
d Z dS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
)timeNc e Zd Z ej dd Z ej ddd Z ej d Z G d d Zd S )
CountryTF primary_keynull )
max_lengthuniquer r c e Zd ZdZdS ) Country.MetacountryN__name__
__module__ __qualname__db_table o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/011_create_new_country_entities.pyMetar s r r N) r r r pw CharFieldidcodenamer r r r r r s~ $U 3 3 3B 2<1T > > >D 2<U # # #D r r c p e Zd Z ej ed Z ej dd Z G d d Z dS )CountrySubnetsFr )r
r c e Zd ZdZdS )CountrySubnets.Metacountry_subnetsNr r r r r r" * s $r r N)
r r r r ForeignKeyFieldr r r ip_netr r r r r r $ sk b u555G R\Re
4
4
4F% % % % % % % % % %r r c e Zd ZdZdZeefZ ej edd Z ej
d ej d g Z ej
dd Z ej
d
Z G d d Zd
S ) CountryListWHITEBLACKTFr z listname in ('WHITE','BLACK'))r constraintsc 8 t t S )N)intr r r r <lambda>zCountryList.<lambda>: s s466{{ r )r defaultr c e Zd ZdZdS )CountryList.Meta country_listNr r r r r r0 > s !r r N)r r r r( r) IP_LISTSr r$ r r r Checklistname IntegerFieldctimecommentr r r r r' r' . s E Eu~H b dGGGGr|
*I!J!J K H
BO/B/B C C CEbl%%%G" " " " " " " " " "r r' Fc | j d }| j d }| t | |t j t d | |t j t d | t | t dS )zWrite your migrations here.iplistincidentTr )r N)orm create_modelr
add_fieldsr r$ r r' )migratordatabasefakekwargsIPListIncidents r migraterD B s \(
#F|J'H '""" (:7(N(N(NOOO ",W4@@@
.))) +&&&&&r c ^ | j d }| j d }| j d }| j d }| j d }| |d | |d | | | | | | dS )z$Write your rollback migrations here.r r# r1 r9 r: N)r;
remove_fields remove_model) r> r? r@ rA r r r' rB rC s r rollbackrH T s l9%G \"34N,~.K
\(
#F|J'H 69--- 8Y/// .))) +&&& '"""""r )F)
__doc__r peeweer Modelr r r' rD rH r r r <module>rL s * bh % % % % %RX % % %" " " " ""( " " "(' ' ' '$
#
#
#
#
#
#r defence360agent/migrations/__pycache__/012_fill_countries_and_subnets.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001176 00000000000 026570 0 ustar
r_j d Z ddZddZdS )zpPeewee migrations: ::
UPD: migration not needed anymore, countries and subnets are loaded after
files update.
Fc d S N migratordatabasefakekwargss n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/012_fill_countries_and_subnets.pymigrater D c d S r r r s r
rollbackr
r r
N)F)__doc__r r r r
r
<module>r sA r
defence360agent/migrations/__pycache__/012_fill_countries_and_subnets.cpython-311.pyc 0000644 0000000 0000000 00000001176 00000000000 025631 0 ustar
r_j d Z ddZddZdS )zpPeewee migrations: ::
UPD: migration not needed anymore, countries and subnets are loaded after
files update.
Fc d S N migratordatabasefakekwargss n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/012_fill_countries_and_subnets.pymigrater D c d S r r r s r
rollbackr
r r
N)F)__doc__r r r r
r
<module>r sA r
defence360agent/migrations/__pycache__/013_add_indexes_to_iplist.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003114 00000000000 025512 0 ustar
r_jS d Z ddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Fc L | j d }| |d dS )zWrite your migrations here.iplistlistnameN)orm add_indexmigratordatabasefakekwargsIPLists i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/013_add_indexes_to_iplist.pymigrater s*
\(
#F vz***** c L | j d }| |d dS )z$Write your rollback migrations here.r r N)r
drop_indexr s r
rollbackr s*
\(
#F
+++++r N)F)__doc__r r r r
<module>r sA ,+ + + + , , , , , ,r defence360agent/migrations/__pycache__/013_add_indexes_to_iplist.cpython-311.pyc 0000644 0000000 0000000 00000003114 00000000000 024553 0 ustar
r_jS d Z ddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Fc L | j d }| |d dS )zWrite your migrations here.iplistlistnameN)orm add_indexmigratordatabasefakekwargsIPLists i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/013_add_indexes_to_iplist.pymigrater s*
\(
#F vz***** c L | j d }| |d dS )z$Write your rollback migrations here.r r N)r
drop_indexr s r
rollbackr s*
\(
#F
+++++r N)F)__doc__r r r r
<module>r sA ,+ + + + , , , , , ,r defence360agent/migrations/__pycache__/014_add_malware_hits.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000010777 00000000000 024462 0 ustar
r_jG d Z ddlZ G d dej Z G d dej Z G d dej Zd d
Zd d ZdS )
a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Nc e Zd Z G d d Z ej d Z ej d Z ej d Z ej d ej
d g Z ej d Z ej dd
Z
d S ) MalwareScanc e Zd ZdZdS )MalwareScan.Meta
malware_scansN__name__
__module__ __qualname__db_table d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/014_add_malware_hits.pyMetar s "r r T primary_keyFnullz!type in ('on-demand', 'realtime'))r constraintsr r defaultN)r r
r r pw CharFieldscanid IntegerFieldstarted completedChecktypepath total_filesr
r r r r s # # # # # # # # R\d
+
+
+F bo5)))G U+++I 2<
*M!N!N O D 2<U # # #D!"/ua888KKKr r c e Zd Z G d d Z ej d Z ej ed Z ej
d Z ej
d Z ej
d Z
ej dd ZdS )
MalwareHitc e Zd ZdZdS )MalwareHit.Meta malware_hitsNr r
r r r r% ( s !r r Tr Fr r N)r r
r r r r idForeignKeyFieldr r r user orig_filer BooleanFieldrestoredr
r r r# r# ' s " " " " " " " "
T * * *B
R
%
8
8
8F 2<U # # #D %(((I 2<U # # #D rE5999HHHr r# c J e Zd Z G d d Z ej d ZdS )MalwareIgnorePathc e Zd ZdZdS )MalwareIgnorePath.Metamalware_ignore_pathNr r
r r r r0 5 s (r r Tr N)r r
r r r r r r
r r r. r. 4 sL ) ) ) ) ) ) ) ) 2<D ) ) )DDDr r. Fc | t | t | t dS )zWrite your migrations here.N) create_modelr r# r. )migratordatabasefakekwargss r migrater8 ; sE +&&& *%%% +,,,,,r c | j d }| j d }| j d }| j d }| | | | | | | | dS )z$Write your rollback migrations here.r r& r1 malware_stanned_statN)orm
drop_model)r4 r5 r6 r7 r r# r. MalwareScannedStats r rollbackr> B s ,/K n-J %:;! &<=
### $$$ )*** *+++++r )F) __doc__peeweer Modelr r# r. r8 r> r
r r <module>rB s * 9 9 9 9 9"( 9 9 9
:
:
:
:
:
:
:
:* * * * * * * *- - - -
,
,
,
,
,
,r defence360agent/migrations/__pycache__/014_add_malware_hits.cpython-311.pyc 0000644 0000000 0000000 00000010777 00000000000 023523 0 ustar
r_jG d Z ddlZ G d dej Z G d dej Z G d dej Zd d
Zd d ZdS )
a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Nc e Zd Z G d d Z ej d Z ej d Z ej d Z ej d ej
d g Z ej d Z ej dd
Z
d S ) MalwareScanc e Zd ZdZdS )MalwareScan.Meta
malware_scansN__name__
__module__ __qualname__db_table d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/014_add_malware_hits.pyMetar s "r r T primary_keyFnullz!type in ('on-demand', 'realtime'))r constraintsr r defaultN)r r
r r pw CharFieldscanid IntegerFieldstarted completedChecktypepath total_filesr
r r r r s # # # # # # # # R\d
+
+
+F bo5)))G U+++I 2<
*M!N!N O D 2<U # # #D!"/ua888KKKr r c e Zd Z G d d Z ej d Z ej ed Z ej
d Z ej
d Z ej
d Z
ej dd ZdS )
MalwareHitc e Zd ZdZdS )MalwareHit.Meta malware_hitsNr r
r r r r% ( s !r r Tr Fr r N)r r
r r r r idForeignKeyFieldr r r user orig_filer BooleanFieldrestoredr
r r r# r# ' s " " " " " " " "
T * * *B
R
%
8
8
8F 2<U # # #D %(((I 2<U # # #D rE5999HHHr r# c J e Zd Z G d d Z ej d ZdS )MalwareIgnorePathc e Zd ZdZdS )MalwareIgnorePath.Metamalware_ignore_pathNr r
r r r r0 5 s (r r Tr N)r r
r r r r r r
r r r. r. 4 sL ) ) ) ) ) ) ) ) 2<D ) ) )DDDr r. Fc | t | t | t dS )zWrite your migrations here.N) create_modelr r# r. )migratordatabasefakekwargss r migrater8 ; sE +&&& *%%% +,,,,,r c | j d }| j d }| j d }| j d }| | | | | | | | dS )z$Write your rollback migrations here.r r& r1 malware_stanned_statN)orm
drop_model)r4 r5 r6 r7 r r# r. MalwareScannedStats r rollbackr> B s ,/K n-J %:;! &<=
### $$$ )*** *+++++r )F) __doc__peeweer Modelr r# r. r8 r> r
r r <module>rB s * 9 9 9 9 9"( 9 9 9
:
:
:
:
:
:
:
:* * * * * * * *- - - -
,
,
,
,
,
,r defence360agent/migrations/__pycache__/015_add_iplist_expiration_index.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001523 00000000000 026726 0 ustar
r_ji ddZ ddZdS )Fc L | j d }| |d dS )zWrite your migrations here.iplist
expirationN)orm add_indexmigratordatabasefakekwargsIPLists o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/015_add_iplist_expiration_index.pymigrater s*
\(
#F v|,,,,, c L | j d }| |d dS )z$Write your rollback migrations here.r r N)r
drop_indexr s r
rollbackr s*
\(
#F -----r N)F)r r r r
<module>r s7 - - - - . . . . . .r defence360agent/migrations/__pycache__/015_add_iplist_expiration_index.cpython-311.pyc 0000644 0000000 0000000 00000001523 00000000000 025767 0 ustar
r_ji ddZ ddZdS )Fc L | j d }| |d dS )zWrite your migrations here.iplist
expirationN)orm add_indexmigratordatabasefakekwargsIPLists o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/015_add_iplist_expiration_index.pymigrater s*
\(
#F v|,,,,, c L | j d }| |d dS )z$Write your rollback migrations here.r r N)r
drop_indexr s r
rollbackr s*
\(
#F -----r N)F)r r r r
<module>r s7 - - - - . . . . . .r defence360agent/migrations/__pycache__/016_fix_autowhitelist_expiration.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002003 00000000000 027171 0 ustar
r_j & d dl m Z dZddZddZdS ) )timei7A Fc | j d }| t |j dk |j t
z
t k z d S )Niplist)
expirationWHITE)ormupdate _MAX_TIMEOUTwherelistnamer r execute)migratordatabasefakekwargs IPListModels p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/016_fix_autowhitelist_expiration.pymigrater sg ,x(K,//55 ( !DFF *\ 9 ; giiiii c d S )N )r r r r s r rollbackr s Dr N)F)r r
r r r r r <module>r sN r defence360agent/migrations/__pycache__/016_fix_autowhitelist_expiration.cpython-311.pyc 0000644 0000000 0000000 00000002003 00000000000 026232 0 ustar
r_j & d dl m Z dZddZddZdS ) )timei7A Fc | j d }| t |j dk |j t
z
t k z d S )Niplist)
expirationWHITE)ormupdate _MAX_TIMEOUTwherelistnamer r execute)migratordatabasefakekwargs IPListModels p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/016_fix_autowhitelist_expiration.pymigrater sg ,x(K,//55 ( !DFF *\ 9 ; giiiii c d S )N )r r r r s r rollbackr s Dr N)F)r r
r r r r r <module>r sN r defence360agent/migrations/__pycache__/017_remove_sensor_prefix.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001341 00000000000 025424 0 ustar
r_je d Z ddZddZdS )z
Migrate server-id w/ prefix inside imunify360.id to server-id w/o prefix
into i360.id file
UPD: migration not needed yet, as far as, the majority of the servers already
converted their server-id to w/0 prefix form.
Fc d S N migratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/017_remove_sensor_prefix.pymigrater
D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r sA r
defence360agent/migrations/__pycache__/017_remove_sensor_prefix.cpython-311.pyc 0000644 0000000 0000000 00000001341 00000000000 024465 0 ustar
r_je d Z ddZddZdS )z
Migrate server-id w/ prefix inside imunify360.id to server-id w/o prefix
into i360.id file
UPD: migration not needed yet, as far as, the majority of the servers already
converted their server-id to w/0 prefix form.
Fc d S N migratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/017_remove_sensor_prefix.pymigrater
D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r sA r
defence360agent/migrations/__pycache__/018_license_info.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003167 00000000000 023627 0 ustar
r_jH D d dl Z G d dej ZddZddZdS ) Nc e Zd Z G d d Z ej d Z ej dd Z ej d Z ej
d Z d S )
Licensec e Zd ZdZdS ) License.MetalicenseN)__name__
__module__ __qualname__db_table `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/018_license_info.pyMetar s r
r T) primary_keyFr )nulldefault)r N) r r r
r pw BooleanFieldstatus IntegerField
expirationlimit CharField redirect_urlr r
r r r s R_
.
.
.F eQ777J BO & & &E 2<T***LLLr
r Fc : | t dS )zWrite your migrations here.N) create_modelr )migratordatabasefakekwargss r migrater! s '"""""r
c J | j d }| | dS )z$Write your rollback migrations here.r N)orm
drop_model)r r r r r s r rollbackr% s( l9%G r
)F)peeweer Modelr r! r% r r
r <module>r( so + + + + +bh + + +# # # #
! ! ! ! ! !r
defence360agent/migrations/__pycache__/018_license_info.cpython-311.pyc 0000644 0000000 0000000 00000003167 00000000000 022670 0 ustar
r_jH D d dl Z G d dej ZddZddZdS ) Nc e Zd Z G d d Z ej d Z ej dd Z ej d Z ej
d Z d S )
Licensec e Zd ZdZdS ) License.MetalicenseN)__name__
__module__ __qualname__db_table `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/018_license_info.pyMetar s r
r T) primary_keyFr )nulldefault)r N) r r r
r pw BooleanFieldstatus IntegerField
expirationlimit CharField redirect_urlr r
r r r s R_
.
.
.F eQ777J BO & & &E 2<T***LLLr
r Fc : | t dS )zWrite your migrations here.N) create_modelr )migratordatabasefakekwargss r migrater! s '"""""r
c J | j d }| | dS )z$Write your rollback migrations here.r N)orm
drop_model)r r r r r s r rollbackr% s( l9%G r
)F)peeweer Modelr r! r% r r
r <module>r( so + + + + +bh + + +# # # #
! ! ! ! ! !r
defence360agent/migrations/__pycache__/019_purge_old_configs.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001243 00000000000 024654 0 ustar
r_j- d Z ddZddZdS )z^
Purge old configs from config file to prevent of "Unknown field" errors.
UPD: Not actual yet
Fc dS )zWrite your migrations here.N migratordatabasefakekwargss e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/019_purge_old_configs.pymigrater
c dS )z$Write your rollback migrations here.Nr r s r rollbackr r r N)F)__doc__r
r r r r <module>r sA & & & &/ / / / / /r defence360agent/migrations/__pycache__/019_purge_old_configs.cpython-311.pyc 0000644 0000000 0000000 00000001243 00000000000 023715 0 ustar
r_j- d Z ddZddZdS )z^
Purge old configs from config file to prevent of "Unknown field" errors.
UPD: Not actual yet
Fc dS )zWrite your migrations here.N migratordatabasefakekwargss e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/019_purge_old_configs.pymigrater
c dS )z$Write your rollback migrations here.Nr r s r rollbackr r r N)F)__doc__r
r r r r <module>r sA & & & &/ / / / / /r defence360agent/migrations/__pycache__/020_malware_scan_types.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002472 00000000000 025041 0 ustar
r_j d Z ddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Fc dS )zWrite your migrations here.N migratordatabasefakekwargss f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/020_malware_scan_types.pymigrater
s
D c dS )z$Write your rollback migrations here.Nr r s r rollbackr
s Dr N)F)__doc__r
r
r r r <module>r sA , r defence360agent/migrations/__pycache__/020_malware_scan_types.cpython-311.pyc 0000644 0000000 0000000 00000002472 00000000000 024102 0 ustar
r_j d Z ddZddZdS )a Peewee migrations: ::
> Model = migrator.orm['name']
> migrator.sql(sql)
> migrator.python(func, *args, **kwargs)
> migrator.create_model(Model)
> migrator.remove_model(Model, cascade=True)
> migrator.add_fields(Model, **fields)
> migrator.change_fields(Model, **fields)
> migrator.remove_fields(Model, *field_names, cascade=True)
> migrator.rename_field(Model, old_field_name, new_field_name)
> migrator.rename_table(Model, new_table_name)
> migrator.add_index(Model, *col_names, unique=False)
> migrator.drop_index(Model, *col_names)
> migrator.add_not_null(Model, *field_names)
> migrator.drop_not_null(Model, *field_names)
> migrator.add_default(Model, field_name, default)
Fc dS )zWrite your migrations here.N migratordatabasefakekwargss f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/020_malware_scan_types.pymigrater
s
D c dS )z$Write your rollback migrations here.Nr r s r rollbackr
s Dr N)F)__doc__r
r
r r r <module>r sA , r defence360agent/migrations/__pycache__/021_add_testing_repo.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005757 00000000000 024505 0 ustar
r_jd d dl Z d dlZd dlmZ d dlmZmZ e j e Z ed Z
dZ d e Z
dZd Zd d
Zd d ZdS )
N)Path)
os_version
OsReleaseInfoz(/etc/yum.repos.d/imunify360-testing.repoz1https://repo.imunify360.cloudlinux.com/defense360z{}/RPM-GPG-KEY-CloudLinuxz
[imunify360-testing]
name=EL-{version} - Imunify360
baseurl={CHECKSITE}/el/{version}/updates-testing/x86_64/
username=defense360
password=nraW!F@\$x4Xd6HHQ
enabled=0
gpgcheck=1
gpgkey={RPM_KEY}
c | dv r\t sAt t | t
t d S d S t d | d S )N) )version CHECKSITERPM_KEYzVersion {} is not supported) TEST_REPO_PATHexists
write_text
TEMPLATE_REPOformatr
r loggerinfo)r s d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/021_add_testing_repo.py install_repor s & $$&& % % $$ #y' %
188AABBBBB Fc V |rd S t j t j z rPd }t }| d rd}n| d rd}t | d S d S # t $ r&}t d| Y d }~d S d }~ww xY w)N6r 7r z)Unable to add imunify360-testing repo: %s) r id_likeRHEL_FEDORA_CENTOSr
startswithr Exceptionr warning)migratordatabasefakekwargsr full_versiones r migrater$ ' s G " "]%E E "G%<<L&&s++
((--
! ! ! ! ! " " G G GBAFFFFFFFFFGs A.A8 8
B(B##B(c |rd S t j t d S # t $ r2}t t
| Y d }~d S d }~ww xY w)N)osremover r r r str)r r r r! r# s r rollbackr) 9 ss
.!!!!! s1vv s !
A 'AA )F)loggingr& pathlibr defence360agent.utilsr r getLogger__name__r r r
r r r r r$ r) r r <module>r0 s ; ; ; ; ; ; ; ; 8 $ $@AA ?
%
,
,Y
7
7
C C CG G G G$ r defence360agent/migrations/__pycache__/021_add_testing_repo.cpython-311.pyc 0000644 0000000 0000000 00000005757 00000000000 023546 0 ustar
r_jd d dl Z d dlZd dlmZ d dlmZmZ e j e Z ed Z
dZ d e Z
dZd Zd d
Zd d ZdS )
N)Path)
os_version
OsReleaseInfoz(/etc/yum.repos.d/imunify360-testing.repoz1https://repo.imunify360.cloudlinux.com/defense360z{}/RPM-GPG-KEY-CloudLinuxz
[imunify360-testing]
name=EL-{version} - Imunify360
baseurl={CHECKSITE}/el/{version}/updates-testing/x86_64/
username=defense360
password=nraW!F@\$x4Xd6HHQ
enabled=0
gpgcheck=1
gpgkey={RPM_KEY}
c | dv r\t sAt t | t
t d S d S t d | d S )N) )version CHECKSITERPM_KEYzVersion {} is not supported) TEST_REPO_PATHexists
write_text
TEMPLATE_REPOformatr
r loggerinfo)r s d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/021_add_testing_repo.py install_repor s & $$&& % % $$ #y' %
188AABBBBB Fc V |rd S t j t j z rPd }t }| d rd}n| d rd}t | d S d S # t $ r&}t d| Y d }~d S d }~ww xY w)N6r 7r z)Unable to add imunify360-testing repo: %s) r id_likeRHEL_FEDORA_CENTOSr
startswithr Exceptionr warning)migratordatabasefakekwargsr full_versiones r migrater$ ' s G " "]%E E "G%<<L&&s++
((--
! ! ! ! ! " " G G GBAFFFFFFFFFGs A.A8 8
B(B##B(c |rd S t j t d S # t $ r2}t t
| Y d }~d S d }~ww xY w)N)osremover r r r str)r r r r! r# s r rollbackr) 9 ss
.!!!!! s1vv s !
A 'AA )F)loggingr& pathlibr defence360agent.utilsr r getLogger__name__r r r
r r r r r$ r) r r <module>r0 s ; ; ; ; ; ; ; ; 8 $ $@AA ?
%
,
,Y
7
7
C C CG G G G$ r defence360agent/migrations/__pycache__/022_mod_security_vendors_migrations.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001050 00000000000 027654 0 ustar
r_j d Z ddZddZdS )z
No need to user now
Fc d S N migratordatabasefakekwargss s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/022_mod_security_vendors_migrations.pymigrater D c d S r r r s r
rollbackr
r r
N)F)__doc__r r r r
r
<module>r sA
r
defence360agent/migrations/__pycache__/022_mod_security_vendors_migrations.cpython-311.pyc 0000644 0000000 0000000 00000001050 00000000000 026715 0 ustar
r_j d Z ddZddZdS )z
No need to user now
Fc d S N migratordatabasefakekwargss s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/022_mod_security_vendors_migrations.pymigrater D c d S r r r s r
rollbackr
r r
N)F)__doc__r r r r
r
<module>r sA
r
././@LongLink 0000000 0000000 0000000 00000000150 00000000000 011561 L ustar root root defence360agent/migrations/__pycache__/023_add_default_rule_in_modsec_custom_conf.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/023_add_default_rule_in_modsec_custom_conf.cpython-311.opt-1.0000644 0000000 0000000 00000004113 00000000000 030344 0 ustar
r_j L d Z ddlZddlZddlmZmZ dZdZdddZd d
Z d d Z
dS )
zUsing ModSecurity 'WordPress login attempt' rule instead of OSSEC one.
This migration is needed in order to add new rule to config after update,
because config is non replaceable.
N) IConfigFile LocalConfig MOD_SEC_BLOCK_BY_CUSTOM_RULE33332
x )max_incident_repetition check_periodFc |rd S t }t j |j sd S t j |j sd S t j |j |j dz | }t | t i t < | |d d S )N.oldF)validate)
r ospathexistsisfileshutilcopyfileconfig_to_dict RULE_VALUES
setdefaultSECTIONRULE_IDdict_to_config)migratordatabasefakekwargs local_confignew_confs z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/023_add_default_rule_in_modsec_custom_conf.pymigrater! s +
L
7>>,+ , ,
7>>,+ , ,
OL%|'86'ABBB**,,H0;H$$W- 5 99999 c |rd S t }|j dz }t j | r t j ||j d S d S )Nr )r r r r r move)r r r r r olds r rollbackr& s` +
L
f
$C w~~c , C *+++++, ,r" )F) __doc__r r defence360agent.contracts.configr r r r r r! r& r" r <module>r* s
E E E E E E E E
(
*,cBB : : : : , , , , , ,r" defence360agent/migrations/__pycache__/023_add_default_rule_in_modsec_custom_conf.cpython-311.pyc 0000644 0000000 0000000 00000004113 00000000000 030121 0 ustar
r_j L d Z ddlZddlZddlmZmZ dZdZdddZd d
Z d d Z
dS )
zUsing ModSecurity 'WordPress login attempt' rule instead of OSSEC one.
This migration is needed in order to add new rule to config after update,
because config is non replaceable.
N) IConfigFile LocalConfig MOD_SEC_BLOCK_BY_CUSTOM_RULE33332
x )max_incident_repetition check_periodFc |rd S t }t j |j sd S t j |j sd S t j |j |j dz | }t | t i t < | |d d S )N.oldF)validate)
r ospathexistsisfileshutilcopyfileconfig_to_dict RULE_VALUES
setdefaultSECTIONRULE_IDdict_to_config)migratordatabasefakekwargs local_confignew_confs z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/023_add_default_rule_in_modsec_custom_conf.pymigrater! s +
L
7>>,+ , ,
7>>,+ , ,
OL%|'86'ABBB**,,H0;H$$W- 5 99999 c |rd S t }|j dz }t j | r t j ||j d S d S )Nr )r r r r r move)r r r r r olds r rollbackr& s` +
L
f
$C w~~c , C *+++++, ,r" )F) __doc__r r defence360agent.contracts.configr r r r r r! r& r" r <module>r* s
E E E E E E E E
(
*,cBB : : : : , , , , , ,r" defence360agent/migrations/__pycache__/024_ignore_from_graylist.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002623 00000000000 025407 0 ustar
r_j D d dl Z G d dej ZddZddZdS ) Nc L e Zd Z ej dd Z G d d ZdS )
IgnoreListTF) primary_keynullc e Zd ZdZdS )IgnoreList.Meta ignore_listN)__name__
__module__ __qualname__db_table h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/024_ignore_from_graylist.pyMetar s r r N)r
r r pw CharFieldipr r r r r r sR $U 3 3 3B! ! ! ! ! ! ! ! ! !r r Fc : | t dS )zWrite your migrations here.N) create_modelr )migratordatabasefakekwargss r migrater s *%%%%%r c J | j d }| | dS )z$Write your rollback migrations here.r N)orm
drop_model)r r r r r s r rollbackr s( m,J
#####r )F)peeweer Modelr r r r r r <module>r" so ! ! ! ! ! ! ! !& & & &
$ $ $ $ $ $r defence360agent/migrations/__pycache__/024_ignore_from_graylist.cpython-311.pyc 0000644 0000000 0000000 00000002623 00000000000 024450 0 ustar
r_j D d dl Z G d dej ZddZddZdS ) Nc L e Zd Z ej dd Z G d d ZdS )
IgnoreListTF) primary_keynullc e Zd ZdZdS )IgnoreList.Meta ignore_listN)__name__
__module__ __qualname__db_table h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/024_ignore_from_graylist.pyMetar s r r N)r
r r pw CharFieldipr r r r r r sR $U 3 3 3B! ! ! ! ! ! ! ! ! !r r Fc : | t dS )zWrite your migrations here.N) create_modelr )migratordatabasefakekwargss r migrater s *%%%%%r c J | j d }| | dS )z$Write your rollback migrations here.r N)orm
drop_model)r r r r r s r rollbackr s( m,J
#####r )F)peeweer Modelr r r r r r <module>r" so ! ! ! ! ! ! ! !& & & &
$ $ $ $ $ $r defence360agent/migrations/__pycache__/025_malware_config_realtime.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003026 00000000000 026021 0 ustar
r_j 2 d dl Z d dlZd dlmZ ddZddZdS ) N) LocalConfigFc |rd S t }t j |j sd S t |j 5 }t j | }d d d n # 1 swxY w Y | di }| dd }||d< ||d< | |d d S )NMALWARE_SCANNINGenable_scan_uploaded_filesTenable_scan_pure_ftpdenable_scan_modsecF)validate)
r ospathexistsopenyaml safe_load
setdefaultpopdict_to_config) migratordatabasefakekwargs local_configfconfmalware_settingsvalues k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/025_malware_config_realtime.pymigrater s ==L
7>>,+ , ,
l !A~a ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! '92>> !=t D DE05,--2)* u 55555s
A..A25A2c d S )N )r r r r s r rollbackr s D )F)r
r defence360agent.contracts.configr r r r r! r <module>r# s[ 8 8 8 8 8 86 6 6 6( r! defence360agent/migrations/__pycache__/025_malware_config_realtime.cpython-311.pyc 0000644 0000000 0000000 00000003026 00000000000 025062 0 ustar
r_j 2 d dl Z d dlZd dlmZ ddZddZdS ) N) LocalConfigFc |rd S t }t j |j sd S t |j 5 }t j | }d d d n # 1 swxY w Y | di }| dd }||d< ||d< | |d d S )NMALWARE_SCANNINGenable_scan_uploaded_filesTenable_scan_pure_ftpdenable_scan_modsecF)validate)
r ospathexistsopenyaml safe_load
setdefaultpopdict_to_config) migratordatabasefakekwargs local_configfconfmalware_settingsvalues k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/025_malware_config_realtime.pymigrater s ==L
7>>,+ , ,
l !A~a ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! '92>> !=t D DE05,--2)* u 55555s
A..A25A2c d S )N )r r r r s r rollbackr s D )F)r
r defence360agent.contracts.configr r r r r! r <module>r# s[ 8 8 8 8 8 86 6 6 6( r! defence360agent/migrations/__pycache__/026_remove_old_temporary_file.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002466 00000000000 026426 0 ustar
r_j9 . d dl Z d dlZd dlZddZddZdS ) NFc |rd S t j }t j |d }t j | rt j | t j |d }t j | D ]5}t j | rt j | 6d S )Nz predict_model_description.jsonz imunify360*)tempfile
gettempdirospathjoinisfileremoveglob)migratordatabasefakekwargstmp_dirr patternfilenames m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/026_remove_old_temporary_file.pymigrater s !##G 7<<!A B BD w~~d
$ gll7M22GIg&&
7>>( # # Ih c d S )N )r r
r r s r rollbackr s Dr )F)r r r r r r r r <module>r sR $ r defence360agent/migrations/__pycache__/026_remove_old_temporary_file.cpython-311.pyc 0000644 0000000 0000000 00000002466 00000000000 025467 0 ustar
r_j9 . d dl Z d dlZd dlZddZddZdS ) NFc |rd S t j }t j |d }t j | rt j | t j |d }t j | D ]5}t j | rt j | 6d S )Nz predict_model_description.jsonz imunify360*)tempfile
gettempdirospathjoinisfileremoveglob)migratordatabasefakekwargstmp_dirr patternfilenames m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/026_remove_old_temporary_file.pymigrater s !##G 7<<!A B BD w~~d
$ gll7M22GIg&&
7>>( # # Ih c d S )N )r r
r r s r rollbackr s Dr )F)r r r r r r r r <module>r sR $ r defence360agent/migrations/__pycache__/027_disable_comdo_fp_rules.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001146 00000000000 025650 0 ustar
r_j d Z ddZddZdS )z\
Current migration doesn't needed,
because apache will be restarted in the other migrations
Fc d S N migratordatabasefakekwargss j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/027_disable_comdo_fp_rules.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r sA r
defence360agent/migrations/__pycache__/027_disable_comdo_fp_rules.cpython-311.pyc 0000644 0000000 0000000 00000001146 00000000000 024711 0 ustar
r_j d Z ddZddZdS )z\
Current migration doesn't needed,
because apache will be restarted in the other migrations
Fc d S N migratordatabasefakekwargss j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/027_disable_comdo_fp_rules.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r sA r
defence360agent/migrations/__pycache__/028_set_permanent_ttl_for_blacklist.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001653 00000000000 027616 0 ustar
r_j^ d Z ddZddZdS ) Fc | j d }| t |j dk |j t k z d S )Niplist)
expirationBLACK)ormupdate
PERMANENT_TTLwherelistnamer execute)migratordatabasefakekwargs IPListModels s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/028_set_permanent_ttl_for_blacklist.pymigrater s^ ,x(K-0066 ( !] 2 4 giiiii c d S )N )r
r r r s r rollbackr
s Dr N)F)r r r r r r <module>r s<
r defence360agent/migrations/__pycache__/028_set_permanent_ttl_for_blacklist.cpython-311.pyc 0000644 0000000 0000000 00000001653 00000000000 026657 0 ustar
r_j^ d Z ddZddZdS ) Fc | j d }| t |j dk |j t k z d S )Niplist)
expirationBLACK)ormupdate
PERMANENT_TTLwherelistnamer execute)migratordatabasefakekwargs IPListModels s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/028_set_permanent_ttl_for_blacklist.pymigrater s^ ,x(K-0066 ( !] 2 4 giiiii c d S )N )r
r r r s r rollbackr
s Dr N)F)r r r r r r <module>r s<
r defence360agent/migrations/__pycache__/029_custom_quarantine.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000763 00000000000 024734 0 ustar
r_jo d Z d Zd ZdS )z# Quarantine is removed in DEF-15234c d S N ___s e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/029_custom_quarantine.pymigrater D c d S r r r s r rollbackr
r
r N)__doc__r r
r r r <module>r s3 ) ) r defence360agent/migrations/__pycache__/029_custom_quarantine.cpython-311.pyc 0000644 0000000 0000000 00000000763 00000000000 023775 0 ustar
r_jo d Z d Zd ZdS )z# Quarantine is removed in DEF-15234c d S N ___s e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/029_custom_quarantine.pymigrater D c d S r r r s r rollbackr
r
r N)__doc__r r
r r r <module>r s3 ) ) r defence360agent/migrations/__pycache__/030_rename_max_incident_repetition.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004017 00000000000 027412 0 ustar
r_js l d dl mZmZ d dlmZ e d e fdefd ZddZdS ) )IConfig LocalConfig)log_error_and_ignoreF config_filec |rd S | }|sd S | di }| dd }|r||d< | di }| D ] } | dd }|r|| d< | d rD| di |d< | dd }
|
r |d j d i |
| |dd
d S ) NMOD_SEC_BLOCK_BY_SEVERITYmax_incident_repetition
max_incidents MOD_SEC_BLOCK_BY_CUSTOM_RULE
INCIDENT_LISTINCIDENT_LOGGING AUTOCLEANUPFT)validate overwrite )config_to_dict
setdefaultpopvaluesgetupdatedict_to_config) migratordatabasefaker kwargsconfigblock_by_severityvaluecustom_rule_listcustom_rule_confauto_cleanup_confs r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/030_rename_max_incident_repetition.pymigrater$ sZ
'
'
)
)F ))*ErJJ ! !";T B BE 3-2/* (()GLL , 3 3 5 5 6 6 $$%>EE 605 _ -
zz/"" C%+ZZ%D%D!" "JJ}d ; ; C -F% & - B B0A B B B v FFFFF c d S )Nr )r r r r s r# rollbackr' + s Dr% N)F) defence360agent.contracts.configr r defence360agent.utilsr r$ r' r r% r# <module>r* s A A A A A A A A 6 6 6 6 6 6
&;== "G "G "G "G "G "GJ r% defence360agent/migrations/__pycache__/030_rename_max_incident_repetition.cpython-311.pyc 0000644 0000000 0000000 00000004017 00000000000 026453 0 ustar
r_js l d dl mZmZ d dlmZ e d e fdefd ZddZdS ) )IConfig LocalConfig)log_error_and_ignoreF config_filec |rd S | }|sd S | di }| dd }|r||d< | di }| D ] } | dd }|r|| d< | d rD| di |d< | dd }
|
r |d j d i |
| |dd
d S ) NMOD_SEC_BLOCK_BY_SEVERITYmax_incident_repetition
max_incidents MOD_SEC_BLOCK_BY_CUSTOM_RULE
INCIDENT_LISTINCIDENT_LOGGING AUTOCLEANUPFT)validate overwrite )config_to_dict
setdefaultpopvaluesgetupdatedict_to_config) migratordatabasefaker kwargsconfigblock_by_severityvaluecustom_rule_listcustom_rule_confauto_cleanup_confs r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/030_rename_max_incident_repetition.pymigrater$ sZ
'
'
)
)F ))*ErJJ ! !";T B BE 3-2/* (()GLL , 3 3 5 5 6 6 $$%>EE 605 _ -
zz/"" C%+ZZ%D%D!" "JJ}d ; ; C -F% & - B B0A B B B v FFFFF c d S )Nr )r r r r s r# rollbackr' + s Dr% N)F) defence360agent.contracts.configr r defence360agent.utilsr r$ r' r r% r# <module>r* s A A A A A A A A 6 6 6 6 6 6
&;== "G "G "G "G "G "GJ r% defence360agent/migrations/__pycache__/031_add_mode_field.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002073 00000000000 024057 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc t | j d }| |t j d dS )zWrite your migrations here. malware_hitsT)null)modeN)orm
add_fieldspw IntegerFieldmigratordatabasefakekwargs MalwareHitss b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/031_add_mode_field.pymigrater s< ,~.K "/t*D*D*DEEEEE c L | j d }| |d dS )z$Write your rollback migrations here.r r N)r
remove_fieldsr s r rollbackr s* ,~.K ;/////r )F)loggingpeeweer getLogger__name__loggerr r r r <module>r sd
8 $ $F F F F0 0 0 0 0 0r defence360agent/migrations/__pycache__/031_add_mode_field.cpython-311.pyc 0000644 0000000 0000000 00000002073 00000000000 023120 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc t | j d }| |t j d dS )zWrite your migrations here. malware_hitsT)null)modeN)orm
add_fieldspw IntegerFieldmigratordatabasefakekwargs MalwareHitss b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/031_add_mode_field.pymigrater s< ,~.K "/t*D*D*DEEEEE c L | j d }| |d dS )z$Write your rollback migrations here.r r N)r
remove_fieldsr s r rollbackr s* ,~.K ;/////r )F)loggingpeeweer getLogger__name__loggerr r r r <module>r sd
8 $ $F F F F0 0 0 0 0 0r defence360agent/migrations/__pycache__/031_modsec_config_for_plesk_include.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004452 00000000000 027531 0 ustar
r_j d dl mZ d dlmZ d dlmZ ee Zej dd Zej dd Z dS ) ) getLogger)run_coro)antivirus_modeFc ddl m} ddlm} n# t $ r Y d S w xY w |s5| r!t
| sd S | ddl m
} | d S # t $ r3}t
dt | Y d }~d S d }~ww xY wNr )Plesk)ModSecSettings)graceful_restart_syncz"Error during web-server update: %s)im360.subsys.panels.pleskr &im360.subsys.panels.plesk.mod_securityr ImportError is_installedr installed_modsecinclude_modsec_conf!defence360agent.subsys.web_serverr
Exceptionloggerwarningstrmigratordatabasefakekwargsr r r
es s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/031_modsec_config_for_plesk_include.pymigrater 333333IIIIIII
E %%'' E 2 2 4 455
F**,,,KKKKKK E E E;SVVDDDDDDDDDE)
7B $B
B=
(B88B=c ddl m} ddlm} n# t $ r Y d S w xY w |s5| r!t
| sd S | ddl m
} | d S # t $ r3}t
dt | Y d }~d S d }~ww xY wr )r r r r r
r r r revert_conf_includer r
r r r r r s r rollbackr" ! r r N)F)
loggingr defence360agent.utilsr r __name__r skipr r" r <module>r) s * * * * * * 0 0 0 0 0 0 8 E E E E. E E E E E Er( defence360agent/migrations/__pycache__/031_modsec_config_for_plesk_include.cpython-311.pyc 0000644 0000000 0000000 00000004452 00000000000 026572 0 ustar
r_j d dl mZ d dlmZ d dlmZ ee Zej dd Zej dd Z dS ) ) getLogger)run_coro)antivirus_modeFc ddl m} ddlm} n# t $ r Y d S w xY w |s5| r!t
| sd S | ddl m
} | d S # t $ r3}t
dt | Y d }~d S d }~ww xY wNr )Plesk)ModSecSettings)graceful_restart_syncz"Error during web-server update: %s)im360.subsys.panels.pleskr &im360.subsys.panels.plesk.mod_securityr ImportError is_installedr installed_modsecinclude_modsec_conf!defence360agent.subsys.web_serverr
Exceptionloggerwarningstrmigratordatabasefakekwargsr r r
es s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/031_modsec_config_for_plesk_include.pymigrater 333333IIIIIII
E %%'' E 2 2 4 455
F**,,,KKKKKK E E E;SVVDDDDDDDDDE)
7B $B
B=
(B88B=c ddl m} ddlm} n# t $ r Y d S w xY w |s5| r!t
| sd S | ddl m
} | d S # t $ r3}t
dt | Y d }~d S d }~ww xY wr )r r r r r
r r r revert_conf_includer r
r r r r r s r rollbackr" ! r r N)F)
loggingr defence360agent.utilsr r __name__r skipr r" r <module>r) s * * * * * * 0 0 0 0 0 0 8 E E E E. E E E E E Er( defence360agent/migrations/__pycache__/032_chmod_quarantine.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000762 00000000000 024505 0 ustar
r_jo d Z d Zd ZdS )z# Quarantine is removed in DEF-15234c d S N ___s d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/032_chmod_quarantine.pymigrater D c d S r r r s r rollbackr
r
r N)__doc__r r
r r r <module>r s3 ) ) r defence360agent/migrations/__pycache__/032_chmod_quarantine.cpython-311.pyc 0000644 0000000 0000000 00000000762 00000000000 023546 0 ustar
r_jo d Z d Zd ZdS )z# Quarantine is removed in DEF-15234c d S N ___s d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/032_chmod_quarantine.pymigrater D c d S r r r s r rollbackr
r
r N)__doc__r r
r r r <module>r s3 ) ) r defence360agent/migrations/__pycache__/033_disable_cphulk.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002725 00000000000 024137 0 ustar
r_j} Z d dl Z d dlZd dlmZ d dlmZ ee Zd ZddZ ddZ
dS ) N) Packaging) getLoggerc t j dt j z dg d S # t j $ r%} t
| Y d } ~ d S d } ~ ww xY w)Nz %s/scripts/disable_3rd_party_idsz --nocheck)
subprocess
check_callr DATADIRCalledProcessErrorloggererror)es b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/033_disable_cphulk.pydisable_3rdpartyr
sx 2Y5FF
( Qs #' AAAFc | |s)t j t j sd S t d S N)ospathisfiler r r migratordatabasefakekwargss r
migrater s9 27>>)"344 c d S r r s r
rollbackr s Dr )F) r r defence360agent.contracts.configr loggingr __name__r
r r r r r r
<module>r! s 6 6 6 6 6 6 8 r defence360agent/migrations/__pycache__/033_disable_cphulk.cpython-311.pyc 0000644 0000000 0000000 00000002725 00000000000 023200 0 ustar
r_j} Z d dl Z d dlZd dlmZ d dlmZ ee Zd ZddZ ddZ
dS ) N) Packaging) getLoggerc t j dt j z dg d S # t j $ r%} t
| Y d } ~ d S d } ~ ww xY w)Nz %s/scripts/disable_3rd_party_idsz --nocheck)
subprocess
check_callr DATADIRCalledProcessErrorloggererror)es b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/033_disable_cphulk.pydisable_3rdpartyr
sx 2Y5FF
( Qs #' AAAFc | |s)t j t j sd S t d S N)ospathisfiler r r migratordatabasefakekwargss r
migrater s9 27>>)"344 c d S r r s r
rollbackr s Dr )F) r r defence360agent.contracts.configr loggingr __name__r
r r r r r r
<module>r! s 6 6 6 6 6 6 8 r defence360agent/migrations/__pycache__/034_hits_extras.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003607 00000000000 023524 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc | j d G fddt j }| | dS )zWrite your migrations here. malware_hitsc e Zd Z G d d Z ej d Z ej dd Z ej d Z
ej d Z d S )
migrate.<locals>.MalwareHitExtrac e Zd ZdZdS )%migrate.<locals>.MalwareHitExtra.Metamalware_hit_extrasN)__name__
__module__ __qualname__db_table _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/034_hits_extras.pyMetar s +HHHr r T) primary_keyFextras)null related_name)r N) r
r r r pw IntegerFieldidForeignKeyFieldhit CharFieldnamevalue)
MalwareHits r MalwareHitExtrar s , , , , , , , , R_
.
.
. b %hOOOr|''' %(((r r N)ormr Model create_model)migratordatabasefakekwargsr r s @r migrater' sc n-J) ) ) ) ) ) )"( ) ) )
/*****r c J | j d }| | dS )z$Write your rollback migrations here.r N)r remove_model)r# r$ r% r& r s r rollbackr* s) l#78O /*****r )F)loggingpeeweer getLoggerr
loggerr' r* r r r <module>r/ s`
8 $ $+ + + +"+ + + + + +r defence360agent/migrations/__pycache__/034_hits_extras.cpython-311.pyc 0000644 0000000 0000000 00000003607 00000000000 022565 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc | j d G fddt j }| | dS )zWrite your migrations here. malware_hitsc e Zd Z G d d Z ej d Z ej dd Z ej d Z
ej d Z d S )
migrate.<locals>.MalwareHitExtrac e Zd ZdZdS )%migrate.<locals>.MalwareHitExtra.Metamalware_hit_extrasN)__name__
__module__ __qualname__db_table _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/034_hits_extras.pyMetar s +HHHr r T) primary_keyFextras)null related_name)r N) r
r r r pw IntegerFieldidForeignKeyFieldhit CharFieldnamevalue)
MalwareHits r MalwareHitExtrar s , , , , , , , , R_
.
.
. b %hOOOr|''' %(((r r N)ormr Model create_model)migratordatabasefakekwargsr r s @r migrater' sc n-J) ) ) ) ) ) )"( ) ) )
/*****r c J | j d }| | dS )z$Write your rollback migrations here.r N)r remove_model)r# r$ r% r& r s r rollbackr* s) l#78O /*****r )F)loggingpeeweer getLoggerr
loggerr' r* r r r <module>r/ s`
8 $ $+ + + +"+ + + + + +r defence360agent/migrations/__pycache__/035_add_dos_expiration_field.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001660 00000000000 026167 0 ustar
r_jh d dl ZddZddZdS ) NFc v | j d }| |t j dd d S )Niplistr T)defaultnull)dos_expiration)orm
add_fieldspw IntegerFieldmigratordatabasefakekwargsIPLists l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/035_add_dos_expiration_field.pymigrater sI
\(
#F rqt D D D c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s+
\(
#F 6#344444r )F)peeweer
r r r r <module>r sC 5 5 5 5 5 5r defence360agent/migrations/__pycache__/035_add_dos_expiration_field.cpython-311.pyc 0000644 0000000 0000000 00000001660 00000000000 025230 0 ustar
r_jh d dl ZddZddZdS ) NFc v | j d }| |t j dd d S )Niplistr T)defaultnull)dos_expiration)orm
add_fieldspw IntegerFieldmigratordatabasefakekwargsIPLists l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/035_add_dos_expiration_field.pymigrater sI
\(
#F rqt D D D c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s+
\(
#F 6#344444r )F)peeweer
r r r r <module>r sC 5 5 5 5 5 5r defence360agent/migrations/__pycache__/036_add_block_port.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006056 00000000000 024140 0 ustar
r_j j d dl Z G d dej Z G d dej Zd dZd dZdS )
Nc e Zd ZdZ ej d Z ej d ej d g Z ej d Z
G d d Z d S )
BlockedPortz+
Port + protocol for blocking data
Fnullz proto in ('tcp', 'udp', 'all'))r constraintsTc e Zd ZdZdZdS )BlockedPort.Meta blocked_port)))portprotoTN__name__
__module__ __qualname__db_tableindexes b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/036_add_block_port.pyMetar s !
r r N) r r r __doc__pw IntegerFieldr CharFieldCheckr commentr r r r r r s 2? & & &D BL
*J!K!K L
E bl%%%G
r r c e Zd ZdZ ej eddd Z ej d Z ej d Z
G d d Z d
S )
IgnoredByPortz)
Ignored IPs for port + protocol
FCASCADEips)r on_delete related_namer Tc e Zd ZdZdZdS )IgnoredByPort.Metaignored_by_port_proto)))
port_protoipTNr
r r r r r$ $ s *
r r N) r r r r r ForeignKeyFieldr r& r r' r r r r r r r s $#%95 J
5 ! ! !Bbl%%%G
r r Fc | t | t | j d }| |t j d d S )NiplistTr ) full_access) create_modelr r orm
add_fieldsr BooleanField)migratordatabasefakekwargsIPLists r migrater5 - sb +&&& -(((
\(
#F BO,F,F,FGGGGGr c | j d }| j d }| j d }| | | | | |d d S )Nr
blocked_port_ipr* r+ )r- remove_model
remove_fields)r0 r1 r2 r3 r r r4 s r rollbackr: 5 sk ,~.K L!23M
\(
#F +&&& -((( 6=11111r )F)peeweer Modelr r r5 r: r r r <module>r= s
"(
*
BH
(H H H H2 2 2 2 2 2r defence360agent/migrations/__pycache__/036_add_block_port.cpython-311.pyc 0000644 0000000 0000000 00000006056 00000000000 023201 0 ustar
r_j j d dl Z G d dej Z G d dej Zd dZd dZdS )
Nc e Zd ZdZ ej d Z ej d ej d g Z ej d Z
G d d Z d S )
BlockedPortz+
Port + protocol for blocking data
Fnullz proto in ('tcp', 'udp', 'all'))r constraintsTc e Zd ZdZdZdS )BlockedPort.Meta blocked_port)))portprotoTN__name__
__module__ __qualname__db_tableindexes b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/036_add_block_port.pyMetar s !
r r N) r r r __doc__pw IntegerFieldr CharFieldCheckr commentr r r r r r s 2? & & &D BL
*J!K!K L
E bl%%%G
r r c e Zd ZdZ ej eddd Z ej d Z ej d Z
G d d Z d
S )
IgnoredByPortz)
Ignored IPs for port + protocol
FCASCADEips)r on_delete related_namer Tc e Zd ZdZdZdS )IgnoredByPort.Metaignored_by_port_proto)))
port_protoipTNr
r r r r r$ $ s *
r r N) r r r r r ForeignKeyFieldr r& r r' r r r r r r r s $#%95 J
5 ! ! !Bbl%%%G
r r Fc | t | t | j d }| |t j d d S )NiplistTr ) full_access) create_modelr r orm
add_fieldsr BooleanField)migratordatabasefakekwargsIPLists r migrater5 - sb +&&& -(((
\(
#F BO,F,F,FGGGGGr c | j d }| j d }| j d }| | | | | |d d S )Nr
blocked_port_ipr* r+ )r- remove_model
remove_fields)r0 r1 r2 r3 r r r4 s r rollbackr: 5 sk ,~.K L!23M
\(
#F +&&& -((( 6=11111r )F)peeweer Modelr r r5 r: r r r <module>r= s
"(
*
BH
(H H H H2 2 2 2 2 2r defence360agent/migrations/__pycache__/037_disabled_rules.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005445 00000000000 024155 0 ustar
r_j| F d dl Z d dlZ e j e ZddZddZdS ) NFc G d dt j G fddt j }| | | dS )zWrite your migrations here.c e Zd Z G d d Z ej Z ej d Z ej d Z ej
d Z dS ) migrate.<locals>.DisabledRulec e Zd ZdZdZdS )"migrate.<locals>.DisabledRule.Metadisabled_rules)))pluginrule_idTN)__name__
__module__ __qualname__db_tableindexes b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/037_disabled_rules.pyMetar
s 'H6GGGr r FnullN) r r r
r pwPrimaryKeyFieldid CharFieldr r
TextFieldnamer r r DisabledRuler s 7 7 7 7 7 7 7 7 R
!
! 5))) ",E***r|'''r r c r e Zd Z ej dd Z ej d Z G d d ZdS ) #migrate.<locals>.DisabledRuleDomaindomainsCASCADE)backref on_deleteFr c 4 e Zd ZdZ ej dd ZdS )(migrate.<locals>.DisabledRuleDomain.Metadisabled_rules_domainsdisabled_rule_id_iddomainN)r r r
r r CompositeKey primary_keyr r r r r$ s' /H)"/*?JJKKKr r N) r r r
r ForeignKeyFieldr& r r' r )r s r DisabledRuleDomainr s~ 0b 0 )y
5))) K K K K K K K K K Kr r+ N)r Model create_model)migratordatabasefakekwargsr+ r s @r migrater2 s ( ( ( ( (rx ( ( (K K K K K K KRX K K K
,''' ,-----r c | | j d | | j d dS )z$Write your rollback migrations here.r% r N) remove_modelorm)r. r/ r0 r1 s r rollbackr6 $ s@ (,'?@AAA (,'7899999r )F)loggingpeeweer getLoggerr loggerr2 r6 r r r <module>r; s`
8 $ $. . . .6: : : : : :r defence360agent/migrations/__pycache__/037_disabled_rules.cpython-311.pyc 0000644 0000000 0000000 00000005445 00000000000 023216 0 ustar
r_j| F d dl Z d dlZ e j e ZddZddZdS ) NFc G d dt j G fddt j }| | | dS )zWrite your migrations here.c e Zd Z G d d Z ej Z ej d Z ej d Z ej
d Z dS ) migrate.<locals>.DisabledRulec e Zd ZdZdZdS )"migrate.<locals>.DisabledRule.Metadisabled_rules)))pluginrule_idTN)__name__
__module__ __qualname__db_tableindexes b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/037_disabled_rules.pyMetar
s 'H6GGGr r FnullN) r r r
r pwPrimaryKeyFieldid CharFieldr r
TextFieldnamer r r DisabledRuler s 7 7 7 7 7 7 7 7 R
!
! 5))) ",E***r|'''r r c r e Zd Z ej dd Z ej d Z G d d ZdS ) #migrate.<locals>.DisabledRuleDomaindomainsCASCADE)backref on_deleteFr c 4 e Zd ZdZ ej dd ZdS )(migrate.<locals>.DisabledRuleDomain.Metadisabled_rules_domainsdisabled_rule_id_iddomainN)r r r
r r CompositeKey primary_keyr r r r r$ s' /H)"/*?JJKKKr r N) r r r
r ForeignKeyFieldr& r r' r )r s r DisabledRuleDomainr s~ 0b 0 )y
5))) K K K K K K K K K Kr r+ N)r Model create_model)migratordatabasefakekwargsr+ r s @r migrater2 s ( ( ( ( (rx ( ( (K K K K K K KRX K K K
,''' ,-----r c | | j d | | j d dS )z$Write your rollback migrations here.r% r N) remove_modelorm)r. r/ r0 r1 s r rollbackr6 $ s@ (,'?@AAA (,'7899999r )F)loggingpeeweer getLoggerr loggerr2 r6 r r r <module>r; s`
8 $ $. . . .6: : : : : :r defence360agent/migrations/__pycache__/038_disabled_rules_import.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002522 00000000000 025541 0 ustar
r_j h d dl Z d dlmZmZ e j e Zd e fdefdZddZdS ) N)IConfig LocalConfigF config_filec |rdS | }|sdS | di | di dg | |dd dS )zWrite your migrations here.NOSSECMOD_SEC_BLOCK_BY_SEVERITYignoreTF) overwritevalidate)config_to_dictpopgetdict_to_config)migratordatabasefaker kwargsconfigs i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/038_disabled_rules_import.pymigrater s
'
'
)
)F
JJw JJ*B//33HbAAA v FFFFF c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr s Dr )F) logging defence360agent.contracts.configr r getLogger__name__loggerr r r r r <module>r s A A A A A A A A 8 $ $
&;== G G G G G G0 r defence360agent/migrations/__pycache__/038_disabled_rules_import.cpython-311.pyc 0000644 0000000 0000000 00000002522 00000000000 024602 0 ustar
r_j h d dl Z d dlmZmZ e j e Zd e fdefdZddZdS ) N)IConfig LocalConfigF config_filec |rdS | }|sdS | di | di dg | |dd dS )zWrite your migrations here.NOSSECMOD_SEC_BLOCK_BY_SEVERITYignoreTF) overwritevalidate)config_to_dictpopgetdict_to_config)migratordatabasefaker kwargsconfigs i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/038_disabled_rules_import.pymigrater s
'
'
)
)F
JJw JJ*B//33HbAAA v FFFFF c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr s Dr )F) logging defence360agent.contracts.configr r getLogger__name__loggerr r r r r <module>r s A A A A A A A A 8 $ $
&;== G G G G G G0 r defence360agent/migrations/__pycache__/039_fix_malware_hits.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002730 00000000000 024515 0 ustar
r_j > d dl Z e j e ZddZddZdS ) NFc | d | d | d | d dS )zWrite your migrations here.a
CREATE TABLE "malware_hits_new" (
"id" INTEGER NOT NULL PRIMARY KEY,
"scanid_id" VARCHAR(255) NOT NULL,
"user" VARCHAR(255) NOT NULL,
"orig_file" VARCHAR(255) NOT NULL,
"type" VARCHAR(255) NOT NULL,
"restored" INTEGER NOT NULL,
"mode" INTEGER,
FOREIGN KEY ("scanid_id") REFERENCES "malware_scans" ("scanid"))
z7INSERT INTO malware_hits_new SELECT * FROM malware_hitszDROP TABLE malware_hitsz3ALTER TABLE malware_hits_new RENAME TO malware_hitsN)sqlmigratordatabasefakekwargss d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/039_fix_malware_hits.pymigrater s`
LL
LLJKKK LL*+++ LLFGGGGG c dS )z$Write your rollback migrations here.N r s r
rollbackr s Dr )F)logging getLogger__name__loggerr r r r r
<module>r sX
8 $ $H H H H* r defence360agent/migrations/__pycache__/039_fix_malware_hits.cpython-311.pyc 0000644 0000000 0000000 00000002730 00000000000 023556 0 ustar
r_j > d dl Z e j e ZddZddZdS ) NFc | d | d | d | d dS )zWrite your migrations here.a
CREATE TABLE "malware_hits_new" (
"id" INTEGER NOT NULL PRIMARY KEY,
"scanid_id" VARCHAR(255) NOT NULL,
"user" VARCHAR(255) NOT NULL,
"orig_file" VARCHAR(255) NOT NULL,
"type" VARCHAR(255) NOT NULL,
"restored" INTEGER NOT NULL,
"mode" INTEGER,
FOREIGN KEY ("scanid_id") REFERENCES "malware_scans" ("scanid"))
z7INSERT INTO malware_hits_new SELECT * FROM malware_hitszDROP TABLE malware_hitsz3ALTER TABLE malware_hits_new RENAME TO malware_hitsN)sqlmigratordatabasefakekwargss d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/039_fix_malware_hits.pymigrater s`
LL
LLJKKK LL*+++ LLFGGGGG c dS )z$Write your rollback migrations here.N r s r
rollbackr s Dr )F)logging getLogger__name__loggerr r r r r
<module>r sX
8 $ $H H H H* r defence360agent/migrations/__pycache__/040_ignore_mod_sec_rule_214920.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001055 00000000000 026003 0 ustar
r_j d Z ddZddZdS )z#Migration was buggy, so skipping itFc d S N migratordatabasefakekwargss n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/040_ignore_mod_sec_rule_214920.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r s= ) ) r
defence360agent/migrations/__pycache__/040_ignore_mod_sec_rule_214920.cpython-311.pyc 0000644 0000000 0000000 00000001055 00000000000 025044 0 ustar
r_j d Z ddZddZdS )z#Migration was buggy, so skipping itFc d S N migratordatabasefakekwargss n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/040_ignore_mod_sec_rule_214920.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r s= ) ) r
defence360agent/migrations/__pycache__/041_fix_invalid_ignore_filed.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001116 00000000000 026160 0 ustar
r_j d Z ddZddZdS )zFAdding 214920 rule to ignored on disabled rules level in 038 migrationFc d S N migratordatabasefakekwargss l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/041_fix_invalid_ignore_filed.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r s= L L r
defence360agent/migrations/__pycache__/041_fix_invalid_ignore_filed.cpython-311.pyc 0000644 0000000 0000000 00000001116 00000000000 025221 0 ustar
r_j d Z ddZddZdS )zFAdding 214920 rule to ignored on disabled rules level in 038 migrationFc d S N migratordatabasefakekwargss l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/041_fix_invalid_ignore_filed.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r s= L L r
defence360agent/migrations/__pycache__/042_rebuildinstalledssldb.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003011 00000000000 025531 0 ustar
r_ju d dl Z d dlZd dlmZ e j e Zej dd Zej dd Z dS ) N)antivirus_modeFc |rd S ddl m} n# t $ r Y d S w xY w| rX t j dg d S # t $ r3}t dt | Y d }~d S d }~ww xY wd S )Nr )cPanelz /scripts/rebuildinstalledssldbz#Failed to rebuild cpanel ssl db: %s)
im360.subsys.panels.cpanelr ImportError is_installed
subprocessrun Exceptionloggerwarningstr)migratordatabasefakekwargsr es i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/042_rebuildinstalledssldb.pymigrater s 5555555 J J N <= > > > > > J J J NN@#a&& I I I I I I I I I JJ Js#
A
B(BBc d S )N )r r r r s r rollbackr s D )F)
loggingr defence360agent.utilsr getLogger__name__r skipr r r r r <module>r s 0 0 0 0 0 0 8 $ $ J J J J r defence360agent/migrations/__pycache__/042_rebuildinstalledssldb.cpython-311.pyc 0000644 0000000 0000000 00000003011 00000000000 024572 0 ustar
r_ju d dl Z d dlZd dlmZ e j e Zej dd Zej dd Z dS ) N)antivirus_modeFc |rd S ddl m} n# t $ r Y d S w xY w| rX t j dg d S # t $ r3}t dt | Y d }~d S d }~ww xY wd S )Nr )cPanelz /scripts/rebuildinstalledssldbz#Failed to rebuild cpanel ssl db: %s)
im360.subsys.panels.cpanelr ImportError is_installed
subprocessrun Exceptionloggerwarningstr)migratordatabasefakekwargsr es i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/042_rebuildinstalledssldb.pymigrater s 5555555 J J N <= > > > > > J J J NN@#a&& I I I I I I I I I JJ Js#
A
B(BBc d S )N )r r r r s r rollbackr s D )F)
loggingr defence360agent.utilsr getLogger__name__r skipr r r r r <module>r s 0 0 0 0 0 0 8 $ $ J J J J r defence360agent/migrations/__pycache__/043_disable_dos_scan_by_default.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001770 00000000000 026640 0 ustar
r_j " d dl mZ ddZddZdS ) )
ConfigFileFc |rd S t }| }|sd S | di }d|d< | |d d S )NDOSFenabled)validate)r config_to_dict
setdefaultdict_to_config)migratordatabasefakekwargs config_fileconfig dos_settingss o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/043_disable_dos_scan_by_default.pymigrater st ,,K
'
'
)
)F $$UB//L #L v 66666 c d S )N )r r r
r s r rollbackr s Dr N)F) defence360agent.contracts.configr r r r r r <module>r sI 7 7 7 7 7 7
7
7
7
7 r defence360agent/migrations/__pycache__/043_disable_dos_scan_by_default.cpython-311.pyc 0000644 0000000 0000000 00000001770 00000000000 025701 0 ustar
r_j " d dl mZ ddZddZdS ) )
ConfigFileFc |rd S t }| }|sd S | di }d|d< | |d d S )NDOSFenabled)validate)r config_to_dict
setdefaultdict_to_config)migratordatabasefakekwargs config_fileconfig dos_settingss o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/043_disable_dos_scan_by_default.pymigrater st ,,K
'
'
)
)F $$UB//L #L v 66666 c d S )N )r r r
r s r rollbackr s Dr N)F) defence360agent.contracts.configr r r r r r <module>r sI 7 7 7 7 7 7
7
7
7
7 r defence360agent/migrations/__pycache__/044_ignore_virtfs_on_cpanel.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002003 00000000000 026053 0 ustar
r_j & d Z ddlmZ ddZddZdS )z[
This migration adds cpanel virtfs directory (/home/virtfs) to ignore
for malware scanning
)cPanelFc ~ |s8t j r'| j d }| d d S d S d S )Nmalware_ignore_pathz /home/virtfs)path)r is_installedorm
get_or_create)migratordatabasefakekwargsMalwareIgnorePaths k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/044_ignore_virtfs_on_cpanel.pymigrater sY =f)++ = $L)> ?''^'<<<<<= = = = c d S )N )r
r r r
s r rollbackr s Dr N)F)__doc__$defence360agent.subsys.panels.cpanelr r r r r r <module>r sU 8 7 7 7 7 7= = = = r defence360agent/migrations/__pycache__/044_ignore_virtfs_on_cpanel.cpython-311.pyc 0000644 0000000 0000000 00000002003 00000000000 025114 0 ustar
r_j & d Z ddlmZ ddZddZdS )z[
This migration adds cpanel virtfs directory (/home/virtfs) to ignore
for malware scanning
)cPanelFc ~ |s8t j r'| j d }| d d S d S d S )Nmalware_ignore_pathz /home/virtfs)path)r is_installedorm
get_or_create)migratordatabasefakekwargsMalwareIgnorePaths k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/044_ignore_virtfs_on_cpanel.pymigrater sY =f)++ = $L)> ?''^'<<<<<= = = = c d S )N )r
r r r
s r rollbackr s Dr N)F)__doc__$defence360agent.subsys.panels.cpanelr r r r r r <module>r sU 8 7 7 7 7 7= = = = r defence360agent/migrations/__pycache__/045_ignore_vdserver_dir_in_csf.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001575 00000000000 026555 0 ustar
r_jS . d dl Z d dlmZ dZddZddZdS ) N)append_with_newlinez/etc/csf/csf.fignoreFc |s;t j t rt t d d S d S d S )Nz/tmp/.vdserver
)ospathisfile CSF_FIGNOREr migratordatabasefakekwargss n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/045_ignore_vdserver_dir_in_csf.pymigrater sJ =bgnn[11 =K);<<<<<= = = = c d S )N r s r rollbackr
s Dr )F)r defence360agent.utilsr r r r r r r <module>r sW 5 5 5 5 5 5$ = = = =
r defence360agent/migrations/__pycache__/045_ignore_vdserver_dir_in_csf.cpython-311.pyc 0000644 0000000 0000000 00000001575 00000000000 025616 0 ustar
r_jS . d dl Z d dlmZ dZddZddZdS ) N)append_with_newlinez/etc/csf/csf.fignoreFc |s;t j t rt t d d S d S d S )Nz/tmp/.vdserver
)ospathisfile CSF_FIGNOREr migratordatabasefakekwargss n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/045_ignore_vdserver_dir_in_csf.pymigrater sJ =bgnn[11 =K);<<<<<= = = = c d S )N r s r rollbackr
s Dr )F)r defence360agent.utilsr r r r r r r <module>r sW 5 5 5 5 5 5$ = = = =
r defence360agent/migrations/__pycache__/046_foreign_key_fix.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002643 00000000000 024340 0 ustar
r_jk > d dl Z e j e ZddZddZdS ) NFc | d | d | d | d dS )zWrite your migrations here.aB
CREATE TABLE "malware_hit_extras_new" (
"id" INTEGER NOT NULL PRIMARY KEY,
"hit_id" INTEGER NOT NULL,
"name" VARCHAR(255) NOT NULL,
"value" VARCHAR(255) NOT NULL,
FOREIGN KEY ("hit_id")
REFERENCES "malware_hits" ("id") ON DELETE CASCADE
)
zCINSERT INTO malware_hit_extras_new SELECT * FROM malware_hit_extrasz DROP TABLE malware_hit_extrasz?ALTER TABLE malware_hit_extras_new RENAME TO malware_hit_extrasN)sqlmigratordatabasefakekwargss c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/046_foreign_key_fix.pymigrater sr
LL
LLM
LL0111 LLI c dS )z$Write your rollback migrations here.N r s r
rollbackr s Dr )F)logging getLogger__name__loggerr r r r r
<module>r sT
8 $ $ 0 r defence360agent/migrations/__pycache__/046_foreign_key_fix.cpython-311.pyc 0000644 0000000 0000000 00000002643 00000000000 023401 0 ustar
r_jk > d dl Z e j e ZddZddZdS ) NFc | d | d | d | d dS )zWrite your migrations here.aB
CREATE TABLE "malware_hit_extras_new" (
"id" INTEGER NOT NULL PRIMARY KEY,
"hit_id" INTEGER NOT NULL,
"name" VARCHAR(255) NOT NULL,
"value" VARCHAR(255) NOT NULL,
FOREIGN KEY ("hit_id")
REFERENCES "malware_hits" ("id") ON DELETE CASCADE
)
zCINSERT INTO malware_hit_extras_new SELECT * FROM malware_hit_extrasz DROP TABLE malware_hit_extrasz?ALTER TABLE malware_hit_extras_new RENAME TO malware_hit_extrasN)sqlmigratordatabasefakekwargss c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/046_foreign_key_fix.pymigrater sr
LL
LLM
LL0111 LLI c dS )z$Write your rollback migrations here.N r s r
rollbackr s Dr )F)logging getLogger__name__loggerr r r r r
<module>r sT
8 $ $ 0 r defence360agent/migrations/__pycache__/047_license_in_file.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002502 00000000000 024273 0 ustar
r_j@ . d dl Z d dlmZ dZddZddZdS ) N)
model_to_dictz /var/imunify360/license_old.jsonFc ( |rd S | j d }| ddd \ }}t t d 5 }t j t
| | d d d n # 1 swxY w Y | | d S )NlicenseTr )status
expiration)defaultsw)orm
get_or_createopenFALLBACK_LICENSE_FILEjsondumpr remove_model)migratordatabasefakekwargs LicenseModellic_fs c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/047_license_in_file.pymigrater s < *L
'
'
( FC
#S ) ) )Q -$$a((() ) ) ) ) ) ) ) ) ) ) ) ) ) ) ,'''''s #A22A69A6c d S )N )r r r r s r rollbackr s D )F)r playhouse.shortcutsr r
r r r r r <module>r sX - - - - - -: ( ( ( ( r defence360agent/migrations/__pycache__/047_license_in_file.cpython-311.pyc 0000644 0000000 0000000 00000002502 00000000000 023334 0 ustar
r_j@ . d dl Z d dlmZ dZddZddZdS ) N)
model_to_dictz /var/imunify360/license_old.jsonFc ( |rd S | j d }| ddd \ }}t t d 5 }t j t
| | d d d n # 1 swxY w Y | | d S )NlicenseTr )status
expiration)defaultsw)orm
get_or_createopenFALLBACK_LICENSE_FILEjsondumpr remove_model)migratordatabasefakekwargs LicenseModellic_fs c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/047_license_in_file.pymigrater s < *L
'
'
( FC
#S ) ) )Q -$$a((() ) ) ) ) ) ) ) ) ) ) ) ) ) ) ,'''''s #A22A69A6c d S )N )r r r r s r rollbackr s D )F)r playhouse.shortcutsr r
r r r r r <module>r sX - - - - - -: ( ( ( ( r defence360agent/migrations/__pycache__/048_malware_hits_vendor_field.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002036 00000000000 026366 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc v | j d }| |t j dd d S )N malware_hitsFclamav)nulldefault)vendor)orm
add_fieldspw CharFieldmigratordatabasefakekwargs MalwareHitss m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/048_malware_hits_vendor_field.pymigrater sI ,~.K BLeX F F F c L | j d }| |d d S )Nr r )r
remove_fieldsr
s r rollbackr s* ,~.K ;11111r )F)loggingpeeweer getLogger__name__loggerr r r r <module>r s`
8 $ $ 2 2 2 2 2 2r defence360agent/migrations/__pycache__/048_malware_hits_vendor_field.cpython-311.pyc 0000644 0000000 0000000 00000002036 00000000000 025427 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc v | j d }| |t j dd d S )N malware_hitsFclamav)nulldefault)vendor)orm
add_fieldspw CharFieldmigratordatabasefakekwargs MalwareHitss m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/048_malware_hits_vendor_field.pymigrater sI ,~.K BLeX F F F c L | j d }| |d d S )Nr r )r
remove_fieldsr
s r rollbackr s* ,~.K ;11111r )F)loggingpeeweer getLogger__name__loggerr r r r <module>r s`
8 $ $ 2 2 2 2 2 2r defence360agent/migrations/__pycache__/049_add_auto_added_field_to_iplist.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002163 00000000000 027323 0 ustar
r_j " d Z ddlZddZddZdS )z
Introducing new filed `auto_whitelisted` in order to mark IPs that were
autowhitelied during `--remote-addr` flag.
This will help to differentiate such IPs in UI.
NFc v | j d }| |t j dd d S )NiplistFT)defaultnull)auto_whitelisted)orm
add_fieldspw BooleanFieldmigratordatabasefakekwargsIPLists r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/049_add_auto_added_field_to_iplist.pymigrater sI
\(
#F T!J!J!J c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s+
\(
#F 6#566666r )F)__doc__peeweer
r r r r <module>r sO
7 7 7 7 7 7r defence360agent/migrations/__pycache__/049_add_auto_added_field_to_iplist.cpython-311.pyc 0000644 0000000 0000000 00000002163 00000000000 026364 0 ustar
r_j " d Z ddlZddZddZdS )z
Introducing new filed `auto_whitelisted` in order to mark IPs that were
autowhitelied during `--remote-addr` flag.
This will help to differentiate such IPs in UI.
NFc v | j d }| |t j dd d S )NiplistFT)defaultnull)auto_whitelisted)orm
add_fieldspw BooleanFieldmigratordatabasefakekwargsIPLists r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/049_add_auto_added_field_to_iplist.pymigrater sI
\(
#F T!J!J!J c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s+
\(
#F 6#566666r )F)__doc__peeweer
r r r r <module>r sO
7 7 7 7 7 7r defence360agent/migrations/__pycache__/050_fill_auto_whitelisted.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002020 00000000000 025534 0 ustar
r_j d Z ddZddZdS )zw
Filling `auto_whitelisted` filed that was added in previous 049 migration.
Matching IPs that were auto added earlier.
Fc | j d }| d |j d d S )NiplistT)auto_whitelistedzIP auto-whitelisted with)ormupdatewherecomment
startswithexecute)migratordatabasefakekwargsIPLists i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/050_fill_auto_whitelisted.pymigrater sR
\(
#F
MM4M((..!!"<==
giiiii c d S )N )r r r
r s r rollbackr s Dr N)F)__doc__r r r r r <module>r sA r defence360agent/migrations/__pycache__/050_fill_auto_whitelisted.cpython-311.pyc 0000644 0000000 0000000 00000002020 00000000000 024575 0 ustar
r_j d Z ddZddZdS )zw
Filling `auto_whitelisted` filed that was added in previous 049 migration.
Matching IPs that were auto added earlier.
Fc | j d }| d |j d d S )NiplistT)auto_whitelistedzIP auto-whitelisted with)ormupdatewherecomment
startswithexecute)migratordatabasefakekwargsIPLists i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/050_fill_auto_whitelisted.pymigrater sR
\(
#F
MM4M((..!!"<==
giiiii c d S )N )r r r
r s r rollbackr s Dr N)F)__doc__r r r r r <module>r sA r defence360agent/migrations/__pycache__/051_cleanup_vd_license.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004621 00000000000 025005 0 ustar
r_j l d dl Z d dlZd dlmZ ej e Z G d d ZddZddZ dS ) N)suppressc e Zd ZdZd Zd ZdS )VirusdieLicensez /usr/local/vdserver/config.jsonc 0 | d d S )N )
_write_key)selfs f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/051_cleanup_vd_license.py
unregisterzVirusdieLicense.unregister s c t | j 5 }t j | }d d d n # 1 swxY w Y ||d< t | j d 5 }t j ||ddd d d d d S # 1 swxY w Y d S )N vdbApiKeywT ),z: ) sort_keysindent
separators)open CONFIG_FILEjsonloaddump)r key read_filecontent
write_files r
r zVirusdieLicense._write_key s
$"
#
# +yi **G + + + + + + + + + + + + + + + #
$"C
(
( J I &
s 6::BB BN)__name__
__module__ __qualname__r r r r r
r r s7 3K
r r Fc t t 5 t ddd dS # 1 swxY w Y dS )zWrite your migrations here.N)r FileNotFoundErrorr r migratordatabasefakekwargss r
migrater) s
# $ $ ' '$$&&&' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' 's !AA
Ac dS )z$Write your rollback migrations here.Nr! r$ s r
rollbackr+ % s Dr )F)
r logging
contextlibr getLoggerr loggerr r) r+ r! r r
<module>r0 s 8 $ $ ,' ' ' ' r defence360agent/migrations/__pycache__/051_cleanup_vd_license.cpython-311.pyc 0000644 0000000 0000000 00000004621 00000000000 024046 0 ustar
r_j l d dl Z d dlZd dlmZ ej e Z G d d ZddZddZ dS ) N)suppressc e Zd ZdZd Zd ZdS )VirusdieLicensez /usr/local/vdserver/config.jsonc 0 | d d S )N )
_write_key)selfs f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/051_cleanup_vd_license.py
unregisterzVirusdieLicense.unregister s c t | j 5 }t j | }d d d n # 1 swxY w Y ||d< t | j d 5 }t j ||ddd d d d d S # 1 swxY w Y d S )N vdbApiKeywT ),z: ) sort_keysindent
separators)open CONFIG_FILEjsonloaddump)r key read_filecontent
write_files r
r zVirusdieLicense._write_key s
$"
#
# +yi **G + + + + + + + + + + + + + + + #
$"C
(
( J I &
s 6::BB BN)__name__
__module__ __qualname__r r r r r
r r s7 3K
r r Fc t t 5 t ddd dS # 1 swxY w Y dS )zWrite your migrations here.N)r FileNotFoundErrorr r migratordatabasefakekwargss r
migrater) s
# $ $ ' '$$&&&' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' 's !AA
Ac dS )z$Write your rollback migrations here.Nr! r$ s r
rollbackr+ % s Dr )F)
r logging
contextlibr getLoggerr loggerr r) r+ r! r r
<module>r0 s 8 $ $ ,' ' ' ' r defence360agent/migrations/__pycache__/052_whitelisted_crawlers.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005160 00000000000 025412 0 ustar
r_j, F d dl Z d dlZ e j e ZddZddZdS ) NFc G d dt j G fddt j }| | | dS )zWrite your migrations here.c h e Zd Z G d d Z ej Z ej d ZdS )#migrate.<locals>.WhitelistedCrawlerc e Zd ZdZdS )(migrate.<locals>.WhitelistedCrawler.Metawhitelisted_crawlersN__name__
__module__ __qualname__db_table h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/052_whitelisted_crawlers.pyMetar
s -HHHr r FnullN) r
r r r pwPrimaryKeyFieldid TextField descriptionr r r WhitelistedCrawlerr s\ . . . . . . . . R
!
!"bl... r r c e Zd Z G d d Z ej Z ej ddd Z ej d Z
dS ) )migrate.<locals>.WhitelistedCrawlerDomainc e Zd ZdZdS ).migrate.<locals>.WhitelistedCrawlerDomain.Metawhitelisted_crawler_domainsNr r r r r r s 4HHHr r FCASCADEdomains)r on_delete related_namer N) r
r r r r r r ForeignKeyFieldcrawlerr domain)r s r WhitelistedCrawlerDomainr s 5 5 5 5 5 5 5 5 R
!
!$"$ "
5)))r r& N)r Model create_model)migratordatabasefakekwargsr& r s @r migrater- s / / / / /RX / / / * * * * * * *28 * * *
,--- 233333r c | | j d | | j d dS )z$Write your rollback migrations here.r r N) remove_modelorm)r) r* r+ r, s r rollbackr1 $ s@ (,'=>??? (,'DEFFFFFr )F)loggingpeeweer getLoggerr
loggerr- r1 r r r <module>r6 sf
8 $ $4 4 4 46G G G G G Gr defence360agent/migrations/__pycache__/052_whitelisted_crawlers.cpython-311.pyc 0000644 0000000 0000000 00000005160 00000000000 024453 0 ustar
r_j, F d dl Z d dlZ e j e ZddZddZdS ) NFc G d dt j G fddt j }| | | dS )zWrite your migrations here.c h e Zd Z G d d Z ej Z ej d ZdS )#migrate.<locals>.WhitelistedCrawlerc e Zd ZdZdS )(migrate.<locals>.WhitelistedCrawler.Metawhitelisted_crawlersN__name__
__module__ __qualname__db_table h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/052_whitelisted_crawlers.pyMetar
s -HHHr r FnullN) r
r r r pwPrimaryKeyFieldid TextField descriptionr r r WhitelistedCrawlerr s\ . . . . . . . . R
!
!"bl... r r c e Zd Z G d d Z ej Z ej ddd Z ej d Z
dS ) )migrate.<locals>.WhitelistedCrawlerDomainc e Zd ZdZdS ).migrate.<locals>.WhitelistedCrawlerDomain.Metawhitelisted_crawler_domainsNr r r r r r s 4HHHr r FCASCADEdomains)r on_delete related_namer N) r
r r r r r r ForeignKeyFieldcrawlerr domain)r s r WhitelistedCrawlerDomainr s 5 5 5 5 5 5 5 5 R
!
!$"$ "
5)))r r& N)r Model create_model)migratordatabasefakekwargsr& r s @r migrater- s / / / / /RX / / / * * * * * * *28 * * *
,--- 233333r c | | j d | | j d dS )z$Write your rollback migrations here.r r N) remove_modelorm)r) r* r+ r, s r rollbackr1 $ s@ (,'=>??? (,'DEFFFFFr )F)loggingpeeweer getLoggerr
loggerr- r1 r r r <module>r6 sf
8 $ $4 4 4 46G G G G G Gr defence360agent/migrations/__pycache__/053_populate_whitelisted_crawlers.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004041 00000000000 027321 0 ustar
r_jK h d dl Z e j e Zdddgfdg dfddgfd d
d gfgZdd
ZddZdS ) NzAGoogle (https://support.google.com/webmasters/answer/80553?hl=ru)z .google.comz.googlebot.comz[Yandex (https://yandex.ru/support/webmaster/robot-workings/check-yandex-robots.xml?lang=ru))z
.yandex.ruz .yandex.comz .yandex.netzIBing (https://www.bing.com/webmaster/help/how-to-verify-bingbot-3905dc26)z.search.msn.comzGBaidu (http://help.baidu.com/question?prod_en=master&class=Baiduspider)z
.baidu.comz .baidu.jpFc d |rdS | j d }| j d }| 5 t D ][\ }}| | }|D ]+} | || ,\ ddd dS # 1 swxY w Y dS )zWrite your migrations here.Nwhitelisted_crawlerswhitelisted_crawler_domains) description)crawlerdomain)ormatomicDATAinsertexecute)
migratordatabasefakekwargswcwcddescrdomains inserted_idds
q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/053_populate_whitelisted_crawlers.pymigrater " s' , -B
,4
5C D D " D DNE7 )))66>>@@K
D
D
;q
99AACCCC
D DD D D D D D D D D D D D D D D D D Ds A$B%%B),B)c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr 1 s D )F)logging getLogger__name__loggerr r r r r r <module>r" s
8 $ $ L ()
d 544
X
Q
{# %8 D D D D r defence360agent/migrations/__pycache__/053_populate_whitelisted_crawlers.cpython-311.pyc 0000644 0000000 0000000 00000004041 00000000000 026362 0 ustar
r_jK h d dl Z e j e Zdddgfdg dfddgfd d
d gfgZdd
ZddZdS ) NzAGoogle (https://support.google.com/webmasters/answer/80553?hl=ru)z .google.comz.googlebot.comz[Yandex (https://yandex.ru/support/webmaster/robot-workings/check-yandex-robots.xml?lang=ru))z
.yandex.ruz .yandex.comz .yandex.netzIBing (https://www.bing.com/webmaster/help/how-to-verify-bingbot-3905dc26)z.search.msn.comzGBaidu (http://help.baidu.com/question?prod_en=master&class=Baiduspider)z
.baidu.comz .baidu.jpFc d |rdS | j d }| j d }| 5 t D ][\ }}| | }|D ]+} | || ,\ ddd dS # 1 swxY w Y dS )zWrite your migrations here.Nwhitelisted_crawlerswhitelisted_crawler_domains) description)crawlerdomain)ormatomicDATAinsertexecute)
migratordatabasefakekwargswcwcddescrdomains inserted_idds
q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/053_populate_whitelisted_crawlers.pymigrater " s' , -B
,4
5C D D " D DNE7 )))66>>@@K
D
D
;q
99AACCCC
D DD D D D D D D D D D D D D D D D D Ds A$B%%B),B)c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr 1 s D )F)logging getLogger__name__loggerr r r r r r <module>r" s
8 $ $ L ()
d 544
X
Q
{# %8 D D D D r defence360agent/migrations/__pycache__/054_add_malicious_and_added_date_fileds.cpython-311.opt-1.pyc0000644 0000000 0000000 00000003025 00000000000 030246 0 ustar
r_j 2 d dl m Z d dlmZmZ ddZddZdS ) )time) BooleanField IntegerFieldFc | j d }| |t dd | j d }| |t dd d S )N malware_hitsF)nulldefault) maliciousmalware_ignore_pathc 8 t t S )N)intr w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/054_add_malicious_and_added_date_fileds.py<lambda>zmigrate.<locals>.<lambda> s CKK r )
added_date)orm
add_fieldsr r migratordatabasefakekwargs MalwareHitsMalwareIgnorePaths r migrater s ,~.K | F F F ! %:; U4G4GHHH r c | j d }| |d | j d }| |d d S )Nr r
r r )r
remove_fieldsr s r rollbackr sO ,~.K ; 444 %:; ,l;;;;;r N)F)r peeweer r r r r r r <module>r! sa - - - - - - - - < < < < < <r defence360agent/migrations/__pycache__/054_add_malicious_and_added_date_fileds.cpython-311.pyc 0000644 0000000 0000000 00000003025 00000000000 027307 0 ustar
r_j 2 d dl m Z d dlmZmZ ddZddZdS ) )time) BooleanField IntegerFieldFc | j d }| |t dd | j d }| |t dd d S )N malware_hitsF)nulldefault) maliciousmalware_ignore_pathc 8 t t S )N)intr w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/054_add_malicious_and_added_date_fileds.py<lambda>zmigrate.<locals>.<lambda> s CKK r )
added_date)orm
add_fieldsr r migratordatabasefakekwargs MalwareHitsMalwareIgnorePaths r migrater s ,~.K | F F F ! %:; U4G4GHHH r c | j d }| |d | j d }| |d d S )Nr r
r r )r
remove_fieldsr s r rollbackr sO ,~.K ; 444 %:; ,l;;;;;r N)F)r peeweer r r r r r r <module>r! sa - - - - - - - - < < < < < <r defence360agent/migrations/__pycache__/055_migrate_move_to_quar_option.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002425 00000000000 026767 0 ustar
r_j2 @ d dl mZmZ d e ddefdZd ZdS ) )
ConfigFileIConfigF)fake config_filer c | rd S | x}sd S | di }| dd | dd | dd | |dd d S )NMALWARE_SCANNINGleave_suspiciousmax_days_in_quarantinemove_to_quarantineFT) overwritevalidate)config_to_dictgetpopdict_to_config)r r ___configmalware_settingss o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/055_migrate_move_to_quar_option.pymigrater s !0022 2F zz"4b99+T22214888-u555 v FFFFF c d S )N )r r s r rollbackr s Dr N) defence360agent.contracts.configr r r r r r r <module>r so @ @ @ @ @ @ @ @ ::<<
G
G
G
G
G
G
G r defence360agent/migrations/__pycache__/055_migrate_move_to_quar_option.cpython-311.pyc 0000644 0000000 0000000 00000002425 00000000000 026030 0 ustar
r_j2 @ d dl mZmZ d e ddefdZd ZdS ) )
ConfigFileIConfigF)fake config_filer c | rd S | x}sd S | di }| dd | dd | dd | |dd d S )NMALWARE_SCANNINGleave_suspiciousmax_days_in_quarantinemove_to_quarantineFT) overwritevalidate)config_to_dictgetpopdict_to_config)r r ___configmalware_settingss o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/055_migrate_move_to_quar_option.pymigrater s !0022 2F zz"4b99+T22214888-u555 v FFFFF c d S )N )r r s r rollbackr s Dr N) defence360agent.contracts.configr r r r r r r <module>r so @ @ @ @ @ @ @ @ ::<<
G
G
G
G
G
G
G r defence360agent/migrations/__pycache__/056_populate_malicious_with_quarantined.cpython-311.opt-1.pyc0000644 0000000 0000000 00000001005 00000000000 030505 0 ustar
r_jo d Z d Zd ZdS )z# Quarantine is removed in DEF-15234c d S N ___s w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/056_populate_malicious_with_quarantined.pymigrater D c d S r r r s r rollbackr
r
r N)__doc__r r
r r r <module>r s3 ) ) r defence360agent/migrations/__pycache__/056_populate_malicious_with_quarantined.cpython-311.pyc 0000644 0000000 0000000 00000001005 00000000000 027546 0 ustar
r_jo d Z d Zd ZdS )z# Quarantine is removed in DEF-15234c d S N ___s w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/056_populate_malicious_with_quarantined.pymigrater D c d S r r r s r rollbackr
r
r N)__doc__r r
r r r <module>r s3 ) ) r defence360agent/migrations/__pycache__/057_filename_is_blob.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003152 00000000000 024440 0 ustar
r_j# > d dl Z e j e ZddZddZdS ) NFc | d | d | d | d dS )z_
This migration os only for consistency, actually all works
with CharField as well
a
CREATE TABLE "malware_hits_new" (
"id" INTEGER NOT NULL PRIMARY KEY,
"scanid_id" VARCHAR(255) NOT NULL,
"user" VARCHAR(255) NOT NULL,
"orig_file" BLOB NOT NULL,
"type" VARCHAR(255) NOT NULL,
"restored" INTEGER NOT NULL,
"mode" INTEGER,
"vendor" VARCHAR(255) NOT NULL,
"malicious" INTEGER NOT NULL,
FOREIGN KEY ("scanid_id") REFERENCES "malware_scans" ("scanid"))
z7INSERT INTO malware_hits_new SELECT * FROM malware_hitszDROP TABLE malware_hitsz3ALTER TABLE malware_hits_new RENAME TO malware_hitsN)sqlmigratordatabasefakekwargss d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/057_filename_is_blob.pymigrater s`
LL
LLJKKK LL*+++ LLFGGGGG c dS )z$Write your rollback migrations here.N r s r
rollbackr ! s Dr )F)logging getLogger__name__loggerr r r r r
<module>r sX
8 $ $H H H H4 r defence360agent/migrations/__pycache__/057_filename_is_blob.cpython-311.pyc 0000644 0000000 0000000 00000003152 00000000000 023501 0 ustar
r_j# > d dl Z e j e ZddZddZdS ) NFc | d | d | d | d dS )z_
This migration os only for consistency, actually all works
with CharField as well
a
CREATE TABLE "malware_hits_new" (
"id" INTEGER NOT NULL PRIMARY KEY,
"scanid_id" VARCHAR(255) NOT NULL,
"user" VARCHAR(255) NOT NULL,
"orig_file" BLOB NOT NULL,
"type" VARCHAR(255) NOT NULL,
"restored" INTEGER NOT NULL,
"mode" INTEGER,
"vendor" VARCHAR(255) NOT NULL,
"malicious" INTEGER NOT NULL,
FOREIGN KEY ("scanid_id") REFERENCES "malware_scans" ("scanid"))
z7INSERT INTO malware_hits_new SELECT * FROM malware_hitszDROP TABLE malware_hitsz3ALTER TABLE malware_hits_new RENAME TO malware_hitsN)sqlmigratordatabasefakekwargss d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/057_filename_is_blob.pymigrater s`
LL
LLJKKK LL*+++ LLFGGGGG c dS )z$Write your rollback migrations here.N r s r
rollbackr ! s Dr )F)logging getLogger__name__loggerr r r r r
<module>r sX
8 $ $H H H H4 r defence360agent/migrations/__pycache__/058_convert_license_last_attempt.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000574 00000000000 027140 0 ustar
r_j ddZ dS )Fc d S )N )migratordatabasefakekwargss p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/058_convert_license_last_attempt.pymigrater s D N)F)r r r
r <module>r s# r
defence360agent/migrations/__pycache__/058_convert_license_last_attempt.cpython-311.pyc 0000644 0000000 0000000 00000000574 00000000000 026201 0 ustar
r_j ddZ dS )Fc d S )N )migratordatabasefakekwargss p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/058_convert_license_last_attempt.pymigrater s D N)F)r r r
r <module>r s# r
defence360agent/migrations/__pycache__/059_scans_error_field.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001644 00000000000 024660 0 ustar
r_j| d dl ZddZddZdS ) NFc v | j d }| |t j d d d S )N
malware_scansT)defaultnull)error)orm
add_fieldspw TextFieldmigratordatabasefakekwargs MalwareScanss e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/059_scans_error_field.pymigrater sI <0L BLD A A A c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s* <0L <11111r )F)peeweer
r r r r <module>r sC 2 2 2 2 2 2r defence360agent/migrations/__pycache__/059_scans_error_field.cpython-311.pyc 0000644 0000000 0000000 00000001644 00000000000 023721 0 ustar
r_j| d dl ZddZddZdS ) NFc v | j d }| |t j d d d S )N
malware_scansT)defaultnull)error)orm
add_fieldspw TextFieldmigratordatabasefakekwargs MalwareScanss e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/059_scans_error_field.pymigrater sI <0L BLD A A A c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s* <0L <11111r )F)peeweer
r r r r <module>r sC 2 2 2 2 2 2r defence360agent/migrations/__pycache__/061_migrate_backup_system_conf.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004062 00000000000 026551 0 ustar
r_jE d Z ddlZddlmZ ddlmZmZmZmZ ddl m
Z
e
j d e dfdedee fd Z e
j d d
Z
dS ) zT
Migrate backup config from user oriented config file
to the separate internal file
N)Optional) BackupConfigIConfig IConfigFile LocalConfig)antivirus_modeF config_filebackup_config_filec |rd S |t }| x}sd S t j |j rd S | di }d| dd | dd di}| |dd | |dd d S ) NBACKUP_RESTORE
BACKUP_SYSTEMenabledF
backup_system)r r T) overwritevalidate)r config_to_dictospathexistsgetpopdict_to_config) migratordatabasefaker r
kwargs config_frombackup_conf_current config_tos n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/061_migrate_backup_system_conf.pymigrater! s ! )^^&5577 7K
w~~(-.. %//*:B??*..y%@@ 0 4 4_d K K
I %%TE & {dU KKKKK c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr% 2 s Dr" )F)__doc__r typingr defence360agent.contracts.configr r r r defence360agent.utilsr skipr! r% r$ r" r <module>r+ s
1 0 0 0 0 0
&;==04 L L L
!- L L L L@ r" defence360agent/migrations/__pycache__/061_migrate_backup_system_conf.cpython-311.pyc 0000644 0000000 0000000 00000004062 00000000000 025612 0 ustar
r_jE d Z ddlZddlmZ ddlmZmZmZmZ ddl m
Z
e
j d e dfdedee fd Z e
j d d
Z
dS ) zT
Migrate backup config from user oriented config file
to the separate internal file
N)Optional) BackupConfigIConfig IConfigFile LocalConfig)antivirus_modeF config_filebackup_config_filec |rd S |t }| x}sd S t j |j rd S | di }d| dd | dd di}| |dd | |dd d S ) NBACKUP_RESTORE
BACKUP_SYSTEMenabledF
backup_system)r r T) overwritevalidate)r config_to_dictospathexistsgetpopdict_to_config) migratordatabasefaker r
kwargs config_frombackup_conf_current config_tos n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/061_migrate_backup_system_conf.pymigrater! s ! )^^&5577 7K
w~~(-.. %//*:B??*..y%@@ 0 4 4_d K K
I %%TE & {dU KKKKK c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr% 2 s Dr" )F)__doc__r typingr defence360agent.contracts.configr r r r defence360agent.utilsr skipr! r% r$ r" r <module>r+ s
1 0 0 0 0 0
&;==04 L L L
!- L L L L@ r" defence360agent/migrations/__pycache__/062_drop_malware_extra_data.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001352 00000000000 026033 0 ustar
r_j5 ddZ ddZdS )Fc J | j d }| | dS )zWrite your migrations here.malware_hit_extrasN)orm remove_model)migratordatabasefakekwargsMalwareExtraDatas k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/062_drop_malware_extra_data.pymigrater s+ |$89 *+++++ c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr s Dr
N)F)r r r r
r <module>r s7 , , , , r
defence360agent/migrations/__pycache__/062_drop_malware_extra_data.cpython-311.pyc 0000644 0000000 0000000 00000001352 00000000000 025074 0 ustar
r_j5 ddZ ddZdS )Fc J | j d }| | dS )zWrite your migrations here.malware_hit_extrasN)orm remove_model)migratordatabasefakekwargsMalwareExtraDatas k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/062_drop_malware_extra_data.pymigrater s+ |$89 *+++++ c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr s Dr
N)F)r r r r
r <module>r s7 , , , , r
defence360agent/migrations/__pycache__/062_fix_null_expiration.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002055 00000000000 025246 0 ustar
r_j d Z ddZddZdS )z>
Fix IPs that were added with NULL expiration to the WB lists
Fc | j d }| d |j ddg |j z d S )Niplist )
expirationWHITEBLACK)ormupdatewherelistnamein_r is_nullexecute)migratordatabasefakekwargs IPListModels g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/062_fix_null_expiration.pymigrater ss ,x(K!$$** ! !7G"4 5 5 ! ) ) + + - giiiii c d S )N )r r r r s r rollbackr s Dr N)F)__doc__r r r r r <module>r sA
r defence360agent/migrations/__pycache__/062_fix_null_expiration.cpython-311.pyc 0000644 0000000 0000000 00000002055 00000000000 024307 0 ustar
r_j d Z ddZddZdS )z>
Fix IPs that were added with NULL expiration to the WB lists
Fc | j d }| d |j ddg |j z d S )Niplist )
expirationWHITEBLACK)ormupdatewherelistnamein_r is_nullexecute)migratordatabasefakekwargs IPListModels g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/062_fix_null_expiration.pymigrater ss ,x(K!$$** ! !7G"4 5 5 ! ) ) + + - giiiii c d S )N )r r r r s r rollbackr s Dr N)F)__doc__r r r r r <module>r sA
r ././@LongLink 0000000 0000000 0000000 00000000155 00000000000 011566 L ustar root root defence360agent/migrations/__pycache__/063_fix_graylist_doslist_expiration_discrepancy.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/063_fix_graylist_doslist_expiration_discrepancy.cpython-311.o0000644 0000000 0000000 00000001653 00000000000 030767 0 ustar
r_ja ddZ ddZdS )Fc | j d }| |j |j dk |j |j k z d S )Niplist)
expirationGRAY)ormupdatedos_expirationwherelistnamer execute)migratordatabasefakekwargs IPListModels /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/063_fix_graylist_doslist_expiration_discrepancy.pymigrater se ,x(K+"<==CC ' !K$> > @ giiiii c d S )N )r r
r r s r rollbackr s Dr N)F)r r r r r <module>r s7 r ././@LongLink 0000000 0000000 0000000 00000000147 00000000000 011567 L ustar root root defence360agent/migrations/__pycache__/063_fix_graylist_doslist_expiration_discrepancy.cpython-311.pyc defence360agent/migrations/__pycache__/063_fix_graylist_doslist_expiration_discrepancy.cpython-311.p0000644 0000000 0000000 00000001653 00000000000 030770 0 ustar
r_ja ddZ ddZdS )Fc | j d }| |j |j dk |j |j k z d S )Niplist)
expirationGRAY)ormupdatedos_expirationwherelistnamer execute)migratordatabasefakekwargs IPListModels /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/063_fix_graylist_doslist_expiration_discrepancy.pymigrater se ,x(K+"<==CC ' !K$> > @ giiiii c d S )N )r r
r r s r rollbackr s Dr N)F)r r r r r <module>r s7 r defence360agent/migrations/__pycache__/064_chmod_i360deploy_log.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001703 00000000000 025076 0 ustar
r_j . d dl mZ d dlZdZddZddZdS ) )suppressNz/var/log/i360deploy.logFc t t 5 t j t d d d d d S # 1 swxY w Y d S )Ni )r FileNotFoundErroroschmodI360DEPLOY_LOGmigratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/064_chmod_i360deploy_log.pymigrater s # $ $ ( (
'''( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (s =AAc d S )N r s r rollbackr s D )F)
contextlibr r r r r r r r <module>r sW *( ( ( (
r defence360agent/migrations/__pycache__/064_chmod_i360deploy_log.cpython-311.pyc 0000644 0000000 0000000 00000001703 00000000000 024137 0 ustar
r_j . d dl mZ d dlZdZddZddZdS ) )suppressNz/var/log/i360deploy.logFc t t 5 t j t d d d d d S # 1 swxY w Y d S )Ni )r FileNotFoundErroroschmodI360DEPLOY_LOGmigratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/064_chmod_i360deploy_log.pymigrater s # $ $ ( (
'''( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (s =AAc d S )N r s r rollbackr s D )F)
contextlibr r r r r r r r <module>r sW *( ( ( (
r defence360agent/migrations/__pycache__/065_remove_capture_csf_lock_from_config.cpython-311.opt-1.pyc0000644 0000000 0000000 00000002426 00000000000 030424 0 ustar
r_ja R d dl Z d dlZd dlmZ e j e ZddZddZdS ) N) LocalConfigFc |rd S t }t j |j sd S | }d|v r/| d | |dd d S d S )NCSF_COOPERATIONTF) overwritevalidate)r ospathexistsconfig_to_dictpopdict_to_config)migratordatabasefakekwargs local_configconfigs w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/065_remove_capture_csf_lock_from_config.pymigrater s ==L
7>>,+ , ,
(
(
*
*FF""
$%%%##FdU#KKKKK #" c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr s Dr )F) loggingr defence360agent.contracts.configr getLogger__name__loggerr r r r r <module>r sq 8 8 8 8 8 8 8 $ $ L L L L r defence360agent/migrations/__pycache__/065_remove_capture_csf_lock_from_config.cpython-311.pyc 0000644 0000000 0000000 00000002426 00000000000 027465 0 ustar
r_ja R d dl Z d dlZd dlmZ e j e ZddZddZdS ) N) LocalConfigFc |rd S t }t j |j sd S | }d|v r/| d | |dd d S d S )NCSF_COOPERATIONTF) overwritevalidate)r ospathexistsconfig_to_dictpopdict_to_config)migratordatabasefakekwargs local_configconfigs w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/065_remove_capture_csf_lock_from_config.pymigrater s ==L
7>>,+ , ,
(
(
*
*FF""
$%%%##FdU#KKKKK #" c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr s Dr )F) loggingr defence360agent.contracts.configr getLogger__name__loggerr r r r r <module>r sq 8 8 8 8 8 8 8 $ $ L L L L r defence360agent/migrations/__pycache__/066_eula_table.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002616 00000000000 023270 0 ustar
r_j D d dl Z G d dej ZddZddZdS ) Nc n e Zd Z G d d Z ej d Z ej dd ZdS )Eulac e Zd ZdZdS ) Eula.MetaeulaN)__name__
__module__ __qualname__db_table ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/066_eula_table.pyMetar s r
r T) primary_keyN)nulldefault) r r r
r pw DateFieldupdated IntegerFieldacceptedr r
r r r sb blt,,,G rD$777HHHr
r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater s $ r
c J | j d }| | d S )Nr )orm remove_model)r r r r r s r rollbackr" s( < D $ r
)F)peeweer Modelr r r" r r
r <module>r% so 8 8 8 8 828 8 8 8 r
defence360agent/migrations/__pycache__/066_eula_table.cpython-311.pyc 0000644 0000000 0000000 00000002616 00000000000 022331 0 ustar
r_j D d dl Z G d dej ZddZddZdS ) Nc n e Zd Z G d d Z ej d Z ej dd ZdS )Eulac e Zd ZdZdS ) Eula.MetaeulaN)__name__
__module__ __qualname__db_table ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/066_eula_table.pyMetar s r
r T) primary_keyN)nulldefault) r r r
r pw DateFieldupdated IntegerFieldacceptedr r
r r r sb blt,,,G rD$777HHHr
r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater s $ r
c J | j d }| | d S )Nr )orm remove_model)r r r r r s r rollbackr" s( < D $ r
)F)peeweer Modelr r r" r r
r <module>r% so 8 8 8 8 828 8 8 8 r
defence360agent/migrations/__pycache__/067_drop_fields_from_modsec_conf.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002313 00000000000 027042 0 ustar
r_j< @ d dl mZmZ d e fdefdZddZdS ) )IConfig LocalConfigF config_filec |rd S | }|sd S | di }| dd | dd | |dd d S )NMOD_SEC
was_installed
OWASP_deletedFT)validate overwrite)config_to_dict
setdefaultpopdict_to_config)migratordatabasefaker kwargsconfmod_sec_settingss p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/067_drop_fields_from_modsec_conf.pymigrater s % % ' 'D y"55 $/// $/// tet DDDDD c d S )N )r r r r s r rollbackr s Dr N)F) defence360agent.contracts.configr r r r r r r <module>r sr A A A A A A A A
&;== E E E E E E* r defence360agent/migrations/__pycache__/067_drop_fields_from_modsec_conf.cpython-311.pyc 0000644 0000000 0000000 00000002313 00000000000 026103 0 ustar
r_j< @ d dl mZmZ d e fdefdZddZdS ) )IConfig LocalConfigF config_filec |rd S | }|sd S | di }| dd | dd | |dd d S )NMOD_SEC
was_installed
OWASP_deletedFT)validate overwrite)config_to_dict
setdefaultpopdict_to_config)migratordatabasefaker kwargsconfmod_sec_settingss p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/067_drop_fields_from_modsec_conf.pymigrater s % % ' 'D y"55 $/// $/// tet DDDDD c d S )N )r r r r s r rollbackr s Dr N)F) defence360agent.contracts.configr r r r r r r <module>r sr A A A A A A A A
&;== E E E E E E* r ././@LongLink 0000000 0000000 0000000 00000000151 00000000000 011562 L ustar root root defence360agent/migrations/__pycache__/068_remove_rules_check_interval_from_config.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/068_remove_rules_check_interval_from_config.cpython-311.opt-10000644 0000000 0000000 00000002237 00000000000 030522 0 ustar
r_j? J d dl Z d dlmZ e j e ZddZddZdS ) N)
ConfigFileFc |rd S t }| }|sd S d|v r/| d | |dd d S d S )NIPTABLES_RULE_CHECKTF) overwritevalidate)r config_to_dictpopdict_to_config)migratordatabasefakekwargs config_fileconfigs {/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/068_remove_rules_check_interval_from_config.pymigrater s} ,,K
'
'
)
)F &&
()))""6TE"JJJJJ '& c dS )z$Write your rollback migrations here.N )r r r
r s r rollbackr s Dr )F)logging defence360agent.contracts.configr getLogger__name__loggerr r r r r <module>r sh 7 7 7 7 7 7 8 $ $ K K K K r defence360agent/migrations/__pycache__/068_remove_rules_check_interval_from_config.cpython-311.pyc 0000644 0000000 0000000 00000002237 00000000000 030355 0 ustar
r_j? J d dl Z d dlmZ e j e ZddZddZdS ) N)
ConfigFileFc |rd S t }| }|sd S d|v r/| d | |dd d S d S )NIPTABLES_RULE_CHECKTF) overwritevalidate)r config_to_dictpopdict_to_config)migratordatabasefakekwargs config_fileconfigs {/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/068_remove_rules_check_interval_from_config.pymigrater s} ,,K
'
'
)
)F &&
()))""6TE"JJJJJ '& c dS )z$Write your rollback migrations here.N )r r r
r s r rollbackr s Dr )F)logging defence360agent.contracts.configr getLogger__name__loggerr r r r r <module>r sh 7 7 7 7 7 7 8 $ $ K K K K r defence360agent/migrations/__pycache__/069_incidents_domain_field.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001630 00000000000 025643 0 ustar
r_jV d dl ZddZddZdS ) NFc v | j d }| |t j d d d S )NincidentT)defaultnull)domain)orm
add_fieldspw TextFieldmigratordatabasefakekwargsIncidents j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/069_incidents_domain_field.pymigrater s< |J'H d)N)N)NOOOOO c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s* |J'H 8X.....r )F)peeweer
r r r r <module>r sG P P P P
/ / / / / /r defence360agent/migrations/__pycache__/069_incidents_domain_field.cpython-311.pyc 0000644 0000000 0000000 00000001630 00000000000 024704 0 ustar
r_jV d dl ZddZddZdS ) NFc v | j d }| |t j d d d S )NincidentT)defaultnull)domain)orm
add_fieldspw TextFieldmigratordatabasefakekwargsIncidents j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/069_incidents_domain_field.pymigrater s< |J'H d)N)N)NOOOOO c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s* |J'H 8X.....r )F)peeweer
r r r r <module>r sG P P P P
/ / / / / /r defence360agent/migrations/__pycache__/070_modsec_incident_names.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006056 00000000000 025502 0 ustar
r_jD ( d dl mZ d ZddZddZdS ) )
TemporaryFilec < | dd d S )N|| maxsplitr )split) descriptions i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/070_modsec_incident_names.py extract_namer s TA . .q 11 Fc
| j d
fd}t d 5 } | D ];\ }}| d |t | <| d | 5 |D ]}| dd \ }}
|
j t | k
d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S ) z
This migration extracts incident name from whole mod_security message
Centos6 version of sqlite does not have instr(), using slow python-based
way
incidentc 3 R K j j j dk j d E d {V d S # t $ r Y d S w xY w)Nmodsecr ) selectidr
whereplugincontainstuplesiterator RuntimeError)r s r select_incidentsz!migrate.<locals>.select_incidents s X-ABBx(233x+44T::;;
FF s BB
B&%B&zw+)modez{},{}
r ,r r )nameN)ormr writeformatr seekatomicr updatestripr r intexecute) migratordatabasefakekwargsr fid_descliner r s @r migrater/ s |J'H
D ! ! ! Q))++ ? ?IC
GGI$$S,t*<*<== > > > > q
__
JJsQJ 7 7 TTZZ\\2288 K3s88+ '))))
s7 A0D<BD$ D<$D( (D<+D( ,D<<E E c dS )z$Write your rollback migrations here.N )r' r( r) r* s r rollbackr2 ) s Dr
N)F)tempfiler r r/ r2 r1 r
r <module>r4 sY " " " " " "2 2 2 B r
defence360agent/migrations/__pycache__/070_modsec_incident_names.cpython-311.pyc 0000644 0000000 0000000 00000006056 00000000000 024543 0 ustar
r_jD ( d dl mZ d ZddZddZdS ) )
TemporaryFilec < | dd d S )N|| maxsplitr )split) descriptions i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/070_modsec_incident_names.py extract_namer s TA . .q 11 Fc
| j d
fd}t d 5 } | D ];\ }}| d |t | <| d | 5 |D ]}| dd \ }}
|
j t | k
d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S ) z
This migration extracts incident name from whole mod_security message
Centos6 version of sqlite does not have instr(), using slow python-based
way
incidentc 3 R K j j j dk j d E d {V d S # t $ r Y d S w xY w)Nmodsecr ) selectidr
whereplugincontainstuplesiterator RuntimeError)r s r select_incidentsz!migrate.<locals>.select_incidents s X-ABBx(233x+44T::;;
FF s BB
B&%B&zw+)modez{},{}
r ,r r )nameN)ormr writeformatr seekatomicr updatestripr r intexecute) migratordatabasefakekwargsr fid_descliner r s @r migrater/ s |J'H
D ! ! ! Q))++ ? ?IC
GGI$$S,t*<*<== > > > > q
__
JJsQJ 7 7 TTZZ\\2288 K3s88+ '))))
s7 A0D<BD$ D<$D( (D<+D( ,D<<E E c dS )z$Write your rollback migrations here.N )r' r( r) r* s r rollbackr2 ) s Dr
N)F)tempfiler r r/ r2 r1 r
r <module>r4 sY " " " " " "2 2 2 B r
defence360agent/migrations/__pycache__/071_malware_hits_hash_size_fields.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002222 00000000000 027222 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc | j d }| |t j d t j d dS )zWrite your migrations here. malware_hitsT)null)sizehashN)orm
add_fieldspw CharFieldmigratordatabasefakekwargs MalwareHitss q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/071_malware_hits_hash_size_fields.pymigrater sV ,~.K ",D111 $8O8O8O c N | j d }| |dd dS )z$Write your rollback migrations here.r r r N)r
remove_fieldsr s r rollbackr s, ,~.K ;77777r )F)loggingpeeweer
getLogger__name__loggerr r r r <module>r s^ 8 $ $ 8 8 8 8 8 8r defence360agent/migrations/__pycache__/071_malware_hits_hash_size_fields.cpython-311.pyc 0000644 0000000 0000000 00000002222 00000000000 026263 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc | j d }| |t j d t j d dS )zWrite your migrations here. malware_hitsT)null)sizehashN)orm
add_fieldspw CharFieldmigratordatabasefakekwargs MalwareHitss q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/071_malware_hits_hash_size_fields.pymigrater sV ,~.K ",D111 $8O8O8O c N | j d }| |dd dS )z$Write your rollback migrations here.r r r N)r
remove_fieldsr s r rollbackr s, ,~.K ;77777r )F)loggingpeeweer
getLogger__name__loggerr r r r <module>r s^ 8 $ $ 8 8 8 8 8 8r defence360agent/migrations/__pycache__/072_add_malware_history_table.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003754 00000000000 026364 0 ustar
r_j \ d dl m Z d dlZd dlmZ G d dej Zd dZd dZdS )
)timeN)
FilenameFieldc e Zd Z G d d Z ed Z ej d Z ej d Z ej d Z
ej d Z ej dd Z
dS ) MalwareHistoryc e Zd ZdZdS )MalwareHistory.Metamalware_historyN)__name__
__module__ __qualname__db_table m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/072_add_malware_history_table.pyMetar s $r r F)nullTc 8 t t S N)intr r r r <lambda>zMalwareHistory.<lambda> s s466{{ r )r defaultN)r
r r r r pathpw CharFieldevent initiatorcause
file_owner IntegerFieldctimer r r r r s % % % % % % % % =e $ $ $D BLe $ $ $E %(((I BLe $ $ $E 4(((J BO/B/B C C CEEEr r Fc : | t d S r ) create_modelr )migratordatabasefakekwargss r migrater' s .)))))r c J | j d }| | d S )Nr )orm remove_model)r# r$ r% r& r s r rollbackr+ s) \"34N .)))))r )F) r peeweer $defence360agent.model.simplificationr Modelr r' r+ r r r <module>r/ s > > > > > > D D D D DRX D D D* * * ** * * * * *r defence360agent/migrations/__pycache__/072_add_malware_history_table.cpython-311.pyc 0000644 0000000 0000000 00000003754 00000000000 025425 0 ustar
r_j \ d dl m Z d dlZd dlmZ G d dej Zd dZd dZdS )
)timeN)
FilenameFieldc e Zd Z G d d Z ed Z ej d Z ej d Z ej d Z
ej d Z ej dd Z
dS ) MalwareHistoryc e Zd ZdZdS )MalwareHistory.Metamalware_historyN)__name__
__module__ __qualname__db_table m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/072_add_malware_history_table.pyMetar s $r r F)nullTc 8 t t S N)intr r r r <lambda>zMalwareHistory.<lambda> s s466{{ r )r defaultN)r
r r r r pathpw CharFieldevent initiatorcause
file_owner IntegerFieldctimer r r r r s % % % % % % % % =e $ $ $D BLe $ $ $E %(((I BLe $ $ $E 4(((J BO/B/B C C CEEEr r Fc : | t d S r ) create_modelr )migratordatabasefakekwargss r migrater' s .)))))r c J | j d }| | d S )Nr )orm remove_model)r# r$ r% r& r s r rollbackr+ s) \"34N .)))))r )F) r peeweer $defence360agent.model.simplificationr Modelr r' r+ r r r <module>r/ s > > > > > > D D D D DRX D D D* * * ** * * * * *r defence360agent/migrations/__pycache__/072_captcha_stat.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005025 00000000000 023623 0 ustar
r_j j d dl Z G d dej Z G d dej Zd dZd dZdS )
Nc e Zd ZdZ ej dd Z ej ddd Z ej d Z G d d Z d
S ) Countryz(
Contains country code and name
TF) primary_keynull )
max_lengthuniquer r c e Zd ZdZdS ) Country.MetacountryN)__name__
__module__ __qualname__db_table `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/072_captcha_stat.pyMetar
s r r N)
r r r __doc__pw CharFieldidcodenamer r r r r r s
$U 3 3 3B 2<1T > > >D 2<U # # #D r r c e Zd Z G d d Z ej d Z ej d Z ej e d Z
ej d Z ej d Z
ej d ZdS ) CaptchaStatc : e Zd ZdZ ej ddddd ZdS )CaptchaStat.Meta captcha_stateventipr
domain timestampN)r r r r r CompositeKeyr r r r r r s1 !%bo T9h
r r Fr
TN)r r r r r TextFieldr! r" ForeignKeyFieldr r
r# IntegerFieldr$ countr r r r r s
BLe $ $ $E 5 ! ! !B b t444G
R\t
$
$
$F U+++I BO ' ' 'EEEr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater0 ! s +&&&&&r c J | j d }| | d S )Nr )orm remove_model)r, r- r. r/ css r rollbackr5 % s( n %B " r )F)peeweer Modelr r r0 r5 r r r <module>r8 s
bh
(
(
(
(
("(
(
(
( ' ' ' ' r defence360agent/migrations/__pycache__/072_captcha_stat.cpython-311.pyc 0000644 0000000 0000000 00000005025 00000000000 022664 0 ustar
r_j j d dl Z G d dej Z G d dej Zd dZd dZdS )
Nc e Zd ZdZ ej dd Z ej ddd Z ej d Z G d d Z d
S ) Countryz(
Contains country code and name
TF) primary_keynull )
max_lengthuniquer r c e Zd ZdZdS ) Country.MetacountryN)__name__
__module__ __qualname__db_table `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/072_captcha_stat.pyMetar
s r r N)
r r r __doc__pw CharFieldidcodenamer r r r r r s
$U 3 3 3B 2<1T > > >D 2<U # # #D r r c e Zd Z G d d Z ej d Z ej d Z ej e d Z
ej d Z ej d Z
ej d ZdS ) CaptchaStatc : e Zd ZdZ ej ddddd ZdS )CaptchaStat.Meta captcha_stateventipr
domain timestampN)r r r r r CompositeKeyr r r r r r s1 !%bo T9h
r r Fr
TN)r r r r r TextFieldr! r" ForeignKeyFieldr r
r# IntegerFieldr$ countr r r r r s
BLe $ $ $E 5 ! ! !B b t444G
R\t
$
$
$F U+++I BO ' ' 'EEEr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater0 ! s +&&&&&r c J | j d }| | d S )Nr )orm remove_model)r, r- r. r/ css r rollbackr5 % s( n %B " r )F)peeweer Modelr r r0 r5 r r r <module>r8 s
bh
(
(
(
(
("(
(
(
( ' ' ' ' r defence360agent/migrations/__pycache__/072_extend_last_synclist.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002211 00000000000 025421 0 ustar
r_j ddZ ddZdS )Fc | d | d | d | d dS )z4Recreating DB in order to make `name` as primary keyz~
CREATE TABLE "last_synclist_new" (
"timestamp" REAL,
"name" VARCHAR(255) NOT NULL PRIMARY KEY
)zWINSERT INTO last_synclist_new SELECT timestamp, "ip" AS name FROM last_synclist LIMIT 1zDROP TABLE last_synclistz5ALTER TABLE last_synclist_new RENAME TO last_synclistN)sqlmigratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/072_extend_last_synclist.pymigrater
si LL
LL D
LL+,,, LLHIIIII c dS )z$Write your rollback migrations here.N r s r rollbackr s r N)F)r
r r
r r <module>r s; J J J J"/ / / / / /r defence360agent/migrations/__pycache__/072_extend_last_synclist.cpython-311.pyc 0000644 0000000 0000000 00000002211 00000000000 024462 0 ustar
r_j ddZ ddZdS )Fc | d | d | d | d dS )z4Recreating DB in order to make `name` as primary keyz~
CREATE TABLE "last_synclist_new" (
"timestamp" REAL,
"name" VARCHAR(255) NOT NULL PRIMARY KEY
)zWINSERT INTO last_synclist_new SELECT timestamp, "ip" AS name FROM last_synclist LIMIT 1zDROP TABLE last_synclistz5ALTER TABLE last_synclist_new RENAME TO last_synclistN)sqlmigratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/072_extend_last_synclist.pymigrater
si LL
LL D
LL+,,, LLHIIIII c dS )z$Write your rollback migrations here.N r s r rollbackr s r N)F)r
r r
r r <module>r s; J J J J"/ / / / / /r defence360agent/migrations/__pycache__/073_drop_dos_expiration.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002317 00000000000 025242 0 ustar
r_jW F d dl Z d dlZ e j e ZddZddZdS ) NFc | j d }| |t j dd | d | |d dS )zWrite your migrations here.iplistF)nulldefault)
no_captchazGUPDATE iplist SET no_captcha=1 WHERE listname='GRAY' AND dos_expirationdos_expirationN)orm
add_fieldspw BooleanFieldsql
remove_fields)migratordatabasefakekwargsIPLists g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/073_drop_dos_expiration.pymigrater s|
\(
#F ?u===
LL 3
6#344444 c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr s Dr )F)loggingpeeweer getLogger__name__loggerr r r r r <module>r s^ 8 $ $ 5 5 5 5 r defence360agent/migrations/__pycache__/073_drop_dos_expiration.cpython-311.pyc 0000644 0000000 0000000 00000002317 00000000000 024303 0 ustar
r_jW F d dl Z d dlZ e j e ZddZddZdS ) NFc | j d }| |t j dd | d | |d dS )zWrite your migrations here.iplistF)nulldefault)
no_captchazGUPDATE iplist SET no_captcha=1 WHERE listname='GRAY' AND dos_expirationdos_expirationN)orm
add_fieldspw BooleanFieldsql
remove_fields)migratordatabasefakekwargsIPLists g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/073_drop_dos_expiration.pymigrater s|
\(
#F ?u===
LL 3
6#344444 c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr s Dr )F)loggingpeeweer getLogger__name__loggerr r r r r <module>r s^ 8 $ $ 5 5 5 5 r defence360agent/migrations/__pycache__/074_ip_as_int.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005574 00000000000 023145 0 ustar
r_j R d dl Z d dlmZ d dlZ e j e ZddZddZdS ) N)timeFc | j d G fddt j }| | dS )zWrite your migrations here.countryc 2 e Zd Z ej d Z ej d ej d g Z ej dd Z ej d Z
ej dd Z ej d Z ej d Z
ej d Z ej dd Z ej d Z ej dd Z ej d Z ej d Z ej d Z G d
d Zd S )
migrate.<locals>.IPListNewF)nullz$listname in ('WHITE','BLACK','GRAY'))r constraintsr T)defaultr c 8 t t S )N)intr ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/074_ip_as_int.py<lambda>z#migrate.<locals>.IPListNew.<lambda> s s466{{ r )r r
c 6 e Zd ZdZ ej ddd ZdS ) migrate.<locals>.IPListNew.Meta
iplist_newnetwork_addressnetmaskversionN)__name__
__module__ __qualname__db_tablepw CompositeKey primary_keyr
r r Metar ) s- #H)"/!9i KKKr r N)r r r r CharFieldipChecklistname IntegerField
expiration
imported_fromctimedeepcommentForeignKeyFieldr BooleanField
no_captcha full_accessauto_whitelistedr r r r )Countrys r IPListNewr s R\u
%
%
% 2<!"HIIJ
%R_D
% $///
2 2
rD))) ",D)))$"$W4888$R_%???
%bo4000 *2?eDDD)"/u555!"/u---!"/u--- r r/ N)ormr Model create_model)migratordatabasefakekwargsr/ r. s @r migrater7
sd l9%G BH @
)$$$$$r c dS )z$Write your rollback migrations here.Nr
)r3 r4 r5 r6 s r rollbackr9 2 s Dr )F) loggingr peeweer getLoggerr loggerr7 r9 r
r r <module>r> ss
8 $ $%% %% %% %%P r defence360agent/migrations/__pycache__/074_ip_as_int.cpython-311.pyc 0000644 0000000 0000000 00000005574 00000000000 022206 0 ustar
r_j R d dl Z d dlmZ d dlZ e j e ZddZddZdS ) N)timeFc | j d G fddt j }| | dS )zWrite your migrations here.countryc 2 e Zd Z ej d Z ej d ej d g Z ej dd Z ej d Z
ej dd Z ej d Z ej d Z
ej d Z ej dd Z ej d Z ej dd Z ej d Z ej d Z ej d Z G d
d Zd S )
migrate.<locals>.IPListNewF)nullz$listname in ('WHITE','BLACK','GRAY'))r constraintsr T)defaultr c 8 t t S )N)intr ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/074_ip_as_int.py<lambda>z#migrate.<locals>.IPListNew.<lambda> s s466{{ r )r r
c 6 e Zd ZdZ ej ddd ZdS ) migrate.<locals>.IPListNew.Meta
iplist_newnetwork_addressnetmaskversionN)__name__
__module__ __qualname__db_tablepw CompositeKey primary_keyr
r r Metar ) s- #H)"/!9i KKKr r N)r r r r CharFieldipChecklistname IntegerField
expiration
imported_fromctimedeepcommentForeignKeyFieldr BooleanField
no_captcha full_accessauto_whitelistedr r r r )Countrys r IPListNewr s R\u
%
%
% 2<!"HIIJ
%R_D
% $///
2 2
rD))) ",D)))$"$W4888$R_%???
%bo4000 *2?eDDD)"/u555!"/u---!"/u--- r r/ N)ormr Model create_model)migratordatabasefakekwargsr/ r. s @r migrater7
sd l9%G BH @
)$$$$$r c dS )z$Write your rollback migrations here.Nr
)r3 r4 r5 r6 s r rollbackr9 2 s Dr )F) loggingr peeweer getLoggerr loggerr7 r9 r
r r <module>r> ss
8 $ $%% %% %% %%P r defence360agent/migrations/__pycache__/075_ips_as_int.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006263 00000000000 023325 0 ustar
r_j N d dl Z d dlZd dlZ e j e ZddZddZdS ) NFc "
| j d }| j d
fd} ddlm} | 5 | D ]} t j |d }n# t $ r Y *w xY w || \ } }
} | | |
| d | | # t j $ r%} t
d| Y d } ~ d } ~ ww xY w d d d n # 1 swxY w Y n# t $ r Y nw xY w| d
| d | d | d
| d d S )zWrite your migrations here.
iplist_newiplistc 3 K E d {V d S # t $ r Y d S w xY w)N)selectdictsiterator RuntimeError)IPLists ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/075_ips_as_int.py
iplist_selectz migrate.<locals>.iplist_select sp }}V,,2244==?? ? ? ? ? ? ? ? ? ? FF s ?A
AAr )pack_ip_networkip)network_addressnetmaskversionzError inserting IP: %sNzDROP TABLE iplistz'ALTER TABLE iplist_new RENAME TO iplistz7CREATE INDEX "iplist_listname" ON "iplist" ("listname")z;CREATE INDEX "iplist_expiration" ON "iplist" ("expiration")z+CREATE INDEX "iplist_ip" ON "iplist" ("ip"))ormim360.utils.netr atomic ipaddress
ip_network
ValueErrorupdateinsertexecutepwIntegrityErrorloggerwarning ImportErrorsql)migratordatabasefakekwargs IPListNewr
r ip_objr netmaskr er s @r migrater+
sZ \*I
\(
#F @333333 __
@ @'-//
@
@ "-fTl;;BB! H &5_R%8%8"T7
+.#'#* @ $$V,,446666( @ @ @NN#;Q????????@%
@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2
LL$%%% LL:;;; LLJKKK LLNOOO LL>?????sp D
D
A%$D
%
A2/D
1A22+D
'CD
C:C50D
5C::D
DD
D#"D#c dS )z$Write your rollback migrations here.N )r" r# r$ r% s r rollbackr. 8 s D )F) loggingpeeweer r getLogger__name__r r+ r. r- r/ r <module>r4 sq
8 $ $+@ +@ +@ +@\ r/ defence360agent/migrations/__pycache__/075_ips_as_int.cpython-311.pyc 0000644 0000000 0000000 00000006263 00000000000 022366 0 ustar
r_j N d dl Z d dlZd dlZ e j e ZddZddZdS ) NFc "
| j d }| j d
fd} ddlm} | 5 | D ]} t j |d }n# t $ r Y *w xY w || \ } }
} | | |
| d | | # t j $ r%} t
d| Y d } ~ d } ~ ww xY w d d d n # 1 swxY w Y n# t $ r Y nw xY w| d
| d | d | d
| d d S )zWrite your migrations here.
iplist_newiplistc 3 K E d {V d S # t $ r Y d S w xY w)N)selectdictsiterator RuntimeError)IPLists ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/075_ips_as_int.py
iplist_selectz migrate.<locals>.iplist_select sp }}V,,2244==?? ? ? ? ? ? ? ? ? ? FF s ?A
AAr )pack_ip_networkip)network_addressnetmaskversionzError inserting IP: %sNzDROP TABLE iplistz'ALTER TABLE iplist_new RENAME TO iplistz7CREATE INDEX "iplist_listname" ON "iplist" ("listname")z;CREATE INDEX "iplist_expiration" ON "iplist" ("expiration")z+CREATE INDEX "iplist_ip" ON "iplist" ("ip"))ormim360.utils.netr atomic ipaddress
ip_network
ValueErrorupdateinsertexecutepwIntegrityErrorloggerwarning ImportErrorsql)migratordatabasefakekwargs IPListNewr
r ip_objr netmaskr er s @r migrater+
sZ \*I
\(
#F @333333 __
@ @'-//
@
@ "-fTl;;BB! H &5_R%8%8"T7
+.#'#* @ $$V,,446666( @ @ @NN#;Q????????@%
@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2
LL$%%% LL:;;; LLJKKK LLNOOO LL>?????sp D
D
A%$D
%
A2/D
1A22+D
'CD
C:C50D
5C::D
DD
D#"D#c dS )z$Write your rollback migrations here.N )r" r# r$ r% s r rollbackr. 8 s D )F) loggingpeeweer r getLogger__name__r r+ r. r- r/ r <module>r4 sq
8 $ $+@ +@ +@ +@\ r/ defence360agent/migrations/__pycache__/076_hash_model.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000745 00000000000 023300 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/076_hash_model.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/076_hash_model.cpython-311.pyc 0000644 0000000 0000000 00000000745 00000000000 022341 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/076_hash_model.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/077_alter_malware_scan.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002751 00000000000 025020 0 ustar
r_j. " d Z ddlZddZddZdS )z[
Altering MalwareScan.type in order to add ability to support
'malware-response' scan type
NFc z | j d }| d |j dk | |t
j dd | |t
j d t
j d
g d S ) N
malware_scansrealtime)typeinotifyT )nulldefault)pathFz5type in ('on-demand', 'realtime', 'malware-response'))r constraints) ormupdatewherer execute
change_fieldspw CharFieldCheck)migratordatabasefakekwargs MalwareScans f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/077_alter_malware_scan.pymigrater s ,/KJ''--I%
giii ",D"===
\K
c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr s Dr )F)__doc__peeweer r r r r r <module>r" sO . r defence360agent/migrations/__pycache__/077_alter_malware_scan.cpython-311.pyc 0000644 0000000 0000000 00000002751 00000000000 024061 0 ustar
r_j. " d Z ddlZddZddZdS )z[
Altering MalwareScan.type in order to add ability to support
'malware-response' scan type
NFc z | j d }| d |j dk | |t
j dd | |t
j d t
j d
g d S ) N
malware_scansrealtime)typeinotifyT )nulldefault)pathFz5type in ('on-demand', 'realtime', 'malware-response'))r constraints) ormupdatewherer execute
change_fieldspw CharFieldCheck)migratordatabasefakekwargs MalwareScans f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/077_alter_malware_scan.pymigrater s ,/KJ''--I%
giii ",D"===
\K
c dS )z$Write your rollback migrations here.N )r r r r s r rollbackr s Dr )F)__doc__peeweer r r r r r <module>r" sO . r defence360agent/migrations/__pycache__/078_fix_signatures_permissions.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001213 00000000000 026653 0 ustar
r_j
d Z ddZddZdS )zRRemoved, as DEF-11611 will fix folder creations so it will not be needed
anymore.
Fc d S )N migratordatabasefakekwargss n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/078_fix_signatures_permissions.pymigrater
s D c dS )z$Write your rollback migrations here.Nr r s r rollbackr
s Dr N)F)__doc__r
r
r r r <module>r sA
r defence360agent/migrations/__pycache__/078_fix_signatures_permissions.cpython-311.pyc 0000644 0000000 0000000 00000001213 00000000000 025714 0 ustar
r_j
d Z ddZddZdS )zRRemoved, as DEF-11611 will fix folder creations so it will not be needed
anymore.
Fc d S )N migratordatabasefakekwargss n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/078_fix_signatures_permissions.pymigrater
s D c dS )z$Write your rollback migrations here.Nr r s r rollbackr
s Dr N)F)__doc__r
r
r r r <module>r sA
r defence360agent/migrations/__pycache__/079_add_uid_gid_fields.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002110 00000000000 024726 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc | j d }| |t j d t j d d S )N malware_hitsT)null)uidgid)orm
add_fieldspw IntegerFieldmigratordatabasefakekwargs
MalwareHits f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/079_add_uid_gid_fields.pymigrater sX n-J O & & & O & & & c N | j d }| |dd d S )Nr r r )r
remove_fieldsr s r rollbackr s, n-J :ue44444r )F)loggingpeeweer
getLogger__name__loggerr r r r <module>r s`
8 $ $ 5 5 5 5 5 5r defence360agent/migrations/__pycache__/079_add_uid_gid_fields.cpython-311.pyc 0000644 0000000 0000000 00000002110 00000000000 023767 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc | j d }| |t j d t j d d S )N malware_hitsT)null)uidgid)orm
add_fieldspw IntegerFieldmigratordatabasefakekwargs
MalwareHits f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/079_add_uid_gid_fields.pymigrater sX n-J O & & & O & & & c N | j d }| |dd d S )Nr r r )r
remove_fieldsr s r rollbackr s, n-J :ue44444r )F)loggingpeeweer
getLogger__name__loggerr r r r <module>r s`
8 $ $ 5 5 5 5 5 5r defence360agent/migrations/__pycache__/080_populate_uid_gid_size_hash_fields.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007030 00000000000 030062 0 ustar
r_j f d dl Z d dlZd dlZd dlZd dlZ ej e ZddZddZ ddZ
dS ) N c | }d} t j | | }|sn(| | |t | z
}@| |fS )zARead an open file descriptor in chunks; return (hexdigest, size).r )osreadupdatelen hexdigest)fd hash_func chunksizehash_sizechunks u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/080_populate_uid_gid_size_hash_fields.py_hash_and_size_from_fdr
sq IKKE DI&&
U E
?? d "" Fc N | j d } | D ]}|j dd } t j |t j t j z t j z }nn# t $ r t d| Y t $ r;}|j
t j k r t d| Y d }~ d }~ww xY w t j | } t! j | j s2t d| t j | (|j 6|j s/t j |dd | j | j c|_ |_ t7 |t8 j \ |_ |_ t j | n# t j | w xY w| d S # tB $ r%}t " | Y d }~d S d }~ww xY w) N malware_hitszutf-8surrogateescape)errorsz(Malware file %s does not exist, skippingz&Malware file %s is a symlink, skippingz/Malware file %s is not a regular file, skippingr )#ormselect orig_fileencoder openO_RDONLY
O_NOFOLLOW
O_NONBLOCKFileNotFoundErrorloggerwarningOSErrorerrnoELOOPfstatstatS_ISREGst_modeclosemoderestoredfchownst_uidst_giduidgidr hashlibsha256hashr save Exception exception)
migratordatabasefakekwargs
MalwareHithitpathr
ests
r migrater@ s4 n-J* $$&& ' ' C=''8I'JJD
WK"-/"-? %
>
7ek))NN@$ HHHH
Xb\\|BJ// NNI
8' 'Ib!Q'''')y")$CGSW%;B%O%O"#( HHJJJJO' ' P sy 3G5 9A=<G5 =%C("G5 $ C(-0C# G5 "C##C((G5 ,AG5G5 A$G/G5 GG5 5
H$?H H$c d S )N )r7 r8 r9 r: s r rollbackrC F s Dr )r )F) r# r1 loggingr r& getLogger__name__r r r@ rC rB r r <module>rG s 8 $ $
#
#
#
#, , , , ^ r defence360agent/migrations/__pycache__/080_populate_uid_gid_size_hash_fields.cpython-311.pyc 0000644 0000000 0000000 00000007030 00000000000 027123 0 ustar
r_j f d dl Z d dlZd dlZd dlZd dlZ ej e ZddZddZ ddZ
dS ) N c | }d} t j | | }|sn(| | |t | z
}@| |fS )zARead an open file descriptor in chunks; return (hexdigest, size).r )osreadupdatelen hexdigest)fd hash_func chunksizehash_sizechunks u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/080_populate_uid_gid_size_hash_fields.py_hash_and_size_from_fdr
sq IKKE DI&&
U E
?? d "" Fc N | j d } | D ]}|j dd } t j |t j t j z t j z }nn# t $ r t d| Y t $ r;}|j
t j k r t d| Y d }~ d }~ww xY w t j | } t! j | j s2t d| t j | (|j 6|j s/t j |dd | j | j c|_ |_ t7 |t8 j \ |_ |_ t j | n# t j | w xY w| d S # tB $ r%}t " | Y d }~d S d }~ww xY w) N malware_hitszutf-8surrogateescape)errorsz(Malware file %s does not exist, skippingz&Malware file %s is a symlink, skippingz/Malware file %s is not a regular file, skippingr )#ormselect orig_fileencoder openO_RDONLY
O_NOFOLLOW
O_NONBLOCKFileNotFoundErrorloggerwarningOSErrorerrnoELOOPfstatstatS_ISREGst_modeclosemoderestoredfchownst_uidst_giduidgidr hashlibsha256hashr save Exception exception)
migratordatabasefakekwargs
MalwareHithitpathr
ests
r migrater@ s4 n-J* $$&& ' ' C=''8I'JJD
WK"-/"-? %
>
7ek))NN@$ HHHH
Xb\\|BJ// NNI
8' 'Ib!Q'''')y")$CGSW%;B%O%O"#( HHJJJJO' ' P sy 3G5 9A=<G5 =%C("G5 $ C(-0C# G5 "C##C((G5 ,AG5G5 A$G/G5 GG5 5
H$?H H$c d S )N )r7 r8 r9 r: s r rollbackrC F s Dr )r )F) r# r1 loggingr r& getLogger__name__r r r@ rC rB r r <module>rG s 8 $ $
#
#
#
#, , , , ^ r defence360agent/migrations/__pycache__/081_fix_clamscan_broken_symlink.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000766 00000000000 026731 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/081_fix_clamscan_broken_symlink.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/081_fix_clamscan_broken_symlink.cpython-311.pyc 0000644 0000000 0000000 00000000766 00000000000 025772 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/081_fix_clamscan_broken_symlink.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/082_add_cl_on_premise_backup_option.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000772 00000000000 027535 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/082_add_cl_on_premise_backup_option.pymigrater
D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/082_add_cl_on_premise_backup_option.cpython-311.pyc 0000644 0000000 0000000 00000000772 00000000000 026576 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/082_add_cl_on_premise_backup_option.pymigrater
D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/082_add_manual_flag.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001632 00000000000 024244 0 ustar
r_j\ d dl ZddZddZdS ) NFc v | j d }| |t j dd d S )NiplistFT)nulldefault)manual)orm
add_fieldspw BooleanFieldmigratordatabasefakekwargsIPLists c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/082_add_manual_flag.pymigrater sI
\(
#F rE4@@@ c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s*
\(
#F 68,,,,,r )F)peeweer
r r r r <module>r sC - - - - - -r defence360agent/migrations/__pycache__/082_add_manual_flag.cpython-311.pyc 0000644 0000000 0000000 00000001632 00000000000 023305 0 ustar
r_j\ d dl ZddZddZdS ) NFc v | j d }| |t j dd d S )NiplistFT)nulldefault)manual)orm
add_fieldspw BooleanFieldmigratordatabasefakekwargsIPLists c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/082_add_manual_flag.pymigrater sI
\(
#F rE4@@@ c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s*
\(
#F 68,,,,,r )F)peeweer
r r r r <module>r sC - - - - - -r defence360agent/migrations/__pycache__/083_drop_no_captcha_field.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003113 00000000000 025451 0 ustar
r_ja d dl ZddZddZdS ) NFc | j d }| d | d | d | d | d | |d d S )Niplistz0UPDATE iplist SET manual=0 WHERE listname='GRAY'z1UPDATE iplist SET manual=1 WHERE listname='WHITE'z1UPDATE iplist SET manual=1 WHERE listname='BLACK'zHUPDATE iplist SET listname='BLACK'WHERE listname='GRAY' AND no_captcha=1zUPDATE iplist SET comment='Automatically blocked due to distributed attack', imported_from='Imunify360' WHERE listname='BLACK' AND manual=0
no_captcha)ormsql
remove_fieldsmigratordatabasefakekwargsIPLists i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/083_drop_no_captcha_field.pymigrater s
\(
#F LLCDDD LLDEEE LLDEEE LL 1
LL /
6<00000 c t | j d }| |t j d d S )Nr F)default)r )r
add_fieldspw BooleanFieldr s r rollbackr s:
\(
#F 2?5+I+I+IJJJJJr )F)peeweer r r r r <module>r sI 1 1 1 1$K K K K K Kr defence360agent/migrations/__pycache__/083_drop_no_captcha_field.cpython-311.pyc 0000644 0000000 0000000 00000003113 00000000000 024512 0 ustar
r_ja d dl ZddZddZdS ) NFc | j d }| d | d | d | d | d | |d d S )Niplistz0UPDATE iplist SET manual=0 WHERE listname='GRAY'z1UPDATE iplist SET manual=1 WHERE listname='WHITE'z1UPDATE iplist SET manual=1 WHERE listname='BLACK'zHUPDATE iplist SET listname='BLACK'WHERE listname='GRAY' AND no_captcha=1zUPDATE iplist SET comment='Automatically blocked due to distributed attack', imported_from='Imunify360' WHERE listname='BLACK' AND manual=0
no_captcha)ormsql
remove_fieldsmigratordatabasefakekwargsIPLists i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/083_drop_no_captcha_field.pymigrater s
\(
#F LLCDDD LLDEEE LLDEEE LL 1
LL /
6<00000 c t | j d }| |t j d d S )Nr F)default)r )r
add_fieldspw BooleanFieldr s r rollbackr s:
\(
#F 2?5+I+I+IJJJJJr )F)peeweer r r r r <module>r sI 1 1 1 1$K K K K K Kr defence360agent/migrations/__pycache__/084_country_subnets_fields.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002405 00000000000 025763 0 ustar
r_j d dl ZddZddZdS ) NFc | j d }| |dd | |t j d t j d t j d d S )Ncountry_subnetsip_netipT)null)network_addressnetmaskversion)orm rename_field
add_fieldspw IntegerFieldmigratordatabasefakekwargsCountrySubnetss j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/084_country_subnets_fields.pymigrater s \"34N .(D999 T222T***T*** c ~ | j d }| |dd | |ddd d S )Nr r r r r r
)r r
remove_fieldsr s r rollbackr sS \"34N .$999 )9i r )F)peeweer r r r r <module>r sC r defence360agent/migrations/__pycache__/084_country_subnets_fields.cpython-311.pyc 0000644 0000000 0000000 00000002405 00000000000 025024 0 ustar
r_j d dl ZddZddZdS ) NFc | j d }| |dd | |t j d t j d t j d d S )Ncountry_subnetsip_netipT)null)network_addressnetmaskversion)orm rename_field
add_fieldspw IntegerFieldmigratordatabasefakekwargsCountrySubnetss j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/084_country_subnets_fields.pymigrater s \"34N .(D999 T222T***T*** c ~ | j d }| |dd | |ddd d S )Nr r r r r r
)r r
remove_fieldsr s r rollbackr sS \"34N .$999 )9i r )F)peeweer r r r r <module>r sC r defence360agent/migrations/__pycache__/085_country_subnets_fields.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002312 00000000000 025761 0 ustar
r_j > d dl Z e j e ZddZddZdS ) NFc |rd S | j d }| d | |d | |d | |d d S )Ncountry_subnetszDELETE FROM country_subnetsnetwork_addressnetmaskversion)ormsql add_not_nullmigratordatabasefakekwargsCountrySubnetss j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/085_country_subnets_fields.pymigrater s \"34N LL./// .*;<<<
.)44444 c P | j d }| |ddd d S )Nr r r r )r
drop_not_nullr s r rollbackr s; \"34N )9i r )F)logging getLogger__name__loggerr r r r <module>r sR 8 $ $ 5 5 5 5 r defence360agent/migrations/__pycache__/085_country_subnets_fields.cpython-311.pyc 0000644 0000000 0000000 00000002312 00000000000 025022 0 ustar
r_j > d dl Z e j e ZddZddZdS ) NFc |rd S | j d }| d | |d | |d | |d d S )Ncountry_subnetszDELETE FROM country_subnetsnetwork_addressnetmaskversion)ormsql add_not_nullmigratordatabasefakekwargsCountrySubnetss j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/085_country_subnets_fields.pymigrater s \"34N LL./// .*;<<<
.)44444 c P | j d }| |ddd d S )Nr r r r )r
drop_not_nullr s r rollbackr s; \"34N )9i r )F)logging getLogger__name__loggerr r r r <module>r sR 8 $ $ 5 5 5 5 r defence360agent/migrations/__pycache__/086_ignored_by_port_fields.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002400 00000000000 025677 0 ustar
r_j d dl ZddZddZdS ) NFc
| j d }| j d }| |t j d t j d t j d t j |d d S )Nignored_by_port_protocountryT)null)network_addressnetmaskversionr )orm
add_fieldspw IntegerFieldForeignKeyField)migratordatabasefakekwargs
IgnoredByPortCountrys j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/086_ignored_by_port_fields.pymigrater s L!89Ml9%G T222T***T***"7666 c R | j d }| |dddd d S )Nr r r r r )r
remove_fields)r r r r r s r rollbackr s= L!89M ()Y r )F)peeweer r r r r <module>r sC r defence360agent/migrations/__pycache__/086_ignored_by_port_fields.cpython-311.pyc 0000644 0000000 0000000 00000002400 00000000000 024740 0 ustar
r_j d dl ZddZddZdS ) NFc
| j d }| j d }| |t j d t j d t j d t j |d d S )Nignored_by_port_protocountryT)null)network_addressnetmaskversionr )orm
add_fieldspw IntegerFieldForeignKeyField)migratordatabasefakekwargs
IgnoredByPortCountrys j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/086_ignored_by_port_fields.pymigrater s L!89Ml9%G T222T***T***"7666 c R | j d }| |dddd d S )Nr r r r r )r
remove_fields)r r r r r s r rollbackr s= L!89M ()Y r )F)peeweer r r r r <module>r sC r defence360agent/migrations/__pycache__/087_ignored_by_port_fields.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006651 00000000000 025714 0 ustar
r_j J d dl Z d dlmZ e j e ZddZddZdS ) N)
ip_networkFc | j d } ddlm} | |j }d |D }n# t $ r g }Y nw xY w|D ]} |t | \ } }
} | | |
|
|j |k f# t $ r` t d| |
|j |k Y w xY w|rddlm} | 5 }
|D ][}|
| }| |
|j |k \ d d d n # 1 swxY w Y n*# t( $ r t d Y nw xY w| |d
| |d | |d d S )
Nignored_by_port_protor )pack_ip_networkc g | ]\ }|S r ).0ips j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/087_ignored_by_port_fields.py
<listcomp>zmigrate.<locals>.<listcomp> s cbr )network_addressnetmaskversionzInvalid IP network %s)geo)countryz2Failed to update countries data in ignored_by_portr r r )ormim360.utils.netr selectr
distincttuples ImportErrorr updatewhereexecute
ValueErrorloggerwarningdeletedefence360agent.internalsr readerget_idOSError add_not_null)migratordatabasefakekwargs
IgnoredByPortr qipsr
netmaskr r
geo_readerr s r migrater/ s L!89M 333333
!1 2 2 ; ; = = D D F F Q 6 6 6!0 B !@!@ Cw
#T7
!
eM$*++GGIIII
K K K NN2B 7 7 7 " " ( ( )9R)? @ @ H H J J J J J K
111111
> > >B ( / / 3 3G!(( ' ) eM , 233GGIIII >
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> NND
-):;;;
-33333s[ A A/.A/7 CA'EEG $A G G GG GG $HHc P | j d }| |ddd d S )Nr r r r )r
drop_not_null)r% r& r' r( r) s r rollbackr2 3 s; L!89M ()Y r
)F)logging ipaddressr getLogger__name__r r/ r2 r r
r <module>r7 se 8 $ $)4 )4 )4 )4X r
defence360agent/migrations/__pycache__/087_ignored_by_port_fields.cpython-311.pyc 0000644 0000000 0000000 00000006651 00000000000 024755 0 ustar
r_j J d dl Z d dlmZ e j e ZddZddZdS ) N)
ip_networkFc | j d } ddlm} | |j }d |D }n# t $ r g }Y nw xY w|D ]} |t | \ } }
} | | |
|
|j |k f# t $ r` t d| |
|j |k Y w xY w|rddlm} | 5 }
|D ][}|
| }| |
|j |k \ d d d n # 1 swxY w Y n*# t( $ r t d Y nw xY w| |d
| |d | |d d S )
Nignored_by_port_protor )pack_ip_networkc g | ]\ }|S r ).0ips j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/087_ignored_by_port_fields.py
<listcomp>zmigrate.<locals>.<listcomp> s cbr )network_addressnetmaskversionzInvalid IP network %s)geo)countryz2Failed to update countries data in ignored_by_portr r r )ormim360.utils.netr selectr
distincttuples ImportErrorr updatewhereexecute
ValueErrorloggerwarningdeletedefence360agent.internalsr readerget_idOSError add_not_null)migratordatabasefakekwargs
IgnoredByPortr qipsr
netmaskr r
geo_readerr s r migrater/ s L!89M 333333
!1 2 2 ; ; = = D D F F Q 6 6 6!0 B !@!@ Cw
#T7
!
eM$*++GGIIII
K K K NN2B 7 7 7 " " ( ( )9R)? @ @ H H J J J J J K
111111
> > >B ( / / 3 3G!(( ' ) eM , 233GGIIII >
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> NND
-):;;;
-33333s[ A A/.A/7 CA'EEG $A G G GG GG $HHc P | j d }| |ddd d S )Nr r r r )r
drop_not_null)r% r& r' r( r) s r rollbackr2 3 s; L!89M ()Y r
)F)logging ipaddressr getLogger__name__r r/ r2 r r
r <module>r7 se 8 $ $)4 )4 )4 )4X r
defence360agent/migrations/__pycache__/088_add_malware_i360_clamd_scan_option.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000775 00000000000 027740 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss v/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/088_add_malware_i360_clamd_scan_option.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/088_add_malware_i360_clamd_scan_option.cpython-311.pyc 0000644 0000000 0000000 00000000775 00000000000 027001 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss v/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/088_add_malware_i360_clamd_scan_option.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/089_proactive_tables.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006631 00000000000 024527 0 ustar
r_j d dl ZddZddZdS ) NFc | j d G fddt j G fddt j }| | | d S )Ncountryc & e Zd Z G d d Z ej Z ej d Z ej d Z
ej d Z ej d Z ej
d Z ej d Z ej d Z ej d Z ej d Z ej d Z ej d Z ej d Z ej d Z ej d ZdS )migrate.<locals>.Proactivec e Zd ZdZdS ) migrate.<locals>.Proactive.Meta proactiveN)__name__
__module__ __qualname__db_table d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/089_proactive_tables.pyMetar s "HHHr r FnullTN)r
r r r pwPrimaryKeyFieldid IntegerField timestamp TextFieldipip_int
ip_versionForeignKeyField
ip_countryreason descriptionactionhostpathurlcountuidgid)Countrys r Proactiver sd # # # # # # # # R
!
!#BO///
R\t
$
$
$ d+++$R_$///
'R'd;;;
5)))"bl--- 5)))r|&&&r|'''bl%%% U+++ bo5))) bo5)))r r) c e Zd Z ej ddd Z ej d Z ej d Z G d d Z d S )
migrate.<locals>.ProactiveEnvFCASCADEenv)r on_delete related_namer Tc 6 e Zd ZdZ ej ddd ZdS )"migrate.<locals>.ProactiveEnv.Meta
proactive_enveventnamevalueN)r
r r r
r CompositeKey primary_keyr r r r r1 " s( &H)"/'67CCKKKr r N)
r
r r r r r3 r r4 r5 r )r) s r ProactiveEnvr+ s "" EYU
r|''' $''' D D D D D D D D D Dr r8 )ormr Model create_model)migratordatabasefakekwargsr8 r( r) s @@r migrater@ s l9%G* * * * * * *BH * * *( D D D D D D Drx D D D
)$$$ ,'''''r c | j d }| j d }| | | | d S )Nr2 r )r9 remove_model)r< r= r> r? r8 r) s r rollbackrC * sH <0L [)I ,''' )$$$$$r )F)peeweer r@ rC r r r <module>rE sD #( #( #( #(L% % % % % %r defence360agent/migrations/__pycache__/089_proactive_tables.cpython-311.pyc 0000644 0000000 0000000 00000006631 00000000000 023570 0 ustar
r_j d dl ZddZddZdS ) NFc | j d G fddt j G fddt j }| | | d S )Ncountryc & e Zd Z G d d Z ej Z ej d Z ej d Z
ej d Z ej d Z ej
d Z ej d Z ej d Z ej d Z ej d Z ej d Z ej d Z ej d Z ej d Z ej d ZdS )migrate.<locals>.Proactivec e Zd ZdZdS ) migrate.<locals>.Proactive.Meta proactiveN)__name__
__module__ __qualname__db_table d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/089_proactive_tables.pyMetar s "HHHr r FnullTN)r
r r r pwPrimaryKeyFieldid IntegerField timestamp TextFieldipip_int
ip_versionForeignKeyField
ip_countryreason descriptionactionhostpathurlcountuidgid)Countrys r Proactiver sd # # # # # # # # R
!
!#BO///
R\t
$
$
$ d+++$R_$///
'R'd;;;
5)))"bl--- 5)))r|&&&r|'''bl%%% U+++ bo5))) bo5)))r r) c e Zd Z ej ddd Z ej d Z ej d Z G d d Z d S )
migrate.<locals>.ProactiveEnvFCASCADEenv)r on_delete related_namer Tc 6 e Zd ZdZ ej ddd ZdS )"migrate.<locals>.ProactiveEnv.Meta
proactive_enveventnamevalueN)r
r r r
r CompositeKey primary_keyr r r r r1 " s( &H)"/'67CCKKKr r N)
r
r r r r r3 r r4 r5 r )r) s r ProactiveEnvr+ s "" EYU
r|''' $''' D D D D D D D D D Dr r8 )ormr Model create_model)migratordatabasefakekwargsr8 r( r) s @@r migrater@ s l9%G* * * * * * *BH * * *( D D D D D D Drx D D D
)$$$ ,'''''r c | j d }| j d }| | | | d S )Nr2 r )r9 remove_model)r< r= r> r? r8 r) s r rollbackrC * sH <0L [)I ,''' )$$$$$r )F)peeweer r@ rC r r r <module>rE sD #( #( #( #(L% % % % % %r defence360agent/migrations/__pycache__/090_safe_user_config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004706 00000000000 024473 0 ustar
r_jy b d dl Z d dlZd dlZd dlZd dlmZ ej e ZddZ ddZ
dS ) N)CoreFc t j D ]} t j |j t j }t j | rt j | st j t j
|j }t j | t j
|d|j t j |d t j |t j }t! j || t j
|d|j t j |d V# t$ $ r3}t& dt+ | Y d }~d }~ww xY wd S # t, $ r t& d| Y d S w xY w)Nr i i zSomething went wrong: %sz Failed to migrate config for %s)pwdgetpwallospathjoinpw_dirr USER_CONFIG_FILE_NAMEisfileislink USER_CONFDIRpw_namemkdirchownpw_gidchmodshutilmoveOSErrorloggerwarningstr Exception exception) migratordatabasefakekwargsusersrcdst_dirdst_filees d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/090_safe_user_config.pymigrater& s BLNN C CD
Cgll4;0JKK7>>#&&
.rw~~c/B/B
. gll4+<dl K KGHW%%%HWa555HWe,,, !w|| !; H KX...HXq$+666HXu---
C
C
C 93q66BBBBBBBB
C C C B B B:DAAAAAABs; F- EE+)F- +
F(5(F# F- #F((F- -%GGc d S )N )r r r r s r% rollbackr) ! s D )F) r r r logging defence360agent.contracts.configr getLogger__name__r r& r) r( r* r% <module>r/ s
1 1 1 1 1 1 8 $ $B B B B, r* defence360agent/migrations/__pycache__/090_safe_user_config.cpython-311.pyc 0000644 0000000 0000000 00000004706 00000000000 023534 0 ustar
r_jy b d dl Z d dlZd dlZd dlZd dlmZ ej e ZddZ ddZ
dS ) N)CoreFc t j D ]} t j |j t j }t j | rt j | st j t j
|j }t j | t j
|d|j t j |d t j |t j }t! j || t j
|d|j t j |d V# t$ $ r3}t& dt+ | Y d }~d }~ww xY wd S # t, $ r t& d| Y d S w xY w)Nr i i zSomething went wrong: %sz Failed to migrate config for %s)pwdgetpwallospathjoinpw_dirr USER_CONFIG_FILE_NAMEisfileislink USER_CONFDIRpw_namemkdirchownpw_gidchmodshutilmoveOSErrorloggerwarningstr Exception exception) migratordatabasefakekwargsusersrcdst_dirdst_filees d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/090_safe_user_config.pymigrater& s BLNN C CD
Cgll4;0JKK7>>#&&
.rw~~c/B/B
. gll4+<dl K KGHW%%%HWa555HWe,,, !w|| !; H KX...HXq$+666HXu---
C
C
C 93q66BBBBBBBB
C C C B B B:DAAAAAABs; F- EE+)F- +
F(5(F# F- #F((F- -%GGc d S )N )r r r r s r% rollbackr) ! s D )F) r r r logging defence360agent.contracts.configr getLogger__name__r r& r) r( r* r% <module>r/ s
1 1 1 1 1 1 8 $ $B B B B, r* defence360agent/migrations/__pycache__/091_compress_old_logs.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004237 00000000000 024707 0 ustar
r_j n d dl Z d dlZd dlZd dlZd dlmZ d dlmZ e j e Z
ddZ ddZ dS ) N)Logger)get_log_file_namesFc & t D ] }t dt j dz D ]}| d| }| d} t j | r~t |d 5 }t j |d 5 } t j
|| d d d n # 1 swxY w Y d d d n # 1 swxY w Y t j | # t $ r&}
t d||
Y d }
~
d }
~
ww xY wd S )N .z.gzrbwbz"Failed file %s compression with %s)r ranger BACKUP_COUNTospathexistsopengzipshutil copyfileobjremove Exceptionlogger exception) migratordatabasefakekwargsfilenameisourcedestf_inf_outes e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/091_compress_old_logs.pymigrater# s &(( q&-122
A &&1&&F >>>D
7>>&)) & fd++ 8tTY d6 6 8 *47778 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 If%%%
8&!
s_ /C -B<B% B<%B)
)B<,B)
-B<0 C <C C C C
D & DD c dS )z$Write your rollback migrations here.N )r r r r s r" rollbackr& s D )F)
loggingr r r defence360agent.contracts.configr defence360agent.internals.loggerr getLogger__name__r r# r& r% r' r" <module>r- s
3 3 3 3 3 3 ? ? ? ? ? ? 8 $ $ $ r' defence360agent/migrations/__pycache__/091_compress_old_logs.cpython-311.pyc 0000644 0000000 0000000 00000004237 00000000000 023750 0 ustar
r_j n d dl Z d dlZd dlZd dlZd dlmZ d dlmZ e j e Z
ddZ ddZ dS ) N)Logger)get_log_file_namesFc & t D ] }t dt j dz D ]}| d| }| d} t j | r~t |d 5 }t j |d 5 } t j
|| d d d n # 1 swxY w Y d d d n # 1 swxY w Y t j | # t $ r&}
t d||
Y d }
~
d }
~
ww xY wd S )N .z.gzrbwbz"Failed file %s compression with %s)r ranger BACKUP_COUNTospathexistsopengzipshutil copyfileobjremove Exceptionlogger exception) migratordatabasefakekwargsfilenameisourcedestf_inf_outes e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/091_compress_old_logs.pymigrater# s &(( q&-122
A &&1&&F >>>D
7>>&)) & fd++ 8tTY d6 6 8 *47778 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 If%%%
8&!
s_ /C -B<B% B<%B)
)B<,B)
-B<0 C <C C C C
D & DD c dS )z$Write your rollback migrations here.N )r r r r s r" rollbackr& s D )F)
loggingr r r defence360agent.contracts.configr defence360agent.internals.loggerr getLogger__name__r r# r& r% r' r" <module>r- s
3 3 3 3 3 3 ? ? ? ? ? ? 8 $ $ $ r' defence360agent/migrations/__pycache__/092_ignore_proc_sys_dirs.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001546 00000000000 025420 0 ustar
r_j d Z ddZddZdS )zC
This migration adds /proc and /sys to ignore for malware scanning
Fc ^ |s(dD ]'}| j d }| | &d S d S )N)z/procz/sysmalware_ignore_path)path)orm
get_or_create)migratordatabasefakekwargs ignored_dirMalwareIgnorePaths h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/092_ignore_proc_sys_dirs.pymigrater sU >, > >K ( -B C + + + = = = => > > > c d S )N )r r r r
s r
rollbackr
s Dr N)F)__doc__r r r r r
<module>r sA
> > > > r defence360agent/migrations/__pycache__/092_ignore_proc_sys_dirs.cpython-311.pyc 0000644 0000000 0000000 00000001546 00000000000 024461 0 ustar
r_j d Z ddZddZdS )zC
This migration adds /proc and /sys to ignore for malware scanning
Fc ^ |s(dD ]'}| j d }| | &d S d S )N)z/procz/sysmalware_ignore_path)path)orm
get_or_create)migratordatabasefakekwargs ignored_dirMalwareIgnorePaths h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/092_ignore_proc_sys_dirs.pymigrater sU >, > >K ( -B C + + + = = = => > > > c d S )N )r r r r
s r
rollbackr
s Dr N)F)__doc__r r r r r
<module>r sA
> > > > r defence360agent/migrations/__pycache__/092_remove_old_disabled_rules.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001320 00000000000 026355 0 ustar
r_jO d Z ddZddZdS )z
Moves disabled rules from the cPanel-specific user data directory to the centralized Apache
configuration directory.
No longer required running due to age and causing issues with the Coraza WAF
Fc d S N migratordatabasefakekwargss m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/092_remove_old_disabled_rules.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r sA r
defence360agent/migrations/__pycache__/092_remove_old_disabled_rules.cpython-311.pyc 0000644 0000000 0000000 00000001320 00000000000 025416 0 ustar
r_jO d Z ddZddZdS )z
Moves disabled rules from the cPanel-specific user data directory to the centralized Apache
configuration directory.
No longer required running due to age and causing issues with the Coraza WAF
Fc d S N migratordatabasefakekwargss m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/092_remove_old_disabled_rules.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r sA r
defence360agent/migrations/__pycache__/093_make_quarantined_files_immutable.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000773 00000000000 027726 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss t/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/093_make_quarantined_files_immutable.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/093_make_quarantined_files_immutable.cpython-311.pyc 0000644 0000000 0000000 00000000773 00000000000 026767 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss t/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/093_make_quarantined_files_immutable.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/094_ignore_cagefs_proc.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001542 00000000000 025007 0 ustar
r_jy d Z ddZddZdS )zU
This migration adds /usr/share/cagefs-skeleton/proc/
to ignore for malware scanning
Fc T |s%| j d }| d d S d S )Nmalware_ignore_pathz /usr/share/cagefs-skeleton/proc)path)orm
get_or_create)migratordatabasefakekwargsMalwareIgnorePaths f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/094_ignore_cagefs_proc.pymigrater
sC P $L)> ?''-N'OOOOOP P c d S )N )r r r r
s r rollbackr
s Dr N)F)__doc__r
r r r r <module>r sE P P P P r defence360agent/migrations/__pycache__/094_ignore_cagefs_proc.cpython-311.pyc 0000644 0000000 0000000 00000001542 00000000000 024050 0 ustar
r_jy d Z ddZddZdS )zU
This migration adds /usr/share/cagefs-skeleton/proc/
to ignore for malware scanning
Fc T |s%| j d }| d d S d S )Nmalware_ignore_pathz /usr/share/cagefs-skeleton/proc)path)orm
get_or_create)migratordatabasefakekwargsMalwareIgnorePaths f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/094_ignore_cagefs_proc.pymigrater
sC P $L)> ?''-N'OOOOOP P c d S )N )r r r r
s r rollbackr
s Dr N)F)__doc__r
r r r r <module>r sE P P P P r defence360agent/migrations/__pycache__/095_add_total_malicious_field.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001677 00000000000 026346 0 ustar
r_j d dl ZddZddZdS ) NFc v | j d }| |t j dd d S )N
malware_scansFr )nulldefault)total_malicious)orm
add_fieldspw IntegerFieldmigratordatabasefakekwargs MalwareScans m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/095_add_total_malicious_field.pymigrater sJ ,/K UA>>> c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s+ ,/K ;(9:::::r )F)peeweer
r r r r <module>r sC ; ; ; ; ; ;r defence360agent/migrations/__pycache__/095_add_total_malicious_field.cpython-311.pyc 0000644 0000000 0000000 00000001677 00000000000 025407 0 ustar
r_j d dl ZddZddZdS ) NFc v | j d }| |t j dd d S )N
malware_scansFr )nulldefault)total_malicious)orm
add_fieldspw IntegerFieldmigratordatabasefakekwargs MalwareScans m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/095_add_total_malicious_field.pymigrater sJ ,/K UA>>> c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s+ ,/K ;(9:::::r )F)peeweer
r r r r <module>r sC ; ; ; ; ; ;r defence360agent/migrations/__pycache__/096_populate_total_malicious_field.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002046 00000000000 027437 0 ustar
r_j ddZ ddZdS )Fc |rd S | j d }| j d }|D ]`}|j |j }||_ | ad S )N
malware_scans malware_hits)ormmalwarehit_setselectwhere maliciouscounttotal_malicioussave)migratordatabasefakekwargs MalwareScan
MalwareHitscanr s r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/096_populate_total_malicious_field.pymigrater s ,/K n-J & & ( ( . .z/C D D J J L L / c d S )N )r
r r r s r rollbackr s Dr N)F)r r r r r <module>r s7 r defence360agent/migrations/__pycache__/096_populate_total_malicious_field.cpython-311.pyc 0000644 0000000 0000000 00000002046 00000000000 026500 0 ustar
r_j ddZ ddZdS )Fc |rd S | j d }| j d }|D ]`}|j |j }||_ | ad S )N
malware_scans malware_hits)ormmalwarehit_setselectwhere maliciouscounttotal_malicioussave)migratordatabasefakekwargs MalwareScan
MalwareHitscanr s r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/096_populate_total_malicious_field.pymigrater s ,/K n-J & & ( ( . .z/C D D J J L L / c d S )N )r
r r r s r rollbackr s Dr N)F)r r r r r <module>r s7 r defence360agent/migrations/__pycache__/097_remove_uid_and_gid.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001767 00000000000 025010 0 ustar
r_jX > d dl Z e j e ZddZddZdS ) NFc | j d } | |dd d S # t $ r%}t | Y d }~d S d }~ww xY w)N malware_hitsuidgid)orm
remove_fields Exceptionlogger exception)migratordatabasefakekwargs
MalwareHites f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/097_remove_uid_and_gid.pymigrater sv n-J z5%88888 s (
AAAc d S )N )r r
r r s r rollbackr s D )F)logging getLogger__name__r
r r r r r <module>r sR 8 $ $ r defence360agent/migrations/__pycache__/097_remove_uid_and_gid.cpython-311.pyc 0000644 0000000 0000000 00000001767 00000000000 024051 0 ustar
r_jX > d dl Z e j e ZddZddZdS ) NFc | j d } | |dd d S # t $ r%}t | Y d }~d S d }~ww xY w)N malware_hitsuidgid)orm
remove_fields Exceptionlogger exception)migratordatabasefakekwargs
MalwareHites f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/097_remove_uid_and_gid.pymigrater sv n-J z5%88888 s (
AAAc d S )N )r r
r r s r rollbackr s D )F)logging getLogger__name__r
r r r r r <module>r sR 8 $ $ r defence360agent/migrations/__pycache__/098_remote_proxy_tables.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005330 00000000000 025262 0 ustar
r_j d dl ZddZddZdS ) NFc G d dt j G fddt j }| | | d S )Nc e Zd ZdZdZdZ ej d Z ej d ej d
ee g Z ej dd Z
G d
d Zd S )
!migrate.<locals>.RemoteProxyGroupz9Groups multiple remote proxies together with common data.manual
imunify360Fnullzsource in ('{}', '{}'))r constraintsT)r defaultc e Zd ZdZdZdS )&migrate.<locals>.RemoteProxyGroup.Metaremote_proxy_group)))namesourceTN)__name__
__module__ __qualname__db_tableindexes g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/098_remote_proxy_tables.pyMetar
s +H3GGGr r N)r r r __doc__MANUAL
IMUNIFY360pw CharFieldr Checkformatr BooleanFieldenabledr r r r RemoteProxyGroupr s GG!
r|''' 188LLMM
""/ud;;; 4 4 4 4 4 4 4 4 4 4r r# c p e Zd Z ej d Z ej d Z G d d ZdS ) migrate.<locals>.RemoteProxyFr c e Zd ZdZdS )!migrate.<locals>.RemoteProxy.Meta remote_proxyN)r r r r r r r r r' s %HHHr r N) r r r r ForeignKeyFieldgroup TextFieldnetworkr )r# s r RemoteProxyr% si ""#3%@@@ ",E*** & & & & & & & & & &r r- )r Model create_modelmigratordatabasefakekwargsr- r# s @r migrater5 s 4 4 4 4 428 4 4 4$& & & & & & &bh & & &
*+++ +&&&&&r c | j d }| j d }| | | | d S )Nr( r )orm remove_modelr0 s r rollbackr9 " sK ,~.K |$89 +&&& *+++++r )F)peeweer r5 r9 r r r <module>r; sC ' ' ' '<, , , , , ,r defence360agent/migrations/__pycache__/098_remote_proxy_tables.cpython-311.pyc 0000644 0000000 0000000 00000005330 00000000000 024323 0 ustar
r_j d dl ZddZddZdS ) NFc G d dt j G fddt j }| | | d S )Nc e Zd ZdZdZdZ ej d Z ej d ej d
ee g Z ej dd Z
G d
d Zd S )
!migrate.<locals>.RemoteProxyGroupz9Groups multiple remote proxies together with common data.manual
imunify360Fnullzsource in ('{}', '{}'))r constraintsT)r defaultc e Zd ZdZdZdS )&migrate.<locals>.RemoteProxyGroup.Metaremote_proxy_group)))namesourceTN)__name__
__module__ __qualname__db_tableindexes g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/098_remote_proxy_tables.pyMetar
s +H3GGGr r N)r r r __doc__MANUAL
IMUNIFY360pw CharFieldr Checkformatr BooleanFieldenabledr r r r RemoteProxyGroupr s GG!
r|''' 188LLMM
""/ud;;; 4 4 4 4 4 4 4 4 4 4r r# c p e Zd Z ej d Z ej d Z G d d ZdS ) migrate.<locals>.RemoteProxyFr c e Zd ZdZdS )!migrate.<locals>.RemoteProxy.Meta remote_proxyN)r r r r r r r r r' s %HHHr r N) r r r r ForeignKeyFieldgroup TextFieldnetworkr )r# s r RemoteProxyr% si ""#3%@@@ ",E*** & & & & & & & & & &r r- )r Model create_modelmigratordatabasefakekwargsr- r# s @r migrater5 s 4 4 4 4 428 4 4 4$& & & & & & &bh & & &
*+++ +&&&&&r c | j d }| j d }| | | | d S )Nr( r )orm remove_modelr0 s r rollbackr9 " sK ,~.K |$89 +&&& *+++++r )F)peeweer r5 r9 r r r <module>r; sC ' ' ' '<, , , , , ,r defence360agent/migrations/__pycache__/099_remove_old_disabled_rules.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004232 00000000000 026371 0 ustar
r_j` d dl Z d dlZd dlZd dlZd dlmZmZ e j e Z dZ
ej dd Z ddZ
dS ) N)antivirus_moderun_coroz,/etc/apache2/conf.d/i360_modsec_disable.confFc , |rd S ddl m} n# t $ r Y d S w xY w | r!t | sd S | }t j t r]t j t t j |j
|j t j |j d S d S # t$ $ r&}t& d| Y d }~d S d }~ww xY w)Nr )cPanelz)Failed to delete old rules config with %s)im360.subsys.panels.cpanelr ImportError is_installedr installed_modsecospathexistsOLD_DISABLED_RULES_CONFIGshutilmovejoinDISABLED_RULES_CONFIG_DIR%GLOBAL_DISABLED_RULES_CONFIG_FILENAME
subprocess
check_callREBUILD_HTTPDCONF_CMD Exceptionlogger exception)migratordatabasefakekwargsr hpes m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/099_remove_old_disabled_rules.pymigrater!
sX 5555555 I""$$ H # # % %-
-
F
VXX
7>>3 4 4 < K) 0<
!"": ; ; ; ; ; < < I I IDaHHHHHHHHHIs*
5C# B C# #
D-DDc d S )N )r r r r s r rollbackr$ , s D )F)loggingr r r defence360agent.utilsr r getLogger__name__r r skipr! r$ r# r% r <module>r+ s
: : : : : : : : 8 $ $ J I I I I< r% defence360agent/migrations/__pycache__/099_remove_old_disabled_rules.cpython-311.pyc 0000644 0000000 0000000 00000004232 00000000000 025432 0 ustar
r_j` d dl Z d dlZd dlZd dlZd dlmZmZ e j e Z dZ
ej dd Z ddZ
dS ) N)antivirus_moderun_coroz,/etc/apache2/conf.d/i360_modsec_disable.confFc , |rd S ddl m} n# t $ r Y d S w xY w | r!t | sd S | }t j t r]t j t t j |j
|j t j |j d S d S # t$ $ r&}t& d| Y d }~d S d }~ww xY w)Nr )cPanelz)Failed to delete old rules config with %s)im360.subsys.panels.cpanelr ImportError is_installedr installed_modsecospathexistsOLD_DISABLED_RULES_CONFIGshutilmovejoinDISABLED_RULES_CONFIG_DIR%GLOBAL_DISABLED_RULES_CONFIG_FILENAME
subprocess
check_callREBUILD_HTTPDCONF_CMD Exceptionlogger exception)migratordatabasefakekwargsr hpes m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/099_remove_old_disabled_rules.pymigrater!
sX 5555555 I""$$ H # # % %-
-
F
VXX
7>>3 4 4 < K) 0<
!"": ; ; ; ; ; < < I I IDaHHHHHHHHHIs*
5C# B C# #
D-DDc d S )N )r r r r s r rollbackr$ , s D )F)loggingr r r defence360agent.utilsr r getLogger__name__r r skipr! r$ r# r% r <module>r+ s
: : : : : : : : 8 $ $ J I I I I< r% defence360agent/migrations/__pycache__/100_remove_captcha_ports_from_csf.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002644 00000000000 027246 0 ustar
r_j; F d dl Z d dlZ ej e ZddZddZdS ) NFc ( |rd S ddl m} ddlm}m} n# t
$ r Y d S w xY wt j |j sd S |
||dddd d S # t $ r t
d Y d S w xY w) Nr )csf)INTCPi i i i z.Failed to remove captcha ports from csf config) im360.subsysr im360.utils.netr r ImportErrorospathisfile
CSF_CONFIG remove_ports Exceptionlogger exception)migratordatabasefakekwargsr r r s q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/100_remove_captcha_ports_from_csf.pymigrater s $$$$$$+++++++++ 7>>#. ) ) K b%u===== K K KIJJJJJJKs
##
A) )$BBc d S )N )r r r r s r rollbackr s D )F)r
logging getLogger__name__r r r r r r <module>r s_ 8 $ $K K K K" r defence360agent/migrations/__pycache__/100_remove_captcha_ports_from_csf.cpython-311.pyc 0000644 0000000 0000000 00000002644 00000000000 026307 0 ustar
r_j; F d dl Z d dlZ ej e ZddZddZdS ) NFc ( |rd S ddl m} ddlm}m} n# t
$ r Y d S w xY wt j |j sd S |
||dddd d S # t $ r t
d Y d S w xY w) Nr )csf)INTCPi i i i z.Failed to remove captcha ports from csf config) im360.subsysr im360.utils.netr r ImportErrorospathisfile
CSF_CONFIG remove_ports Exceptionlogger exception)migratordatabasefakekwargsr r r s q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/100_remove_captcha_ports_from_csf.pymigrater s $$$$$$+++++++++ 7>>#. ) ) K b%u===== K K KIJJJJJJKs
##
A) )$BBc d S )N )r r r r s r rollbackr s D )F)r
logging getLogger__name__r r r r r r <module>r s_ 8 $ $K K K K" r ././@LongLink 0000000 0000000 0000000 00000000150 00000000000 011561 L ustar root root defence360agent/migrations/__pycache__/101_remove_unneeded_acronis_ports_from_csf.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/101_remove_unneeded_acronis_ports_from_csf.cpython-311.opt-1.0000644 0000000 0000000 00000003153 00000000000 030431 0 ustar
r_j1 F d dl Z d dlZ ej e ZddZddZdS ) NFc j |rd S ddl m} ddlm}m}m} n# t $ r Y d S w xY wt j |j
sd S | ||dddddd d
h | ||dddd d S # t $ r t d Y d S w xY w)
Nr )csf)INOUTTCPi i i ia i i )iZ ix )rangesz5Failed to remove unused Arconis ports from csf config) im360.subsysr im360.utils.netr r r ImportErrorospathisfile
CSF_CONFIG remove_ports Exceptionlogger exception)migratordatabasefakekwargsr r r r s z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/101_remove_unneeded_acronis_ports_from_csf.pymigrater s2 $$$$$$00000000000 7>>#. ) )
>
c4T:::::
C
s
%%9B
$B21B2c d S )N )r r r r s r rollbackr & s D )F)r logging getLogger__name__r r r r r r <module>r! s[ 8 $ $
> r defence360agent/migrations/__pycache__/101_remove_unneeded_acronis_ports_from_csf.cpython-311.pyc 0000644 0000000 0000000 00000003153 00000000000 030206 0 ustar
r_j1 F d dl Z d dlZ ej e ZddZddZdS ) NFc j |rd S ddl m} ddlm}m}m} n# t $ r Y d S w xY wt j |j
sd S | ||dddddd d
h | ||dddd d S # t $ r t d Y d S w xY w)
Nr )csf)INOUTTCPi i i ia i i )iZ ix )rangesz5Failed to remove unused Arconis ports from csf config) im360.subsysr im360.utils.netr r r ImportErrorospathisfile
CSF_CONFIG remove_ports Exceptionlogger exception)migratordatabasefakekwargsr r r r s z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/101_remove_unneeded_acronis_ports_from_csf.pymigrater s2 $$$$$$00000000000 7>>#. ) )
>
c4T:::::
C
s
%%9B
$B21B2c d S )N )r r r r s r rollbackr & s D )F)r logging getLogger__name__r r r r r r <module>r! s[ 8 $ $
> r defence360agent/migrations/__pycache__/102_proactive_ignore_list.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006456 00000000000 025562 0 ustar
r_jL * d dl m Z d dlZddZddZdS ) )timeNFc \ G d dt j G fddt j }| | | | j d }| |t j d | |d d
d S ) Nc t e Zd ZdZ ej dd Z ej de Z G d d Z
dS ) %migrate.<locals>.ProactiveIgnoredPathz3
Ignore list for proactive defence
FT)null primary_key)r defaultc e Zd ZdZdS )*migrate.<locals>.ProactiveIgnoredPath.Metaproactive_ignored_pathN)__name__
__module__ __qualname__db_table i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/102_proactive_ignore_list.pyMetar s /HHHr r N) r
r r __doc__pw TextFieldpath IntegerFieldr timestampr r r r ProactiveIgnoredPathr st r|D999#BO=== 0 0 0 0 0 0 0 0 0 0r r c e Zd ZdZ ej ddd Z ej d Z ej d Z
G d d Z d S )
%migrate.<locals>.ProactiveIgnoredRulez(
Specific rules ignored
FCASCADErules)r on_delete related_namer c e Zd ZdZdZdS )*migrate.<locals>.ProactiveIgnoredRule.Metaproactive_ignored_rule)))r rule_idTN)r
r r r indexesr r r r r$ s /H4GGGr r N) r
r r r r ForeignKeyFieldr r r& r rule_namer )r s r ProactiveIgnoredRuler s "r!
""/u--- BLe,,, 5 5 5 5 5 5 5 5 5 5r r* proactiveTr" )r& reasonr) )r Model create_modelorm
add_fieldsr rename_field)migratordatabasefakekwargsr* Proactiver s @r migrater7 s 0 0 0 0 0rx 0 0 05 5 5 5 5 5 5rx 5 5 5$
./// ./// [)I T***
)X{;;;;;r c | j d }| j d }| | | | | j d }| |d | |dd d S )Nr r% r+ r& r) r, )r/ remove_model
remove_fieldsr1 )r2 r3 r4 r5 r r* r6 s r rollbackr; / s #<(@A#<(@A ./// ./// [)I 9i000 )[(;;;;;r )F)r peeweer r7 r; r r r <module>r= sV &< &< &< &<R< < < < < <r defence360agent/migrations/__pycache__/102_proactive_ignore_list.cpython-311.pyc 0000644 0000000 0000000 00000006456 00000000000 024623 0 ustar
r_jL * d dl m Z d dlZddZddZdS ) )timeNFc \ G d dt j G fddt j }| | | | j d }| |t j d | |d d
d S ) Nc t e Zd ZdZ ej dd Z ej de Z G d d Z
dS ) %migrate.<locals>.ProactiveIgnoredPathz3
Ignore list for proactive defence
FT)null primary_key)r defaultc e Zd ZdZdS )*migrate.<locals>.ProactiveIgnoredPath.Metaproactive_ignored_pathN)__name__
__module__ __qualname__db_table i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/102_proactive_ignore_list.pyMetar s /HHHr r N) r
r r __doc__pw TextFieldpath IntegerFieldr timestampr r r r ProactiveIgnoredPathr st r|D999#BO=== 0 0 0 0 0 0 0 0 0 0r r c e Zd ZdZ ej ddd Z ej d Z ej d Z
G d d Z d S )
%migrate.<locals>.ProactiveIgnoredRulez(
Specific rules ignored
FCASCADErules)r on_delete related_namer c e Zd ZdZdZdS )*migrate.<locals>.ProactiveIgnoredRule.Metaproactive_ignored_rule)))r rule_idTN)r
r r r indexesr r r r r$ s /H4GGGr r N) r
r r r r ForeignKeyFieldr r r& r rule_namer )r s r ProactiveIgnoredRuler s "r!
""/u--- BLe,,, 5 5 5 5 5 5 5 5 5 5r r* proactiveTr" )r& reasonr) )r Model create_modelorm
add_fieldsr rename_field)migratordatabasefakekwargsr* Proactiver s @r migrater7 s 0 0 0 0 0rx 0 0 05 5 5 5 5 5 5rx 5 5 5$
./// ./// [)I T***
)X{;;;;;r c | j d }| j d }| | | | | j d }| |d | |dd d S )Nr r% r+ r& r) r, )r/ remove_model
remove_fieldsr1 )r2 r3 r4 r5 r r* r6 s r rollbackr; / s #<(@A#<(@A ./// ./// [)I 9i000 )[(;;;;;r )F)r peeweer r7 r; r r r <module>r= sV &< &< &< &<R< < < < < <r defence360agent/migrations/__pycache__/102_replace_comodo.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001513 00000000000 024130 0 ustar
r_j ddZ ddZdS )Fc Z | d | d d S )Nz~UPDATE incident SET name=replace(name, 'COMODO WAF', 'IM360 WAF'), description=replace(description, 'COMODO WAF', 'IM360 WAF')zGUPDATE disabled_rules SET name=replace(name, 'COMODO WAF', 'IM360 WAF'))sqlmigratordatabasefakekwargss b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/102_replace_comodo.pymigrater
sE LL F
LL < c d S )N r s r rollbackr
s Dr N)F)r
r r
r r <module>r s7 r defence360agent/migrations/__pycache__/102_replace_comodo.cpython-311.pyc 0000644 0000000 0000000 00000001513 00000000000 023171 0 ustar
r_j ddZ ddZdS )Fc Z | d | d d S )Nz~UPDATE incident SET name=replace(name, 'COMODO WAF', 'IM360 WAF'), description=replace(description, 'COMODO WAF', 'IM360 WAF')zGUPDATE disabled_rules SET name=replace(name, 'COMODO WAF', 'IM360 WAF'))sqlmigratordatabasefakekwargss b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/102_replace_comodo.pymigrater
sE LL F
LL < c d S )N r s r rollbackr
s Dr N)F)r
r r
r r <module>r s7 r defence360agent/migrations/__pycache__/103_remove_vd_license.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001245 00000000000 024650 0 ustar
r_j < d Z ddlmZ ee ZddZddZdS )z'
Remove Virusdie registration from CLN
) getLoggerFc d S N migratordatabasefakekwargss e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/103_remove_vd_license.pymigrater
D c d S r r r s r rollbackr r r N)F)__doc__loggingr __name__loggerr
r r r r <module>r sf
8 r defence360agent/migrations/__pycache__/103_remove_vd_license.cpython-311.pyc 0000644 0000000 0000000 00000001245 00000000000 023711 0 ustar
r_j < d Z ddlmZ ee ZddZddZdS )z'
Remove Virusdie registration from CLN
) getLoggerFc d S N migratordatabasefakekwargss e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/103_remove_vd_license.pymigrater
D c d S r r r s r rollbackr r r N)F)__doc__loggingr __name__loggerr
r r r r <module>r sf
8 r defence360agent/migrations/__pycache__/104_add_feature_management_permissions.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002743 00000000000 030257 0 ustar
r_j F d dl mZmZmZ G d de ZddZddZdS ) ) BooleanField CharFieldModelc X e Zd Z G d d Z ed Z ed ZdS )FeatureManagementPermsc e Zd ZdZdS )FeatureManagementPerms.Meta feature_management_permissionsN)__name__
__module__ __qualname__db_table v/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/104_add_feature_management_permissions.pyMetar s 3r r T)unique)defaultN)r r r
r r userr proactiver r r r r s\ 4 4 4 4 4 4 4 4 9D ! ! !D T***IIIr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater s 011111r c J | j d }| | d S )Nr
)orm remove_model)r r r r r s r rollbackr! s+ %\*J K 011111r N)F)peeweer r r r r r! r r r <module>r# s 1 1 1 1 1 1 1 1 1 1+ + + + +U + + +2 2 2 22 2 2 2 2 2r defence360agent/migrations/__pycache__/104_add_feature_management_permissions.cpython-311.pyc 0000644 0000000 0000000 00000002743 00000000000 027320 0 ustar
r_j F d dl mZmZmZ G d de ZddZddZdS ) ) BooleanField CharFieldModelc X e Zd Z G d d Z ed Z ed ZdS )FeatureManagementPermsc e Zd ZdZdS )FeatureManagementPerms.Meta feature_management_permissionsN)__name__
__module__ __qualname__db_table v/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/104_add_feature_management_permissions.pyMetar s 3r r T)unique)defaultN)r r r
r r userr proactiver r r r r s\ 4 4 4 4 4 4 4 4 9D ! ! !D T***IIIr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater s 011111r c J | j d }| | d S )Nr
)orm remove_model)r r r r r s r rollbackr! s+ %\*J K 011111r N)F)peeweer r r r r r! r r r <module>r# s 1 1 1 1 1 1 1 1 1 1+ + + + +U + + +2 2 2 22 2 2 2 2 2r ././@LongLink 0000000 0000000 0000000 00000000161 00000000000 011563 L ustar root root defence360agent/migrations/__pycache__/105_populate_default_feature_management_permissions.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/105_populate_default_feature_management_permissions.cpython-30000644 0000000 0000000 00000001426 00000000000 031167 0 ustar
r_j* d Z ddZddZdS ) Fc ^ |rd S | j d }| t d S )N feature_management_permissions)user)orm
get_or_createDEFAULT)migratordatabasefakekwargsFeatureManagementPermss /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/105_populate_default_feature_management_permissions.pymigrater s: %\*J K((g(66666 c d S )N )r r
r r s r rollbackr
s Dr N)F)r r r r r r <module>r s<
7 7 7 7 r ././@LongLink 0000000 0000000 0000000 00000000153 00000000000 011564 L ustar root root defence360agent/migrations/__pycache__/105_populate_default_feature_management_permissions.cpython-311.pyc defence360agent/migrations/__pycache__/105_populate_default_feature_management_permissions.cpython-30000644 0000000 0000000 00000001426 00000000000 031167 0 ustar
r_j* d Z ddZddZdS ) Fc ^ |rd S | j d }| t d S )N feature_management_permissions)user)orm
get_or_createDEFAULT)migratordatabasefakekwargsFeatureManagementPermss /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/105_populate_default_feature_management_permissions.pymigrater s: %\*J K((g(66666 c d S )N )r r
r r s r rollbackr
s Dr N)F)r r r r r r <module>r s<
7 7 7 7 r defence360agent/migrations/__pycache__/106_add_malware_cleanup_in_config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002255 00000000000 027147 0 ustar
r_j/ " d dl mZ ddZddZdS ) )
ConfigFileFc |rd S t }| }|sd S | di }| dd | dd | |d d S )NMALWARE_CLEANUP trim_file_instead_of_removalTkeep_original_files_days F)validate)r config_to_dict
setdefaultdict_to_config)migratordatabasefakekwargs config_fileconfmalware_cleanups q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/106_add_malware_cleanup_in_config.pymigrater s ,,K % % ' 'D oo&7<<O =tDDD 92>>> te 44444 c d S )N )r
r r r s r rollbackr s Dr N)F) defence360agent.contracts.configr r r r r r <module>r sI 7 7 7 7 7 7 5 5 5 5 r defence360agent/migrations/__pycache__/106_add_malware_cleanup_in_config.cpython-311.pyc 0000644 0000000 0000000 00000002255 00000000000 026210 0 ustar
r_j/ " d dl mZ ddZddZdS ) )
ConfigFileFc |rd S t }| }|sd S | di }| dd | dd | |d d S )NMALWARE_CLEANUP trim_file_instead_of_removalTkeep_original_files_days F)validate)r config_to_dict
setdefaultdict_to_config)migratordatabasefakekwargs config_fileconfmalware_cleanups q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/106_add_malware_cleanup_in_config.pymigrater s ,,K % % ' 'D oo&7<<O =tDDD 92>>> te 44444 c d S )N )r
r r r s r rollbackr s Dr N)F) defence360agent.contracts.configr r r r r r <module>r sI 7 7 7 7 7 7 5 5 5 5 r defence360agent/migrations/__pycache__/106_malware_hit_status_field_add.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002563 00000000000 027041 0 ustar
r_j d dl Z d dlmZmZ d dlmZ ej ddd Z e j e Z
d
dZ d
d Z dS ) N) CharField
FloatField)importerzimav.malwarelib.configMalwareHitStatus)modulenamedefaultFc | j d }| |t t j t d d S )N malware_hits)r T)null)status
cleaned_at)orm
add_fieldsr r FOUNDr migratordatabasefakekwargs
MalwareHits p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/106_malware_hit_status_field_add.pymigrater sX n-J !1!7888 4((( c N | j d }| |dd d S )Nr r
r )r
remove_fieldsr s r rollbackr s, n-J :x >>>>>r )F)
loggingpeeweer r defence360agent.utilsr getr getLogger__name__loggerr r r r <module>r& s ( ( ( ( ( ( ( ( * * * * * * 8< #*<d
8 $ $ ? ? ? ? ? ?r defence360agent/migrations/__pycache__/106_malware_hit_status_field_add.cpython-311.pyc 0000644 0000000 0000000 00000002563 00000000000 026102 0 ustar
r_j d dl Z d dlmZmZ d dlmZ ej ddd Z e j e Z
d
dZ d
d Z dS ) N) CharField
FloatField)importerzimav.malwarelib.configMalwareHitStatus)modulenamedefaultFc | j d }| |t t j t d d S )N malware_hits)r T)null)status
cleaned_at)orm
add_fieldsr r FOUNDr migratordatabasefakekwargs
MalwareHits p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/106_malware_hit_status_field_add.pymigrater sX n-J !1!7888 4((( c N | j d }| |dd d S )Nr r
r )r
remove_fieldsr s r rollbackr s, n-J :x >>>>>r )F)
loggingpeeweer r defence360agent.utilsr getr getLogger__name__loggerr r r r <module>r& s ( ( ( ( ( ( ( ( * * * * * * 8< #*<d
8 $ $ ? ? ? ? ? ?r defence360agent/migrations/__pycache__/107_add_bruteforce_rule_33339.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002676 00000000000 025740 0 ustar
r_j4 N d dl Z d dlmZ dZ e j e ZddZddZdS ) N)
ConfigFile MOD_SEC_BLOCK_BY_CUSTOM_RULEFc , |rd S t }| d }| t i }ddd|d< | t |i d S # t
$ r t d Y d S w xY w)NF) normalizex
) check_period
max_incidents33339z Failed to create rule for 33339)r config_to_dict
setdefaultKEYdict_to_config Exceptionlogger exception)migratordatabasefakekwargs config_fileconfigmod_sec_block_ruless m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/107_add_bruteforce_rule_33339.pymigrater
s < ll ++e+<< $ / /R 8 8 (
(
G$
""C)<#=>>>>> < < <:;;;;;;<s A#A+ +$BBc d S )N )r r r r s r rollbackr s D )F) logging defence360agent.contracts.configr r getLogger__name__r r r r r r <module>r$ si 7 7 7 7 7 7$ 8 $ $< < < <* r defence360agent/migrations/__pycache__/107_add_bruteforce_rule_33339.cpython-311.pyc 0000644 0000000 0000000 00000002676 00000000000 025001 0 ustar
r_j4 N d dl Z d dlmZ dZ e j e ZddZddZdS ) N)
ConfigFile MOD_SEC_BLOCK_BY_CUSTOM_RULEFc , |rd S t }| d }| t i }ddd|d< | t |i d S # t
$ r t d Y d S w xY w)NF) normalizex
) check_period
max_incidents33339z Failed to create rule for 33339)r config_to_dict
setdefaultKEYdict_to_config Exceptionlogger exception)migratordatabasefakekwargs config_fileconfigmod_sec_block_ruless m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/107_add_bruteforce_rule_33339.pymigrater
s < ll ++e+<< $ / /R 8 8 (
(
G$
""C)<#=>>>>> < < <:;;;;;;<s A#A+ +$BBc d S )N )r r r r s r rollbackr s D )F) logging defence360agent.contracts.configr r getLogger__name__r r r r r r <module>r$ si 7 7 7 7 7 7$ 8 $ $< < < <* r defence360agent/migrations/__pycache__/107_malware_hit_status_field_populate.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002052 00000000000 030134 0 ustar
r_j J d dl Z d dlmZ e j e ZddZddZdS ) N) BooleanFieldFc T |s%| j d }| |d d S d S )N malware_hitsrestored)orm
remove_fieldsmigratordatabasefakekwargs
MalwareHits u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/107_malware_hit_status_field_populate.pymigrater s< 7 \.1
z:666667 7 c j | j d }| |t d d S )Nr F)default)r )r
add_fieldsr r s r rollbackr s8 n-J
\%-H-H-HIIIIIr )F)loggingpeeweer getLogger__name__loggerr r r r <module>r sj 8 $ $7 7 7 7 J J J J J Jr defence360agent/migrations/__pycache__/107_malware_hit_status_field_populate.cpython-311.pyc 0000644 0000000 0000000 00000002052 00000000000 027175 0 ustar
r_j J d dl Z d dlmZ e j e ZddZddZdS ) N) BooleanFieldFc T |s%| j d }| |d d S d S )N malware_hitsrestored)orm
remove_fieldsmigratordatabasefakekwargs
MalwareHits u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/107_malware_hit_status_field_populate.pymigrater s< 7 \.1
z:666667 7 c j | j d }| |t d d S )Nr F)default)r )r
add_fieldsr r s r rollbackr s8 n-J
\%-H-H-HIIIIIr )F)loggingpeeweer getLogger__name__loggerr r r r <module>r sj 8 $ $7 7 7 7 J J J J J Jr defence360agent/migrations/__pycache__/108_feature_management_cleanup_add.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002066 00000000000 027335 0 ustar
r_j J d dl Z d dlmZ e j e ZddZddZdS ) N) BooleanFieldFc j | j d }| |t d d S )N feature_management_permissionsF)default)cleanup)orm
add_fieldsr migratordatabasefakekwargsFeatureManagementPermss r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/108_feature_management_cleanup_add.pymigrater sG %\*J K U(C(C(C c L | j d }| |d d S )Nr r )r
remove_fieldsr
s r rollbackr s- %\*J K 19=====r )F)loggingpeeweer getLogger__name__loggerr r r r <module>r sd 8 $ $ > > > > > >r defence360agent/migrations/__pycache__/108_feature_management_cleanup_add.cpython-311.pyc 0000644 0000000 0000000 00000002066 00000000000 026376 0 ustar
r_j J d dl Z d dlmZ e j e ZddZddZdS ) N) BooleanFieldFc j | j d }| |t d d S )N feature_management_permissionsF)default)cleanup)orm
add_fieldsr migratordatabasefakekwargsFeatureManagementPermss r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/108_feature_management_cleanup_add.pymigrater sG %\*J K U(C(C(C c L | j d }| |d d S )Nr r )r
remove_fieldsr
s r rollbackr s- %\*J K 19=====r )F)loggingpeeweer getLogger__name__loggerr r r r <module>r sd 8 $ $ > > > > > >r defence360agent/migrations/__pycache__/108_validate_config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003436 00000000000 024307 0 ustar
r_j Z d dl Z d dlZd dlmZmZmZ e j e ZddZ ddZ
dS ) N)ConfigsValidatorConfigsValidatorError LocalConfigFc |rd S t j d S # t $ rz t }|j dz }t j |j | | }| | t
d| Y d S w xY w# t $ r t d Y d S w xY w)Nz.invalidz?Invalid config replaced with default one. Old config save in %sz1Failed to replace invalid config with default one)
r validate_system_configr r pathosrenameconfig_to_dictdict_to_configloggerwarning Exception exception)migratordatabasefakekwargs local_config
backup_configdefault_configs c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/108_validate_config.pymigrater s N 3 5 5 5 5 5$
&==L ( -
:M Il' 7 7 7 ) 8 8 : :N ' ' 7 7 7 NN)
N N NLMMMMMMNs( B B B# B B# #$C
C c d S )N )r r r r s r rollbackr * s D )F) loggingr defence360agent.contracts.configr r r getLogger__name__r
r r r r r <module>r" s
8 $ $N N N N0 r defence360agent/migrations/__pycache__/108_validate_config.cpython-311.pyc 0000644 0000000 0000000 00000003436 00000000000 023350 0 ustar
r_j Z d dl Z d dlZd dlmZmZmZ e j e ZddZ ddZ
dS ) N)ConfigsValidatorConfigsValidatorError LocalConfigFc |rd S t j d S # t $ rz t }|j dz }t j |j | | }| | t
d| Y d S w xY w# t $ r t d Y d S w xY w)Nz.invalidz?Invalid config replaced with default one. Old config save in %sz1Failed to replace invalid config with default one)
r validate_system_configr r pathosrenameconfig_to_dictdict_to_configloggerwarning Exception exception)migratordatabasefakekwargs local_config
backup_configdefault_configs c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/108_validate_config.pymigrater s N 3 5 5 5 5 5$
&==L ( -
:M Il' 7 7 7 ) 8 8 : :N ' ' 7 7 7 NN)
N N NLMMMMMMNs( B B B# B B# #$C
C c d S )N )r r r r s r rollbackr * s D )F) loggingr defence360agent.contracts.configr r r getLogger__name__r
r r r r r <module>r" s
8 $ $N N N N0 r defence360agent/migrations/__pycache__/109_dos_detector.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003376 00000000000 023653 0 ustar
r_j N d dl Z d dlmZmZ e j e ZddZddZdS ) N)_DOS_DETECTOR_MIN_LIMIT
ConfigFileFc |rd S t }| d }d|vrd S d|d v rTt |d d t r3t |d d t
|d d< |d d= d|d v r |d d |d d< |d d= | |d d S # t $ r t d Y d S w xY w)
NFDOSmax_connections
default_limittimeoutintervalT) overwritez Failed to replace DOS settings)
r config_to_dict
isinstanceintmaxr dict_to_config Exceptionlogger exception)migratordatabasefakekwargs config_fileconfigs `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/109_dos_detector.pymigrater s0 ; ll ++E22 F u
- -* 5M+ ,c3
3
- .1u
/02I. .F5M/ * u
/0 u
% %(.u
i(@F5M* %u
i(""6T"::::: ; ; ;9::::::;s 'C B C $C87C8c d S )N )r r r r s r rollbackr ' s D )F) logging defence360agent.contracts.configr r getLogger__name__r r r r r r <module>r$ s|
8 $ $; ; ; ;8 r defence360agent/migrations/__pycache__/109_dos_detector.cpython-311.pyc 0000644 0000000 0000000 00000003376 00000000000 022714 0 ustar
r_j N d dl Z d dlmZmZ e j e ZddZddZdS ) N)_DOS_DETECTOR_MIN_LIMIT
ConfigFileFc |rd S t }| d }d|vrd S d|d v rTt |d d t r3t |d d t
|d d< |d d= d|d v r |d d |d d< |d d= | |d d S # t $ r t d Y d S w xY w)
NFDOSmax_connections
default_limittimeoutintervalT) overwritez Failed to replace DOS settings)
r config_to_dict
isinstanceintmaxr dict_to_config Exceptionlogger exception)migratordatabasefakekwargs config_fileconfigs `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/109_dos_detector.pymigrater s0 ; ll ++E22 F u
- -* 5M+ ,c3
3
- .1u
/02I. .F5M/ * u
/0 u
% %(.u
i(@F5M* %u
i(""6T"::::: ; ; ;9::::::;s 'C B C $C87C8c d S )N )r r r r s r rollbackr ' s D )F) logging defence360agent.contracts.configr r getLogger__name__r r r r r r <module>r$ s|
8 $ $; ; ; ;8 r defence360agent/migrations/__pycache__/110_ignore_list_ip_as_int.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003117 00000000000 025521 0 ustar
r_ja d dl ZddZddZdS ) NFc h |rd S G d dt j }| | d S )Nc e Zd Z ej d Z ej d Z ej d Z ej d Z G d d Z
dS ) migrate.<locals>.IgnoreListNewF)nullc 6 e Zd ZdZ ej ddd ZdS )#migrate.<locals>.IgnoreListNew.Metaignore_list_newnetwork_addressnetmaskversionN)__name__
__module__ __qualname__db_tablepw CompositeKey primary_key i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/110_ignore_list_ip_as_int.pyMetar s- (H)"/!9i KKKr r N) r
r r r CharFieldip IntegerFieldr
r r r r r r
IgnoreListNewr s
R\u
%
%
%)"/u555!"/u---!"/u--- r r )r Model create_model)migratordatabasefakekwargsr s r migrater" sW
-(((((r c d S )Nr )r r r r! s r rollbackr$ s Dr )F)peeweer r" r$ r r r <module>r& sC ) ) ) )& r defence360agent/migrations/__pycache__/110_ignore_list_ip_as_int.cpython-311.pyc 0000644 0000000 0000000 00000003117 00000000000 024562 0 ustar
r_ja d dl ZddZddZdS ) NFc h |rd S G d dt j }| | d S )Nc e Zd Z ej d Z ej d Z ej d Z ej d Z G d d Z
dS ) migrate.<locals>.IgnoreListNewF)nullc 6 e Zd ZdZ ej ddd ZdS )#migrate.<locals>.IgnoreListNew.Metaignore_list_newnetwork_addressnetmaskversionN)__name__
__module__ __qualname__db_tablepw CompositeKey primary_key i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/110_ignore_list_ip_as_int.pyMetar s- (H)"/!9i KKKr r N) r
r r r CharFieldip IntegerFieldr
r r r r r r
IgnoreListNewr s
R\u
%
%
%)"/u555!"/u---!"/u--- r r )r Model create_model)migratordatabasefakekwargsr s r migrater" sW
-(((((r c d S )Nr )r r r r! s r rollbackr$ s Dr )F)peeweer r" r$ r r r <module>r& sC ) ) ) )& r defence360agent/migrations/__pycache__/111_ignore_list_ip_as_int.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004626 00000000000 025530 0 ustar
r_j- d dl Z ddZddZdS ) NFc |rd S | j d }| j d } ddlm} ddlm} | 5 d | D }t } |D ]=}
t j
|
} n# t $ r Y $w xY w| | >| D ]=} || \ } }
}|
| | | |
| > d d d n # 1 swxY w Y n# t $ r Y nw xY w| d | d d S )
Nignore_list_new ignore_listr )IP)pack_ip_networkc g | ]
}|d S )ip ).0items i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/111_ignore_list_ip_as_int.py
<listcomp>zmigrate.<locals>.<listcomp> s MMM$t*MMM )r network_addressnetmaskversionzDROP TABLE ignore_listz1ALTER TABLE ignore_list_new RENAME TO ignore_list)orm defence360agent.utils.validater im360.utils.netr atomicselectdictsset ipaddress
ip_network
ValueErroraddcreateip_net_to_string ImportErrorsql)migratordatabasefakekwargs
IgnoreListNew
IgnoreListr r
ip_stringsipsr r netmaskr s r
migrater, s L!23M m,J555555333333 __
MM1B1B1D1D1J1J1L1LMMMJ%%C"
"-d33BB! H
%4_R%8%8"T7 $$**2..$' # %
.
LL)*** LLDEEEEEsI D AD BD
B&#D %B&&AD DD
D%$D%c dS )z$Write your rollback migrations here.Nr
)r" r# r$ r% s r
rollbackr. ( s Dr )F)r r, r. r
r r
<module>r/ sH !F !F !F !FH r defence360agent/migrations/__pycache__/111_ignore_list_ip_as_int.cpython-311.pyc 0000644 0000000 0000000 00000004626 00000000000 024571 0 ustar
r_j- d dl Z ddZddZdS ) NFc |rd S | j d }| j d } ddlm} ddlm} | 5 d | D }t } |D ]=}
t j
|
} n# t $ r Y $w xY w| | >| D ]=} || \ } }
}|
| | | |
| > d d d n # 1 swxY w Y n# t $ r Y nw xY w| d | d d S )
Nignore_list_new ignore_listr )IP)pack_ip_networkc g | ]
}|d S )ip ).0items i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/111_ignore_list_ip_as_int.py
<listcomp>zmigrate.<locals>.<listcomp> s MMM$t*MMM )r network_addressnetmaskversionzDROP TABLE ignore_listz1ALTER TABLE ignore_list_new RENAME TO ignore_list)orm defence360agent.utils.validater im360.utils.netr atomicselectdictsset ipaddress
ip_network
ValueErroraddcreateip_net_to_string ImportErrorsql)migratordatabasefakekwargs
IgnoreListNew
IgnoreListr r
ip_stringsipsr r netmaskr s r
migrater, s L!23M m,J555555333333 __
MM1B1B1D1D1J1J1L1LMMMJ%%C"
"-d33BB! H
%4_R%8%8"T7 $$**2..$' # %
.
LL)*** LLDEEEEEsI D AD BD
B&#D %B&&AD DD
D%$D%c dS )z$Write your rollback migrations here.Nr
)r" r# r$ r% s r
rollbackr. ( s Dr )F)r r, r. r
r r
<module>r/ sH !F !F !F !FH r defence360agent/migrations/__pycache__/112_hardened_php.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007212 00000000000 023601 0 ustar
r_j\ d dl Z d dlZd dlZd dlZd dlmZ ej ddd Z ej ddd Z ej e
Z dZ dZ
d Zd
Zd Zd ZddZddZdS ) N)importerz imav.malwarelib.utils.chattrsubtract_flags)modulenamedefaultFS_IMMUTABLE_FLzimunify360-alt-php.repoz imunify360-ea-php-hardened.repoz/etc/yum.repos.d/c d| v rt t hS t j d rt t g S t t g S )N
cloudlinuxz/usr/local/cpanel/cpanel)ALT_PHPEA_PHPospathexistsset)releases `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/112_hardened_php.pyirrelevant_reposr sM w 2 3 3 G9~~ F8}} c x t d S t t fD ]} t | z }t j | s,t | 5 }t | t t j
| d d d d n # 1 swxY w Y d S )Ni ) r r r REPOS_DIRr
r r openfilenor chmod) repo_namer fs r fix_permissionsr " s v& ( ( 9$w~~d##
$ZZ (1 188:: 7 7 7 HQXXZZ ' ' ' ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (s AB..B2 5B2 c t j d sd S t d 5 } | }d d d n # 1 swxY w Y t
t | D ]O}t j t 5 t j t |z d d d n # 1 swxY w Y Pd S )Nz/etc/redhat-release)
r
r r r readlowerr r
contextlibsuppressFileNotFoundErrorunlinkr )r r r s r
do_migrater$ / s@
7>>/ 0 0
# $ $ #&&((..""# # # # # # # # # # # # # # #%g.. - -
!2
3
3 - - Ii)+ , , , - - - - - - - - - - - - - - -- -s# 'A$$A(+A(' CC C Fc |rd S t d S # t $ r t d Y d S w xY w)Nz+Failed to clean up HardenedPHP repositories)r$ Exceptionlogger exceptionmigratordatabasefakekwargss r migrater. ; s_ H H H HFGGGGGGHs $>>c d S )N r) s r rollbackr1 D s Dr )F)r loggingr
os.pathdefence360agent.utilsr getr r getLogger__name__r' r r r r r r$ r. r1 r0 r r <module>r8 s * * * * * * )0@$ (, )0A4
8 $ $
# *
(
(
( - - -H H H H r defence360agent/migrations/__pycache__/112_hardened_php.cpython-311.pyc 0000644 0000000 0000000 00000007212 00000000000 022642 0 ustar
r_j\ d dl Z d dlZd dlZd dlZd dlmZ ej ddd Z ej ddd Z ej e
Z dZ dZ
d Zd
Zd Zd ZddZddZdS ) N)importerz imav.malwarelib.utils.chattrsubtract_flags)modulenamedefaultFS_IMMUTABLE_FLzimunify360-alt-php.repoz imunify360-ea-php-hardened.repoz/etc/yum.repos.d/c d| v rt t hS t j d rt t g S t t g S )N
cloudlinuxz/usr/local/cpanel/cpanel)ALT_PHPEA_PHPospathexistsset)releases `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/112_hardened_php.pyirrelevant_reposr sM w 2 3 3 G9~~ F8}} c x t d S t t fD ]} t | z }t j | s,t | 5 }t | t t j
| d d d d n # 1 swxY w Y d S )Ni ) r r r REPOS_DIRr
r r openfilenor chmod) repo_namer fs r fix_permissionsr " s v& ( ( 9$w~~d##
$ZZ (1 188:: 7 7 7 HQXXZZ ' ' ' ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (s AB..B2 5B2 c t j d sd S t d 5 } | }d d d n # 1 swxY w Y t
t | D ]O}t j t 5 t j t |z d d d n # 1 swxY w Y Pd S )Nz/etc/redhat-release)
r
r r r readlowerr r
contextlibsuppressFileNotFoundErrorunlinkr )r r r s r
do_migrater$ / s@
7>>/ 0 0
# $ $ #&&((..""# # # # # # # # # # # # # # #%g.. - -
!2
3
3 - - Ii)+ , , , - - - - - - - - - - - - - - -- -s# 'A$$A(+A(' CC C Fc |rd S t d S # t $ r t d Y d S w xY w)Nz+Failed to clean up HardenedPHP repositories)r$ Exceptionlogger exceptionmigratordatabasefakekwargss r migrater. ; s_ H H H HFGGGGGGHs $>>c d S )N r) s r rollbackr1 D s Dr )F)r loggingr
os.pathdefence360agent.utilsr getr r getLogger__name__r' r r r r r r$ r. r1 r0 r r <module>r8 s * * * * * * )0@$ (, )0A4
8 $ $
# *
(
(
( - - -H H H H r defence360agent/migrations/__pycache__/113_move_quarantined_files.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000770 00000000000 025706 0 ustar
r_jo d Z d Zd ZdS )z# Quarantine is removed in DEF-15234c d S N ___s j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/113_move_quarantined_files.pymigrater D c d S r r r s r rollbackr
r
r N)__doc__r r
r r r <module>r s3 ) ) r defence360agent/migrations/__pycache__/113_move_quarantined_files.cpython-311.pyc 0000644 0000000 0000000 00000000770 00000000000 024747 0 ustar
r_jo d Z d Zd ZdS )z# Quarantine is removed in DEF-15234c d S N ___s j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/113_move_quarantined_files.pymigrater D c d S r r r s r rollbackr
r
r N)__doc__r r
r r r <module>r s3 ) ) r defence360agent/migrations/__pycache__/114_disable_auto-quarantine.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003455 00000000000 025767 0 ustar
r_j V d dl Z d dlZd dlmZmZ e j e ZddZddZ dS ) N)
ConfigFileCoreFc |rdS dg}t j t j r1| t j t j |D ]}t | }| }|s)| di
d }|dk r5d|d d< | |dd }# t $ r Y w xY wdS )
zWrite your migrations here.N)usernameMALWARE_SCANNINGdefault_action
quarantinenotifyTF) overwritevalidate)
ospathexistsr USER_CONFDIRextendlistdirr config_to_dict
setdefaultgetdict_to_config Exception) migratordatabasefakekwargs usernamesr config_fileconfigr s k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/114_disable_auto-quarantine.pymigrater s1 I w~~d'(( 8D$566777 (333 ++-- **+=rBBFF
\ ) );CF% &'7 8
**dU +
* s C!!
C.-C.c d S )N )r r r r s r rollbackr# " s D )F)
loggingr
defence360agent.contracts.configr r getLogger__name__loggerr r# r" r$ r <module>r* ss = = = = = = = = 8 $ $ 2 r$ defence360agent/migrations/__pycache__/114_disable_auto-quarantine.cpython-311.pyc 0000644 0000000 0000000 00000003455 00000000000 025030 0 ustar
r_j V d dl Z d dlZd dlmZmZ e j e ZddZddZ dS ) N)
ConfigFileCoreFc |rdS dg}t j t j r1| t j t j |D ]}t | }| }|s)| di
d }|dk r5d|d d< | |dd }# t $ r Y w xY wdS )
zWrite your migrations here.N)usernameMALWARE_SCANNINGdefault_action
quarantinenotifyTF) overwritevalidate)
ospathexistsr USER_CONFDIRextendlistdirr config_to_dict
setdefaultgetdict_to_config Exception) migratordatabasefakekwargs usernamesr config_fileconfigr s k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/114_disable_auto-quarantine.pymigrater s1 I w~~d'(( 8D$566777 (333 ++-- **+=rBBFF
\ ) );CF% &'7 8
**dU +
* s C!!
C.-C.c d S )N )r r r r s r rollbackr# " s D )F)
loggingr
defence360agent.contracts.configr r getLogger__name__loggerr r# r" r$ r <module>r* ss = = = = = = = = 8 $ $ 2 r$ defence360agent/migrations/__pycache__/115_feature_management_fields.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004262 00000000000 026342 0 ustar
r_jN 2 d dl Zd dlmZmZmZ ddZddZdS ) N)NAFULL AV_REPORTFc | j d }| |t j t dt j d t t g t j t dt j d t t t g | dt f | dt f | d t f | d
t f |
|d d d S )
N feature_management_permissionsFz proactive_new in ('{}','{}'))defaultnull constraintszav in ('{}','{}','{}'))
proactive_newavz>UPDATE feature_management_permissions SET av=? WHERE cleanup=1z>UPDATE feature_management_permissions SET av=? WHERE cleanup=0zKUPDATE feature_management_permissions SET proactive_new=? WHERE proactive=1zKUPDATE feature_management_permissions SET proactive_new=? WHERE proactive=0cleanup proactive) orm
add_fieldspw TextFieldr Checkformatr r sql
remove_fields)migratordatabasefakekwargspermissions_models m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/115_feature_management_fields.pymigrater sS %EF l7>>r4HHII
< 188YMMNN
$
LLH
LLH
LL
LL
,iEEEEE c d S )N )r r r r s r rollbackr! 1 s Dr )F)peeweer ,defence360agent.feature_management.constantsr r r r r! r r r <module>r$ sf L L L L L L L L L L(F (F (F (FV r defence360agent/migrations/__pycache__/115_feature_management_fields.cpython-311.pyc 0000644 0000000 0000000 00000004262 00000000000 025403 0 ustar
r_jN 2 d dl Zd dlmZmZmZ ddZddZdS ) N)NAFULL AV_REPORTFc | j d }| |t j t dt j d t t g t j t dt j d t t t g | dt f | dt f | d t f | d
t f |
|d d d S )
N feature_management_permissionsFz proactive_new in ('{}','{}'))defaultnull constraintszav in ('{}','{}','{}'))
proactive_newavz>UPDATE feature_management_permissions SET av=? WHERE cleanup=1z>UPDATE feature_management_permissions SET av=? WHERE cleanup=0zKUPDATE feature_management_permissions SET proactive_new=? WHERE proactive=1zKUPDATE feature_management_permissions SET proactive_new=? WHERE proactive=0cleanup proactive) orm
add_fieldspw TextFieldr Checkformatr r sql
remove_fields)migratordatabasefakekwargspermissions_models m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/115_feature_management_fields.pymigrater sS %EF l7>>r4HHII
< 188YMMNN
$
LLH
LLH
LL
LL
,iEEEEE c d S )N )r r r r s r rollbackr! 1 s Dr )F)peeweer ,defence360agent.feature_management.constantsr r r r r! r r r <module>r$ sf L L L L L L L L L L(F (F (F (FV r defence360agent/migrations/__pycache__/116_feature_management_fields.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001533 00000000000 026341 0 ustar
r_j ddZ ddZdS )Fc N | j d }| |dd dS )z{
This is final accions for migration 115. For some reason,
it does not work if executed in the same migration
feature_management_permissions
proactive_new proactiveN)orm rename_field)migratordatabasefakekwargspermissions_models m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/116_feature_management_fields.pymigrater s1
! %EF +_kJJJJJ c d S )N )r r r
r s r
rollbackr
s Dr N)F)r r r r r
<module>r s; K K K K r defence360agent/migrations/__pycache__/116_feature_management_fields.cpython-311.pyc 0000644 0000000 0000000 00000001533 00000000000 025402 0 ustar
r_j ddZ ddZdS )Fc N | j d }| |dd dS )z{
This is final accions for migration 115. For some reason,
it does not work if executed in the same migration
feature_management_permissions
proactive_new proactiveN)orm rename_field)migratordatabasefakekwargspermissions_models m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/116_feature_management_fields.pymigrater s1
! %EF +_kJJJJJ c d S )N )r r r
r s r
rollbackr
s Dr N)F)r r r r r
<module>r s; K K K K r defence360agent/migrations/__pycache__/117_remove_incorrect_fields.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003217 00000000000 026061 0 ustar
r_j n d dl Z d dlmZmZ e j e Zd Zd e fdefdZddZ dS ) N)IConfig LocalConfigc 6 | d }d|vrd S |d dd |d dd | |dd d S # t $ r t d Y d S w xY w) NF) normalizeDOStimeoutmax_connectionsT) overwritevalidatezFailed to remove fields)config_to_dictpopdict_to_config Exceptionlogger exception) config_fileconfigs k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/117_remove_incorrect_fields.py _fix_configr s 4 ++e+<< Fu
)T***u
+T222""6TE"JJJJJ 4 4 423333334s A0 AA0 0$BBFr c , |rd S t | d S N)r )migratordatabasefaker kwargss r migrater s% c d S r )r r r r s r rollbackr $ s Dr )F)
logging defence360agent.contracts.configr r getLogger__name__r r r r r r r <module>r% s A A A A A A A A 8 $ $ 4 4 4$
&;==
r defence360agent/migrations/__pycache__/117_remove_incorrect_fields.cpython-311.pyc 0000644 0000000 0000000 00000003217 00000000000 025122 0 ustar
r_j n d dl Z d dlmZmZ e j e Zd Zd e fdefdZddZ dS ) N)IConfig LocalConfigc 6 | d }d|vrd S |d dd |d dd | |dd d S # t $ r t d Y d S w xY w) NF) normalizeDOStimeoutmax_connectionsT) overwritevalidatezFailed to remove fields)config_to_dictpopdict_to_config Exceptionlogger exception) config_fileconfigs k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/117_remove_incorrect_fields.py _fix_configr s 4 ++e+<< Fu
)T***u
+T222""6TE"JJJJJ 4 4 423333334s A0 AA0 0$BBFr c , |rd S t | d S N)r )migratordatabasefaker kwargss r migrater s% c d S r )r r r r s r rollbackr $ s Dr )F)
logging defence360agent.contracts.configr r getLogger__name__r r r r r r r <module>r% s A A A A A A A A 8 $ $ 4 4 4$
&;==
r defence360agent/migrations/__pycache__/118_add_malware_user_infected.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000764 00000000000 026332 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/118_add_malware_user_infected.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/118_add_malware_user_infected.cpython-311.pyc 0000644 0000000 0000000 00000000764 00000000000 025373 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/118_add_malware_user_infected.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/118_remove_country_subnets.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001415 00000000000 026010 0 ustar
r_j > d dl Z e j e ZddZddZdS ) NFc J | j d }| | d S )Ncountry_subnets)orm remove_model)migratordatabasefakekwargsCountrySubnetss j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/118_remove_country_subnets.pymigrater
s) \"34N .))))) c d S )N )r r r r
s r rollbackr s Dr )F)logging getLogger__name__loggerr
r r r r <module>r sR 8 $ $* * * *
r defence360agent/migrations/__pycache__/118_remove_country_subnets.cpython-311.pyc 0000644 0000000 0000000 00000001415 00000000000 025051 0 ustar
r_j > d dl Z e j e ZddZddZdS ) NFc J | j d }| | d S )Ncountry_subnets)orm remove_model)migratordatabasefakekwargsCountrySubnetss j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/118_remove_country_subnets.pymigrater
s) \"34N .))))) c d S )N )r r r r
s r rollbackr s Dr )F)logging getLogger__name__loggerr
r r r r <module>r sR 8 $ $* * * *
r defence360agent/migrations/__pycache__/119_populate_malware_user_infected.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000771 00000000000 027432 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/119_populate_malware_user_infected.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/119_populate_malware_user_infected.cpython-311.pyc 0000644 0000000 0000000 00000000771 00000000000 026473 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/119_populate_malware_user_infected.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/120_scheduled_scan.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004604 00000000000 024125 0 ustar
r_j d dl Z d dlmZmZ d dlZd dlmZ d dlm Z e j
ddd Z e j e
Ze j e j e j e j fZd dZd
d
Zd
d ZdS ) N)date timedelta)
ConfigFile)importerzimav.malwarelib.configMalwareScanType)modulenamedefaultc t j t d z }dd|j ii} t | }| | d S # t $ r t d Y d S w xY w)N )daysMALWARE_SCAN_SCHEDULE day_of_month)pathz*Failed to set malware scan schedule config) r todayr dayr dict_to_config Exceptionlogger exception)r tomorrowconfig config_files b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/120_scheduled_scan.py_update_configr s z||iQ / / //H HL"
F G d+++ ""6***** G G GEFFFFFFGs %A $B ?B Fc | j d }| |t j dt j d t g |rd S t d S )N
malware_scansFz
type in {})null constraints)type)orm
change_fieldspw CharFieldCheckformattypesr )migratordatabasefakekwargs MalwareScans r migrater- ' s ,/K
\RXl.A.A%.H.H%I%I$J
c d S N )r( r) r* r+ s r rollbackr2 7 s Dr. r0 )F)loggingdatetimer r peeweer# defence360agent.contracts.configr defence360agent.utilsr getr getLogger__name__r ON_DEMANDREALTIMEMALWARE_RESPONSE
BACKGROUNDr' r r- r2 r1 r. r <module>r? s $ $ $ $ $ $ $ $ 7 7 7 7 7 7 * * * * * * (, #*;T
8 $ $ $
G
G
G
G
r. defence360agent/migrations/__pycache__/120_scheduled_scan.cpython-311.pyc 0000644 0000000 0000000 00000004604 00000000000 023166 0 ustar
r_j d dl Z d dlmZmZ d dlZd dlmZ d dlm Z e j
ddd Z e j e
Ze j e j e j e j fZd dZd
d
Zd
d ZdS ) N)date timedelta)
ConfigFile)importerzimav.malwarelib.configMalwareScanType)modulenamedefaultc t j t d z }dd|j ii} t | }| | d S # t $ r t d Y d S w xY w)N )daysMALWARE_SCAN_SCHEDULE day_of_month)pathz*Failed to set malware scan schedule config) r todayr dayr dict_to_config Exceptionlogger exception)r tomorrowconfig config_files b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/120_scheduled_scan.py_update_configr s z||iQ / / //H HL"
F G d+++ ""6***** G G GEFFFFFFGs %A $B ?B Fc | j d }| |t j dt j d t g |rd S t d S )N
malware_scansFz
type in {})null constraints)type)orm
change_fieldspw CharFieldCheckformattypesr )migratordatabasefakekwargs MalwareScans r migrater- ' s ,/K
\RXl.A.A%.H.H%I%I$J
c d S N )r( r) r* r+ s r rollbackr2 7 s Dr. r0 )F)loggingdatetimer r peeweer# defence360agent.contracts.configr defence360agent.utilsr getr getLogger__name__r ON_DEMANDREALTIMEMALWARE_RESPONSE
BACKGROUNDr' r r- r2 r1 r. r <module>r? s $ $ $ $ $ $ $ $ 7 7 7 7 7 7 * * * * * * (, #*;T
8 $ $ $
G
G
G
G
r. defence360agent/migrations/__pycache__/121_drop_captcha_stat.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001153 00000000000 024640 0 ustar
r_j ddZ ddZdS )Fc F | | j d d S )N captcha_stat) remove_modelormmigratordatabasefakekwargss e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/121_drop_captcha_stat.pymigrater s# (,~677777 c d S )N r s r rollbackr s Dr
N)F)r r r r
r <module>r s7 8 8 8 8 r
defence360agent/migrations/__pycache__/121_drop_captcha_stat.cpython-311.pyc 0000644 0000000 0000000 00000001153 00000000000 023701 0 ustar
r_j ddZ ddZdS )Fc F | | j d d S )N captcha_stat) remove_modelormmigratordatabasefakekwargss e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/121_drop_captcha_stat.pymigrater s# (,~677777 c d S )N r s r rollbackr s Dr
N)F)r r r r
r <module>r s7 8 8 8 8 r
defence360agent/migrations/__pycache__/122_cagefs_unmount.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000762 00000000000 024201 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/122_cagefs_unmount.pymigrater s D c d S r r r s r
rollbackr s Dr N)F)r r r r r
<module>r s7 r defence360agent/migrations/__pycache__/122_cagefs_unmount.cpython-311.pyc 0000644 0000000 0000000 00000000762 00000000000 023242 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/122_cagefs_unmount.pymigrater s D c d S r r r s r
rollbackr s Dr N)F)r r r r r
<module>r s7 r defence360agent/migrations/__pycache__/123_add_last_user_scan.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002364 00000000000 025002 0 ustar
r_j D d dl Z G d dej ZddZddZdS ) Nc e Zd Z G d d Z ej d Z ej d Z ej d Z dS ) LastUserScanc e Zd ZdZdS )LastUserScan.Metalast_user_scansN)__name__
__module__ __qualname__db_table f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/123_add_last_user_scan.pyMetar s $r
r T) primary_keyF)nullN)
r r r
r pw CharField last_scanid IntegerFieldstarteduidr r
r r r st % % % % % % % % ",4000K bo5)))G
"/u
%
%
%CCCr
r Fc d S Nr migratordatabasefakekwargss r migrater
Dr
c d S r r r s r rollbackr" r r
)F)peeweer Modelr r r" r r
r <module>r% so & & & & &28 & & & r
defence360agent/migrations/__pycache__/123_add_last_user_scan.cpython-311.pyc 0000644 0000000 0000000 00000002364 00000000000 024043 0 ustar
r_j D d dl Z G d dej ZddZddZdS ) Nc e Zd Z G d d Z ej d Z ej d Z ej d Z dS ) LastUserScanc e Zd ZdZdS )LastUserScan.Metalast_user_scansN)__name__
__module__ __qualname__db_table f/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/123_add_last_user_scan.pyMetar s $r
r T) primary_keyF)nullN)
r r r
r pw CharField last_scanid IntegerFieldstarteduidr r
r r r st % % % % % % % % ",4000K bo5)))G
"/u
%
%
%CCCr
r Fc d S Nr migratordatabasefakekwargss r migrater
Dr
c d S r r r s r rollbackr" r r
)F)peeweer Modelr r r" r r
r <module>r% so & & & & &28 & & & r
defence360agent/migrations/__pycache__/123_disable_scheduled_scan.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003574 00000000000 025620 0 ustar
r_j t d dl Z d dlZd dlZd dlmZmZ ej e ZdZ d dZ
e fdZ d
dZ d
dZ
dS ) N)
ConfigFileNONEz!/etc/cron.d/imunify_scan_schedulec ddt ii} t | }| | d S # t $ r t d Y d S w xY w)NMALWARE_SCAN_SCHEDULEintervalpathz*Failed to set malware scan schedule config)r r dict_to_config Exceptionlogger exception)r config config_files j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/123_disable_scheduled_scan.py_update_configr
s "
F G d+++ ""6***** G G GEFFFFFFGs %4 $A A c t j t 5 t j | d d d d S # 1 swxY w Y d S N)
contextlibsuppressFileNotFoundErrorosunlinkr s r _remove_cronr s . / /
$ s <A A Fc d S r migratordatabasefakekwargss r migrater! s D c d S r r r s r rollbackr$ * s Dr" r )F)r loggingr defence360agent.contracts.configr r getLogger__name__r CRON_PATHr r r! r$ r r" r <module>r* s = = = = = = = = 8 $ $
0 G G G G
r" defence360agent/migrations/__pycache__/123_disable_scheduled_scan.cpython-311.pyc 0000644 0000000 0000000 00000003574 00000000000 024661 0 ustar
r_j t d dl Z d dlZd dlZd dlmZmZ ej e ZdZ d dZ
e fdZ d
dZ d
dZ
dS ) N)
ConfigFileNONEz!/etc/cron.d/imunify_scan_schedulec ddt ii} t | }| | d S # t $ r t d Y d S w xY w)NMALWARE_SCAN_SCHEDULEintervalpathz*Failed to set malware scan schedule config)r r dict_to_config Exceptionlogger exception)r config config_files j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/123_disable_scheduled_scan.py_update_configr
s "
F G d+++ ""6***** G G GEFFFFFFGs %4 $A A c t j t 5 t j | d d d d S # 1 swxY w Y d S N)
contextlibsuppressFileNotFoundErrorosunlinkr s r _remove_cronr s . / /
$ s <A A Fc d S r migratordatabasefakekwargss r migrater! s D c d S r r r s r rollbackr$ * s Dr" r )F)r loggingr defence360agent.contracts.configr r getLogger__name__r CRON_PATHr r r! r$ r r" r <module>r* s = = = = = = = = 8 $ $
0 G G G G
r" defence360agent/migrations/__pycache__/123_rename_plesk_vendor.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003655 00000000000 025213 0 ustar
r_j h d dl Z d dlmZmZ e j e Zej dd ZddZ dS ) N)run_coroantivirus_modeFc |rd S ddl m} ddlm} n# t $ r Y d S w xY w | r|t
| rg | }t
| }dd | v r't
| d S d S d S d S # t $ r&}t d| Y d }~d S d }~ww xY w)Nr )Plesk) plesk_supports_custom_vendors
imunify360 z/Unable to reinstall modsec "custom" ruleset: %s)
im360.subsys.panels.pleskr &im360.subsys.panels.plesk.mod_securityr ImportError is_installedr modsec_vendor_listjoininstall_settings Exceptionloggerwarning) migratordatabasefakekwargsr r panelinstalled_vendorses g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/123_rename_plesk_vendor.pymigrater sc 333333
M 3H-J-J-L-L$M$M 3EGGE ()A)A)C)C D D sxx(9 : ::://1122222 3 3 3 3 ;: M M MH!LLLLLLLLLMs$
!!BB; ;
C+C&&C+c d S )N )r r r r s r rollbackr s D )F)
loggingdefence360agent.utilsr r getLogger__name__r skipr r r r r <module>r& s : : : : : : : :
8 $ $ M M M M, r defence360agent/migrations/__pycache__/123_rename_plesk_vendor.cpython-311.pyc 0000644 0000000 0000000 00000003655 00000000000 024254 0 ustar
r_j h d dl Z d dlmZmZ e j e Zej dd ZddZ dS ) N)run_coroantivirus_modeFc |rd S ddl m} ddlm} n# t $ r Y d S w xY w | r|t
| rg | }t
| }dd | v r't
| d S d S d S d S # t $ r&}t d| Y d }~d S d }~ww xY w)Nr )Plesk) plesk_supports_custom_vendors
imunify360 z/Unable to reinstall modsec "custom" ruleset: %s)
im360.subsys.panels.pleskr &im360.subsys.panels.plesk.mod_securityr ImportError is_installedr modsec_vendor_listjoininstall_settings Exceptionloggerwarning) migratordatabasefakekwargsr r panelinstalled_vendorses g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/123_rename_plesk_vendor.pymigrater sc 333333
M 3H-J-J-L-L$M$M 3EGGE ()A)A)C)C D D sxx(9 : ::://1122222 3 3 3 3 ;: M M MH!LLLLLLLLLMs$
!!BB; ;
C+C&&C+c d S )N )r r r r s r rollbackr s D )F)
loggingdefence360agent.utilsr r getLogger__name__r skipr r r r r <module>r& s : : : : : : : :
8 $ $ M M M M, r defence360agent/migrations/__pycache__/124_add_hook_management_functionality.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003577 00000000000 030111 0 ustar
r_j~ b d dl m Z d dlmZmZmZmZ d dlmZ G d de Zd
dZ d
dZ
d S ) )time)Model CharField IntegerField BooleanField)
FilenameFieldc e Zd Z G d d Z ed Z ed Z edd Z e
d Z dS ) EventHookc e Zd ZdZdS )EventHook.Meta
event_hookN)__name__
__module__ __qualname__db_table u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/124_add_hook_management_functionality.pyMetar s r r F)nullc 8 t t S N)intr r r r <lambda>zEventHook.<lambda> s s466{{ r )r default)r N) r r r r r pathr eventr createdr nativer r r r
r
s =e $ $ $D I5 ! ! !El/B/BCCCG
\%
(
(
(FFFr r
Fc : | t d S r ) create_modelr
)migratordatabasefakekwargss r migrater& s )$$$$$r c J | j d }| | d S )Nr
)orm remove_model)r" r# r$ r% r
s r rollbackr* s( \*I )$$$$$r N)F) r peeweer r r r $defence360agent.model.simplificationr r
r& r* r r r <module>r- s ? ? ? ? ? ? ? ? ? ? ? ? > > > > > >) ) ) ) ) ) ) )% % % %% % % % % %r defence360agent/migrations/__pycache__/124_add_hook_management_functionality.cpython-311.pyc 0000644 0000000 0000000 00000003577 00000000000 027152 0 ustar
r_j~ b d dl m Z d dlmZmZmZmZ d dlmZ G d de Zd
dZ d
dZ
d S ) )time)Model CharField IntegerField BooleanField)
FilenameFieldc e Zd Z G d d Z ed Z ed Z edd Z e
d Z dS ) EventHookc e Zd ZdZdS )EventHook.Meta
event_hookN)__name__
__module__ __qualname__db_table u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/124_add_hook_management_functionality.pyMetar s r r F)nullc 8 t t S N)intr r r r <lambda>zEventHook.<lambda> s s466{{ r )r default)r N) r r r r r pathr eventr createdr nativer r r r
r
s =e $ $ $D I5 ! ! !El/B/BCCCG
\%
(
(
(FFFr r
Fc : | t d S r ) create_modelr
)migratordatabasefakekwargss r migrater& s )$$$$$r c J | j d }| | d S )Nr
)orm remove_model)r" r# r$ r% r
s r rollbackr* s( \*I )$$$$$r N)F) r peeweer r r r $defence360agent.model.simplificationr r
r& r* r r r <module>r- s ? ? ? ? ? ? ? ? ? ? ? ? > > > > > >) ) ) ) ) ) ) )% % % %% % % % % %r defence360agent/migrations/__pycache__/124_add_infected_domains_vendor.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002100 00000000000 026632 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc | j d }| |t j dd | d S )Ninfected_domain_listFzgoogle-safe-browsing)nulldefault)vendor)orm
add_fieldspw TextFielddeleteexecute)migratordatabasefakekwargsInfectedDomainss o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/124_add_infected_domains_vendor.pymigrater sh l#9:O |0FGGG $$&&&&& c d S )N )r r r r s r rollbackr s Dr )F)loggingpeeweer
getLogger__name__loggerr r r r r <module>r s^ 8 $ $' ' ' ' r defence360agent/migrations/__pycache__/124_add_infected_domains_vendor.cpython-311.pyc 0000644 0000000 0000000 00000002100 00000000000 025673 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc | j d }| |t j dd | d S )Ninfected_domain_listFzgoogle-safe-browsing)nulldefault)vendor)orm
add_fieldspw TextFielddeleteexecute)migratordatabasefakekwargsInfectedDomainss o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/124_add_infected_domains_vendor.pymigrater sh l#9:O |0FGGG $$&&&&& c d S )N )r r r r s r rollbackr s Dr )F)loggingpeeweer
getLogger__name__loggerr r r r r <module>r s^ 8 $ $' ' ' ' r defence360agent/migrations/__pycache__/125_rescan_scan_type.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005371 00000000000 024510 0 ustar
r_jO d dl Z d dlmZmZ d dlZd dlmZ d dlmZ ej ddd Z e j
e Z e j
e j e j e j e j fZd d Zd d
ZdS ) N)datetime timedelta)importer)split_for_chunkzimav.malwarelib.configMalwareScanType)modulenamedefaultFc | j d }| j d }t j t d z
}t | |j | |j
|k }t | D ]l}| |j
| \ } }
| | |
m| |j
|k \ } }
| | |
| |t! j dt! j d t( g d S ) N malware_hits
malware_scans )daysFz
type in {})null constraints)type)ormr nowr timestamplistselectidjoinwherestartedr deletein_sql
change_fieldspw CharFieldCheckformattypes) migratordatabasefakekwargs
MalwareHit MalwareScandatehits_to_deletechunkr paramss d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/125_rescan_scan_type.pymigrater0 s n-J,/K LNNYB / / / / : : < <D*-((
k {"T) * * N ! 00 " " ''))//
0A0A%0H0HIIMMOO V S&!!!! $$&&,,[-@4-GHHLLNNKC LLf
\RXl.A.A%.H.H%I%I$J
c d S )N )r% r& r' r( s r/ rollbackr4 3 s Dr1 )F)loggingr r peeweer defence360agent.utilsr r getr getLogger__name__logger ON_DEMANDREALTIMEMALWARE_RESPONSE
BACKGROUNDRESCANr$ r0 r4 r3 r1 r/ <module>rA s ( ( ( ( ( ( ( ( * * * * * * 1 1 1 1 1 1 (, #*;T
8 $ $ $ 6 r1 defence360agent/migrations/__pycache__/125_rescan_scan_type.cpython-311.pyc 0000644 0000000 0000000 00000005371 00000000000 023551 0 ustar
r_jO d dl Z d dlmZmZ d dlZd dlmZ d dlmZ ej ddd Z e j
e Z e j
e j e j e j e j fZd d Zd d
ZdS ) N)datetime timedelta)importer)split_for_chunkzimav.malwarelib.configMalwareScanType)modulenamedefaultFc | j d }| j d }t j t d z
}t | |j | |j
|k }t | D ]l}| |j
| \ } }
| | |
m| |j
|k \ } }
| | |
| |t! j dt! j d t( g d S ) N malware_hits
malware_scans )daysFz
type in {})null constraints)type)ormr nowr timestamplistselectidjoinwherestartedr deletein_sql
change_fieldspw CharFieldCheckformattypes) migratordatabasefakekwargs
MalwareHit MalwareScandatehits_to_deletechunkr paramss d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/125_rescan_scan_type.pymigrater0 s n-J,/K LNNYB / / / / : : < <D*-((
k {"T) * * N ! 00 " " ''))//
0A0A%0H0HIIMMOO V S&!!!! $$&&,,[-@4-GHHLLNNKC LLf
\RXl.A.A%.H.H%I%I$J
c d S )N )r% r& r' r( s r/ rollbackr4 3 s Dr1 )F)loggingr r peeweer defence360agent.utilsr r getr getLogger__name__logger ON_DEMANDREALTIMEMALWARE_RESPONSE
BACKGROUNDRESCANr$ r0 r4 r3 r1 r/ <module>rA s ( ( ( ( ( ( ( ( * * * * * * 1 1 1 1 1 1 (, #*;T
8 $ $ $ 6 r1 ././@LongLink 0000000 0000000 0000000 00000000150 00000000000 011561 L ustar root root defence360agent/migrations/__pycache__/126_add_malware_scan_modified_files_option.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/126_add_malware_scan_modified_files_option.cpython-311.opt-1.0000644 0000000 0000000 00000003222 00000000000 030324 0 ustar
r_j | d dl Z d dlZd dlmZmZ d dlmZ e d e fdefd ZddZdS ) N) IConfigFile LocalConfig)log_error_and_ignoreF config_filec j |rd S t j |j sd S t |j 5 }t j | }d d d n # 1 swxY w Y | di }| dd }||d< | |d d S )NMALWARE_SCANNINGscan_modified_filesF)validate) ospathexistsopenyaml safe_load
setdefaultpopdict_to_config) migratordatabasefaker kwargsfconfmalware_settingsvalues z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/126_add_malware_scan_modified_files_option.pymigrater s
7>>+* + +
k !1~a ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! '92>> !6 = =E.3*+ te 44444s A A$'A$c d S )N )r r r r s r rollbackr ! s D )F) r r defence360agent.contracts.configr r defence360agent.utilsr r r r r! r <module>r$ s E E E E E E E E 6 6 6 6 6 6
*{}} 5 5 5 5 5 5. r! defence360agent/migrations/__pycache__/126_add_malware_scan_modified_files_option.cpython-311.pyc 0000644 0000000 0000000 00000003222 00000000000 030101 0 ustar
r_j | d dl Z d dlZd dlmZmZ d dlmZ e d e fdefd ZddZdS ) N) IConfigFile LocalConfig)log_error_and_ignoreF config_filec j |rd S t j |j sd S t |j 5 }t j | }d d d n # 1 swxY w Y | di }| dd }||d< | |d d S )NMALWARE_SCANNINGscan_modified_filesF)validate) ospathexistsopenyaml safe_load
setdefaultpopdict_to_config) migratordatabasefaker kwargsfconfmalware_settingsvalues z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/126_add_malware_scan_modified_files_option.pymigrater s
7>>+* + +
k !1~a ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! '92>> !6 = =E.3*+ te 44444s A A$'A$c d S )N )r r r r s r rollbackr ! s D )F) r r defence360agent.contracts.configr r defence360agent.utilsr r r r r! r <module>r$ s E E E E E E E E 6 6 6 6 6 6
*{}} 5 5 5 5 5 5. r! defence360agent/migrations/__pycache__/126_move_malware_hits_list.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004260 00000000000 025725 0 ustar
r_j: d dl Z d dlZd dlmZ d dlmZmZ e j e Z d Z
ej dd Z ddZ
dS ) N) FILES_DIR)importerantivirus_modec t j | | d S # t $ r Y d S t $ r&}t d| Y d }~d S d }~ww xY w)Nz6Failed to move HackerTrap list to the new location: %r)shutilmoveFileNotFoundError Exceptionloggererror)srcdsterrs j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/126_move_malware_hits_list.py_mover
s
C
Dc
s
A AAAFc B |rd S ddl m} t j ddd }n# t $ r Y d S w xY wt t |_ | }| }||fD ]$}t t | |j %d S )Nr )
HackerTrapz imav.malwarelib.subsys.malwareHackerTrapHitsSaver)modulenamedefault) defence360agent.contracts.configr r get ImportErrorstrr BASE_DIR _filepath_clean_filepathr DIR) migratordatabasefakekwargsr r src1src2r
s r migrater& s ?????? &l3&
$'y>> ( ( * *D . . 0 0DTz ( (
c#hh
''''( (s $
22c d S )N )r r! r" r# s r rollbackr) - s D )F)loggingr defence360agent.filesr defence360agent.utilsr r getLogger__name__r r skipr& r) r( r* r <module>r1 s
+ + + + + + : : : : : : : : 8 $ $
( ( ( (. r* defence360agent/migrations/__pycache__/126_move_malware_hits_list.cpython-311.pyc 0000644 0000000 0000000 00000004260 00000000000 024766 0 ustar
r_j: d dl Z d dlZd dlmZ d dlmZmZ e j e Z d Z
ej dd Z ddZ
dS ) N) FILES_DIR)importerantivirus_modec t j | | d S # t $ r Y d S t $ r&}t d| Y d }~d S d }~ww xY w)Nz6Failed to move HackerTrap list to the new location: %r)shutilmoveFileNotFoundError Exceptionloggererror)srcdsterrs j/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/126_move_malware_hits_list.py_mover
s
C
Dc
s
A AAAFc B |rd S ddl m} t j ddd }n# t $ r Y d S w xY wt t |_ | }| }||fD ]$}t t | |j %d S )Nr )
HackerTrapz imav.malwarelib.subsys.malwareHackerTrapHitsSaver)modulenamedefault) defence360agent.contracts.configr r get ImportErrorstrr BASE_DIR _filepath_clean_filepathr DIR) migratordatabasefakekwargsr r src1src2r
s r migrater& s ?????? &l3&
$'y>> ( ( * *D . . 0 0DTz ( (
c#hh
''''( (s $
22c d S )N )r r! r" r# s r rollbackr) - s D )F)loggingr defence360agent.filesr defence360agent.utilsr r getLogger__name__r r skipr& r) r( r* r <module>r1 s
+ + + + + + : : : : : : : : 8 $ $
( ( ( (. r* defence360agent/migrations/__pycache__/127_remove_malware_hit_mode.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001243 00000000000 026041 0 ustar
r_j ddZ ddZdS )Fc L | j d }| |d d S )N malware_hitsmode)orm
remove_fields)migratordatabasefakekwargs
MalwareHits k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/127_remove_malware_hit_mode.pymigrater
s* n-J :v..... c d S )N )r r r r
s r rollbackr s Dr N)F)r
r r r r <module>r s7 / / / /
r defence360agent/migrations/__pycache__/127_remove_malware_hit_mode.cpython-311.pyc 0000644 0000000 0000000 00000001243 00000000000 025102 0 ustar
r_j ddZ ddZdS )Fc L | j d }| |d d S )N malware_hitsmode)orm
remove_fields)migratordatabasefakekwargs
MalwareHits k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/127_remove_malware_hit_mode.pymigrater
s* n-J :v..... c d S )N )r r r r
s r rollbackr s Dr N)F)r
r r r r <module>r s7 / / / /
r defence360agent/migrations/__pycache__/128_move_cleanup_storage_files.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007276 00000000000 026564 0 ustar
r_j d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm Z ej
ddd Z e j e
Zd Zd Zd
d Zd
d ZdS ) N) CharFieldModel)importer)
FilenameFieldz imav.malwarelib.cleanup.storageCleanupStorage)modulenamedefaultc 2 G fddt }|S )zl
Model stub for migration because we can't use migrator.orm[] due to
custom field FilenameField
c e Zd Z G fdd Z ed Z ed Z ed Z ed Z e
de fd Z dS ) get_model.<locals>.MalwareHitc e Zd ZdZ ZdS )"get_model.<locals>.MalwareHit.Meta malware_hitsN)__name__
__module__ __qualname__db_tabledatabasedbs n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/128_move_cleanup_storage_files.pyMetar s %HHHH r F)nullTreturnc t j j | j | j | j g S # t $ r Y dS w xY w)zZ
Get file name for cleanup storage
:return: file name
N)ospathextsepjoinuserhashsize TypeError)selfs r storage_namez*get_model.<locals>.MalwareHit.storage_name# sN
w~**DIty$)+LMMM
tt
s 58
AAN)
r r r r r r" r orig_filer# r$ propertystrr' r s r
MalwareHitr
s ye$$$!Mu--- yd###yd### #
r r+ )r )r r+ s ` r get_modelr, s? U * r c , t t j j | |f \ } }t t | |f \ } } t j | | d S # t $ r Y d S t $ r&}t
d| Y d }~d S d }~ww xY w)Nz2Failed to move stored file to the new location: %r) mapr r joinpathr* shutilmoveFileNotFoundError Exceptionloggererror)srcdsterrs r _mover9 1 s >&/#s<<HC3c
##HCP C
P P P I3OOOOOOOOOPs A
B$ B-BBFc |rd S t | }|D ];}|j }| t |j }t || <d S N)r, r' r r( r9 )migratorr fakekwargsr+ hitr6 r7 s r migrater@ < si 8$$J ; ))#-88
c3
r c d S r; )r< r r= r> s r rollbackrC K s Dr )F)loggingr r0 peeweer r defence360agent.utilsr $defence360agent.model.simplificationr getr getLoggerr r4 r, r9 r@ rC rB r r <module>rJ s
# # # # # # # # * * * * * * > > > > > > ,
8 $ $ <P P P r defence360agent/migrations/__pycache__/128_move_cleanup_storage_files.cpython-311.pyc 0000644 0000000 0000000 00000007276 00000000000 025625 0 ustar
r_j d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm Z ej
ddd Z e j e
Zd Zd Zd
d Zd
d ZdS ) N) CharFieldModel)importer)
FilenameFieldz imav.malwarelib.cleanup.storageCleanupStorage)modulenamedefaultc 2 G fddt }|S )zl
Model stub for migration because we can't use migrator.orm[] due to
custom field FilenameField
c e Zd Z G fdd Z ed Z ed Z ed Z ed Z e
de fd Z dS ) get_model.<locals>.MalwareHitc e Zd ZdZ ZdS )"get_model.<locals>.MalwareHit.Meta malware_hitsN)__name__
__module__ __qualname__db_tabledatabasedbs n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/128_move_cleanup_storage_files.pyMetar s %HHHH r F)nullTreturnc t j j | j | j | j g S # t $ r Y dS w xY w)zZ
Get file name for cleanup storage
:return: file name
N)ospathextsepjoinuserhashsize TypeError)selfs r storage_namez*get_model.<locals>.MalwareHit.storage_name# sN
w~**DIty$)+LMMM
tt
s 58
AAN)
r r r r r r" r orig_filer# r$ propertystrr' r s r
MalwareHitr
s ye$$$!Mu--- yd###yd### #
r r+ )r )r r+ s ` r get_modelr, s? U * r c , t t j j | |f \ } }t t | |f \ } } t j | | d S # t $ r Y d S t $ r&}t
d| Y d }~d S d }~ww xY w)Nz2Failed to move stored file to the new location: %r) mapr r joinpathr* shutilmoveFileNotFoundError Exceptionloggererror)srcdsterrs r _mover9 1 s >&/#s<<HC3c
##HCP C
P P P I3OOOOOOOOOPs A
B$ B-BBFc |rd S t | }|D ];}|j }| t |j }t || <d S N)r, r' r r( r9 )migratorr fakekwargsr+ hitr6 r7 s r migrater@ < si 8$$J ; ))#-88
c3
r c d S r; )r< r r= r> s r rollbackrC K s Dr )F)loggingr r0 peeweer r defence360agent.utilsr $defence360agent.model.simplificationr getr getLoggerr r4 r, r9 r@ rC rB r r <module>rJ s
# # # # # # # # * * * * * * > > > > > > ,
8 $ $ <P P P r defence360agent/migrations/__pycache__/129_fixed_cagefs_unmount.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006146 00000000000 025371 0 ustar
r_jl d dl Z d dlZd dlZd dlmZ d dlmZmZ dZdZ dZ
dZ ed d d
gfd Z d Z
ee j d
e
d d ZddZddZdS ) N) lru_cache)retry_onrun_with_umaskcagefsrestartz/usr/sbin/cagefsctlz --wait-lock z/usr/binz/binc 4 t d | D S )z6Return whether we can find systemctl in given *paths*.c 3 K | ]A}t j t j |d V BdS ) systemctlN)ospathisfilejoin).0ps h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/129_fixed_cagefs_unmount.py <genexpr>z$systemctl_present.<locals>.<genexpr> s@ KKrw~~bgll1k : :;;KKKKKK )any)pathss r systemctl_presentr
s! KKUKKK K KKr c t rdt t g}ndt t g} t j | n# t
$ r Y nw xY wt
j d d S )Nr service )r _COMMAND
_SERVICE_NAME
subprocess
check_call Exceptiontimesleep)excicmds r _restart_cagefsr% st 3Hm4-2
c""""
JqMMMMMs A
AA T) max_trieson_errorsilentc H t j | dt j d S )NF)shellstderr)r check_outputSTDOUT)r$ s r _execute_commandr/ s% CuZ5FGGGGGGr F c
|rd S t t dgt t dgg}t | 5 t j t r|D ]}t
| d d d d S # 1 swxY w Y d S )Nz--force-update-etcz
--remount-all)_CAGEFSCTL_TOOL
_WAIT_LOCKr r r
existsr/ )migratordatabasefakeumaskkwargscmd_listr$ s r migrater; ) s *&:; *o6H
& &
7>>/ * * &
&
& %%%%& & & & & & & & & & & & & & & & & &s 9A88A<?A<c d S )N )r5 r6 r7 r9 s r rollbackr> 6 s Dr )Fr0 )F)r r r functoolsr defence360agent.utilsr r r r r2 r3 r r% CalledProcessErrorr/ r; r> r= r r <module>rB s : : : : : : : :
'
1 ' 0 L L L L
!
H H
H
&
&
&
& r defence360agent/migrations/__pycache__/129_fixed_cagefs_unmount.cpython-311.pyc 0000644 0000000 0000000 00000006146 00000000000 024432 0 ustar
r_jl d dl Z d dlZd dlZd dlmZ d dlmZmZ dZdZ dZ
dZ ed d d
gfd Z d Z
ee j d
e
d d ZddZddZdS ) N) lru_cache)retry_onrun_with_umaskcagefsrestartz/usr/sbin/cagefsctlz --wait-lock z/usr/binz/binc 4 t d | D S )z6Return whether we can find systemctl in given *paths*.c 3 K | ]A}t j t j |d V BdS ) systemctlN)ospathisfilejoin).0ps h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/129_fixed_cagefs_unmount.py <genexpr>z$systemctl_present.<locals>.<genexpr> s@ KKrw~~bgll1k : :;;KKKKKK )any)pathss r systemctl_presentr
s! KKUKKK K KKr c t rdt t g}ndt t g} t j | n# t
$ r Y nw xY wt
j d d S )Nr service )r _COMMAND
_SERVICE_NAME
subprocess
check_call Exceptiontimesleep)excicmds r _restart_cagefsr% st 3Hm4-2
c""""
JqMMMMMs A
AA T) max_trieson_errorsilentc H t j | dt j d S )NF)shellstderr)r check_outputSTDOUT)r$ s r _execute_commandr/ s% CuZ5FGGGGGGr F c
|rd S t t dgt t dgg}t | 5 t j t r|D ]}t
| d d d d S # 1 swxY w Y d S )Nz--force-update-etcz
--remount-all)_CAGEFSCTL_TOOL
_WAIT_LOCKr r r
existsr/ )migratordatabasefakeumaskkwargscmd_listr$ s r migrater; ) s *&:; *o6H
& &
7>>/ * * &
&
& %%%%& & & & & & & & & & & & & & & & & &s 9A88A<?A<c d S )N )r5 r6 r7 r9 s r rollbackr> 6 s Dr )Fr0 )F)r r r functoolsr defence360agent.utilsr r r r r2 r3 r r% CalledProcessErrorr/ r; r> r= r r <module>rB s : : : : : : : :
'
1 ' 0 L L L L
!
H H
H
&
&
&
& r defence360agent/migrations/__pycache__/130_add_messages_to_send.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002644 00000000000 025316 0 ustar
r_j F d dl mZmZmZ G d de ZddZddZdS ) )
FloatFieldModel BlobFieldc X e Zd Z G d d Z ed Z ed ZdS )
MessageToSendc e Zd ZdZdS )MessageToSend.Metamessages_to_sendN)__name__
__module__ __qualname__db_table h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/130_add_messages_to_send.pyMetar s %r r F)nullN)r r r
r r timestampr messager r r r r s\ & & & & & & & &
&&&IiU###GGGr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater s -(((((r c J | j d }| | d S )Nr
)orm
drop_model)r r r r r s r rollbackr s) L!34M
&&&&&r N)F)peeweer r r r r r r r r <module>r" s / / / / / / / / / /$ $ $ $ $E $ $ $) ) ) )' ' ' ' ' 'r defence360agent/migrations/__pycache__/130_add_messages_to_send.cpython-311.pyc 0000644 0000000 0000000 00000002644 00000000000 024357 0 ustar
r_j F d dl mZmZmZ G d de ZddZddZdS ) )
FloatFieldModel BlobFieldc X e Zd Z G d d Z ed Z ed ZdS )
MessageToSendc e Zd ZdZdS )MessageToSend.Metamessages_to_sendN)__name__
__module__ __qualname__db_table h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/130_add_messages_to_send.pyMetar s %r r F)nullN)r r r
r r timestampr messager r r r r s\ & & & & & & & &
&&&IiU###GGGr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater s -(((((r c J | j d }| | d S )Nr
)orm
drop_model)r r r r r s r rollbackr s) L!34M
&&&&&r N)F)peeweer r r r r r r r r <module>r" s / / / / / / / / / /$ $ $ $ $E $ $ $) ) ) )' ' ' ' ' 'r defence360agent/migrations/__pycache__/131_incident_timestamp_index.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001211 00000000000 026221 0 ustar
r_j1 ddZ ddZdS )Fc 0 | d d S )NzECREATE INDEX IF NOT EXISTS incident_timestamp ON incident (timestamp))sqlmigratordatabasefakekwargss l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/131_incident_timestamp_index.pymigrater
s% LLO c d S )N r s r rollbackr
s Dr N)F)r
r r
r r <module>r s7 r defence360agent/migrations/__pycache__/131_incident_timestamp_index.cpython-311.pyc 0000644 0000000 0000000 00000001211 00000000000 025262 0 ustar
r_j1 ddZ ddZdS )Fc 0 | d d S )NzECREATE INDEX IF NOT EXISTS incident_timestamp ON incident (timestamp))sqlmigratordatabasefakekwargss l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/131_incident_timestamp_index.pymigrater
s% LLO c d S )N r s r rollbackr
s Dr N)F)r
r r
r r <module>r s7 r defence360agent/migrations/__pycache__/132_add_timestamp_field.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001776 00000000000 025151 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc t | j d }| |t j d d S )N malware_hitsT)null) timestamp)orm
add_fieldspw
FloatFieldmigratordatabasefakekwargs MalwareHitss g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/132_add_timestamp_field.pymigrater s: ,~.K r}$/G/G/GHHHHH c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s* ,~.K ; 44444r )F)loggingpeeweer getLogger__name__loggerr r r r <module>r sd
8 $ $I I I I
5 5 5 5 5 5r defence360agent/migrations/__pycache__/132_add_timestamp_field.cpython-311.pyc 0000644 0000000 0000000 00000001776 00000000000 024212 0 ustar
r_j F d dl Z d dlZ e j e ZddZddZdS ) NFc t | j d }| |t j d d S )N malware_hitsT)null) timestamp)orm
add_fieldspw
FloatFieldmigratordatabasefakekwargs MalwareHitss g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/132_add_timestamp_field.pymigrater s: ,~.K r}$/G/G/GHHHHH c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s* ,~.K ; 44444r )F)loggingpeeweer getLogger__name__loggerr r r r <module>r sd
8 $ $I I I I
5 5 5 5 5 5r defence360agent/migrations/__pycache__/133_add_scope_field_to_iplist.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002343 00000000000 026335 0 ustar
r_jG P d dl Z d dlZ e j e Zd\ ZZddZddZ dS ) N)localgroupFc
| j d }| |t j dt j dt
dt d g d S )NiplistTz scope in ('z','z'))null constraints)scope)orm
add_fieldspw CharFieldCheck SCOPE_LOCAL SCOPE_GROUPmigratordatabasefakekwargsip_lists m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/133_add_scope_field_to_iplist.pymigrater sp l8$G l;;; LMM
c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s* l8$G 7G,,,,,r )F)
loggingpeeweer getLogger__name__loggerr r r r r r <module>r# sj
8 $ $+ [
- - - - - -r defence360agent/migrations/__pycache__/133_add_scope_field_to_iplist.cpython-311.pyc 0000644 0000000 0000000 00000002343 00000000000 025376 0 ustar
r_jG P d dl Z d dlZ e j e Zd\ ZZddZddZ dS ) N)localgroupFc
| j d }| |t j dt j dt
dt d g d S )NiplistTz scope in ('z','z'))null constraints)scope)orm
add_fieldspw CharFieldCheck SCOPE_LOCAL SCOPE_GROUPmigratordatabasefakekwargsip_lists m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/133_add_scope_field_to_iplist.pymigrater sp l8$G l;;; LMM
c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s* l8$G 7G,,,,,r )F)
loggingpeeweer getLogger__name__loggerr r r r r r <module>r# sj
8 $ $+ [
- - - - - -r defence360agent/migrations/__pycache__/134_change_default_of_intensity_ram.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002543 00000000000 027550 0 ustar
r_jW R d dl Z d dlmZ e j e ZddZddZddZdS ) N)
ConfigFilec dddii} t | }| | d S # t $ r t d Y d S w xY w)NMALWARE_SCAN_INTENSITYrami )pathz*Failed to set malware scan schedule config)r dict_to_config Exceptionlogger exception)r config config_files s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/134_change_default_of_intensity_ram.py_update_configr s 4#
F G d+++ ""6***** G G GEFFFFFFGs %/ $AAFc * |rd S t d S N)r migratordatabasefakekwargss r migrater s! c d S r r s r rollbackr s Dr r )F) logging defence360agent.contracts.configr getLogger__name__r
r r r r r r <module>r s| 7 7 7 7 7 7 8 $ $ G G G G r defence360agent/migrations/__pycache__/134_change_default_of_intensity_ram.cpython-311.pyc 0000644 0000000 0000000 00000002543 00000000000 026611 0 ustar
r_jW R d dl Z d dlmZ e j e ZddZddZddZdS ) N)
ConfigFilec dddii} t | }| | d S # t $ r t d Y d S w xY w)NMALWARE_SCAN_INTENSITYrami )pathz*Failed to set malware scan schedule config)r dict_to_config Exceptionlogger exception)r config config_files s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/134_change_default_of_intensity_ram.py_update_configr s 4#
F G d+++ ""6***** G G GEFFFFFFGs %/ $AAFc * |rd S t d S N)r migratordatabasefakekwargss r migrater s! c d S r r s r rollbackr s Dr r )F) logging defence360agent.contracts.configr getLogger__name__r
r r r r r r <module>r s| 7 7 7 7 7 7 8 $ $ G G G G r defence360agent/migrations/__pycache__/135_export_proactive.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005047 00000000000 024566 0 ustar
r_j d dl Z d dlZd dlZ ej e Zd\ ZZdZd e Z
dZ d Z d
dZ
d
d ZdS ) N)z
proactive.csvzproactive_env.csvzSELECT
id, timestamp, ip, ip_int, ip_version, ip_country_id, description, action,
host, path, url, count, uid, gid, rule_id, rule_name
FROM proactive ORDER BY timestamp DESC LIMIT ?z
SELECT proactive_env.event_id, proactive_env.name, proactive_env.value
FROM proactive_env INNER JOIN ({}) pa ON proactive_env.event_id=pa.id
z%/var/lib/imunify360-php-daemon/exportc \ t t ft t ffD ]\ }}| ||f }t t j || ddd 5 }t j
| }| | d d d n # 1 swxY w Y d S )Nw zutf-8)newlineencoding)
PROACTIVE_CSV
PROACTIVE_SQLPROACTIVE_ENV_CSVPROACTIVE_ENV_SQL execute_sqlopenospathjoincsvwriter writerows)database
target_dir
events_numfilenamequerycurcsvfile
csv_writers d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/135_export_proactive.pyexportr s
& -. & &% ""5:-88
GLLX . .
&
G,,J % % % & & & & & & & & & & & & & & & & &s **B B$ 'B$ Fc |rd S t j t d t |t d d S # t $ r t
d Y d S w xY w)NT)exist_oki z'Failed to export proactive defence data)r makedirs
EXPORT_DIRr Exceptionlogger exceptionmigratorr fakekwargss r migrater) % s D
J....xT***** D D DBCCCCCCDs 19 $A! A!c d S )N r% s r rollbackr, 0 s D )F)r r logging getLogger__name__r# r r
r formatr r! r r) r, r+ r- r <module>r2 s
8 $ $#G
2
F 5
&
&
& D D D D r- defence360agent/migrations/__pycache__/135_export_proactive.cpython-311.pyc 0000644 0000000 0000000 00000005047 00000000000 023627 0 ustar
r_j d dl Z d dlZd dlZ ej e Zd\ ZZdZd e Z
dZ d Z d
dZ
d
d ZdS ) N)z
proactive.csvzproactive_env.csvzSELECT
id, timestamp, ip, ip_int, ip_version, ip_country_id, description, action,
host, path, url, count, uid, gid, rule_id, rule_name
FROM proactive ORDER BY timestamp DESC LIMIT ?z
SELECT proactive_env.event_id, proactive_env.name, proactive_env.value
FROM proactive_env INNER JOIN ({}) pa ON proactive_env.event_id=pa.id
z%/var/lib/imunify360-php-daemon/exportc \ t t ft t ffD ]\ }}| ||f }t t j || ddd 5 }t j
| }| | d d d n # 1 swxY w Y d S )Nw zutf-8)newlineencoding)
PROACTIVE_CSV
PROACTIVE_SQLPROACTIVE_ENV_CSVPROACTIVE_ENV_SQL execute_sqlopenospathjoincsvwriter writerows)database
target_dir
events_numfilenamequerycurcsvfile
csv_writers d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/135_export_proactive.pyexportr s
& -. & &% ""5:-88
GLLX . .
&
G,,J % % % & & & & & & & & & & & & & & & & &s **B B$ 'B$ Fc |rd S t j t d t |t d d S # t $ r t
d Y d S w xY w)NT)exist_oki z'Failed to export proactive defence data)r makedirs
EXPORT_DIRr Exceptionlogger exceptionmigratorr fakekwargss r migrater) % s D
J....xT***** D D DBCCCCCCDs 19 $A! A!c d S )N r% s r rollbackr, 0 s D )F)r r logging getLogger__name__r# r r
r formatr r! r r) r, r+ r- r <module>r2 s
8 $ $#G
2
F 5
&
&
& D D D D r- defence360agent/migrations/__pycache__/135_make_completed_nullable.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001425 00000000000 026014 0 ustar
r_j: ddZ ddZdS )Fc L | j d }| |d d S N
malware_scans completed)orm
drop_not_nullmigratordatabasefakekwargs MalwareScans k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/135_make_completed_nullable.pymigrater s* ,/K ; 44444 c L | j d }| |d d S r )r add_not_nullr s r rollbackr s* ,/K +{33333r N)F)r r r r <module>r s7 5 5 5 5
4 4 4 4 4 4r defence360agent/migrations/__pycache__/135_make_completed_nullable.cpython-311.pyc 0000644 0000000 0000000 00000001425 00000000000 025055 0 ustar
r_j: ddZ ddZdS )Fc L | j d }| |d d S N
malware_scans completed)orm
drop_not_nullmigratordatabasefakekwargs MalwareScans k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/135_make_completed_nullable.pymigrater s* ,/K ; 44444 c L | j d }| |d d S r )r add_not_nullr s r rollbackr s* ,/K +{33333r N)F)r r r r <module>r s7 5 5 5 5
4 4 4 4 4 4r defence360agent/migrations/__pycache__/136_drop_proactive.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001317 00000000000 024206 0 ustar
r_j ddZ ddZdS )Fc | | j d | | j d d S )N proactive
proactive_env) remove_modelormmigratordatabasefakekwargss b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/136_drop_proactive.pymigrater
s> (,{3444 (,788888 c d S )N r s r rollbackr s Dr N)F)r
r r r r <module>r s7 9 9 9 9
r defence360agent/migrations/__pycache__/136_drop_proactive.cpython-311.pyc 0000644 0000000 0000000 00000001317 00000000000 023247 0 ustar
r_j ddZ ddZdS )Fc | | j d | | j d d S )N proactive
proactive_env) remove_modelormmigratordatabasefakekwargss b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/136_drop_proactive.pymigrater
s> (,{3444 (,788888 c d S )N r s r rollbackr s Dr N)F)r
r r r r <module>r s7 9 9 9 9
r defence360agent/migrations/__pycache__/137_swap_initiator_and_cause.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002335 00000000000 026226 0 ustar
r_j > d dl Z e j e ZddZddZdS ) NFc | j d } | D ]8}|j dv r|j |j c|_ |_ | 9d S # t
$ r%}t | Y d }~d S d }~ww xY w)Nmalware_history)manualz on-demandrealtime)ormselect initiatorcausesave Exceptionlogger exception)migratordatabasefakekwargsMalwareHistoryentryes l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/137_swap_initiator_and_cause.pymigrater s \"34N #**,, E"EEE/4 , U_ JJLLLL s A
A
B
(BB
c d S )N )r r r r s r rollbackr s D )F)logging getLogger__name__r
r r r r r <module>r sR 8 $ $ r defence360agent/migrations/__pycache__/137_swap_initiator_and_cause.cpython-311.pyc 0000644 0000000 0000000 00000002335 00000000000 025267 0 ustar
r_j > d dl Z e j e ZddZddZdS ) NFc | j d } | D ]8}|j dv r|j |j c|_ |_ | 9d S # t
$ r%}t | Y d }~d S d }~ww xY w)Nmalware_history)manualz on-demandrealtime)ormselect initiatorcausesave Exceptionlogger exception)migratordatabasefakekwargsMalwareHistoryentryes l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/137_swap_initiator_and_cause.pymigrater s \"34N #**,, E"EEE/4 , U_ JJLLLL s A
A
B
(BB
c d S )N )r r r r s r rollbackr s D )F)logging getLogger__name__r
r r r r r <module>r sR 8 $ $ r defence360agent/migrations/__pycache__/138_move_rapid_scan_dir.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005260 00000000000 025160 0 ustar
r_jV l d dl Z d dlZd dlZd dlmZ d dlmZ ej ddd Zd
dZ d
d Z
dS ) N)
hosting_panel)importerz imav.malwarelib.utils.user_list panel_users)modulenamedefaultFc |rd S t j }t j | | t }|D ]}t j |d }t |j dz |j z } t j |d } n# t $ r Y uw xY w| || k r t j || # t $ r Y w xY wd S Nhomez.rapid-scan-dbasyncionew_event_loopset_event_looprun_until_completer pathlibPathstrparentr r HostingPanelget_rapid_scan_db_dirOSErrorshutilmove
migratordatabasefakekwargsloopusersuserpath_objold_pathnew_paths
g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/138_move_rapid_scan_dir.pymigrater&
s( ! # #D 4 # #KMM 2 2E <V --x)99HMIJJ $133IIV HH H x8 3 3 K( + + + + D s$ ,B88
CCC((
C54C5c t j }t j | | t }|D ]}t j |d }t |j dz |j z } t j |d } n# t $ r Y uw xY w| || k r t j | | # t $ r Y w xY wd S r
r r s
r% rollbackr( % s ! # #D 4 # #KMM 2 2E <V --x)99HMIJJ $133IIV HH H x8 3 3 K( + + + + D s$ ,B44
C CC$$
C10C1)F) r
r r defence360agent.subsys.panelsr defence360agent.utilsr getr r& r( r% <module>r. s
7 7 7 7 7 7 * * * * * *hl ,=$
0 r- defence360agent/migrations/__pycache__/138_move_rapid_scan_dir.cpython-311.pyc 0000644 0000000 0000000 00000005260 00000000000 024221 0 ustar
r_jV l d dl Z d dlZd dlZd dlmZ d dlmZ ej ddd Zd
dZ d
d Z
dS ) N)
hosting_panel)importerz imav.malwarelib.utils.user_list panel_users)modulenamedefaultFc |rd S t j }t j | | t }|D ]}t j |d }t |j dz |j z } t j |d } n# t $ r Y uw xY w| || k r t j || # t $ r Y w xY wd S Nhomez.rapid-scan-dbasyncionew_event_loopset_event_looprun_until_completer pathlibPathstrparentr r HostingPanelget_rapid_scan_db_dirOSErrorshutilmove
migratordatabasefakekwargsloopusersuserpath_objold_pathnew_paths
g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/138_move_rapid_scan_dir.pymigrater&
s( ! # #D 4 # #KMM 2 2E <V --x)99HMIJJ $133IIV HH H x8 3 3 K( + + + + D s$ ,B88
CCC((
C54C5c t j }t j | | t }|D ]}t j |d }t |j dz |j z } t j |d } n# t $ r Y uw xY w| || k r t j | | # t $ r Y w xY wd S r
r r s
r% rollbackr( % s ! # #D 4 # #KMM 2 2E <V --x)99HMIJJ $133IIV HH H x8 3 3 K( + + + + D s$ ,B44
C CC$$
C10C1)F) r
r r defence360agent.subsys.panelsr defence360agent.utilsr getr r& r( r% <module>r. s
7 7 7 7 7 7 * * * * * *hl ,=$
0 r- defence360agent/migrations/__pycache__/139_generic_modsec_config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001216 00000000000 025462 0 ustar
r_j ddZ ddZdS )Fc dS )z
Rely on install-vendors to update modsec.conf on the 1st install.
Drop support for updating old imunify360 versions without modsec.conf.d/
N migratordatabasefakekwargss i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/139_generic_modsec_config.pymigrater
s c d S )Nr r s r rollbackr
s Dr N)F)r
r
r r r <module>r s7 r defence360agent/migrations/__pycache__/139_generic_modsec_config.cpython-311.pyc 0000644 0000000 0000000 00000001216 00000000000 024523 0 ustar
r_j ddZ ddZdS )Fc dS )z
Rely on install-vendors to update modsec.conf on the 1st install.
Drop support for updating old imunify360 versions without modsec.conf.d/
N migratordatabasefakekwargss i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/139_generic_modsec_config.pymigrater
s c d S )Nr r s r rollbackr
s Dr N)F)r
r
r r r <module>r s7 r defence360agent/migrations/__pycache__/140_cast_malware_hit_orig_file_as_blob.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001303 00000000000 030162 0 ustar
r_j# ddZ ddZdS )Fc 8 |rd S | d d S )Nz^UPDATE malware_hits SET orig_file = CAST(orig_file AS BLOB) WHERE typeof(orig_file) != "blob";)sqlmigratordatabasefakekwargss v/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/140_cast_malware_hit_orig_file_as_blob.pymigrater
s4 LL - c d S )N r s r rollbackr s Dr N)F)r
r r
r r <module>r s7 r defence360agent/migrations/__pycache__/140_cast_malware_hit_orig_file_as_blob.cpython-311.pyc 0000644 0000000 0000000 00000001303 00000000000 027223 0 ustar
r_j# ddZ ddZdS )Fc 8 |rd S | d d S )Nz^UPDATE malware_hits SET orig_file = CAST(orig_file AS BLOB) WHERE typeof(orig_file) != "blob";)sqlmigratordatabasefakekwargss v/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/140_cast_malware_hit_orig_file_as_blob.pymigrater
s4 LL - c d S )N r s r rollbackr s Dr N)F)r
r r
r r <module>r s7 r defence360agent/migrations/__pycache__/141_drop_last_user_scans.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001235 00000000000 025375 0 ustar
r_j ddZ ddZdS )Fc \ d| j v r"| | j d d S d S )Nlast_user_scans)orm remove_modelmigratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/141_drop_last_user_scans.pymigrater s9 HL(( hl+< =>>>>> )( c d S )N r s r rollbackr s Dr
N)F)r r r r
r <module>r s7 ? ? ? ?
r
defence360agent/migrations/__pycache__/141_drop_last_user_scans.cpython-311.pyc 0000644 0000000 0000000 00000001235 00000000000 024436 0 ustar
r_j ddZ ddZdS )Fc \ d| j v r"| | j d d S d S )Nlast_user_scans)orm remove_modelmigratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/141_drop_last_user_scans.pymigrater s9 HL(( hl+< =>>>>> )( c d S )N r s r rollbackr s Dr
N)F)r r r r
r <module>r s7 ? ? ? ?
r
defence360agent/migrations/__pycache__/143_malware_hit_cascade_delete.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007072 00000000000 026451 0 ustar
r_j j d dl Z G d de j Z G d de j Zd dZd dZdS )
Nc J e Zd Z G d d Z ej d ZdS ) MalwareScanc e Zd ZdZdS )MalwareScan.Meta
malware_scansN__name__
__module__ __qualname__db_table n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/143_malware_hit_cascade_delete.pyMetar s "r r T) primary_keyN)r r
r r peewee CharFieldscanidr
r r r r sM # # # # # # # # V
$
/
/
/FFFr r c e Zd Z G d d Z ej Z ej eddd Z ej
d Z ej d Z
ej
d Z ej dd Z ej
dd Z ej
d
Z ej
d
Z ej d
Z ej
d Z ej d
Zed
ZdS )
MalwareHitc e Zd ZdZdS )MalwareHit.Meta malware_hitsNr r
r r r r s !r r FhitsCASCADE)null related_name on_delete)r )r defaultzai-bolitTfound)r c 8 t d | j j S )Nc | j S N) column_name)fields r <lambda>z,MalwareHit.get_field_names.<locals>.<lambda> s !2 r )map_meta
sorted_fields)clss r get_field_nameszMalwareHit.get_field_names s 22CI4KLLLr N)r r
r r r PrimaryKeyFieldidForeignKeyFieldr r r user BlobField orig_filetype BooleanField maliciousvendorhashsize
FloatField timestampstatus
cleaned_at classmethodr+ r
r r r r sf " " " " " " " "
! !B
#V
#%f F 6 ' ' 'D e,,,I 6 ' ' 'D##>>>I
V
5*
=
=
=F 6 & & &D 6 & & &D!!t,,,I
V
g
.
.
.F""---JM M [M M Mr r Fc 6 | d | t d t }| d | | d d S )Nz4ALTER TABLE malware_hits RENAME TO malware_hits_old;,z@INSERT INTO malware_hits ({0}) SELECT {0} FROM malware_hits_old;z DROP TABLE malware_hits_old;)sql create_modelr joinr+ format)migratordatabasefakekwargsmalware_hit_fieldss r migraterH # s LLGHHH *%%% *"<"<">">?? LLJ " # #
LL/00000r c d S r# r
)rC rD rE rF s r rollbackrJ / s Dr )F)r Modelr r rH rJ r
r r <module>rL s
0 0 0 0 0&, 0 0 0M M M M M M M M0 1 1 1 1 r defence360agent/migrations/__pycache__/143_malware_hit_cascade_delete.cpython-311.pyc 0000644 0000000 0000000 00000007072 00000000000 025512 0 ustar
r_j j d dl Z G d de j Z G d de j Zd dZd dZdS )
Nc J e Zd Z G d d Z ej d ZdS ) MalwareScanc e Zd ZdZdS )MalwareScan.Meta
malware_scansN__name__
__module__ __qualname__db_table n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/143_malware_hit_cascade_delete.pyMetar s "r r T) primary_keyN)r r
r r peewee CharFieldscanidr
r r r r sM # # # # # # # # V
$
/
/
/FFFr r c e Zd Z G d d Z ej Z ej eddd Z ej
d Z ej d Z
ej
d Z ej dd Z ej
dd Z ej
d
Z ej
d
Z ej d
Z ej
d Z ej d
Zed
ZdS )
MalwareHitc e Zd ZdZdS )MalwareHit.Meta malware_hitsNr r
r r r r s !r r FhitsCASCADE)null related_name on_delete)r )r defaultzai-bolitTfound)r c 8 t d | j j S )Nc | j S N) column_name)fields r <lambda>z,MalwareHit.get_field_names.<locals>.<lambda> s !2 r )map_meta
sorted_fields)clss r get_field_nameszMalwareHit.get_field_names s 22CI4KLLLr N)r r
r r r PrimaryKeyFieldidForeignKeyFieldr r r user BlobField orig_filetype BooleanField maliciousvendorhashsize
FloatField timestampstatus
cleaned_at classmethodr+ r
r r r r sf " " " " " " " "
! !B
#V
#%f F 6 ' ' 'D e,,,I 6 ' ' 'D##>>>I
V
5*
=
=
=F 6 & & &D 6 & & &D!!t,,,I
V
g
.
.
.F""---JM M [M M Mr r Fc 6 | d | t d t }| d | | d d S )Nz4ALTER TABLE malware_hits RENAME TO malware_hits_old;,z@INSERT INTO malware_hits ({0}) SELECT {0} FROM malware_hits_old;z DROP TABLE malware_hits_old;)sql create_modelr joinr+ format)migratordatabasefakekwargsmalware_hit_fieldss r migraterH # s LLGHHH *%%% *"<"<">">?? LLJ " # #
LL/00000r c d S r# r
)rC rD rE rF s r rollbackrJ / s Dr )F)r Modelr r rH rJ r
r r <module>rL s
0 0 0 0 0&, 0 0 0M M M M M M M M0 1 1 1 1 r defence360agent/migrations/__pycache__/144_remove_clamav_config_options.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003174 00000000000 027110 0 ustar
r_j5 h d dl Z d dlmZmZ e j e Zd e fdefdZddZdS ) N)IConfig
ConfigFileF config_filec v |rd S | d }d|vrd S |d dd |d dd |d dd | |dd d S # t $ r t d Y d S w xY w)
NF) normalizeMALWARE_SCANNING
i360_clamdshow_clamav_results
clamav_binaryT) overwritevalidatez&Failed to remove clamav config options)config_to_dictpopdict_to_config Exceptionlogger exception)migratordatabasefaker kwargsconfigs p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/144_remove_clamav_config_options.pymigrater s C ++e+<< V + + F!"&&|T:::!"&&'<dCCC!"&&===""6TE"JJJJJ C C CABBBBBBCs B A,B $B87B8c d S )N )r r r r s r rollbackr ! s D )F) logging defence360agent.contracts.configr r getLogger__name__r r r r r r <module>r# s @ @ @ @ @ @ @ @ 8 $ $
%:<< C C C C C C2 r defence360agent/migrations/__pycache__/144_remove_clamav_config_options.cpython-311.pyc 0000644 0000000 0000000 00000003174 00000000000 026151 0 ustar
r_j5 h d dl Z d dlmZmZ e j e Zd e fdefdZddZdS ) N)IConfig
ConfigFileF config_filec v |rd S | d }d|vrd S |d dd |d dd |d dd | |dd d S # t $ r t d Y d S w xY w)
NF) normalizeMALWARE_SCANNING
i360_clamdshow_clamav_results
clamav_binaryT) overwritevalidatez&Failed to remove clamav config options)config_to_dictpopdict_to_config Exceptionlogger exception)migratordatabasefaker kwargsconfigs p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/144_remove_clamav_config_options.pymigrater s C ++e+<< V + + F!"&&|T:::!"&&'<dCCC!"&&===""6TE"JJJJJ C C CABBBBBBCs B A,B $B87B8c d S )N )r r r r s r rollbackr ! s D )F) logging defence360agent.contracts.configr r getLogger__name__r r r r r r <module>r# s @ @ @ @ @ @ @ @ 8 $ $
%:<< C C C C C C2 r defence360agent/migrations/__pycache__/144_remove_hash_table.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001125 00000000000 024631 0 ustar
r_j ddZ ddZdS )Fc 0 | d d S )Nz"DROP TABLE IF EXISTS malware_hash;)sqlmigratordatabasefakekwargss e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/144_remove_hash_table.pymigrater
s LL566666 c d S )N r s r rollbackr s Dr N)F)r
r r
r r <module>r s7 7 7 7 7 r defence360agent/migrations/__pycache__/144_remove_hash_table.cpython-311.pyc 0000644 0000000 0000000 00000001125 00000000000 023672 0 ustar
r_j ddZ ddZdS )Fc 0 | d d S )Nz"DROP TABLE IF EXISTS malware_hash;)sqlmigratordatabasefakekwargss e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/144_remove_hash_table.pymigrater
s LL566666 c d S )N r s r rollbackr s Dr N)F)r
r r
r r <module>r s7 7 7 7 7 r defence360agent/migrations/__pycache__/145_move_quarantine.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000761 00000000000 024365 0 ustar
r_jo d Z d Zd ZdS )z# Quarantine is removed in DEF-15234c d S N ___s c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/145_move_quarantine.pymigrater D c d S r r r s r rollbackr
r
r N)__doc__r r
r r r <module>r s3 ) ) r defence360agent/migrations/__pycache__/145_move_quarantine.cpython-311.pyc 0000644 0000000 0000000 00000000761 00000000000 023426 0 ustar
r_jo d Z d Zd ZdS )z# Quarantine is removed in DEF-15234c d S N ___s c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/145_move_quarantine.pymigrater D c d S r r r s r rollbackr
r
r N)__doc__r r
r r r <module>r s3 ) ) r ././@LongLink 0000000 0000000 0000000 00000000146 00000000000 011566 L ustar root root defence360agent/migrations/__pycache__/146_malware_user_infected_cascade_delete.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/146_malware_user_infected_cascade_delete.cpython-311.opt-1.py0000644 0000000 0000000 00000000777 00000000000 030351 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss x/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/146_malware_user_infected_cascade_delete.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/146_malware_user_infected_cascade_delete.cpython-311.pyc 0000644 0000000 0000000 00000000777 00000000000 027555 0 ustar
r_j ddZ ddZdS )Fc d S N migratordatabasefakekwargss x/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/146_malware_user_infected_cascade_delete.pymigrater D c d S r r r s r
rollbackr r r
N)F)r r r r
r
<module>r s7 r
defence360agent/migrations/__pycache__/147_remove_vendor_field.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001641 00000000000 025205 0 ustar
r_j d dl Z ddZddZdS ) NFc L | j d }| |d d S )N malware_hitsvendor)orm
remove_fieldsmigratordatabasefakekwargsr s g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/147_remove_vendor_field.pymigrater s* </L <22222 c v | j d }| |t j dd d S )Nr Fzai-bolit)nulldefault)r )r
add_fieldspeewee CharFieldr s r
rollbackr sJ </L V -5* M M M r )F)r r r r r
<module>r s@
3 3 3 3
r defence360agent/migrations/__pycache__/147_remove_vendor_field.cpython-311.pyc 0000644 0000000 0000000 00000001641 00000000000 024246 0 ustar
r_j d dl Z ddZddZdS ) NFc L | j d }| |d d S )N malware_hitsvendor)orm
remove_fieldsmigratordatabasefakekwargsr s g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/147_remove_vendor_field.pymigrater s* </L <22222 c v | j d }| |t j dd d S )Nr Fzai-bolit)nulldefault)r )r
add_fieldspeewee CharFieldr s r
rollbackr sJ </L V -5* M M M r )F)r r r r r
<module>r s@
3 3 3 3
r defence360agent/migrations/__pycache__/147_user_scan_type.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002544 00000000000 024216 0 ustar
r_j d dl Zd dlmZ ej ddd Zej ej ej ej ej
ej fZ d dZ
d dZdS )
N)importerzimav.malwarelib.configMalwareScanType)modulenamedefaultFc | j d }| |t j dt j d t g d S )N
malware_scansFz
type in {})null constraints)type)orm
change_fieldspw CharFieldCheckformattypes)migratordatabasefakekwargs MalwareScans b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/147_user_scan_type.pymigrater sl ,/K
\RXl.A.A%.H.H%I%I$J
c d S )N )r r r r s r rollbackr s Dr )F)peeweer defence360agent.utilsr getr ON_DEMANDREALTIMEMALWARE_RESPONSE
BACKGROUNDRESCANUSERr r r r r r <module>r( s * * * * * * (, #*;T
$
r defence360agent/migrations/__pycache__/147_user_scan_type.cpython-311.pyc 0000644 0000000 0000000 00000002544 00000000000 023257 0 ustar
r_j d dl Zd dlmZ ej ddd Zej ej ej ej ej
ej fZ d dZ
d dZdS )
N)importerzimav.malwarelib.configMalwareScanType)modulenamedefaultFc | j d }| |t j dt j d t g d S )N
malware_scansFz
type in {})null constraints)type)orm
change_fieldspw CharFieldCheckformattypes)migratordatabasefakekwargs MalwareScans b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/147_user_scan_type.pymigrater sl ,/K
\RXl.A.A%.H.H%I%I$J
c d S )N )r r r r s r rollbackr s Dr )F)peeweer defence360agent.utilsr getr ON_DEMANDREALTIMEMALWARE_RESPONSE
BACKGROUNDRESCANUSERr r r r r r <module>r( s * * * * * * (, #*;T
$
r defence360agent/migrations/__pycache__/148_reconstruct_pickled_scan_queue.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001210 00000000000 027437 0 ustar
r_j d Z d ZdS )c dS )z
Backward compatibility for reconstruction of pickled scan queue
is done in the imav.malwarelib.scan.queue.py module.
Migration is no longer needed.
N ___s r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/148_reconstruct_pickled_scan_queue.pymigrater c dS )zDowngrade is not supportedNr r s r rollbackr r r
N)r r r r
r <module>r
s- % % % % %r
defence360agent/migrations/__pycache__/148_reconstruct_pickled_scan_queue.cpython-311.pyc 0000644 0000000 0000000 00000001210 00000000000 026500 0 ustar
r_j d Z d ZdS )c dS )z
Backward compatibility for reconstruction of pickled scan queue
is done in the imav.malwarelib.scan.queue.py module.
Migration is no longer needed.
N ___s r/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/148_reconstruct_pickled_scan_queue.pymigrater c dS )zDowngrade is not supportedNr r s r rollbackr r r
N)r r r r
r <module>r
s- % % % % %r
defence360agent/migrations/__pycache__/148_remove_malware_user_infected.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001150 00000000000 027070 0 ustar
r_j ddZ ddZdS )Fc 0 | d d S )Nz*DROP TABLE IF EXISTS malware_user_infected)sqlmigratordatabasefakekwargss p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/148_remove_malware_user_infected.pymigrater
s LL=>>>>> c d S )N r s r rollbackr s Dr N)F)r
r r
r r <module>r s7 ? ? ? ? r defence360agent/migrations/__pycache__/148_remove_malware_user_infected.cpython-311.pyc 0000644 0000000 0000000 00000001150 00000000000 026131 0 ustar
r_j ddZ ddZdS )Fc 0 | d d S )Nz*DROP TABLE IF EXISTS malware_user_infected)sqlmigratordatabasefakekwargss p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/148_remove_malware_user_infected.pymigrater
s LL=>>>>> c d S )N r s r rollbackr s Dr N)F)r
r r
r r <module>r s7 ? ? ? ? r defence360agent/migrations/__pycache__/149_add_captcha_passed_field_to_iplist.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001665 00000000000 030203 0 ustar
r_jm d dl ZddZddZdS ) NFc v | j d }| |t j dd d S )NiplistF)nulldefault)captcha_passed)orm
add_fieldspw BooleanFieldmigratordatabasefakekwargsIPLists v/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/149_add_captcha_passed_field_to_iplist.pymigrater sI
\(
#F rE5 I I I c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s+
\(
#F 6#344444r )F)peeweer
r r r r <module>r sC 5 5 5 5 5 5r defence360agent/migrations/__pycache__/149_add_captcha_passed_field_to_iplist.cpython-311.pyc 0000644 0000000 0000000 00000001665 00000000000 027244 0 ustar
r_jm d dl ZddZddZdS ) NFc v | j d }| |t j dd d S )NiplistF)nulldefault)captcha_passed)orm
add_fieldspw BooleanFieldmigratordatabasefakekwargsIPLists v/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/149_add_captcha_passed_field_to_iplist.pymigrater sI
\(
#F rE5 I I I c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s+
\(
#F 6#344444r )F)peeweer
r r r r <module>r sC 5 5 5 5 5 5r defence360agent/migrations/__pycache__/149_make_config_inactive.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003003 00000000000 025310 0 ustar
r_j J d Z ddlZddlZ ej e ZddZddZdS )z
This migration is needed to cleanup modsec config on cPanel
by removing includes for modsec2.imunify.conf
File is automatically included from /etc/apache2/conf.d, thus no
explicit includes are needed
NFc |rd S dD ]e} t j ddd | gd 0# t $ r Y <t $ r t
d| Y bw xY wd S )N)z includes/modsec2.imunify.confzmodsec2.imunify.confz/usr/sbin/whmapi1modsec_make_config_inactivez config={}T)checkzFailed to make %s inactive)
subprocessrunformatFileNotFoundError Exceptionlogger exception)migratordatabasefakekwargsconfs h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/149_make_config_inactive.pymigrater
s I
A
A A N'1 &&t,,
! D A A A 94 @ @ @ @ @ A
A
As ,7
A*$A*)A*c d S )N )r
r r r s r rollbackr ! s D )F)__doc__loggingr getLogger__name__r r r r r r <module>r sn 8 $ $A A A A( r defence360agent/migrations/__pycache__/149_make_config_inactive.cpython-311.pyc 0000644 0000000 0000000 00000003003 00000000000 024351 0 ustar
r_j J d Z ddlZddlZ ej e ZddZddZdS )z
This migration is needed to cleanup modsec config on cPanel
by removing includes for modsec2.imunify.conf
File is automatically included from /etc/apache2/conf.d, thus no
explicit includes are needed
NFc |rd S dD ]e} t j ddd | gd 0# t $ r Y <t $ r t
d| Y bw xY wd S )N)z includes/modsec2.imunify.confzmodsec2.imunify.confz/usr/sbin/whmapi1modsec_make_config_inactivez config={}T)checkzFailed to make %s inactive)
subprocessrunformatFileNotFoundError Exceptionlogger exception)migratordatabasefakekwargsconfs h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/149_make_config_inactive.pymigrater
s I
A
A A N'1 &&t,,
! D A A A 94 @ @ @ @ @ A
A
As ,7
A*$A*)A*c d S )N )r
r r r s r rollbackr ! s D )F)__doc__loggingr getLogger__name__r r r r r r <module>r sn 8 $ $A A A A( r ././@LongLink 0000000 0000000 0000000 00000000160 00000000000 011562 L ustar root root defence360agent/migrations/__pycache__/150_update_captcha_passed_field_for_iplist_entries.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/150_update_captcha_passed_field_for_iplist_entries.cpython-310000644 0000000 0000000 00000002716 00000000000 031006 0 ustar
r_j > d dl Z e j e ZddZddZdS ) NFc n | j d }|j dk |j z |j z |j d z } | |j di | }| d S # t $ r t d Y d S w xY w)NiplistWHITEz due to successful captcha passTz%Failed update to captcha_passed field)
ormlistname full_accessmanualcommentcontainsupdatecaptcha_passedwhereexecute Exceptionlogger exception)migratordatabasefakekwargsIPListcaptcha_pass_conditionqs /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/150_update_captcha_passed_field_for_iplist_entries.pymigrater s
\(
#F G # M> > " "#C D D F B MM60$7 8 8 > > "
B B B@AAAAAABs AB $B43B4c d S )N )r r r r s r rollbackr s D )F)logging getLogger__name__r r r r r r <module>r# sV 8 $ $B B B B" r ././@LongLink 0000000 0000000 0000000 00000000152 00000000000 011563 L ustar root root defence360agent/migrations/__pycache__/150_update_captcha_passed_field_for_iplist_entries.cpython-311.pyc defence360agent/migrations/__pycache__/150_update_captcha_passed_field_for_iplist_entries.cpython-310000644 0000000 0000000 00000002716 00000000000 031006 0 ustar
r_j > d dl Z e j e ZddZddZdS ) NFc n | j d }|j dk |j z |j z |j d z } | |j di | }| d S # t $ r t d Y d S w xY w)NiplistWHITEz due to successful captcha passTz%Failed update to captcha_passed field)
ormlistname full_accessmanualcommentcontainsupdatecaptcha_passedwhereexecute Exceptionlogger exception)migratordatabasefakekwargsIPListcaptcha_pass_conditionqs /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/150_update_captcha_passed_field_for_iplist_entries.pymigrater s
\(
#F G # M> > " "#C D D F B MM60$7 8 8 > > "
B B B@AAAAAABs AB $B43B4c d S )N )r r r r s r rollbackr s D )F)logging getLogger__name__r r r r r r <module>r# sV 8 $ $B B B B" r defence360agent/migrations/__pycache__/151_change_constraint_for_iplist.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002114 00000000000 027102 0 ustar
r_j d dl ZddZddZdS ) NFc
| j d }d}| |t j dt j d d | g d S )Niplist)WHITEBLACKGRAYGRAY_SPLASHSCREENFzlistname in ('{}')z',')null constraints)listname)orm
change_fieldspw CharFieldCheckformatjoin)migratordatabasefakekwargs
orm_IPListIP_LISTSs p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/151_change_constraint_for_iplist.pymigrater s h'J>H -44UZZ5I5IJJKK
c d S )N )r r r r s r rollbackr s Dr )F)peeweer r r r r r <module>r sC r defence360agent/migrations/__pycache__/151_change_constraint_for_iplist.cpython-311.pyc 0000644 0000000 0000000 00000002114 00000000000 026143 0 ustar
r_j d dl ZddZddZdS ) NFc
| j d }d}| |t j dt j d d | g d S )Niplist)WHITEBLACKGRAYGRAY_SPLASHSCREENFzlistname in ('{}')z',')null constraints)listname)orm
change_fieldspw CharFieldCheckformatjoin)migratordatabasefakekwargs
orm_IPListIP_LISTSs p/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/151_change_constraint_for_iplist.pymigrater s h'J>H -44UZZ5I5IJJKK
c d S )N )r r r r s r rollbackr s Dr )F)peeweer r r r r r <module>r sC r defence360agent/migrations/__pycache__/152_add_listname_to_primary_key.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000010452 00000000000 026725 0 ustar
r_j B d dl mZmZmZmZmZmZmZ d dlZddZ ddZ
dS ) ) BooleanField CharFieldCheck CompositeKeyForeignKeyField IntegerFieldModelNFc | j d }| j d G fddt }| | d |j j D dgz }| d d | | d
| d | |d | |d
| |d d S )Niplistcountryc
b e Zd ZdZdZdxZ\ ZZZZ d\ Z
Z e d Z
e d ed d e g Z ed
d Z e d Z ed d
Z ed Z e d Z e d Z edd Z edd Z ed Z ed d Z ed Z ed Z ed Z! e d ede
de d g Z" G d d Z#dS )migrate.<locals>.TMP_IPListz'iplist' db table. action_type)WHITEBLACKGRAYGRAY_SPLASHSCREEN)localgroupF)nullzlistname in ('{}')z',')r constraintsr T)defaultr c B t t j S N)inttime o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/152_add_listname_to_primary_key.py<lambda>z$migrate.<locals>.TMP_IPList.<lambda>. s s49;;'7'7 r )r r z scope in ('z')c . e Zd ZdZ edddd ZdS ) migrate.<locals>.TMP_IPList.Meta tmpiplistnetwork_addressnetmaskversionlistnameN)__name__
__module__ __qualname__db_tabler primary_keyr r r Metar" K s- "H&,!9i KKKr r- N)$r( r) r* __doc__ ACTION_TYPEIP_LISTSr r r r SCOPE_LOCAL SCOPE_GROUPr ipr formatjoinr' r
expiration
imported_fromctimedeepcommentr r r captcha_passedmanual full_accessauto_whitelistedr$ r% r& scoper- )Countrys r
TMP_IPListr s $ >
:E5$(9 $4 [
YE
"
"
" 9*11%**X2F2FGGHH
"\D
" t,,,
7 7
|&&&)&&&!/'555 & 5%@@@ 5$777 #l--- '<T5AAA&,E222 ,E*** ,E*** [[[IJJ
r rA c g | ]
}|d k | S )r r ).0names r
<listcomp>zmigrate.<locals>.<listcomp>Z s- 9
r
country_idz<INSERT INTO tmpiplist ({fields}) SELECT {fields} FROM iplist,)fieldszDROP TABLE iplistz&ALTER TABLE tmpiplist RENAME TO iplistr' r6 r3 ) ormr create_model_metasorted_field_namessqlr4 r5 add_index)migratordatabasefakekwargs
orm_IPListrA rH r@ s @r migraterT
sF h'Jl9%G> > > > > > >U > > >@
*%%% $7
F
LLFMM88F## N
LL$%%% LL9::: z:... z<000 z4(((((r c d S r r )rO rP rQ rR s r rollbackrV k s Dr )F) peeweer r r r r r r r rT rV r r r <module>rX s [) [) [) [)| r defence360agent/migrations/__pycache__/152_add_listname_to_primary_key.cpython-311.pyc 0000644 0000000 0000000 00000010452 00000000000 025766 0 ustar
r_j B d dl mZmZmZmZmZmZmZ d dlZddZ ddZ
dS ) ) BooleanField CharFieldCheck CompositeKeyForeignKeyField IntegerFieldModelNFc | j d }| j d G fddt }| | d |j j D dgz }| d d | | d
| d | |d | |d
| |d d S )Niplistcountryc
b e Zd ZdZdZdxZ\ ZZZZ d\ Z
Z e d Z
e d ed d e g Z ed
d Z e d Z ed d
Z ed Z e d Z e d Z edd Z edd Z ed Z ed d Z ed Z ed Z ed Z! e d ede
de d g Z" G d d Z#dS )migrate.<locals>.TMP_IPListz'iplist' db table. action_type)WHITEBLACKGRAYGRAY_SPLASHSCREEN)localgroupF)nullzlistname in ('{}')z',')r constraintsr T)defaultr c B t t j S N)inttime o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/152_add_listname_to_primary_key.py<lambda>z$migrate.<locals>.TMP_IPList.<lambda>. s s49;;'7'7 r )r r z scope in ('z')c . e Zd ZdZ edddd ZdS ) migrate.<locals>.TMP_IPList.Meta tmpiplistnetwork_addressnetmaskversionlistnameN)__name__
__module__ __qualname__db_tabler primary_keyr r r Metar" K s- "H&,!9i KKKr r- N)$r( r) r* __doc__ ACTION_TYPEIP_LISTSr r r r SCOPE_LOCAL SCOPE_GROUPr ipr formatjoinr' r
expiration
imported_fromctimedeepcommentr r r captcha_passedmanual full_accessauto_whitelistedr$ r% r& scoper- )Countrys r
TMP_IPListr s $ >
:E5$(9 $4 [
YE
"
"
" 9*11%**X2F2FGGHH
"\D
" t,,,
7 7
|&&&)&&&!/'555 & 5%@@@ 5$777 #l--- '<T5AAA&,E222 ,E*** ,E*** [[[IJJ
r rA c g | ]
}|d k | S )r r ).0names r
<listcomp>zmigrate.<locals>.<listcomp>Z s- 9
r
country_idz<INSERT INTO tmpiplist ({fields}) SELECT {fields} FROM iplist,)fieldszDROP TABLE iplistz&ALTER TABLE tmpiplist RENAME TO iplistr' r6 r3 ) ormr create_model_metasorted_field_namessqlr4 r5 add_index)migratordatabasefakekwargs
orm_IPListrA rH r@ s @r migraterT
sF h'Jl9%G> > > > > > >U > > >@
*%%% $7
F
LLFMM88F## N
LL$%%% LL9::: z:... z<000 z4(((((r c d S r r )rO rP rQ rR s r rollbackrV k s Dr )F) peeweer r r r r r r r rT rV r r r <module>rX s [) [) [) [)| r defence360agent/migrations/__pycache__/153_migrate_config_default_action.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004617 00000000000 027211 0 ustar
r_jF d dl Z d dlZd dlmZmZ d dlmZ e j e Z d e dfdefdZ
e defd Z d
d Z dS ) N)
ConfigFileIConfig)log_error_and_ignorez/etc/imunify360/user_configF config_filec |rd S t | t j | sd S t j | D ] }t t | d S )N)username)migrate_configospathexistslistdirr )migratordatabaseuser_config_dirr fakekwargsr s q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/153_migrate_config_default_action.pymigrater
s} ;
7>>/ * * J// 6 6z844455556 6 c b | d }|sd S | di }| d }|dk r>d|d< | di }| d }| |d k rd |d< n |d
v rd|d< nd S | |d dd d S )
NF) normalizeMALWARE_SCANNINGdefault_action
quarantinecleanupMALWARE_CLEANUPkeep_original_files_days )cleanup_or_quarantinedeleteT) overwritevalidater )config_to_dict
setdefaultgetdict_to_config)r configmalware_settingsr cleanup_settingskeep_original_filess r r r s
'
'%
'
8
8F (();R@@%))*:;;N %%-6)*!,,->CC . 2 23M N N */BS/H/H;> 7 8 > > >-6)** $% r c d S )N )r r r r s r rollbackr- 8 s Dr )F)
loggingr
defence360agent.contracts.configr r defence360agent.utilsr getLogger__name__loggerr r r- r, r r <module>r4 s @ @ @ @ @ @ @ @ 6 6 6 6 6 6 8 $ $ 2%:<< 6 6 6 6 6 6, . r defence360agent/migrations/__pycache__/153_migrate_config_default_action.cpython-311.pyc 0000644 0000000 0000000 00000004617 00000000000 026252 0 ustar
r_jF d dl Z d dlZd dlmZmZ d dlmZ e j e Z d e dfdefdZ
e defd Z d
d Z dS ) N)
ConfigFileIConfig)log_error_and_ignorez/etc/imunify360/user_configF config_filec |rd S t | t j | sd S t j | D ] }t t | d S )N)username)migrate_configospathexistslistdirr )migratordatabaseuser_config_dirr fakekwargsr s q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/153_migrate_config_default_action.pymigrater
s} ;
7>>/ * * J// 6 6z844455556 6 c b | d }|sd S | di }| d }|dk r>d|d< | di }| d }| |d k rd |d< n |d
v rd|d< nd S | |d dd d S )
NF) normalizeMALWARE_SCANNINGdefault_action
quarantinecleanupMALWARE_CLEANUPkeep_original_files_days )cleanup_or_quarantinedeleteT) overwritevalidater )config_to_dict
setdefaultgetdict_to_config)r configmalware_settingsr cleanup_settingskeep_original_filess r r r s
'
'%
'
8
8F (();R@@%))*:;;N %%-6)*!,,->CC . 2 23M N N */BS/H/H;> 7 8 > > >-6)** $% r c d S )N )r r r r s r rollbackr- 8 s Dr )F)
loggingr
defence360agent.contracts.configr r defence360agent.utilsr getLogger__name__loggerr r r- r, r r <module>r4 s @ @ @ @ @ @ @ @ 6 6 6 6 6 6 8 $ $ 2%:<< 6 6 6 6 6 6, . r defence360agent/migrations/__pycache__/153_update_incident_name.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001226 00000000000 025323 0 ustar
r_j ddZ ddZdS )Fc 0 | d d S )NzTUPDATE incident SET name='Login Blocked by cpHulk' where plugin='cphulk' and name='')sqlmigratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/153_update_incident_name.pymigrater
s' LL - c d S )N r s r rollbackr s Dr N)F)r
r r
r r <module>r s7 r defence360agent/migrations/__pycache__/153_update_incident_name.cpython-311.pyc 0000644 0000000 0000000 00000001226 00000000000 024364 0 ustar
r_j ddZ ddZdS )Fc 0 | d d S )NzTUPDATE incident SET name='Login Blocked by cpHulk' where plugin='cphulk' and name='')sqlmigratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/153_update_incident_name.pymigrater
s' LL - c d S )N r s r rollbackr s Dr N)F)r
r r
r r <module>r s7 r ././@LongLink 0000000 0000000 0000000 00000000156 00000000000 011567 L ustar root root defence360agent/migrations/__pycache__/154_migrate_config_user_override_malware_actions.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/154_migrate_config_user_override_malware_actions.cpython-311.0000644 0000000 0000000 00000002605 00000000000 030656 0 ustar
r_j D d dl mZmZmZ e dddefdZd ZdS ) )IConfig LocalConfig
NonBaseMergerF) config_filefaker c |rd S t t j d }| di }| d }|!d|d< | d|idd d S d S )N)namesT)
force_read PERMISSIONS user_override_malware_actionsF)validatewithout_defaults)r get_layer_namesconfigs_to_dict
setdefaultgetdict_to_config)r r ___configpermission_settingsr s /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/154_migrate_config_user_override_malware_actions.pymigrater s
,.. oo&& !++M2>>$7$;$;'% %! %,?C ;<""
/ 0 ! #
-, c d S )N )r r s r rollbackr s Dr N) defence360agent.contracts.configr r r r r r r r <module>r s (3{}}5
W
, r ././@LongLink 0000000 0000000 0000000 00000000150 00000000000 011561 L ustar root root defence360agent/migrations/__pycache__/154_migrate_config_user_override_malware_actions.cpython-311.pyc defence360agent/migrations/__pycache__/154_migrate_config_user_override_malware_actions.cpython-311.0000644 0000000 0000000 00000002605 00000000000 030656 0 ustar
r_j D d dl mZmZmZ e dddefdZd ZdS ) )IConfig LocalConfig
NonBaseMergerF) config_filefaker c |rd S t t j d }| di }| d }|!d|d< | d|idd d S d S )N)namesT)
force_read PERMISSIONS user_override_malware_actionsF)validatewithout_defaults)r get_layer_namesconfigs_to_dict
setdefaultgetdict_to_config)r r ___configpermission_settingsr s /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/154_migrate_config_user_override_malware_actions.pymigrater s
,.. oo&& !++M2>>$7$;$;'% %! %,?C ;<""
/ 0 ! #
-, c d S )N )r r s r rollbackr s Dr N) defence360agent.contracts.configr r r r r r r r <module>r s (3{}}5
W
, r ././@LongLink 0000000 0000000 0000000 00000000160 00000000000 011562 L ustar root root defence360agent/migrations/__pycache__/155_migrate_config_user_override_proactive_defense.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/155_migrate_config_user_override_proactive_defense.cpython-310000644 0000000 0000000 00000002643 00000000000 031037 0 ustar
r_j! D d dl mZmZmZ e dddefdZd ZdS ) )IConfig LocalConfig
NonBaseMergerF) config_filefaker c |rd S t t j d }| di }| d }|!d|d< | d|idd d S d S )N)namesT)
force_read PERMISSIONS user_override_proactive_defenseF)validatewithout_defaults)r get_layer_namesconfigs_to_dict
setdefaultgetdict_to_config)r r ___configpermission_settings user_override_malware_actionss /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/155_migrate_config_user_override_proactive_defense.pymigrater s
,.. oo&& !++M2>>$7$;$;)% %! %,AE =>""
/ 0 ! #
-, c d S )N )r r s r rollbackr s Dr N) defence360agent.contracts.configr r r r r r r r <module>r s (3{}}5
W
, r ././@LongLink 0000000 0000000 0000000 00000000152 00000000000 011563 L ustar root root defence360agent/migrations/__pycache__/155_migrate_config_user_override_proactive_defense.cpython-311.pyc defence360agent/migrations/__pycache__/155_migrate_config_user_override_proactive_defense.cpython-310000644 0000000 0000000 00000002643 00000000000 031037 0 ustar
r_j! D d dl mZmZmZ e dddefdZd ZdS ) )IConfig LocalConfig
NonBaseMergerF) config_filefaker c |rd S t t j d }| di }| d }|!d|d< | d|idd d S d S )N)namesT)
force_read PERMISSIONS user_override_proactive_defenseF)validatewithout_defaults)r get_layer_namesconfigs_to_dict
setdefaultgetdict_to_config)r r ___configpermission_settings user_override_malware_actionss /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/155_migrate_config_user_override_proactive_defense.pymigrater s
,.. oo&& !++M2>>$7$;$;)% %! %,AE =>""
/ 0 ! #
-, c d S )N )r r s r rollbackr s Dr N) defence360agent.contracts.configr r r r r r r r <module>r s (3{}}5
W
, r defence360agent/migrations/__pycache__/156_remove_default_values_from_config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001745 00000000000 030125 0 ustar
r_jY d Z ddZddZdS )a
Remove values from imunify360.config that are the same as in
imunify360-base.config.
Use stub migration, since for new installations imunify360-base.config
is absent, so this migration is no longer needed in this case.
Otherwise, when the migration has already been applied, no need to reapply.
Keep the migration itself, since it was already released.
To remove schema defaults from imunify360.config
159_remove_defaults_from_local_config migration is used.
Fc d S N migratordatabasefakekwargss u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/156_remove_default_values_from_config.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r sA
r
defence360agent/migrations/__pycache__/156_remove_default_values_from_config.cpython-311.pyc 0000644 0000000 0000000 00000001745 00000000000 027166 0 ustar
r_jY d Z ddZddZdS )a
Remove values from imunify360.config that are the same as in
imunify360-base.config.
Use stub migration, since for new installations imunify360-base.config
is absent, so this migration is no longer needed in this case.
Otherwise, when the migration has already been applied, no need to reapply.
Keep the migration itself, since it was already released.
To remove schema defaults from imunify360.config
159_remove_defaults_from_local_config migration is used.
Fc d S N migratordatabasefakekwargss u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/156_remove_default_values_from_config.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r sA
r
defence360agent/migrations/__pycache__/157_move_i360_modsec_disable_conf.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003474 00000000000 026730 0 ustar
r_j j d dl Z d dlZd dlZd dlmZ e j e ZdZdZ dZ
dZ d
dZ d
d Z
dS ) N)
OsReleaseInfoz7/etc/apache2/conf/plesk.conf.d/i360_modsec_disable.confz>/etc/apache2/conf/plesk.conf.d/vhosts/i360_modsec_disable.confz5/etc/httpd/conf/plesk.conf.d/i360_modsec_disable.confz</etc/httpd/conf/plesk.conf.d/vhosts/i360_modsec_disable.confFc N |rd S t j t j z rt }t }nt
}t }t j | rD t j || d S # t $ r t d| Y d S w xY wd S )NzFailed move %s)r id_likeDEBIAN#_DEBIAN_OLD_MODSEC_DISABLE_FILENAME#_DEBIAN_NEW_MODSEC_DISABLE_FILENAME _OLD_MODSEC_DISABLE_FILENAME _NEW_MODSEC_DISABLE_FILENAMEospathexistsshutilmove Exceptionlogger exception)migratordatabasefakekwargs
old_file_name
new_file_names q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/157_move_i360_modsec_disable_conf.pymigrater s !55 5;
;
4
4
w~~m$$ > > K
} 5 5 5 5 5 > > > -} = = = = = = >> >s "A9 9%B"!B"c d S )N )r r r r s r rollbackr ) s D )F)loggingr r defence360agent.utilsr getLogger__name__r r r r
r r r r r r <module>r# s
/ / / / / / 8 $ $ > $ E $ < C
> > > >" r defence360agent/migrations/__pycache__/157_move_i360_modsec_disable_conf.cpython-311.pyc 0000644 0000000 0000000 00000003474 00000000000 025771 0 ustar
r_j j d dl Z d dlZd dlZd dlmZ e j e ZdZdZ dZ
dZ d
dZ d
d Z
dS ) N)
OsReleaseInfoz7/etc/apache2/conf/plesk.conf.d/i360_modsec_disable.confz>/etc/apache2/conf/plesk.conf.d/vhosts/i360_modsec_disable.confz5/etc/httpd/conf/plesk.conf.d/i360_modsec_disable.confz</etc/httpd/conf/plesk.conf.d/vhosts/i360_modsec_disable.confFc N |rd S t j t j z rt }t }nt
}t }t j | rD t j || d S # t $ r t d| Y d S w xY wd S )NzFailed move %s)r id_likeDEBIAN#_DEBIAN_OLD_MODSEC_DISABLE_FILENAME#_DEBIAN_NEW_MODSEC_DISABLE_FILENAME _OLD_MODSEC_DISABLE_FILENAME _NEW_MODSEC_DISABLE_FILENAMEospathexistsshutilmove Exceptionlogger exception)migratordatabasefakekwargs
old_file_name
new_file_names q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/157_move_i360_modsec_disable_conf.pymigrater s !55 5;
;
4
4
w~~m$$ > > K
} 5 5 5 5 5 > > > -} = = = = = = >> >s "A9 9%B"!B"c d S )N )r r r r s r rollbackr ) s D )F)loggingr r defence360agent.utilsr getLogger__name__r r r r
r r r r r r <module>r# s
/ / / / / / 8 $ $ > $ E $ < C
> > > >" r ././@LongLink 0000000 0000000 0000000 00000000147 00000000000 011567 L ustar root root defence360agent/migrations/__pycache__/158_move_i360_modsec_disable_conf_symlink.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/158_move_i360_modsec_disable_conf_symlink.cpython-311.opt-1.p0000644 0000000 0000000 00000004736 00000000000 030145 0 ustar
r_j r d dl Z d dlZd dlZd dlmZ e j e ZdZdZ dZ
dZ dZ dZ
d d Zd d
ZdS ) N)
OsReleaseInfoz2/etc/apache2/plesk.conf.d/i360_modsec_disable.confz</etc/apache2/conf-enabled/zz999_modsec2.imunify_disable.confz5/etc/httpd/conf/plesk.conf.d/i360_modsec_disable.confz4/etc/httpd/conf.d/zz999_modsec2.imunify_disable.confz7/etc/apache2/conf/plesk.conf.d/i360_modsec_disable.confFc ` |rd S d }d }t j t j z r t }t }t
}t }nt }t }|rat j
| rB t j
|| n+# t $ r t d| Y nw xY wt j
| rX t j | t j || d S # t $ r t d| Y d S w xY wd S )NzFailed move %szFailed change symlink %s)r id_likeDEBIAN#_DEBIAN_OLD_MODSEC_DISABLE_FILENAME#_DEBIAN_NEW_MODSEC_DISABLE_FILENAME#_DEBIAN_MODSEC_DISABLE_SYMLINK_PATH _DEBIAN_MODSEC_DISABLE_SYMLINK _MODSEC_DISABLE_SYMLINK_PATH_MODSEC_DISABLE_SYMLINKospathexistsshutilmove Exceptionlogger exceptionislinkunlinksymlink)migratordatabasefakekwargs
old_file_name
new_file_name symlink_pathr s y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/158_move_i360_modsec_disable_conf_symlink.pymigrater sQ MM !55 *;
;
: 03 ) >
66 > > K
} 5 5 5 5 > > > -} = = = = = > w~~g B B Ig J|W - - - - - B B B 7 A A A A A A B B Bs$ 6B %B43B4)D %D+*D+c d S )N )r r r r s r rollbackr# : s D )F)loggingr
r defence360agent.utilsr getLogger__name__r r r
r r r r r r# r" r$ r <module>r) s
/ / / / / / 8 $ $ 9 $ C < ;
9 $ > $
B B B B6 r$ defence360agent/migrations/__pycache__/158_move_i360_modsec_disable_conf_symlink.cpython-311.pyc 0000644 0000000 0000000 00000004736 00000000000 027542 0 ustar
r_j r d dl Z d dlZd dlZd dlmZ e j e ZdZdZ dZ
dZ dZ dZ
d d Zd d
ZdS ) N)
OsReleaseInfoz2/etc/apache2/plesk.conf.d/i360_modsec_disable.confz</etc/apache2/conf-enabled/zz999_modsec2.imunify_disable.confz5/etc/httpd/conf/plesk.conf.d/i360_modsec_disable.confz4/etc/httpd/conf.d/zz999_modsec2.imunify_disable.confz7/etc/apache2/conf/plesk.conf.d/i360_modsec_disable.confFc ` |rd S d }d }t j t j z r t }t }t
}t }nt }t }|rat j
| rB t j
|| n+# t $ r t d| Y nw xY wt j
| rX t j | t j || d S # t $ r t d| Y d S w xY wd S )NzFailed move %szFailed change symlink %s)r id_likeDEBIAN#_DEBIAN_OLD_MODSEC_DISABLE_FILENAME#_DEBIAN_NEW_MODSEC_DISABLE_FILENAME#_DEBIAN_MODSEC_DISABLE_SYMLINK_PATH _DEBIAN_MODSEC_DISABLE_SYMLINK _MODSEC_DISABLE_SYMLINK_PATH_MODSEC_DISABLE_SYMLINKospathexistsshutilmove Exceptionlogger exceptionislinkunlinksymlink)migratordatabasefakekwargs
old_file_name
new_file_name symlink_pathr s y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/158_move_i360_modsec_disable_conf_symlink.pymigrater sQ MM !55 *;
;
: 03 ) >
66 > > K
} 5 5 5 5 > > > -} = = = = = > w~~g B B Ig J|W - - - - - B B B 7 A A A A A A B B Bs$ 6B %B43B4)D %D+*D+c d S )N )r r r r s r rollbackr# : s D )F)loggingr
r defence360agent.utilsr getLogger__name__r r r
r r r r r r# r" r$ r <module>r) s
/ / / / / / 8 $ $ 9 $ C < ;
9 $ > $
B B B B6 r$ defence360agent/migrations/__pycache__/159_remove_defaults_from_local_config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003336 00000000000 030104 0 ustar
r_j Z d Z ddlZddlmZ ddlmZ ej e ZddZ ddZ
dS ) zv
Remove all default values from main config
(/etc/sysconfig/imunify360/imunify360.config).
See DEF-17214 for details.
N) LocalConfig)exclude_equalsFc < |rd S t }| d }| i d }t || }| |d d S # t
$ r&}t d| Y d }~d S d }~ww xY w)NT)
force_readF)without_defaults) main_conf base_conf) overwritez(Can't overwrite local config, reason: %s)r config_to_dict normalizer dict_to_config Exceptionloggererror) migratordatabasefakekwargs local_config
local_confdefaultsnon_default_confexcs u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/159_remove_defaults_from_local_config.pymigrater s F"}} !00D0AA
))"u)EE) H
##$4#EEEEE F F F ?EEEEEEEEEFs A#A+ +
B5BBc d S )N )r r r r s r rollbackr s D )F) __doc__logging defence360agent.contracts.configr )defence360agent.contracts.config_providerr getLogger__name__r r r r r r <module>r& s
8 8 8 8 8 8 D D D D D D 8 $ $F F F F$ r defence360agent/migrations/__pycache__/159_remove_defaults_from_local_config.cpython-311.pyc 0000644 0000000 0000000 00000003336 00000000000 027145 0 ustar
r_j Z d Z ddlZddlmZ ddlmZ ej e ZddZ ddZ
dS ) zv
Remove all default values from main config
(/etc/sysconfig/imunify360/imunify360.config).
See DEF-17214 for details.
N) LocalConfig)exclude_equalsFc < |rd S t }| d }| i d }t || }| |d d S # t
$ r&}t d| Y d }~d S d }~ww xY w)NT)
force_readF)without_defaults) main_conf base_conf) overwritez(Can't overwrite local config, reason: %s)r config_to_dict normalizer dict_to_config Exceptionloggererror) migratordatabasefakekwargs local_config
local_confdefaultsnon_default_confexcs u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/159_remove_defaults_from_local_config.pymigrater s F"}} !00D0AA
))"u)EE) H
##$4#EEEEE F F F ?EEEEEEEEEFs A#A+ +
B5BBc d S )N )r r r r s r rollbackr s D )F) __doc__logging defence360agent.contracts.configr )defence360agent.contracts.config_providerr getLogger__name__r r r r r r <module>r& s
8 8 8 8 8 8 D D D D D D 8 $ $F F F F$ r defence360agent/migrations/__pycache__/160_remove_quarantine.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000012353 00000000000 024711 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZm Z d dl
m Z m Z d dl
mZ d dlmZ e j e ZdZd Zd
Zed d gZd
ZddZd Zde eef fdZ dedeeef fdZ dS ) N)glob)Path)TupleUnion) CharFieldModel)
FilenameField) HostingPanelz.imunify.quarantinedz/var/imunify360 quarantinedz/var/wwwz/home*c 2 G fddt }|S )zl
Model stub for migration because we can't use migrator.orm[] due to
custom field FilenameField
c Z e Zd Z G fdd Z ed Z e ZdS ) get_model.<locals>.MalwareHitc e Zd ZdZ ZdS )"get_model.<locals>.MalwareHit.Meta malware_hitsN)__name__
__module__ __qualname__db_tabledatabasedbs e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/160_remove_quarantine.pyMetar s %HHHH r F)nullN)r r r r r orig_filer statusr s r
MalwareHitr s` "Mu--- r r )r )r r s ` r get_modelr s? U r Fc |rd S |pt }t | }| |j t
k }|D ]8}t
|j \ } } || | 9t D ]B}
t t j
|
t D ]
} || Cd S N)delete_quarantine_folderr selectwherer QUARANTINED find_quarr delete_instanceQUARANTINE_PARENTSr ospathjoin QUAR_NAME) _migratorr fakedelete_function___modelr hitpath_to_deleteparents r migrater7 ) s &A)AO h E,,..&&u|{'BCCK %cm 4 4''' % , , "27<< #B#B C C , ,N ON + + + + ,, ,r c d S r" )r1 r2 s r rollbackr: ? s Dr quarantine_pathc t | } | j t k rK| | k r5t d| t
j | d d S d S d S )Nz Deleting quarantine folder %sT)
ignore_errors)r namer- resolveloggerinfoshutilrmtree)r; s r r# r# C sr ?++O )) 6 6 8 8 8 8 3_EEE
oT:::::: *) 8 8r sourcereturnc t | }t t t z | t d f}d}d}|j D ]P} t j | j }|} n # t $ r Y >t $ r |cY c S w xY w| |j dk r|S | | | z } t |j }n# t t f$ r |cY S w xY w | | }n# t" $ r |cY S w xY w|t z |fS )zy
Find file in quarantine by source path.
This function is copied from agent code since it is to be removed.
/Nroot)r DEF_QUARr- relative_toparentspwdgetpwuidstatst_uidFileNotFoundErrorKeyErrorpw_namer? r
base_home_dirpw_dir RuntimeError
ValueError) rD filedefault_resultuserr6 r+ resolved_placebase_dirrelatives r r' r' M s <<D(^^i/1A1A$s))1L1LLN D
F < 233D F E
! H " " "! ! ! ! ! ! " |t|v-- ^^%%(8(8(@(@@N >>// << | , !--h77 i ))s< +B
B' B'&B'$&D D! D!%D; ; E
E
)FN) loggingr* rL rB r pathlibr typingr r peeweer r $defence360agent.model.simplificationr +defence360agent.subsys.panels.hosting_panelr
getLoggerr r@ r- rI r& r) r r7 r: strr# r' r9 r r <module>re s\
# # # # # # # # ? > > > > > D D D D D D 8 $ $ "
H5 ", , , ,, ;eCI.> ; ; ; ;'*c '*eD$J / '* '* '* '* '* '*r defence360agent/migrations/__pycache__/160_remove_quarantine.cpython-311.pyc 0000644 0000000 0000000 00000012353 00000000000 023752 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZm Z d dl
m Z m Z d dl
mZ d dlmZ e j e ZdZd Zd
Zed d gZd
ZddZd Zde eef fdZ dedeeef fdZ dS ) N)glob)Path)TupleUnion) CharFieldModel)
FilenameField) HostingPanelz.imunify.quarantinedz/var/imunify360 quarantinedz/var/wwwz/home*c 2 G fddt }|S )zl
Model stub for migration because we can't use migrator.orm[] due to
custom field FilenameField
c Z e Zd Z G fdd Z ed Z e ZdS ) get_model.<locals>.MalwareHitc e Zd ZdZ ZdS )"get_model.<locals>.MalwareHit.Meta malware_hitsN)__name__
__module__ __qualname__db_tabledatabasedbs e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/160_remove_quarantine.pyMetar s %HHHH r F)nullN)r r r r r orig_filer statusr s r
MalwareHitr s` "Mu--- r r )r )r r s ` r get_modelr s? U r Fc |rd S |pt }t | }| |j t
k }|D ]8}t
|j \ } } || | 9t D ]B}
t t j
|
t D ]
} || Cd S N)delete_quarantine_folderr selectwherer QUARANTINED find_quarr delete_instanceQUARANTINE_PARENTSr ospathjoin QUAR_NAME) _migratorr fakedelete_function___modelr hitpath_to_deleteparents r migrater7 ) s &A)AO h E,,..&&u|{'BCCK %cm 4 4''' % , , "27<< #B#B C C , ,N ON + + + + ,, ,r c d S r" )r1 r2 s r rollbackr: ? s Dr quarantine_pathc t | } | j t k rK| | k r5t d| t
j | d d S d S d S )Nz Deleting quarantine folder %sT)
ignore_errors)r namer- resolveloggerinfoshutilrmtree)r; s r r# r# C sr ?++O )) 6 6 8 8 8 8 3_EEE
oT:::::: *) 8 8r sourcereturnc t | }t t t z | t d f}d}d}|j D ]P} t j | j }|} n # t $ r Y >t $ r |cY c S w xY w| |j dk r|S | | | z } t |j }n# t t f$ r |cY S w xY w | | }n# t" $ r |cY S w xY w|t z |fS )zy
Find file in quarantine by source path.
This function is copied from agent code since it is to be removed.
/Nroot)r DEF_QUARr- relative_toparentspwdgetpwuidstatst_uidFileNotFoundErrorKeyErrorpw_namer? r
base_home_dirpw_dir RuntimeError
ValueError) rD filedefault_resultuserr6 r+ resolved_placebase_dirrelatives r r' r' M s <<D(^^i/1A1A$s))1L1LLN D
F < 233D F E
! H " " "! ! ! ! ! ! " |t|v-- ^^%%(8(8(@(@@N >>// << | , !--h77 i ))s< +B
B' B'&B'$&D D! D!%D; ; E
E
)FN) loggingr* rL rB r pathlibr typingr r peeweer r $defence360agent.model.simplificationr +defence360agent.subsys.panels.hosting_panelr
getLoggerr r@ r- rI r& r) r r7 r: strr# r' r9 r r <module>re s\
# # # # # # # # ? > > > > > D D D D D D 8 $ $ "
H5 ", , , ,, ;eCI.> ; ; ; ;'*c '*eD$J / '* '* '* '* '* '*r defence360agent/migrations/__pycache__/160_unmount_sigs_v1.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004340 00000000000 024322 0 ustar
r_j V d Z ddlZddlZddlmZ ej e ZddZddZ dS )z Unmount sigs/v1 from CageFS. N)PathFc |rd S ddl m} |j }n# t $ r d}Y nw xY w t | }d|vrd S n@# t $ r Y d S t $ r'}t d|| Y d }~d S d }~ww xY w t j d|ddd
d S # t $ r&}t d | Y d }~d S d }~ww xY w) Nr )clcagefsz/etc/cagefs/cagefs.mpz /var/imunify360/files/sigs/v1zCan't read %s, reason: %sz5sed -i.im360-bak '\:/var/imunify360/files/sigs/v1:d' z && grep /var/imunify360/files/sigs/v1 /proc/mounts | awk '{ print $2 }' | xargs -rn1 umount && /usr/sbin/cagefsctl --wait-lock --unmount-all && /usr/sbin/cagefsctl --wait-lock --force-update-etc && /usr/sbin/cagefsctl --wait-lock --remount-allTz /bin/bash)shell
executablez!Can't unmount sigs/v1, reason: %s) defence360agent.subsysr CAGEFS_MP_FILENAME ImportErrorr read_textFileNotFoundError Exceptionlogger exception
subprocess
check_call)migratordatabasefakekwargsr filenametextes c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/160_unmount_sigs_v1.pymigrater s{ +333333. + + +*+ H~~'')) +$ 6 6 F 7
4hBBB A DL88
N "
A A A<a@@@@@@@@@AsA
##!A
B B % BB B- -
C 7CC c d S )N )r r r r s r rollbackr . s D )F)
__doc__loggingr pathlibr getLogger__name__r r r r r r <module>r$ s{ " " 8 $ $"A "A "A "AJ r defence360agent/migrations/__pycache__/160_unmount_sigs_v1.cpython-311.pyc 0000644 0000000 0000000 00000004340 00000000000 023363 0 ustar
r_j V d Z ddlZddlZddlmZ ej e ZddZddZ dS )z Unmount sigs/v1 from CageFS. N)PathFc |rd S ddl m} |j }n# t $ r d}Y nw xY w t | }d|vrd S n@# t $ r Y d S t $ r'}t d|| Y d }~d S d }~ww xY w t j d|ddd
d S # t $ r&}t d | Y d }~d S d }~ww xY w) Nr )clcagefsz/etc/cagefs/cagefs.mpz /var/imunify360/files/sigs/v1zCan't read %s, reason: %sz5sed -i.im360-bak '\:/var/imunify360/files/sigs/v1:d' z && grep /var/imunify360/files/sigs/v1 /proc/mounts | awk '{ print $2 }' | xargs -rn1 umount && /usr/sbin/cagefsctl --wait-lock --unmount-all && /usr/sbin/cagefsctl --wait-lock --force-update-etc && /usr/sbin/cagefsctl --wait-lock --remount-allTz /bin/bash)shell
executablez!Can't unmount sigs/v1, reason: %s) defence360agent.subsysr CAGEFS_MP_FILENAME ImportErrorr read_textFileNotFoundError Exceptionlogger exception
subprocess
check_call)migratordatabasefakekwargsr filenametextes c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/160_unmount_sigs_v1.pymigrater s{ +333333. + + +*+ H~~'')) +$ 6 6 F 7
4hBBB A DL88
N "
A A A<a@@@@@@@@@AsA
##!A
B B % BB B- -
C 7CC c d S )N )r r r r s r rollbackr . s D )F)
__doc__loggingr pathlibr getLogger__name__r r r r r r <module>r$ s{ " " 8 $ $"A "A "A "AJ r defence360agent/migrations/__pycache__/161_remove_ea4_main_local_conf.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005174 00000000000 026402 0 ustar
r_j d Z ddlZddlmZ ddlZddlmZ ej e Z ed Z
ed Z dZ dZ
ej d e e
fd
Zd d ZdS )
at
Remove /var/cpanel/templates/apache2_4/ea4_main.local file
introduced by imunify360. This file was used to change apache log format
(%h->%a), when imunify360 installed remote_ip apache module.
Since this file is created once it can be outdated after updating cPanel (
in case if /var/cpanel/templates/apache2_4/ea4_main.default also updated).
See DEF-9641 for details.
N)Path)antivirus_modez./var/cpanel/templates/apache2_4/ea4_main.localz0/var/cpanel/templates/apache2_4/ea4_main.defaultz%a z%h Fc |rd S ddl m} n# t $ r Y d S w xY w | r| r}| }| t t }||k r3| t j |j d S d S d S d S # t $ r'} t d|| Y d } ~ d S d } ~ ww xY w)Nr )cPanelzCan't remove %s, reason: %s)im360.subsys.panels.cpanelr ImportError is_installedexists read_textreplaceNEWOLDunlink
subprocess
check_callREBUILD_HTTPDCONF_CMD Exceptionloggererror)
migratordatabasefakedefault_conf_pathlocal_conf_pathkwargsr origin_text
restored_textexcs
n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/161_remove_ea4_main_local_conf.pymigrater sS 5555555
J D_%;%;%=%= D+5577K + 5 5 7 7 ? ?S I IM ++ &&(((%f&BCCCCC D D D D ,+ J J J 2OSIIIIIIIIIJs$
B!C
C9 C44C9c d S )N )r r r r s r rollbackr# : s D )F)__doc__loggingpathlibr r defence360agent.utilsr getLogger__name__r EA4_MAIN_LOCAL_PATHEA4_MAIN_DEFAULT_PATHr
r skipr r# r" r$ r <module>r. s 0 0 0 0 0 0 8 $ $dKLL 6
+' J J J J: r$ defence360agent/migrations/__pycache__/161_remove_ea4_main_local_conf.cpython-311.pyc 0000644 0000000 0000000 00000005174 00000000000 025443 0 ustar
r_j d Z ddlZddlmZ ddlZddlmZ ej e Z ed Z
ed Z dZ dZ
ej d e e
fd
Zd d ZdS )
at
Remove /var/cpanel/templates/apache2_4/ea4_main.local file
introduced by imunify360. This file was used to change apache log format
(%h->%a), when imunify360 installed remote_ip apache module.
Since this file is created once it can be outdated after updating cPanel (
in case if /var/cpanel/templates/apache2_4/ea4_main.default also updated).
See DEF-9641 for details.
N)Path)antivirus_modez./var/cpanel/templates/apache2_4/ea4_main.localz0/var/cpanel/templates/apache2_4/ea4_main.defaultz%a z%h Fc |rd S ddl m} n# t $ r Y d S w xY w | r| r}| }| t t }||k r3| t j |j d S d S d S d S # t $ r'} t d|| Y d } ~ d S d } ~ ww xY w)Nr )cPanelzCan't remove %s, reason: %s)im360.subsys.panels.cpanelr ImportError is_installedexists read_textreplaceNEWOLDunlink
subprocess
check_callREBUILD_HTTPDCONF_CMD Exceptionloggererror)
migratordatabasefakedefault_conf_pathlocal_conf_pathkwargsr origin_text
restored_textexcs
n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/161_remove_ea4_main_local_conf.pymigrater sS 5555555
J D_%;%;%=%= D+5577K + 5 5 7 7 ? ?S I IM ++ &&(((%f&BCCCCC D D D D ,+ J J J 2OSIIIIIIIIIJs$
B!C
C9 C44C9c d S )N )r r r r s r rollbackr# : s D )F)__doc__loggingpathlibr r defence360agent.utilsr getLogger__name__r EA4_MAIN_LOCAL_PATHEA4_MAIN_DEFAULT_PATHr
r skipr r# r" r$ r <module>r. s 0 0 0 0 0 0 8 $ $dKLL 6
+' J J J J: r$ defence360agent/migrations/__pycache__/162_add_resource_type.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004632 00000000000 024670 0 ustar
r_j( x d dl Z d dlZd dlmZ ej ddd Z e j e Z d dZ
d dZ dS )
N)importerzimav.malwarelib.configMalwareScanResourceType)modulenamedefaultFc
| j d }| |t j dt j j t j d t j j t j j f g t j d t j d t j d t j d | j d }| |t j dt j j t j d t j j t j j f g |
|d
d d S ) N malware_hitsFzresource_type in {})nullr constraintsT)r
)
resource_typeapp_namedb_hostdb_portdb_name
malware_scans)r total_filestotal_resources) orm
add_fieldspw CharFieldr FILEvalueCheckformatDB rename_field)migratordatabasefakekwargs MalwareHits MalwareScans e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/162_add_resource_type.pymigrater% s{ ,~.K l+06)00 3 6 < 3 8 >
4((( $''' $''' $'''' * ,/K l+06)00 3 6 < 3 8 >
"
+}6GHHHHH c L | j d }| |d d S )Nr r )r
remove_fields)r r r r! r" s r$ rollbackr) < s* ,~.K ;88888r& )F) loggingpeeweer defence360agent.utilsr getr getLogger__name__loggerr% r) r& r$ <module>r2 s * * * * * *&(, # "
8 $ $)I )I )I )IX9 9 9 9 9 9r& defence360agent/migrations/__pycache__/162_add_resource_type.cpython-311.pyc 0000644 0000000 0000000 00000004632 00000000000 023731 0 ustar
r_j( x d dl Z d dlZd dlmZ ej ddd Z e j e Z d dZ
d dZ dS )
N)importerzimav.malwarelib.configMalwareScanResourceType)modulenamedefaultFc
| j d }| |t j dt j j t j d t j j t j j f g t j d t j d t j d t j d | j d }| |t j dt j j t j d t j j t j j f g |
|d
d d S ) N malware_hitsFzresource_type in {})nullr constraintsT)r
)
resource_typeapp_namedb_hostdb_portdb_name
malware_scans)r total_filestotal_resources) orm
add_fieldspw CharFieldr FILEvalueCheckformatDB rename_field)migratordatabasefakekwargs MalwareHits MalwareScans e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/162_add_resource_type.pymigrater% s{ ,~.K l+06)00 3 6 < 3 8 >
4((( $''' $''' $'''' * ,/K l+06)00 3 6 < 3 8 >
"
+}6GHHHHH c L | j d }| |d d S )Nr r )r
remove_fields)r r r r! r" s r$ rollbackr) < s* ,~.K ;88888r& )F) loggingpeeweer defence360agent.utilsr getr getLogger__name__loggerr% r) r& r$ <module>r2 s * * * * * *&(, # "
8 $ $)I )I )I )IX9 9 9 9 9 9r& defence360agent/migrations/__pycache__/163_drop_malware_scanned_stat.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001377 00000000000 026376 0 ustar
r_j ddZ ddZdS )Fc n | j d }| | d S # t $ r Y d S w xY w)Nmalware_scanned_stat)orm remove_modelKeyError)migratordatabasefakekwargsmodels m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/163_drop_malware_scanned_stat.pymigrater
sP
34 e$$$$$
s "&
44c d S )N )r r r r
s r rollbackr s D N)F)r
r r r r <module>r s7
r defence360agent/migrations/__pycache__/163_drop_malware_scanned_stat.cpython-311.pyc 0000644 0000000 0000000 00000001377 00000000000 025437 0 ustar
r_j ddZ ddZdS )Fc n | j d }| | d S # t $ r Y d S w xY w)Nmalware_scanned_stat)orm remove_modelKeyError)migratordatabasefakekwargsmodels m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/163_drop_malware_scanned_stat.pymigrater
sP
34 e$$$$$
s "&
44c d S )N )r r r r
s r rollbackr s D N)F)r
r r r r <module>r s7
r defence360agent/migrations/__pycache__/164_add_resource_type_to_ignore.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005133 00000000000 026734 0 ustar
r_j{ ^ d dl Z d dlmZmZmZmZmZ G d de ZdddZd Z d Z
dS )
N) CharFieldCheck CompositeKey IntegerFieldModelc e Zd Z G d d ZdZ e Z ed ed g Z e dd Z
dS ) TMPMalwareIgnorePathc * e Zd ZdZ edd ZdS )TMPMalwareIgnorePath.Metatmp_malware_ignore_pathpath
resource_typeN)__name__
__module__ __qualname__db_tabler primary_key o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/164_add_resource_type_to_ignore.pyMetar s$ ,"l6?;; r r NFz resource_type in ('file','db'))null constraintsc B t t j S N)inttimer r r <lambda>z TMPMalwareIgnorePath.<lambda> s #dikk:J:J r )r default) r r r r CACHEr r
r r r
added_dater r r r r s < < < < < < < <
E 9;;D I
'G!H!H I M 52J2JKKKJJJr r F)fakec $ t | d S r ) change_malware_ignore_path_model)migratorr" ___s r migrater( s $X.....r c | t | d | d | d | d d S )NzyINSERT INTO tmp_malware_ignore_path(path,added_date,resource_type) SELECT path,added_date,'file' FROM malware_ignore_pathz DROP TABLE malware_ignore_pathzAALTER TABLE tmp_malware_ignore_path RENAME TO malware_ignore_pathzUCREATE INDEX malware_ignore_path_resource_type ON malware_ignore_path (resource_type)) create_modelr sql)r% s r r$ r$ s ./// LL A
LL1222 LLK
LL 1 r c d S r r )r& r' s r rollbackr- ( s Dr ) r peeweer r r r r r r( r$ r- r r r <module>r/ s F F F F F F F F F F F F F F L L L L L5 L L L % / / / / /
r defence360agent/migrations/__pycache__/164_add_resource_type_to_ignore.cpython-311.pyc 0000644 0000000 0000000 00000005133 00000000000 025775 0 ustar
r_j{ ^ d dl Z d dlmZmZmZmZmZ G d de ZdddZd Z d Z
dS )
N) CharFieldCheck CompositeKey IntegerFieldModelc e Zd Z G d d ZdZ e Z ed ed g Z e dd Z
dS ) TMPMalwareIgnorePathc * e Zd ZdZ edd ZdS )TMPMalwareIgnorePath.Metatmp_malware_ignore_pathpath
resource_typeN)__name__
__module__ __qualname__db_tabler primary_key o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/164_add_resource_type_to_ignore.pyMetar s$ ,"l6?;; r r NFz resource_type in ('file','db'))null constraintsc B t t j S N)inttimer r r <lambda>z TMPMalwareIgnorePath.<lambda> s #dikk:J:J r )r default) r r r r CACHEr r
r r r
added_dater r r r r s < < < < < < < <
E 9;;D I
'G!H!H I M 52J2JKKKJJJr r F)fakec $ t | d S r ) change_malware_ignore_path_model)migratorr" ___s r migrater( s $X.....r c | t | d | d | d | d d S )NzyINSERT INTO tmp_malware_ignore_path(path,added_date,resource_type) SELECT path,added_date,'file' FROM malware_ignore_pathz DROP TABLE malware_ignore_pathzAALTER TABLE tmp_malware_ignore_path RENAME TO malware_ignore_pathzUCREATE INDEX malware_ignore_path_resource_type ON malware_ignore_path (resource_type)) create_modelr sql)r% s r r$ r$ s ./// LL A
LL1222 LLK
LL 1 r c d S r r )r& r' s r rollbackr- ( s Dr ) r peeweer r r r r r r( r$ r- r r r <module>r/ s F F F F F F F F F F F F F F L L L L L5 L L L % / / / / /
r defence360agent/migrations/__pycache__/165_add_db_fields_to_malware_history.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003102 00000000000 027700 0 ustar
r_j ` d dl mZmZ d dlmZ ej ddd Zddd Zddd
ZdS ) ) CharFieldCheck)importerzimav.malwarelib.configMalwareScanResourceTypeN)modulenamedefaultF)fakec
, | j d }| |t d t dt d t
j j t
j j f gt
j j d S )Nmalware_historyT)nullFzresource_type in {})r
constraintsr )app_name
resource_type) orm
add_fieldsr r formatr DBvalueFILEmigratorr
___r s t/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/165_add_db_fields_to_malware_history.pymigrater s l#45O %%% )00 3 6 < 3 8 > ,06
c N | j d }| |dd d S )Nr r r )r
remove_fieldsr s r rollbackr " s- l#45O ?JHHHHHr ) peeweer r defence360agent.utilsr getr r r r r <module>r% s # # # # # # # # * * * * * *&(, # " % , !& I I I I I I Ir defence360agent/migrations/__pycache__/165_add_db_fields_to_malware_history.cpython-311.pyc 0000644 0000000 0000000 00000003102 00000000000 026741 0 ustar
r_j ` d dl mZmZ d dlmZ ej ddd Zddd Zddd
ZdS ) ) CharFieldCheck)importerzimav.malwarelib.configMalwareScanResourceTypeN)modulenamedefaultF)fakec
, | j d }| |t d t dt d t
j j t
j j f gt
j j d S )Nmalware_historyT)nullFzresource_type in {})r
constraintsr )app_name
resource_type) orm
add_fieldsr r formatr DBvalueFILEmigratorr
___r s t/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/165_add_db_fields_to_malware_history.pymigrater s l#45O %%% )00 3 6 < 3 8 > ,06
c N | j d }| |dd d S )Nr r r )r
remove_fieldsr s r rollbackr " s- l#45O ?JHHHHHr ) peeweer r defence360agent.utilsr getr r r r r <module>r% s # # # # # # # # * * * * * *&(, # " % , !& I I I I I I Ir defence360agent/migrations/__pycache__/166_add_id_field_to_malware_ignore_path.cpython-311.opt-1.pyc0000644 0000000 0000000 00000004423 00000000000 030332 0 ustar
r_j \ d dl m Z d dlmZmZmZmZmZ G d de ZdddZd Z d S )
)time) CharFieldCheck IntegerFieldModelPrimaryKeyFieldc e Zd Z G d d ZdZ e Z e Z ed e d g Z
e dd Z dS ) MalwareIgnorePathc e Zd ZdZdZdS )MalwareIgnorePath.Metamalware_ignore_path)))path
resource_typeTN)__name__
__module__ __qualname__db_tableindexes w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/166_add_id_field_to_malware_ignore_path.pyMetar s (6r r NFz resource_type in ('file','db'))null constraintsc 8 t t S N)intr r r r <lambda>zMalwareIgnorePath.<lambda> s #dff++ r )r default)
r r r r CACHEr idr r r r r
added_dater r r r
r
s 7 7 7 7 7 7 7 7
E B 9;;D I
'G!H!H I M 52E2EFFFJJJr r
F)fakec | d | t | d | d d S )NzBALTER TABLE malware_ignore_path RENAME TO malware_ignore_path_old;zINSERT INTO malware_ignore_path(path,added_date,resource_type) SELECT path,added_date,resource_type FROM malware_ignore_path_oldz#DROP TABLE malware_ignore_path_old;)sql create_modelr
)migratorr# ___s r migrater* si LLL
+,,, LL L
LL677777r c d S r r )r( r) s r rollbackr, ! s Dr N)
r peeweer r r r r r
r* r, r r r <module>r. s I I I I I I I I I I I I I I G G G G G G G G % 8 8 8 8 8 r defence360agent/migrations/__pycache__/166_add_id_field_to_malware_ignore_path.cpython-311.pyc 0000644 0000000 0000000 00000004423 00000000000 027373 0 ustar
r_j \ d dl m Z d dlmZmZmZmZmZ G d de ZdddZd Z d S )
)time) CharFieldCheck IntegerFieldModelPrimaryKeyFieldc e Zd Z G d d ZdZ e Z e Z ed e d g Z
e dd Z dS ) MalwareIgnorePathc e Zd ZdZdZdS )MalwareIgnorePath.Metamalware_ignore_path)))path
resource_typeTN)__name__
__module__ __qualname__db_tableindexes w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/166_add_id_field_to_malware_ignore_path.pyMetar s (6r r NFz resource_type in ('file','db'))null constraintsc 8 t t S N)intr r r r <lambda>zMalwareIgnorePath.<lambda> s #dff++ r )r default)
r r r r CACHEr idr r r r r
added_dater r r r
r
s 7 7 7 7 7 7 7 7
E B 9;;D I
'G!H!H I M 52E2EFFFJJJr r
F)fakec | d | t | d | d d S )NzBALTER TABLE malware_ignore_path RENAME TO malware_ignore_path_old;zINSERT INTO malware_ignore_path(path,added_date,resource_type) SELECT path,added_date,resource_type FROM malware_ignore_path_oldz#DROP TABLE malware_ignore_path_old;)sql create_modelr
)migratorr# ___s r migrater* si LLL
+,,, LL L
LL677777r c d S r r )r( r) s r rollbackr, ! s Dr N)
r peeweer r r r r r
r* r, r r r <module>r. s I I I I I I I I I I I I I I G G G G G G G G % 8 8 8 8 8 r defence360agent/migrations/__pycache__/167_remote_iplist.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004624 00000000000 024055 0 ustar
r_j f d dl mZmZmZmZ G d de Z G d de Zd
dZd
dZd S ) ) CharFieldModel IntegerField CompositeKeyc e Zd Z ed Z ed Z ed Z ed Z G d d ZdS ) IPListRecordFnullc . e Zd ZdZ edddd ZdS )IPListRecord.Meta iplistrecordnetwork_addressnetmaskversion iplist_idN__name__
__module__ __qualname__db_tabler primary_key a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/167_remote_iplist.pyMetar
s- !"l y)[
r r N) r r r r r r r r r r r r r r s "l...Ol&&&Gl&&&G %(((I
r r c X e Zd Z ed Z ed Z G d d ZdS )
IPListPurposeFr c * e Zd ZdZ edd ZdS )IPListPurpose.Meta
iplistpurposepurposer Nr r r r r r s$ ""l9k:: r r N)r r r r r! r r r r r r r r s` iU###G %(((I; ; ; ; ; ; ; ; ; ;r r Fc n | t | t d S )N) create_modelr r )migratordatabasefakekwargss r migrater( s0 ,''' -(((((r c | j d }| | | j d }| | d S )Nr
r )orm remove_model)r$ r% r& r' r r s r rollbackr, sH </L ,''' L 1M -(((((r N)F) peeweer r r r r r r( r, r r r <module>r. s ? ? ? ? ? ? ? ? ? ? ? ?
5
; ; ; ; ;E ; ; ;) ) ) )
) ) ) ) ) )r defence360agent/migrations/__pycache__/167_remote_iplist.cpython-311.pyc 0000644 0000000 0000000 00000004624 00000000000 023116 0 ustar
r_j f d dl mZmZmZmZ G d de Z G d de Zd
dZd
dZd S ) ) CharFieldModel IntegerField CompositeKeyc e Zd Z ed Z ed Z ed Z ed Z G d d ZdS ) IPListRecordFnullc . e Zd ZdZ edddd ZdS )IPListRecord.Meta iplistrecordnetwork_addressnetmaskversion iplist_idN__name__
__module__ __qualname__db_tabler primary_key a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/167_remote_iplist.pyMetar
s- !"l y)[
r r N) r r r r r r r r r r r r r r s "l...Ol&&&Gl&&&G %(((I
r r c X e Zd Z ed Z ed Z G d d ZdS )
IPListPurposeFr c * e Zd ZdZ edd ZdS )IPListPurpose.Meta
iplistpurposepurposer Nr r r r r r s$ ""l9k:: r r N)r r r r r! r r r r r r r r s` iU###G %(((I; ; ; ; ; ; ; ; ; ;r r Fc n | t | t d S )N) create_modelr r )migratordatabasefakekwargss r migrater( s0 ,''' -(((((r c | j d }| | | j d }| | d S )Nr
r )orm remove_model)r$ r% r& r' r r s r rollbackr, sH </L ,''' L 1M -(((((r N)F) peeweer r r r r r r( r, r r r <module>r. s ? ? ? ? ? ? ? ? ? ? ? ?
5
; ; ; ; ;E ; ; ;) ) ) )
) ) ) ) ) )r defence360agent/migrations/__pycache__/168_add_icontact_throttle.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003553 00000000000 025540 0 ustar
r_jp V d dl mZmZmZmZ d dlmZ G d de Zd dZd dZ dS )
) CharFieldCheck IntegerFieldModel)IContactMessageTypec e Zd Z G d d Z ed ed eej eej
f g Z e d Z
dS ) IContactThrottlec e Zd ZdZdS )IContactThrottle.Metaicontact_throttleN)__name__
__module__ __qualname__db_table i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/168_add_icontact_throttle.pyMetar s &r r Tzmessage_type in {}) primary_key constraintsr )defaultN)r
r r r r r formatstrr
MALWARE_FOUNDSCAN_NOT_SCHEDULED message_typer timestampr r r r r s ' ' ' ' ' ' ' ' 9 E$++ / =>> / BCC
L Q'''IIIr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater$ s *+++++r c J | j d }| | d S )Nr )orm remove_model)r r! r" r# r s r rollbackr( s+ |$78 *+++++r N)F)
peeweer r r r defence360agent.contracts.configr r r$ r( r r r <module>r+ s 8 8 8 8 8 8 8 8 8 8 8 8 @ @ @ @ @ @( ( ( ( (u ( ( ((, , , ,, , , , , ,r defence360agent/migrations/__pycache__/168_add_icontact_throttle.cpython-311.pyc 0000644 0000000 0000000 00000003553 00000000000 024601 0 ustar
r_jp V d dl mZmZmZmZ d dlmZ G d de Zd dZd dZ dS )
) CharFieldCheck IntegerFieldModel)IContactMessageTypec e Zd Z G d d Z ed ed eej eej
f g Z e d Z
dS ) IContactThrottlec e Zd ZdZdS )IContactThrottle.Metaicontact_throttleN)__name__
__module__ __qualname__db_table i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/168_add_icontact_throttle.pyMetar s &r r Tzmessage_type in {}) primary_key constraintsr )defaultN)r
r r r r r formatstrr
MALWARE_FOUNDSCAN_NOT_SCHEDULED message_typer timestampr r r r r s ' ' ' ' ' ' ' ' 9 E$++ / =>> / BCC
L Q'''IIIr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater$ s *+++++r c J | j d }| | d S )Nr )orm remove_model)r r! r" r# r s r rollbackr( s+ |$78 *+++++r N)F)
peeweer r r r defence360agent.contracts.configr r r$ r( r r r <module>r+ s 8 8 8 8 8 8 8 8 8 8 8 8 @ @ @ @ @ @( ( ( ( (u ( ( ((, , , ,, , , , , ,r ././@LongLink 0000000 0000000 0000000 00000000161 00000000000 011563 L ustar root root defence360agent/migrations/__pycache__/169_add_record_to_throttle_scan_not_schedule_events.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/169_add_record_to_throttle_scan_not_schedule_events.cpython-30000644 0000000 0000000 00000002457 00000000000 031150 0 ustar
r_j{ * d dl Z d dlmZ ddZddZdS ) N)IContactMessageTypeFc |rd S | j d }| t j t j dz d S )Nicontact_throttlei: ) message_type timestamp)ormcreater SCAN_NOT_SCHEDULEDtime)migratordatabasefakekwargsIContactThrotles /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/169_add_record_to_throttle_scan_not_schedule_events.pymigrater sW l#67O(;)+++ c |rd S | j d }| |j t j k d S )Nr )r deletewherer r r
execute)r r
r r IContactThrottles r rollbackr sZ |$78 ##%)<)OO
giiiiir )F)r defence360agent.contracts.configr r r r r <module>r sR @ @ @ @ @ @ r ././@LongLink 0000000 0000000 0000000 00000000153 00000000000 011564 L ustar root root defence360agent/migrations/__pycache__/169_add_record_to_throttle_scan_not_schedule_events.cpython-311.pyc defence360agent/migrations/__pycache__/169_add_record_to_throttle_scan_not_schedule_events.cpython-30000644 0000000 0000000 00000002457 00000000000 031150 0 ustar
r_j{ * d dl Z d dlmZ ddZddZdS ) N)IContactMessageTypeFc |rd S | j d }| t j t j dz d S )Nicontact_throttlei: ) message_type timestamp)ormcreater SCAN_NOT_SCHEDULEDtime)migratordatabasefakekwargsIContactThrotles /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/169_add_record_to_throttle_scan_not_schedule_events.pymigrater sW l#67O(;)+++ c |rd S | j d }| |j t j k d S )Nr )r deletewherer r r
execute)r r
r r IContactThrottles r rollbackr sZ |$78 ##%)<)OO
giiiiir )F)r defence360agent.contracts.configr r r r r <module>r sR @ @ @ @ @ @ r defence360agent/migrations/__pycache__/170_add_db_fields_to_malware_history.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002075 00000000000 027704 0 ustar
r_j * d dl mZ dddZdddZdS ) ) CharFieldF)fakec | j d }| |t d t d t d d S )Nmalware_historyT)null)db_hostdb_portdb_name)orm
add_fieldsr migratorr ___r s t/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/170_add_db_fields_to_malware_history.pymigrater sc l#45O t$$$t$$$t$$$ c P | j d }| |ddd d S )Nr r r r
)r
remove_fieldsr
s r rollbackr s/ l#45O ?Iy)LLLLLr N)peeweer r r r r <module>r sd % !& M M M M M M Mr defence360agent/migrations/__pycache__/170_add_db_fields_to_malware_history.cpython-311.pyc 0000644 0000000 0000000 00000002075 00000000000 026745 0 ustar
r_j * d dl mZ dddZdddZdS ) ) CharFieldF)fakec | j d }| |t d t d t d d S )Nmalware_historyT)null)db_hostdb_portdb_name)orm
add_fieldsr migratorr ___r s t/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/170_add_db_fields_to_malware_history.pymigrater sc l#45O t$$$t$$$t$$$ c P | j d }| |ddd d S )Nr r r r
)r
remove_fieldsr
s r rollbackr s/ l#45O ?Iy)LLLLLr N)peeweer r r r r <module>r sd % !& M M M M M M Mr defence360agent/migrations/__pycache__/180_move_captcha_configs.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001224 00000000000 025323 0 ustar
r_j d Z ddZddZdS )z
No need to rollback captcha keys config because WebshieldCaptchaKeys plugin
recreates it on the agent start so just stubbing the migration
Fc d S N migratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/180_move_captcha_configs.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r sA r
defence360agent/migrations/__pycache__/180_move_captcha_configs.cpython-311.pyc 0000644 0000000 0000000 00000001224 00000000000 024364 0 ustar
r_j d Z ddZddZdS )z
No need to rollback captcha keys config because WebshieldCaptchaKeys plugin
recreates it on the agent start so just stubbing the migration
Fc d S N migratordatabasefakekwargss h/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/180_move_captcha_configs.pymigrater D c d S r r r s r
rollbackr r r
N)F)__doc__r r r r
r
<module>r sA r
././@LongLink 0000000 0000000 0000000 00000000153 00000000000 011564 L ustar root root defence360agent/migrations/__pycache__/182_remove_constraints_from_icontact_throttle.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/182_remove_constraints_from_icontact_throttle.cpython-311.opt0000644 0000000 0000000 00000003613 00000000000 031020 0 ustar
r_j J d Z ddlmZmZmZ G d de Zd dZd dZdS )
zl
Drop constrains for icontact_throttle.message_type, since correlation server
can set any type (DEF-19971).
) CharField IntegerFieldModelc X e Zd Z G d d Z ed Z ed ZdS )IContactThrottlec e Zd ZdZdS )IContactThrottle.Metaicontact_throttleN)__name__
__module__ __qualname__db_table }/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/182_remove_constraints_from_icontact_throttle.pyMetar s &r r T) primary_keyr )defaultN)r r r
r r message_typer timestampr r r r r s\ ' ' ' ' ' ' ' ' 9...L Q'''IIIr r Fc |rd S | d | t | d | d d S )Nz=ALTER TABLE icontact_throttle RENAME TO icontact_throttle_oldznINSERT INTO icontact_throttle(message_type,timestamp) SELECT message_type,timestamp FROM icontact_throttle_oldz DROP TABLE icontact_throttle_old)sql create_modelr migratordatabasefakekwargss r migrater sv LLG
*+++ LL C
LL344444r c d S )Nr r s r rollbackr! s Dr N)F)__doc__peeweer r r r r r! r r r <module>r$ s 2 1 1 1 1 1 1 1 1 1( ( ( ( (u ( ( ( 5 5 5 5 r defence360agent/migrations/__pycache__/182_remove_constraints_from_icontact_throttle.cpython-311.pyc0000644 0000000 0000000 00000003613 00000000000 031011 0 ustar
r_j J d Z ddlmZmZmZ G d de Zd dZd dZdS )
zl
Drop constrains for icontact_throttle.message_type, since correlation server
can set any type (DEF-19971).
) CharField IntegerFieldModelc X e Zd Z G d d Z ed Z ed ZdS )IContactThrottlec e Zd ZdZdS )IContactThrottle.Metaicontact_throttleN)__name__
__module__ __qualname__db_table }/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/182_remove_constraints_from_icontact_throttle.pyMetar s &r r T) primary_keyr )defaultN)r r r
r r message_typer timestampr r r r r s\ ' ' ' ' ' ' ' ' 9...L Q'''IIIr r Fc |rd S | d | t | d | d d S )Nz=ALTER TABLE icontact_throttle RENAME TO icontact_throttle_oldznINSERT INTO icontact_throttle(message_type,timestamp) SELECT message_type,timestamp FROM icontact_throttle_oldz DROP TABLE icontact_throttle_old)sql create_modelr migratordatabasefakekwargss r migrater sv LLG
*+++ LL C
LL344444r c d S )Nr r s r rollbackr! s Dr N)F)__doc__peeweer r r r r r! r r r <module>r$ s 2 1 1 1 1 1 1 1 1 1( ( ( ( (u ( ( ( 5 5 5 5 r defence360agent/migrations/__pycache__/183_add_user_field_to_malware_scans.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001741 00000000000 027523 0 ustar
r_j * d dl mZ dddZdddZdS ) ) CharFieldF)fakec r |rd S | j d }| |t d d S )N
malware_scansT)null) initiator)orm
add_fieldsr migratorr ___r s s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/183_add_user_field_to_malware_scans.pymigrater sS L 1M &&& c T |rd S | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s7 L 1M =+66666r N)peeweer r r r r <module>r s] % !& 7 7 7 7 7 7 7r defence360agent/migrations/__pycache__/183_add_user_field_to_malware_scans.cpython-311.pyc 0000644 0000000 0000000 00000001741 00000000000 026564 0 ustar
r_j * d dl mZ dddZdddZdS ) ) CharFieldF)fakec r |rd S | j d }| |t d d S )N
malware_scansT)null) initiator)orm
add_fieldsr migratorr ___r s s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/183_add_user_field_to_malware_scans.pymigrater sS L 1M &&& c T |rd S | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s7 L 1M =+66666r N)peeweer r r r r <module>r s] % !& 7 7 7 7 7 7 7r ././@LongLink 0000000 0000000 0000000 00000000154 00000000000 011565 L ustar root root defence360agent/migrations/__pycache__/184_create_a_table_for_secure_site_permissions.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/184_create_a_table_for_secure_site_permissions.cpython-311.op0000644 0000000 0000000 00000002704 00000000000 030663 0 ustar
r_j B d dl Z G d dej ZddZd ZdS ) Nc e Zd Z G d d Z ej d Z ej d ej d gd Z d S )
SecureSitec e Zd ZdZdS )SecureSite.Meta secure_siteN)__name__
__module__ __qualname__db_table ~/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/184_create_a_table_for_secure_site_permissions.pyMetar s r
r T)uniqueFz$subscription_type in ('basic','pro')basic)null constraintsdefaultN)
r r r
r pw CharFielduser TextFieldChecksubscription_typer r
r r r s ! ! ! ! ! ! ! ! 2<t $ $ $D$
RX DEEF r
r Fc B |rd S | t d S )N) create_modelr )migrator_dbfake__s r migrater! s) *%%%%%r
c dS )z
Not supportedNr )_r s r rollbackr$ s r
)F)peeweer Modelr r! r$ r r
r <module>r' sj & & & & r
././@LongLink 0000000 0000000 0000000 00000000146 00000000000 011566 L ustar root root defence360agent/migrations/__pycache__/184_create_a_table_for_secure_site_permissions.cpython-311.pyc defence360agent/migrations/__pycache__/184_create_a_table_for_secure_site_permissions.cpython-311.py0000644 0000000 0000000 00000002704 00000000000 030675 0 ustar
r_j B d dl Z G d dej ZddZd ZdS ) Nc e Zd Z G d d Z ej d Z ej d ej d gd Z d S )
SecureSitec e Zd ZdZdS )SecureSite.Meta secure_siteN)__name__
__module__ __qualname__db_table ~/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/184_create_a_table_for_secure_site_permissions.pyMetar s r
r T)uniqueFz$subscription_type in ('basic','pro')basic)null constraintsdefaultN)
r r r
r pw CharFielduser TextFieldChecksubscription_typer r
r r r s ! ! ! ! ! ! ! ! 2<t $ $ $D$
RX DEEF r
r Fc B |rd S | t d S )N) create_modelr )migrator_dbfake__s r migrater! s) *%%%%%r
c dS )z
Not supportedNr )_r s r rollbackr$ s r
)F)peeweer Modelr r! r$ r r
r <module>r' sj & & & & r
defence360agent/migrations/__pycache__/185_delete_all_secure_site_id.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002421 00000000000 026327 0 ustar
r_j H d dl Z d dlmZ e j e ZddZd ZdS ) N)PathFc |rd S t d d }|D ],}| s| d -d S # t $ r t
d Y d S w xY w)N/zhome*/*/.secure_site_idT)
missing_okz:An exception occurred while deleting .secure_site_id files)r glob
is_symlinkunlink Exceptionlogger exception)migrator_dbfake__id_filesid_files m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/185_delete_all_secure_site_id.pymigrater s
99>>";<< 0 0G%%''
0$/// 0 0
H
s AA $B Bc dS )z
Not supportedN )_r s r rollbackr s )F)loggingpathlibr getLogger__name__r r r r r r <module>r s_ 8 $ $
r defence360agent/migrations/__pycache__/185_delete_all_secure_site_id.cpython-311.pyc 0000644 0000000 0000000 00000002421 00000000000 025370 0 ustar
r_j H d dl Z d dlmZ e j e ZddZd ZdS ) N)PathFc |rd S t d d }|D ],}| s| d -d S # t $ r t
d Y d S w xY w)N/zhome*/*/.secure_site_idT)
missing_okz:An exception occurred while deleting .secure_site_id files)r glob
is_symlinkunlink Exceptionlogger exception)migrator_dbfake__id_filesid_files m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/185_delete_all_secure_site_id.pymigrater s
99>>";<< 0 0G%%''
0$/// 0 0
H
s AA $B Bc dS )z
Not supportedN )_r s r rollbackr s )F)loggingpathlibr getLogger__name__r r r r r r <module>r s_ 8 $ $
r defence360agent/migrations/__pycache__/186_add_user_field_to_icontact_throttle.cpython-311.opt-1.pyc0000644 0000000 0000000 00000006346 00000000000 030446 0 ustar
r_j> 6 d dl mZmZmZmZ dddZdddZdS ) ) CompositeKeyModel CharField IntegerFieldF)fakec @ |rd S | j d } G d dt }| |t d | | | d | d | d d S )
Nicontact_throttlec l e Zd Z G d d Z e Z ed Z ed ZdS )$migrate.<locals>.TmpIContactThrottlec * e Zd ZdZ edd ZdS ))migrate.<locals>.TmpIContactThrottle.Metatmp_icontact_throttle message_typeuserN)__name__
__module__ __qualname__db_tabler primary_key w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/186_add_user_field_to_icontact_throttle.pyMetar
s$ .H&,~v>>KKKr r Tnullr defaultN) r r r r r r r r timestampr r r TmpIContactThrottler
sg ? ? ? ? ? ? ? ? !y{{ yd### L+++ r r Tr )r z}INSERT INTO tmp_icontact_throttle (message_type, user, timestamp) SELECT message_type, user, timestamp FROM icontact_throttle DROP TABLE icontact_throttle=ALTER TABLE tmp_icontact_throttle RENAME TO icontact_throttle)ormr
add_fieldsr create_modelsql)migratorr ___r r s r migrater) s %89, , , , ,e , , ,
D
!
!
!
-... LL F
LL/000 LLG r c |rd S G d dt }| | | d | d | d d S )Nc X e Zd Z G d d Z ed Z ed ZdS )%rollback.<locals>.TmpIContactThrottlec e Zd ZdZdS )*rollback.<locals>.TmpIContactThrottle.Metar N)r r r r r r r r r. ) s *HHHr r T)r r r N)r r r r r r r r r r r r r, ( s\ + + + + + + + + !yT222 L+++ r r zqINSERT INTO tmp_icontact_throttle (message_type, timestamp) SELECT message_type, timestamp FROM icontact_throttler r! )r r$ r% )r& r r' r( r s r rollbackr/ $ s , , , , ,e , , ,
-... LL @
LL/000 LLG r N)peeweer r r r r) r/ r r r <module>r1 sp ? ? ? ? ? ? ? ? ? ? ? ? % @ !& r defence360agent/migrations/__pycache__/186_add_user_field_to_icontact_throttle.cpython-311.pyc 0000644 0000000 0000000 00000006346 00000000000 027507 0 ustar
r_j> 6 d dl mZmZmZmZ dddZdddZdS ) ) CompositeKeyModel CharField IntegerFieldF)fakec @ |rd S | j d } G d dt }| |t d | | | d | d | d d S )
Nicontact_throttlec l e Zd Z G d d Z e Z ed Z ed ZdS )$migrate.<locals>.TmpIContactThrottlec * e Zd ZdZ edd ZdS ))migrate.<locals>.TmpIContactThrottle.Metatmp_icontact_throttle message_typeuserN)__name__
__module__ __qualname__db_tabler primary_key w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/186_add_user_field_to_icontact_throttle.pyMetar
s$ .H&,~v>>KKKr r Tnullr defaultN) r r r r r r r r timestampr r r TmpIContactThrottler
sg ? ? ? ? ? ? ? ? !y{{ yd### L+++ r r Tr )r z}INSERT INTO tmp_icontact_throttle (message_type, user, timestamp) SELECT message_type, user, timestamp FROM icontact_throttle DROP TABLE icontact_throttle=ALTER TABLE tmp_icontact_throttle RENAME TO icontact_throttle)ormr
add_fieldsr create_modelsql)migratorr ___r r s r migrater) s %89, , , , ,e , , ,
D
!
!
!
-... LL F
LL/000 LLG r c |rd S G d dt }| | | d | d | d d S )Nc X e Zd Z G d d Z ed Z ed ZdS )%rollback.<locals>.TmpIContactThrottlec e Zd ZdZdS )*rollback.<locals>.TmpIContactThrottle.Metar N)r r r r r r r r r. ) s *HHHr r T)r r r N)r r r r r r r r r r r r r, ( s\ + + + + + + + + !yT222 L+++ r r zqINSERT INTO tmp_icontact_throttle (message_type, timestamp) SELECT message_type, timestamp FROM icontact_throttler r! )r r$ r% )r& r r' r( r s r rollbackr/ $ s , , , , ,e , , ,
-... LL @
LL/000 LLG r N)peeweer r r r r) r/ r r r <module>r1 sp ? ? ? ? ? ? ? ? ? ? ? ? % @ !& r defence360agent/migrations/__pycache__/187_fix_scan_unserialization.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007125 00000000000 026271 0 ustar
r_j d Z ddlZddlZddlZddlmZ ej e Z ed Z dZ
dZ G d dej Z
d Zd
d d Zd
d d
ZdS )zZ
Used to fix issue with inability to unserialize stored scans.
See DEF-23121 for details.
N)Pathz$/var/imunify360/aibolit/scans.picklezim360.malwarelibzimav.malwarelibc e Zd Z fdZ xZS ) AVUnpicklerc $ t || S # t $ r` | t rDt j | t t }t || cY S w xY wN)
super
find_classModuleNotFoundError
startswithIM360_MALWARELIB importlib
import_modulereplace
AV_MALWARELIBgetattr)selfmodulename av_module __class__s l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/187_fix_scan_unserialization.pyr zAVUnpickler.find_class s 77%%fd33 3" !122
0 % 3NN#3]CC y$/////
s !% A&B
B)__name__
__module__ __qualname__r
__classcell__)r s @r r r s8 r c | |j dz }| d 5 }t j | | d d d n # 1 swxY w Y | | d S )Nz.tempwb) with_namer openpickledumpr )objpath temp_pathfs r r" r" s ty7 233I C ds AA AF)fakec |st sd S t t v r t d 5 }t
| }d d d n # 1 swxY w Y t |t d S # t $ r,}t dt | Y d }~d S d }~ww xY wd S )Nrbz"Failed to load pickle scans %s: %s)
SCANS_PATHexistsr encode
read_bytesr r loadr" Exceptionlogger exception)migratorr' ___r& r# excs r migrater6 ' sC :$$&& J$9$9$;$;;; " &&
,!!!nn))++
,
,
,
,
,
,
,
,
,
,
,
,
,
,
,
j ! ! ! ! ! 4j#
<;s< B; +"B
B; B B; B !B; ;
C1!C,,C1c d S r )r2 r' r3 r4 s r rollbackr9 7 s Dr )__doc__r
loggingr! pathlibr getLoggerr r0 r* r r Unpicklerr r" r6 r9 r8 r r <module>r? s
8 $ $
T8
9
9
% !
&"
%
"
"
"
"
" !& r defence360agent/migrations/__pycache__/187_fix_scan_unserialization.cpython-311.pyc 0000644 0000000 0000000 00000007125 00000000000 025332 0 ustar
r_j d Z ddlZddlZddlZddlmZ ej e Z ed Z dZ
dZ G d dej Z
d Zd
d d Zd
d d
ZdS )zZ
Used to fix issue with inability to unserialize stored scans.
See DEF-23121 for details.
N)Pathz$/var/imunify360/aibolit/scans.picklezim360.malwarelibzimav.malwarelibc e Zd Z fdZ xZS ) AVUnpicklerc $ t || S # t $ r` | t rDt j | t t }t || cY S w xY wN)
super
find_classModuleNotFoundError
startswithIM360_MALWARELIB importlib
import_modulereplace
AV_MALWARELIBgetattr)selfmodulename av_module __class__s l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/187_fix_scan_unserialization.pyr zAVUnpickler.find_class s 77%%fd33 3" !122
0 % 3NN#3]CC y$/////
s !% A&B
B)__name__
__module__ __qualname__r
__classcell__)r s @r r r s8 r c | |j dz }| d 5 }t j | | d d d n # 1 swxY w Y | | d S )Nz.tempwb) with_namer openpickledumpr )objpath temp_pathfs r r" r" s ty7 233I C ds AA AF)fakec |st sd S t t v r t d 5 }t
| }d d d n # 1 swxY w Y t |t d S # t $ r,}t dt | Y d }~d S d }~ww xY wd S )Nrbz"Failed to load pickle scans %s: %s)
SCANS_PATHexistsr encode
read_bytesr r loadr" Exceptionlogger exception)migratorr' ___r& r# excs r migrater6 ' sC :$$&& J$9$9$;$;;; " &&
,!!!nn))++
,
,
,
,
,
,
,
,
,
,
,
,
,
,
,
j ! ! ! ! ! 4j#
<;s< B; +"B
B; B B; B !B; ;
C1!C,,C1c d S r )r2 r' r3 r4 s r rollbackr9 7 s Dr )__doc__r
loggingr! pathlibr getLoggerr r0 r* r r Unpicklerr r" r6 r9 r8 r r <module>r? s
8 $ $
T8
9
9
% !
&"
%
"
"
"
"
" !& r ././@LongLink 0000000 0000000 0000000 00000000147 00000000000 011567 L ustar root root defence360agent/migrations/__pycache__/188_add_protection_status_field_myimunify.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/188_add_protection_status_field_myimunify.cpython-311.opt-1.p0000644 0000000 0000000 00000002601 00000000000 030510 0 ustar
r_j F d dl mZmZmZ G d de ZddZddZdS ) ) BooleanField CharFieldModelc Z e Zd Z G d d Z ed Z edd ZdS ) MyImunifyc e Zd ZdZdS )MyImunify.Meta myimunifyN)__name__
__module__ __qualname__db_table y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/188_add_protection_status_field_myimunify.pyMetar s r r T)uniqueF)nulldefaultN)r r r
r r userr
protectionr r r r r s^ 9D ! ! !D 5%888JJJr r Fc B |rd S | t d S N) create_modelr migrator_dbfake__s r migrater ) )$$$$$r c B |rd S | t d S r ) remove_modelr r s r rollbackr$ r! r N)F)peeweer r r r r r$ r r r <module>r& s 1 1 1 1 1 1 1 1 1 19 9 9 9 9 9 9 9% % % % % % % % % %r defence360agent/migrations/__pycache__/188_add_protection_status_field_myimunify.cpython-311.pyc 0000644 0000000 0000000 00000002601 00000000000 030105 0 ustar
r_j F d dl mZmZmZ G d de ZddZddZdS ) ) BooleanField CharFieldModelc Z e Zd Z G d d Z ed Z edd ZdS ) MyImunifyc e Zd ZdZdS )MyImunify.Meta myimunifyN)__name__
__module__ __qualname__db_table y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/188_add_protection_status_field_myimunify.pyMetar s r r T)uniqueF)nulldefaultN)r r r
r r userr
protectionr r r r r s^ 9D ! ! !D 5%888JJJr r Fc B |rd S | t d S N) create_modelr migrator_dbfake__s r migrater ) )$$$$$r c B |rd S | t d S r ) remove_modelr r s r rollbackr$ r! r N)F)peeweer r r r r r$ r r r <module>r& s 1 1 1 1 1 1 1 1 1 19 9 9 9 9 9 9 9% % % % % % % % % %r defence360agent/migrations/__pycache__/189_add_messages_to_send_nr.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002667 00000000000 026040 0 ustar
r_j F d dl mZmZmZ G d de ZddZddZdS ) )
FloatFieldModel BlobFieldc X e Zd Z G d d Z ed Z ed ZdS )
MessageToSendc e Zd ZdZdS )MessageToSend.Metamessages_to_send_nrN)__name__
__module__ __qualname__db_table k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/189_add_messages_to_send_nr.pyMetar s (r r F)nullN)r r r
r r timestampr messager r r r r s\ ) ) ) ) ) ) ) )
&&&IiU###GGGr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater s -(((((r c J | j d }| | d S )Nmessages_to_send)orm
drop_model)r r r r r s r rollbackr! s) L!34M
&&&&&r N)F)peeweer r r r r r! r r r <module>r# s / / / / / / / / / /$ $ $ $ $E $ $ $) ) ) )' ' ' ' ' 'r defence360agent/migrations/__pycache__/189_add_messages_to_send_nr.cpython-311.pyc 0000644 0000000 0000000 00000002667 00000000000 025101 0 ustar
r_j F d dl mZmZmZ G d de ZddZddZdS ) )
FloatFieldModel BlobFieldc X e Zd Z G d d Z ed Z ed ZdS )
MessageToSendc e Zd ZdZdS )MessageToSend.Metamessages_to_send_nrN)__name__
__module__ __qualname__db_table k/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/189_add_messages_to_send_nr.pyMetar s (r r F)nullN)r r r
r r timestampr messager r r r r s\ ) ) ) ) ) ) ) )
&&&IiU###GGGr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater s -(((((r c J | j d }| | d S )Nmessages_to_send)orm
drop_model)r r r r r s r rollbackr! s) L!34M
&&&&&r N)F)peeweer r r r r r! r r r <module>r# s / / / / / / / / / /$ $ $ $ $E $ $ $) ) ) )' ' ' ' ' 'r defence360agent/migrations/__pycache__/190_add_analyst_cleanup_request_table.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004536 00000000000 030105 0 ustar
r_jx b d dl mZmZmZmZmZmZ d dlmZmZ G d de Z d dZ
d dZ dS )
)Model AutoField CharField TextFieldTimestampFieldCheck)datetimetimezonec 8 e Zd ZdZ G d d Z e Z ed Z ed Z e
d Z e d e
j ej Z edd ed g Z e d e
j ej Zd
S ) AnalystCleanupRequestz
Model for storing analyst cleanup requests.
Tracks request details and status for each cleanup request submitted.
c e Zd ZdZdS )AnalystCleanupRequest.Metaanalyst_cleanup_requestsN)__name__
__module__ __qualname__db_table u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/190_add_analyst_cleanup_request_table.pyMetar s -r r F)null)r defaultpendingz/status in ('pending','in_progress','completed'))r r constraintsN)r r r __doc__r r idr username
zendesk_idr ticket_linkr r nowr
utc
created_atr status last_updatedr r r r r s
. . . . . . . .
Bye$$$H&&&J)'''K ULHL 4N4NOOOJ
Y
ULMMN F
">
LHL 6 6 LLLr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater, $ s /00000r c J | j d }| | d S )Nr )orm
drop_model)r( r) r* r+ analyst_cleanup_requests r rollbackr1 ( s+ &l+E F /00000r N)F) peeweer r r r r r r r
r r, r1 r r r <module>r3 s ( ' ' ' ' ' ' ' E 01 1 1 11 1 1 1 1 1r defence360agent/migrations/__pycache__/190_add_analyst_cleanup_request_table.cpython-311.pyc 0000644 0000000 0000000 00000004536 00000000000 027146 0 ustar
r_jx b d dl mZmZmZmZmZmZ d dlmZmZ G d de Z d dZ
d dZ dS )
)Model AutoField CharField TextFieldTimestampFieldCheck)datetimetimezonec 8 e Zd ZdZ G d d Z e Z ed Z ed Z e
d Z e d e
j ej Z edd ed g Z e d e
j ej Zd
S ) AnalystCleanupRequestz
Model for storing analyst cleanup requests.
Tracks request details and status for each cleanup request submitted.
c e Zd ZdZdS )AnalystCleanupRequest.Metaanalyst_cleanup_requestsN)__name__
__module__ __qualname__db_table u/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/190_add_analyst_cleanup_request_table.pyMetar s -r r F)null)r defaultpendingz/status in ('pending','in_progress','completed'))r r constraintsN)r r r __doc__r r idr username
zendesk_idr ticket_linkr r nowr
utc
created_atr status last_updatedr r r r r s
. . . . . . . .
Bye$$$H&&&J)'''K ULHL 4N4NOOOJ
Y
ULMMN F
">
LHL 6 6 LLLr r Fc : | t d S )N) create_modelr )migratordatabasefakekwargss r migrater, $ s /00000r c J | j d }| | d S )Nr )orm
drop_model)r( r) r* r+ analyst_cleanup_requests r rollbackr1 ( s+ &l+E F /00000r N)F) peeweer r r r r r r r
r r, r1 r r r <module>r3 s ( ' ' ' ' ' ' ' E 01 1 1 11 1 1 1 1 1r defence360agent/migrations/__pycache__/191_create_wordpress_incident_table.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005222 00000000000 027565 0 ustar
r_j6 T d Z ddlZddlmZ G d dej Zd dZd dZdS )
zCreate wordpress_incident table for WordPress CVE protection incidents.
This migration creates a dedicated table for WordPress incidents rather than
using the generic incident table. This allows for better separation of concerns
and cleaner data model.
N) JSONFieldc e Zd Z ej dd Z ej d Z ej d Z ej d Z
ej d Z ej d Z ej d Z
ej d Z ej d Z ej dd Z ej dd Z ed Z ej dd Z G d d
ZdS ) WordpressIncidentT) primary_keynull)r
country_id)r column_nameN)r defaultFc e Zd ZdZdS )WordpressIncident.Metawordpress_incidentN)__name__
__module__ __qualname__db_table s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/191_create_wordpress_incident_table.pyMetar s 'r r )r r r pw IntegerFieldid CharFieldpluginrule
FloatField timestampretriesseverityname TextField descriptionabusercountrydomainr
extra_info BooleanFieldsent_to_serverr r r r r r sF T 5 5 5B
R\t
$
$
$F 2<T " " "D
4(((I bo4(((G rD)))H 2<T " " "D ",D)))K
R\t
$
$
$Fbl,???G
R\tT
2
2
2F%%%J$R_%???N( ( ( ( ( ( ( ( ( (r r Fc t | t | t dd d S )Nr F)unique) create_modelr add_indexmigratordatabasefakekwargss r migrater2 s; +,,,
(+eDDDDDr c > | t d d S )NT)cascade) remove_modelr r- s r rollbackr6 & s" +T:::::r )F) __doc__peeweer playhouse.sqlite_extr Modelr r2 r6 r r r <module>r; s * * * * * *( ( ( ( ( ( ( (&E E E E; ; ; ; ; ;r defence360agent/migrations/__pycache__/191_create_wordpress_incident_table.cpython-311.pyc 0000644 0000000 0000000 00000005222 00000000000 026626 0 ustar
r_j6 T d Z ddlZddlmZ G d dej Zd dZd dZdS )
zCreate wordpress_incident table for WordPress CVE protection incidents.
This migration creates a dedicated table for WordPress incidents rather than
using the generic incident table. This allows for better separation of concerns
and cleaner data model.
N) JSONFieldc e Zd Z ej dd Z ej d Z ej d Z ej d Z
ej d Z ej d Z ej d Z
ej d Z ej d Z ej dd Z ej dd Z ed Z ej dd Z G d d
ZdS ) WordpressIncidentT) primary_keynull)r
country_id)r column_nameN)r defaultFc e Zd ZdZdS )WordpressIncident.Metawordpress_incidentN)__name__
__module__ __qualname__db_table s/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/191_create_wordpress_incident_table.pyMetar s 'r r )r r r pw IntegerFieldid CharFieldpluginrule
FloatField timestampretriesseverityname TextField descriptionabusercountrydomainr
extra_info BooleanFieldsent_to_serverr r r r r r sF T 5 5 5B
R\t
$
$
$F 2<T " " "D
4(((I bo4(((G rD)))H 2<T " " "D ",D)))K
R\t
$
$
$Fbl,???G
R\tT
2
2
2F%%%J$R_%???N( ( ( ( ( ( ( ( ( (r r Fc t | t | t dd d S )Nr F)unique) create_modelr add_indexmigratordatabasefakekwargss r migrater2 s; +,,,
(+eDDDDDr c > | t d d S )NT)cascade) remove_modelr r- s r rollbackr6 & s" +T:::::r )F) __doc__peeweer playhouse.sqlite_extr Modelr r2 r6 r r r <module>r; s * * * * * *( ( ( ( ( ( ( (&E E E E; ; ; ; ; ;r defence360agent/migrations/__pycache__/192_add_wordpress_incident_unique_index.cpython-311.opt-1.pyc0000644 0000000 0000000 00000002550 00000000000 030462 0 ustar
r_jS d Z ddZddZdS )a Add unique composite index to wordpress_incident table for deduplication.
This migration adds a unique index on the fields used to identify duplicate
incidents (abuser, name, plugin, rule, severity, domain), similar to the
aggregation key used in the resident agent's aggregate plugin.
Fc
Z | j d }| |ddddddd d
S ) z6Add unique composite index for incident deduplication.wordpress_incidentabusernamepluginruleseveritydomainT)uniqueN)orm add_indexmigratordatabasefakekwargsWordpressIncidents w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/192_add_wordpress_incident_unique_index.pymigrater sQ %9:
c V | j d }| |dddddd dS ) z"Remove the unique composite index.r r r r r r r N)r
drop_indexr
s r rollbackr sG %9: r N)F)__doc__r r r r <module>r sA $ r defence360agent/migrations/__pycache__/192_add_wordpress_incident_unique_index.cpython-311.pyc 0000644 0000000 0000000 00000002550 00000000000 027523 0 ustar
r_jS d Z ddZddZdS )a Add unique composite index to wordpress_incident table for deduplication.
This migration adds a unique index on the fields used to identify duplicate
incidents (abuser, name, plugin, rule, severity, domain), similar to the
aggregation key used in the resident agent's aggregate plugin.
Fc
Z | j d }| |ddddddd d
S ) z6Add unique composite index for incident deduplication.wordpress_incidentabusernamepluginruleseveritydomainT)uniqueN)orm add_indexmigratordatabasefakekwargsWordpressIncidents w/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/192_add_wordpress_incident_unique_index.pymigrater sQ %9:
c V | j d }| |dddddd dS ) z"Remove the unique composite index.r r r r r r r N)r
drop_indexr
s r rollbackr sG %9: r N)F)__doc__r r r r <module>r sA $ r ././@LongLink 0000000 0000000 0000000 00000000157 00000000000 011570 L ustar root root defence360agent/migrations/__pycache__/193_remove_sent_to_server_from_wordpress_incident.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/193_remove_sent_to_server_from_wordpress_incident.cpython-3110000644 0000000 0000000 00000002207 00000000000 031065 0 ustar
r_jM " d Z ddlZddZddZdS )zRemove sent_to_server column from wordpress_incident table.
The sent_to_server field is no longer needed for WordPress incident tracking.
NFc L | j d }| |d d S )Nwordpress_incidentsent_to_server)orm
remove_fieldsmigratordatabasefakekwargsWordpressIncidents /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/193_remove_sent_to_server_from_wordpress_incident.pymigrater s. %9: ,.>????? c v | j d }| |t j dd d S )Nr F)nulldefault)r )r
add_fieldspw BooleanFieldr s r rollbackr sL %9: E5AAA r )F)__doc__peeweer r r r r <module>r sS
@ @ @ @
r ././@LongLink 0000000 0000000 0000000 00000000151 00000000000 011562 L ustar root root defence360agent/migrations/__pycache__/193_remove_sent_to_server_from_wordpress_incident.cpython-311.pyc defence360agent/migrations/__pycache__/193_remove_sent_to_server_from_wordpress_incident.cpython-3110000644 0000000 0000000 00000002207 00000000000 031065 0 ustar
r_jM " d Z ddlZddZddZdS )zRemove sent_to_server column from wordpress_incident table.
The sent_to_server field is no longer needed for WordPress incident tracking.
NFc L | j d }| |d d S )Nwordpress_incidentsent_to_server)orm
remove_fieldsmigratordatabasefakekwargsWordpressIncidents /opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/193_remove_sent_to_server_from_wordpress_incident.pymigrater s. %9: ,.>????? c v | j d }| |t j dd d S )Nr F)nulldefault)r )r
add_fieldspw BooleanFieldr s r rollbackr sL %9: E5AAA r )F)__doc__peeweer r r r r <module>r sS
@ @ @ @
r defence360agent/migrations/__pycache__/194_add_wp_disabled_rules.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004043 00000000000 025470 0 ustar
r_j " d Z ddlZddZddZdS )zAdd wp_disabled_rules table for WordPress-specific disabled rules.
This table stores disabled WordPress protection rules with a scope-based design
supporting global and domain-level disables.
NFc ` G d dt j }| | d S )Nc e Zd Z G d d Z ej Z ej d Z ej d Z ej d Z
ej d Z ej d Z
ej d ZdS ) migrate.<locals>.WPDisabledRulec e Zd ZdZdZdS )$migrate.<locals>.WPDisabledRule.Metawp_disabled_rules)))rule_idscope scope_valueTN)__name__
__module__ __qualname__db_tableindexes i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/194_add_wp_disabled_rules.pyMetar s *HDGGGr r F)nullTN)r r
r r pwPrimaryKeyFieldid CharFieldr r
r
FloatField disabled_atsource IntegerFieldcreated_by_user_idr r r WPDisabledRuler s E E E E E E E E R
!
! ",E*** %((("bl--- #bm/// 5))) ,R_% 8 8 8r r )r Model create_modelmigratordatabasefakekwargsr s r migrater'
sJ 9 9 9 9 9 9 9 9
.)))))r c J | j d }| | d S )Nr )orm remove_modelr" s r rollbackr+ s) \"56N .)))))r )F)__doc__peeweer r' r+ r r r <module>r. sO * * * *"* * * * * *r defence360agent/migrations/__pycache__/194_add_wp_disabled_rules.cpython-311.pyc 0000644 0000000 0000000 00000004043 00000000000 024531 0 ustar
r_j " d Z ddlZddZddZdS )zAdd wp_disabled_rules table for WordPress-specific disabled rules.
This table stores disabled WordPress protection rules with a scope-based design
supporting global and domain-level disables.
NFc ` G d dt j }| | d S )Nc e Zd Z G d d Z ej Z ej d Z ej d Z ej d Z
ej d Z ej d Z
ej d ZdS ) migrate.<locals>.WPDisabledRulec e Zd ZdZdZdS )$migrate.<locals>.WPDisabledRule.Metawp_disabled_rules)))rule_idscope scope_valueTN)__name__
__module__ __qualname__db_tableindexes i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/194_add_wp_disabled_rules.pyMetar s *HDGGGr r F)nullTN)r r
r r pwPrimaryKeyFieldid CharFieldr r
r
FloatField disabled_atsource IntegerFieldcreated_by_user_idr r r WPDisabledRuler s E E E E E E E E R
!
! ",E*** %((("bl--- #bm/// 5))) ,R_% 8 8 8r r )r Model create_modelmigratordatabasefakekwargsr s r migrater'
sJ 9 9 9 9 9 9 9 9
.)))))r c J | j d }| | d S )Nr )orm remove_modelr" s r rollbackr+ s) \"56N .)))))r )F)__doc__peeweer r' r+ r r r <module>r. sO * * * *"* * * * * *r defence360agent/migrations/__pycache__/194_create_nonprivileged_config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002476 00000000000 026716 0 ustar
r_j N d Z ddlZddlmZ ej e ZddZddZdS )z[
Create imunify360-merged-nonprivileged.config with settings needed by non-root processes.
N)MergerFc |rd S t j t d d S # t $ r&}t d| Y d }~d S d }~ww xY w)Nz)Successfully created nonprivileged configz)Failed to create nonprivileged config: %s)r update_merged_configloggerinfo Exceptionerror)migratordatabasefakekwargsexcs o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/194_create_nonprivileged_config.pymigrater s
#%%% ?@@@@@
7
s -5
A%A A%c d S )N )r
r r r
s r rollbackr s D )F) __doc__logging defence360agent.contracts.configr getLogger__name__r r r r r r <module>r sp 3 3 3 3 3 3 8 $ $
" r defence360agent/migrations/__pycache__/194_create_nonprivileged_config.cpython-311.pyc 0000644 0000000 0000000 00000002476 00000000000 025757 0 ustar
r_j N d Z ddlZddlmZ ej e ZddZddZdS )z[
Create imunify360-merged-nonprivileged.config with settings needed by non-root processes.
N)MergerFc |rd S t j t d d S # t $ r&}t d| Y d }~d S d }~ww xY w)Nz)Successfully created nonprivileged configz)Failed to create nonprivileged config: %s)r update_merged_configloggerinfo Exceptionerror)migratordatabasefakekwargsexcs o/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/194_create_nonprivileged_config.pymigrater s
#%%% ?@@@@@
7
s -5
A%A A%c d S )N )r
r r r
s r rollbackr s D )F) __doc__logging defence360agent.contracts.configr getLogger__name__r r r r r r <module>r sp 3 3 3 3 3 3 8 $ $
" r defence360agent/migrations/__pycache__/195_create_wordpress_site.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003066 00000000000 025575 0 ustar
r_jm J d Z ddlmZmZmZ G d de Zd dZd dZdS )
zCreate wordpress_site table.
migrator.create_model() emits CREATE TABLE IF NOT EXISTS, so this is a
no-op on installs where imav/014 (now retained as a no-op) had already
created the table.
) IntegerField CharFieldModelc r e Zd Z G d d Z edd Z ed Z ed ZdS )
WordpressSitec e Zd ZdZdS )WordpressSite.Metawordpress_siteN)__name__
__module__ __qualname__db_table i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/195_create_wordpress_site.pyMetar s #r r TF) primary_keynull)r N) r r r
r r docrootdomainr uidr r r r r sp $ $ $ $ $ $ $ $ iDu555G
YE
"
"
"F
,E
"
"
"CCCr r Fc : | t d S N) create_modelr migratordatabasefakekwargss r migrater s -(((((r c d S r r r s r rollbackr" s Dr N)F)__doc__peeweer r r r r r" r r r <module>r% s 2 1 1 1 1 1 1 1 1 1# # # # #E # # #) ) ) ) r defence360agent/migrations/__pycache__/195_create_wordpress_site.cpython-311.pyc 0000644 0000000 0000000 00000003066 00000000000 024636 0 ustar
r_jm J d Z ddlmZmZmZ G d de Zd dZd dZdS )
zCreate wordpress_site table.
migrator.create_model() emits CREATE TABLE IF NOT EXISTS, so this is a
no-op on installs where imav/014 (now retained as a no-op) had already
created the table.
) IntegerField CharFieldModelc r e Zd Z G d d Z edd Z ed Z ed ZdS )
WordpressSitec e Zd ZdZdS )WordpressSite.Metawordpress_siteN)__name__
__module__ __qualname__db_table i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/195_create_wordpress_site.pyMetar s #r r TF) primary_keynull)r N) r r r
r r docrootdomainr uidr r r r r sp $ $ $ $ $ $ $ $ iDu555G
YE
"
"
"F
,E
"
"
"CCCr r Fc : | t d S N) create_modelr migratordatabasefakekwargss r migrater s -(((((r c d S r r r s r rollbackr" s Dr N)F)__doc__peeweer r r r r r" r r r <module>r% s 2 1 1 1 1 1 1 1 1 1# # # # #E # # #) ) ) ) r defence360agent/migrations/__pycache__/196_add_disabled_rules_sync_ts.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002141 00000000000 026523 0 ustar
r_j7 & d Z ddlmZ ddZddZdS )zzAdd disabled_rules_sync_ts field to wordpress_site table.
Tracks when disabled-rules.php was last written for each site.
)
FloatFieldFc l | j d }| |t dd d S )Nwordpress_siteT)nulldefault)disabled_rules_sync_ts)orm
add_fieldsr migratordatabasefakekwargs
WordpressSites n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/196_add_disabled_rules_sync_ts.pymigrater sI L!12M )tT B B B c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s, L!12M =*BCCCCCr N)F)__doc__peeweer r r r r <module>r s[
D D D D D Dr defence360agent/migrations/__pycache__/196_add_disabled_rules_sync_ts.cpython-311.pyc 0000644 0000000 0000000 00000002141 00000000000 025564 0 ustar
r_j7 & d Z ddlmZ ddZddZdS )zzAdd disabled_rules_sync_ts field to wordpress_site table.
Tracks when disabled-rules.php was last written for each site.
)
FloatFieldFc l | j d }| |t dd d S )Nwordpress_siteT)nulldefault)disabled_rules_sync_ts)orm
add_fieldsr migratordatabasefakekwargs
WordpressSites n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/196_add_disabled_rules_sync_ts.pymigrater sI L!12M )tT B B B c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr s, L!12M =*BCCCCCr N)F)__doc__peeweer r r r r <module>r s[
D D D D D Dr ././@LongLink 0000000 0000000 0000000 00000000150 00000000000 011561 L ustar root root defence360agent/migrations/__pycache__/197_add_wordpress_site_manually_deleted_at.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/197_add_wordpress_site_manually_deleted_at.cpython-311.opt-1.0000644 0000000 0000000 00000002611 00000000000 030417 0 ustar
r_j & d Z ddlmZ ddZddZdS )zAdd manually_deleted_at column to wordpress_site table.
The database.get_columns() guard makes this idempotent on installs where
imav/015 (now retained as a no-op) had already added the column.
)TimestampFieldFc |rd S d | d D }d|vr4| j d }| |t d d S d S )Nc g | ] }|j
S )name).0cols z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/197_add_wordpress_site_manually_deleted_at.py
<listcomp>zmigrate.<locals>.<listcomp>
s JJJCsxJJJ wordpress_sitemanually_deleted_atT)null)r ) get_columnsorm add_columnsr )migratordatabasefakekwargscolumns
WordpressSites r
migrater
s JJ8#7#78H#I#IJJJG G++ %56
~4/H/H/H
,+r c d S )Nr )r r r r s r
rollbackr s Dr N)F)__doc__peeweer r r r r r
<module>r sU " ! ! ! ! !
r defence360agent/migrations/__pycache__/197_add_wordpress_site_manually_deleted_at.cpython-311.pyc 0000644 0000000 0000000 00000002611 00000000000 030174 0 ustar
r_j & d Z ddlmZ ddZddZdS )zAdd manually_deleted_at column to wordpress_site table.
The database.get_columns() guard makes this idempotent on installs where
imav/015 (now retained as a no-op) had already added the column.
)TimestampFieldFc |rd S d | d D }d|vr4| j d }| |t d d S d S )Nc g | ] }|j
S )name).0cols z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/197_add_wordpress_site_manually_deleted_at.py
<listcomp>zmigrate.<locals>.<listcomp>
s JJJCsxJJJ wordpress_sitemanually_deleted_atT)null)r ) get_columnsorm add_columnsr )migratordatabasefakekwargscolumns
WordpressSites r
migrater
s JJ8#7#78H#I#IJJJG G++ %56
~4/H/H/H
,+r c d S )Nr )r r r r s r
rollbackr s Dr N)F)__doc__peeweer r r r r r
<module>r sU " ! ! ! ! !
r defence360agent/migrations/__pycache__/198_add_wordpress_site_version.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002564 00000000000 026634 0 ustar
r_j & d Z ddlmZ ddZddZdS )zAdd version column to wordpress_site table.
The database.get_columns() guard makes this idempotent on installs where
imav/017 (now retained as a no-op) had already added the column.
) CharFieldFc |rd S d | d D }d|vr5| j d }| |t dd d S d S )Nc g | ] }|j
S )name).0cols n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/198_add_wordpress_site_version.py
<listcomp>zmigrate.<locals>.<listcomp>
s JJJCsxJJJ wordpress_siteversionz1.0.0F)defaultnull)r ) get_columnsorm add_columnsr )migratordatabasefakekwargscolumns
WordpressSites r
migrater
s JJ8#7#78H#I#IJJJG %56
9W5#I#I#I
r c d S )Nr )r r r r s r
rollbackr s Dr N)F)__doc__peeweer r r r r r
<module>r sU
r defence360agent/migrations/__pycache__/198_add_wordpress_site_version.cpython-311.pyc 0000644 0000000 0000000 00000002564 00000000000 025675 0 ustar
r_j & d Z ddlmZ ddZddZdS )zAdd version column to wordpress_site table.
The database.get_columns() guard makes this idempotent on installs where
imav/017 (now retained as a no-op) had already added the column.
) CharFieldFc |rd S d | d D }d|vr5| j d }| |t dd d S d S )Nc g | ] }|j
S )name).0cols n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/198_add_wordpress_site_version.py
<listcomp>zmigrate.<locals>.<listcomp>
s JJJCsxJJJ wordpress_siteversionz1.0.0F)defaultnull)r ) get_columnsorm add_columnsr )migratordatabasefakekwargscolumns
WordpressSites r
migrater
s JJ8#7#78H#I#IJJJG %56
9W5#I#I#I
r c d S )Nr )r r r r s r
rollbackr s Dr N)F)__doc__peeweer r r r r r
<module>r sU
r defence360agent/migrations/__pycache__/199_proactive_log_permission.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005261 00000000000 026306 0 ustar
r_j f d Z ddlmZmZmZmZ ddlmZmZm Z m
Z
G d de Z d
dZ d
dZ
d S ) a Allow `log` as a proactive feature-management permission value.
Relaxes the CHECK constraint on
``feature_management_permissions.proactive`` from
``(NA, FULL)`` to ``(NA, LOG, FULL)``. SQLite cannot alter CHECK
constraints in place, so the table is recreated.
DEF-42523.
) CharFieldCheckModel TextField) AV_REPORTFULLLOGNAc
e Zd Z G d d Z ed Z ed ed e e
e ge Z ed ed e e
e ge
Zd S )
FeatureManagementPermsc e Zd ZdZdS )FeatureManagementPerms.Meta feature_management_permissionsN)__name__
__module__ __qualname__db_table l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/199_proactive_log_permission.pyMetar s 3r r T)uniqueFz proactive in ('{}','{}','{}'))null constraintsdefaultzav in ('{}','{}','{}')N)r r r r r userr r formatr
r r proactiver avr r r r r s 4 4 4 4 4 4 4 4 9D ! ! !D
E188S$GG H H
I
E*11"iFF G G
BBBr r Fc |rd S | d | t | d | d d S )NzWALTER TABLE feature_management_permissions RENAME TO feature_management_permissions_oldzINSERT INTO feature_management_permissions(user, proactive, av) SELECT user, proactive, av FROM feature_management_permissions_oldz-DROP TABLE feature_management_permissions_old)sql create_modelr migratordatabasefakekwargss r migrater( ) sx LL 7
0111 LL M
LL@AAAAAr c d S )Nr r# s r rollbackr* 8 s Dr N)F)__doc__peeweer r r r ,defence360agent.feature_management.constantsr r r r
r r( r* r r r <module>r. s 6 5 5 5 5 5 5 5 5 5 5 5 U * B B B B r defence360agent/migrations/__pycache__/199_proactive_log_permission.cpython-311.pyc 0000644 0000000 0000000 00000005261 00000000000 025347 0 ustar
r_j f d Z ddlmZmZmZmZ ddlmZmZm Z m
Z
G d de Z d
dZ d
dZ
d S ) a Allow `log` as a proactive feature-management permission value.
Relaxes the CHECK constraint on
``feature_management_permissions.proactive`` from
``(NA, FULL)`` to ``(NA, LOG, FULL)``. SQLite cannot alter CHECK
constraints in place, so the table is recreated.
DEF-42523.
) CharFieldCheckModel TextField) AV_REPORTFULLLOGNAc
e Zd Z G d d Z ed Z ed ed e e
e ge Z ed ed e e
e ge
Zd S )
FeatureManagementPermsc e Zd ZdZdS )FeatureManagementPerms.Meta feature_management_permissionsN)__name__
__module__ __qualname__db_table l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/199_proactive_log_permission.pyMetar s 3r r T)uniqueFz proactive in ('{}','{}','{}'))null constraintsdefaultzav in ('{}','{}','{}')N)r r r r r userr r formatr
r r proactiver avr r r r r s 4 4 4 4 4 4 4 4 9D ! ! !D
E188S$GG H H
I
E*11"iFF G G
BBBr r Fc |rd S | d | t | d | d d S )NzWALTER TABLE feature_management_permissions RENAME TO feature_management_permissions_oldzINSERT INTO feature_management_permissions(user, proactive, av) SELECT user, proactive, av FROM feature_management_permissions_oldz-DROP TABLE feature_management_permissions_old)sql create_modelr migratordatabasefakekwargss r migrater( ) sx LL 7
0111 LL M
LL@AAAAAr c d S )Nr r# s r rollbackr* 8 s Dr N)F)__doc__peeweer r r r ,defence360agent.feature_management.constantsr r r r
r r( r* r r r <module>r. s 6 5 5 5 5 5 5 5 5 5 5 5 U * B B B B r defence360agent/migrations/__pycache__/200_seed_per_user_waf_enabled.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006237 00000000000 026317 0 ustar
r_jg d dl Z d dlZd dlmZmZmZ d dlmZ ej ddd Z ej
e Z d
dZ
d
d ZdS ) N)
UserConfigUserTypechoose_value_from_config)importerz imav.malwarelib.utils.user_list panel_users)modulenamedefaultFc |st d S t j }t j | | t }n?# t
$ r2 t d Y | d S w xY w|D ]} |d }n:# t t f$ r&}t d|| Y d }~>d }~ww xY w t dd| \ } }
|
t j k rmn3# t
$ r&}t d|| Y d }~d }~ww xY w t | dddiid # t
$ r&}t d
|| Y d }~d }~ww xY w | d S # | w xY w) Nz4Failed to enumerate panel users for waf_enabled seeduserz=Skipping malformed panel entry %r during waf_enabled seed: %s WORDPRESS waf_enabled)usernamez8Failed to read waf_enabled for user %s while seeding: %sT)without_defaultsz4Failed to seed WORDPRESS.waf_enabled for user %s: %s)r asyncionew_event_loopset_event_looprun_until_complete Exceptionlogger exceptioncloseKeyError TypeErrorwarningr r ROOTr dict_to_config) migratordatabasefakekwargsloopusersentryr e_sources m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/200_seed_per_user_waf_enabled.pymigrater) sg {" ! # #D 4 / ++KMM::EE F
P
Y $ $ E
= i(
4 ! % 6
X]** +
N
H---<< =$"78%) =
J
?$ L
s !A F. $B;F. BF. B$#F. $C5 CF. CF. %DF.
D6 D1,F. 1D66F. :)E$#F. $
F. F
F. FF. .Gc d S )N )r r r r! s r( rollbackr, L s D )F)r logging defence360agent.contracts.configr r r defence360agent.utilsr getr getLogger__name__r r) r, r+ r- r( <module>r4 s
+ * * * * *hl ,
8 $ $5 5 5 5p r- defence360agent/migrations/__pycache__/200_seed_per_user_waf_enabled.cpython-311.pyc 0000644 0000000 0000000 00000006237 00000000000 025360 0 ustar
r_jg d dl Z d dlZd dlmZmZmZ d dlmZ ej ddd Z ej
e Z d
dZ
d
d ZdS ) N)
UserConfigUserTypechoose_value_from_config)importerz imav.malwarelib.utils.user_list panel_users)modulenamedefaultFc |st d S t j }t j | | t }n?# t
$ r2 t d Y | d S w xY w|D ]} |d }n:# t t f$ r&}t d|| Y d }~>d }~ww xY w t dd| \ } }
|
t j k rmn3# t
$ r&}t d|| Y d }~d }~ww xY w t | dddiid # t
$ r&}t d
|| Y d }~d }~ww xY w | d S # | w xY w) Nz4Failed to enumerate panel users for waf_enabled seeduserz=Skipping malformed panel entry %r during waf_enabled seed: %s WORDPRESS waf_enabled)usernamez8Failed to read waf_enabled for user %s while seeding: %sT)without_defaultsz4Failed to seed WORDPRESS.waf_enabled for user %s: %s)r asyncionew_event_loopset_event_looprun_until_complete Exceptionlogger exceptioncloseKeyError TypeErrorwarningr r ROOTr dict_to_config) migratordatabasefakekwargsloopusersentryr e_sources m/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/200_seed_per_user_waf_enabled.pymigrater) sg {" ! # #D 4 / ++KMM::EE F
P
Y $ $ E
= i(
4 ! % 6
X]** +
N
H---<< =$"78%) =
J
?$ L
s !A F. $B;F. BF. B$#F. $C5 CF. CF. %DF.
D6 D1,F. 1D66F. :)E$#F. $
F. F
F. FF. .Gc d S )N )r r r r! s r( rollbackr, L s D )F)r logging defence360agent.contracts.configr r r defence360agent.utilsr getr getLogger__name__r r) r, r+ r- r( <module>r4 s
+ * * * * *hl ,
8 $ $5 5 5 5p r- defence360agent/migrations/__pycache__/201_rerender_nonprivileged_config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002355 00000000000 027242 0 ustar
r_jB N d Z ddlZddlmZ ej e ZddZddZdS )z
Re-render imunify360-merged-nonprivileged.config so the newly-split
MALWARE_SCANNING.enable_scan_modsec key lands on upgrade.
N)MergerFc |rd S t j d S # t $ r&}t d| Y d }~d S d }~ww xY w)Nz,Failed to re-render nonprivileged config: %s)r update_merged_config Exceptionloggererror)migratordatabasefakekwargsexcs q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/201_rerender_nonprivileged_config.pymigrater s
#%%%%%
:
s
A AA c d S )N )r r
r r s r rollbackr s D )F) __doc__logging defence360agent.contracts.configr getLogger__name__r r r r r r <module>r sp 3 3 3 3 3 3 8 $ $
r defence360agent/migrations/__pycache__/201_rerender_nonprivileged_config.cpython-311.pyc 0000644 0000000 0000000 00000002355 00000000000 026303 0 ustar
r_jB N d Z ddlZddlmZ ej e ZddZddZdS )z
Re-render imunify360-merged-nonprivileged.config so the newly-split
MALWARE_SCANNING.enable_scan_modsec key lands on upgrade.
N)MergerFc |rd S t j d S # t $ r&}t d| Y d }~d S d }~ww xY w)Nz,Failed to re-render nonprivileged config: %s)r update_merged_config Exceptionloggererror)migratordatabasefakekwargsexcs q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/201_rerender_nonprivileged_config.pymigrater s
#%%%%%
:
s
A AA c d S )N )r r
r r s r rollbackr s D )F) __doc__logging defence360agent.contracts.configr getLogger__name__r r r r r r <module>r sp 3 3 3 3 3 3 8 $ $
r defence360agent/migrations/__pycache__/202_add_wordpress_incident_bucket.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005641 00000000000 027236 0 ustar
r_jZ 0 d Z ddlZdZedz ZddZddZdS ) z<Aggregate WordPress incidents per minute instead of forever. N)abusernamepluginruleseveritydomainbucketFc | j d }| |t j d | d | j |gt R | j |gt R ddi | d d S )Nwordpress_incidentT)nullr zuUPDATE wordpress_incident SET bucket = CAST(timestamp / 60 AS INTEGER) WHERE bucket IS NULL AND timestamp IS NOT NULLuniquez0DROP INDEX IF EXISTS wordpressincident_timestamp) orm
add_fieldspw IntegerFieldsql
drop_indexOLD_UNIQUE_KEY add_indexNEW_UNIQUE_KEY)migratordatabasefakekwargsWordpressIncidents q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/202_add_wordpress_incident_bucket.pymigrater s %9: )"/t2L2L2LMMM
LL C H);N;;;;H(G>GGG$GGG LLCDDDDD c | j d }d t }d d t D }| d | j |gt
R | d| d| d | d | d | |d
| j |gt R d d i d S )
Nr z, z AND c 3 & K | ] }d | d| V
dS )zdup.z IS wordpress_incident.N ).0columns r <genexpr>zrollback.<locals>.<genexpr> sF 7v66f66 r zXCREATE INDEX IF NOT EXISTS wordpressincident_timestamp ON wordpress_incident (timestamp)zcUPDATE wordpress_incident SET retries = (SELECT SUM(dup.retries) FROM wordpress_incident dup WHERE zL), timestamp = (SELECT MIN(dup.timestamp) FROM wordpress_incident dup WHERE )z`DELETE FROM wordpress_incident WHERE id NOT IN (SELECT MIN(id) FROM wordpress_incident GROUP BY r
r T)r joinr r r r
remove_fieldsr )r r r r r keysame_keys r rollbackr+ s? %9:
))N
#
#C|| $ H
LL - H);N;;;;
LL
LL D=@ D D D
,h777H(G>GGG$GGGGGr )F)__doc__peeweer r r r r+ r" r r <module>r. sb B B K +-
E
E
E
E H H H H H Hr defence360agent/migrations/__pycache__/202_add_wordpress_incident_bucket.cpython-311.pyc 0000644 0000000 0000000 00000005641 00000000000 026277 0 ustar
r_jZ 0 d Z ddlZdZedz ZddZddZdS ) z<Aggregate WordPress incidents per minute instead of forever. N)abusernamepluginruleseveritydomainbucketFc | j d }| |t j d | d | j |gt R | j |gt R ddi | d d S )Nwordpress_incidentT)nullr zuUPDATE wordpress_incident SET bucket = CAST(timestamp / 60 AS INTEGER) WHERE bucket IS NULL AND timestamp IS NOT NULLuniquez0DROP INDEX IF EXISTS wordpressincident_timestamp) orm
add_fieldspw IntegerFieldsql
drop_indexOLD_UNIQUE_KEY add_indexNEW_UNIQUE_KEY)migratordatabasefakekwargsWordpressIncidents q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/202_add_wordpress_incident_bucket.pymigrater s %9: )"/t2L2L2LMMM
LL C H);N;;;;H(G>GGG$GGG LLCDDDDD c | j d }d t }d d t D }| d | j |gt
R | d| d| d | d | d | |d
| j |gt R d d i d S )
Nr z, z AND c 3 & K | ] }d | d| V
dS )zdup.z IS wordpress_incident.N ).0columns r <genexpr>zrollback.<locals>.<genexpr> sF 7v66f66 r zXCREATE INDEX IF NOT EXISTS wordpressincident_timestamp ON wordpress_incident (timestamp)zcUPDATE wordpress_incident SET retries = (SELECT SUM(dup.retries) FROM wordpress_incident dup WHERE zL), timestamp = (SELECT MIN(dup.timestamp) FROM wordpress_incident dup WHERE )z`DELETE FROM wordpress_incident WHERE id NOT IN (SELECT MIN(id) FROM wordpress_incident GROUP BY r
r T)r joinr r r r
remove_fieldsr )r r r r r keysame_keys r rollbackr+ s? %9:
))N
#
#C|| $ H
LL - H);N;;;;
LL
LL D=@ D D D
,h777H(G>GGG$GGGGGr )F)__doc__peeweer r r r r+ r" r r <module>r. sb B B K +-
E
E
E
E H H H H H Hr ././@LongLink 0000000 0000000 0000000 00000000147 00000000000 011567 L ustar root root defence360agent/migrations/__pycache__/203_add_wordpress_incident_unsent_retries.cpython-311.opt-1.pyc defence360agent/migrations/__pycache__/203_add_wordpress_incident_unsent_retries.cpython-311.opt-1.p0000644 0000000 0000000 00000003311 00000000000 030467 0 ustar
r_jL " d Z ddlZddZddZdS )a_ Track how many occurrences of each wordpress_incident correlation owes.
The counter is decremented only once the transport acknowledges the message
that carried them, so the periodic task can re-send incidents whose message
was lost. A counter rather than a flag: occurrences merged into a row that
was already reported still have to reach correlation.
Rows that already exist when the column is added take the DEFAULT of 0 and
are therefore treated as fully reported. Their delivery was never tracked,
and re-sending a whole retention window of history on upgrade would be worse
than leaving them alone.
NFc | j d }| |t j dddt j d g d S )Nwordpress_incidentFr Tz DEFAULT 0)nulldefaultindex constraints)unsent_retries)orm
add_fieldspw IntegerFieldSQLmigratordatabasefakekwargsWordpressIncidents y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/203_add_wordpress_incident_unsent_retries.pymigrater si %9: ,,-
c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr ! s. %9: ,.>?????r )F)__doc__peeweer r r r r <module>r sU
@ @ @ @ @ @r defence360agent/migrations/__pycache__/203_add_wordpress_incident_unsent_retries.cpython-311.pyc 0000644 0000000 0000000 00000003311 00000000000 030064 0 ustar
r_jL " d Z ddlZddZddZdS )a_ Track how many occurrences of each wordpress_incident correlation owes.
The counter is decremented only once the transport acknowledges the message
that carried them, so the periodic task can re-send incidents whose message
was lost. A counter rather than a flag: occurrences merged into a row that
was already reported still have to reach correlation.
Rows that already exist when the column is added take the DEFAULT of 0 and
are therefore treated as fully reported. Their delivery was never tracked,
and re-sending a whole retention window of history on upgrade would be worse
than leaving them alone.
NFc | j d }| |t j dddt j d g d S )Nwordpress_incidentFr Tz DEFAULT 0)nulldefaultindex constraints)unsent_retries)orm
add_fieldspw IntegerFieldSQLmigratordatabasefakekwargsWordpressIncidents y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/203_add_wordpress_incident_unsent_retries.pymigrater si %9: ,,-
c L | j d }| |d d S )Nr r )r
remove_fieldsr s r rollbackr ! s. %9: ,.>?????r )F)__doc__peeweer r r r r <module>r sU
@ @ @ @ @ @r defence360agent/migrations/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000305 00000000000 022330 0 ustar
r_j d S )N r X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/__init__.py<module>r s r defence360agent/migrations/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000305 00000000000 021371 0 ustar
r_j d S )N r X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/__init__.py<module>r s r defence360agent/migrations/__pycache__/conf.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000572 00000000000 021524 0 ustar
r_jt F d dl mZ d ej ZdS ) )Modelz sqlite:///{}N) defence360agent.contracts.configr formatPATHDATABASE T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/conf.py<module>r s0 2 2 2 2 2 2 , ,r defence360agent/migrations/__pycache__/conf.cpython-311.pyc 0000644 0000000 0000000 00000000572 00000000000 020565 0 ustar
r_jt F d dl mZ d ej ZdS ) )Modelz sqlite:///{}N) defence360agent.contracts.configr formatPATHDATABASE T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/migrations/conf.py<module>r s0 2 2 2 2 2 2 , ,r defence360agent/migrations/conf.py 0000644 0000000 0000000 00000000164 00000000000 014222 0 ustar # Migration config
from defence360agent.contracts.config import Model
DATABASE = "sqlite:///{}".format(Model.PATH)
defence360agent/model/ 0000755 0000000 0000000 00000000000 00000000000 011646 5 ustar defence360agent/model/__init__.py 0000644 0000000 0000000 00000001703 00000000000 013760 0 ustar from peewee import IntegrityError, Model as BaseModel
class Model(BaseModel):
"""
Common Model class that fix create_or_get method with using CompositeKey.
https://stackoverflow.com/questions/35167628/peewee-create-or-get-error-in-model-with-compositekey
"""
@classmethod
def create_or_get(cls, **kwargs):
try:
with cls._meta.database.atomic():
return cls.create(**kwargs), True
except IntegrityError:
query = []
for field_name, value in kwargs.items():
field = getattr(cls, field_name)
field_is_primary_key = (
field.name in cls._meta.primary_key.field_names
if cls._meta.composite_key
else field.primary_key
)
if field.unique or field_is_primary_key:
query.append(field == value)
return cls.get(*query), False
defence360agent/model/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 014056 5 ustar defence360agent/model/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003602 00000000000 021257 0 ustar
r_j 2 d dl mZmZ G d de ZdS ) )IntegrityErrorModelc ( e Zd ZdZed ZdS )r z
Common Model class that fix create_or_get method with using CompositeKey.
https://stackoverflow.com/questions/35167628/peewee-create-or-get-error-in-model-with-compositekey
c | j j 5 | j di |dfcd d d S # 1 swxY w Y d S # t $ r g }| D ]b\ }}t
| | }| j j r|j | j j j
v n|j }|j s|r| ||k c | j
| dfcY S w xY w)NTF )_metadatabaseatomiccreater itemsgetattr
composite_keyname primary_key field_namesuniqueappendget)clskwargsquery
field_namevaluefieldfield_is_primary_keys S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/__init__.py
create_or_getzModel.create_or_get
sY *#**,,
2
2!sz++F++T1
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2 * * *E%+\\^^
1
1!
E Z00 y.+EJ#)"7"CCC * %
< 1#7 1LL% 00037E?E) ) ) ) *s2 A < A A A A A BCCN)__name__
__module__ __qualname____doc__ classmethodr r r r r s9
* * [* * *r# r N)peeweer r BaseModelr r# r <module>r& sQ 5 5 5 5 5 5 5 5* * * * *I * * * * *r# defence360agent/model/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000003602 00000000000 020320 0 ustar
r_j 2 d dl mZmZ G d de ZdS ) )IntegrityErrorModelc ( e Zd ZdZed ZdS )r z
Common Model class that fix create_or_get method with using CompositeKey.
https://stackoverflow.com/questions/35167628/peewee-create-or-get-error-in-model-with-compositekey
c | j j 5 | j di |dfcd d d S # 1 swxY w Y d S # t $ r g }| D ]b\ }}t
| | }| j j r|j | j j j
v n|j }|j s|r| ||k c | j
| dfcY S w xY w)NTF )_metadatabaseatomiccreater itemsgetattr
composite_keyname primary_key field_namesuniqueappendget)clskwargsquery
field_namevaluefieldfield_is_primary_keys S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/__init__.py
create_or_getzModel.create_or_get
sY *#**,,
2
2!sz++F++T1
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2 * * *E%+\\^^
1
1!
E Z00 y.+EJ#)"7"CCC * %
< 1#7 1LL% 00037E?E) ) ) ) *s2 A < A A A A A BCCN)__name__
__module__ __qualname____doc__ classmethodr r r r r s9
* * [* * *r# r N)peeweer r BaseModelr r# r <module>r& sQ 5 5 5 5 5 5 5 5* * * * *I * * * * *r# defence360agent/model/__pycache__/analyst_cleanup.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000013321 00000000000 022701 0 ustar
r_j
N d dl Zd dlmZmZ d dlmZmZmZ G d de ZdS ) N)Modelinstance)datetimetimezone timedeltac e Zd ZdZ G d d Z ej Z ej d Z ej d Z
ej d Z ej
d ej ej Z ej dd ej d g Z ej
d ej ej Zed
Zedd
Zedd Zededz fd Zed Z ed Z dS )AnalystCleanupRequestz
Model for storing analyst cleanup requests.
Tracks request details and status for each cleanup request submitted.
c e Zd Zej ZdZdS )AnalystCleanupRequest.Metaanalyst_cleanup_requestsN)__name__
__module__ __qualname__r dbdatabasedb_table Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/analyst_cleanup.pyMetar s ;-r r F)null)r defaultpendingz/status in ('pending','in_progress','completed'))r r constraintsc 2 | ||| S )z Create a new cleanup request)username
zendesk_id ticket_link)create)clsr r r s r create_requestz$AnalystCleanupRequest.create_request" s& zz *+
r 2 r c | | j |k | j | | S )z$Get all requests for a specific user)selectwherer order_by
created_atdesclimitoffset)r r r) r* s r get_user_requestsz'AnalystCleanupRequest.get_user_requests) sY
JJLL
U3<8+
,
,
Xcn))++
,
,
U5\\
VF^^
r c | | j | | S )z Get all requests for a sever)r$ r& r' r( r) r* )r r) r* s r get_all_requestsz&AnalystCleanupRequest.get_all_requests4 sE
JJLL
Xcn))++
,
,
U5\\
VF^^
r returnNc | | j |k | j ddg z d }|r|j ndS )z
Gets user requests for a user and checks if there are requests
with [pending | in_progress] state. If found, returns ticket_link,
otherwise returns None
r in_progress N)r$ r% r statusin_r) firstr )r r active_requests r get_active_request_linkz-AnalystCleanupRequest.get_active_request_link> ss
JJLL
U ):>>9m"<==? U1XX
%'' .<E~))Er c | || | j |k S )z Update the status of a request)r2 last_updated)updater% r execute)r r
new_statusr8 s r
update_statusz#AnalystCleanupRequest.update_statusP s9
JJj|J D D
U3>Z/
0
0
WYY
r c t j t j t d z
}t
t
j t
j t
j t
j
t
j ddg t
j dk t
j
|k z z S )z
Returns a query to fetch active cleanup requests and recently completed
requests for the specified users.
)daysr r0 completed)
r nowr utcr r r$ r r r2 r8 r% r3 )r three_days_agos r get_all_relevant_requestsz/AnalystCleanupRequest.get_all_relevant_requestsY s " hl33iQ6G6G6GG$++ ! * ! , ! ( ! .
%
"
)
-
-y-.H
I
I&-<(5 GI
r )r" r ) r
r r __doc__r pw AutoFieldid CharFieldr r TextFieldr TimestampFieldr rA r rB r' Checkr2 r8 classmethodr! r+ r- strr6 r< rD r r r r r s
. . . . . . . .
Br|'''H 5)))J ",E***K""
LHL 6 6 J R\
BHF G G
F %2$
LHL 6 6 L
[
[
[
F#* F F F [F"
[
[
r r ) peeweerF defence360agent.modelr r r r r r r r r <module>rQ s 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2f
f
f
f
f
E f
f
f
f
f
r defence360agent/model/__pycache__/analyst_cleanup.cpython-311.pyc 0000644 0000000 0000000 00000013321 00000000000 021742 0 ustar
r_j
N d dl Zd dlmZmZ d dlmZmZmZ G d de ZdS ) N)Modelinstance)datetimetimezone timedeltac e Zd ZdZ G d d Z ej Z ej d Z ej d Z
ej d Z ej
d ej ej Z ej dd ej d g Z ej
d ej ej Zed
Zedd
Zedd Zededz fd Zed Z ed Z dS )AnalystCleanupRequestz
Model for storing analyst cleanup requests.
Tracks request details and status for each cleanup request submitted.
c e Zd Zej ZdZdS )AnalystCleanupRequest.Metaanalyst_cleanup_requestsN)__name__
__module__ __qualname__r dbdatabasedb_table Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/analyst_cleanup.pyMetar s ;-r r F)null)r defaultpendingz/status in ('pending','in_progress','completed'))r r constraintsc 2 | ||| S )z Create a new cleanup request)username
zendesk_id ticket_link)create)clsr r r s r create_requestz$AnalystCleanupRequest.create_request" s& zz *+
r 2 r c | | j |k | j | | S )z$Get all requests for a specific user)selectwherer order_by
created_atdesclimitoffset)r r r) r* s r get_user_requestsz'AnalystCleanupRequest.get_user_requests) sY
JJLL
U3<8+
,
,
Xcn))++
,
,
U5\\
VF^^
r c | | j | | S )z Get all requests for a sever)r$ r& r' r( r) r* )r r) r* s r get_all_requestsz&AnalystCleanupRequest.get_all_requests4 sE
JJLL
Xcn))++
,
,
U5\\
VF^^
r returnNc | | j |k | j ddg z d }|r|j ndS )z
Gets user requests for a user and checks if there are requests
with [pending | in_progress] state. If found, returns ticket_link,
otherwise returns None
r in_progress N)r$ r% r statusin_r) firstr )r r active_requests r get_active_request_linkz-AnalystCleanupRequest.get_active_request_link> ss
JJLL
U ):>>9m"<==? U1XX
%'' .<E~))Er c | || | j |k S )z Update the status of a request)r2 last_updated)updater% r execute)r r
new_statusr8 s r
update_statusz#AnalystCleanupRequest.update_statusP s9
JJj|J D D
U3>Z/
0
0
WYY
r c t j t j t d z
}t
t
j t
j t
j t
j
t
j ddg t
j dk t
j
|k z z S )z
Returns a query to fetch active cleanup requests and recently completed
requests for the specified users.
)daysr r0 completed)
r nowr utcr r r$ r r r2 r8 r% r3 )r three_days_agos r get_all_relevant_requestsz/AnalystCleanupRequest.get_all_relevant_requestsY s " hl33iQ6G6G6GG$++ ! * ! , ! ( ! .
%
"
)
-
-y-.H
I
I&-<(5 GI
r )r" r ) r
r r __doc__r pw AutoFieldid CharFieldr r TextFieldr TimestampFieldr rA r rB r' Checkr2 r8 classmethodr! r+ r- strr6 r< rD r r r r r s
. . . . . . . .
Br|'''H 5)))J ",E***K""
LHL 6 6 J R\
BHF G G
F %2$
LHL 6 6 L
[
[
[
F#* F F F [F"
[
[
r r ) peeweerF defence360agent.modelr r r r r r r r r <module>rQ s 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2f
f
f
f
f
E f
f
f
f
f
r defence360agent/model/__pycache__/event_hook.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006763 00000000000 021674 0 ustar
r_j ^ d dl m Z d dlmZmZmZ d dlmZmZ d dlm Z G d de Z
dS ) )time) CharField IntegerField BooleanField)instanceModel)
FilenameFieldc e Zd ZdZ G d d Z ed Z ed Z e dd Z
e d Z e
d Ze
dd
Ze
d Zd Zd
S ) EventHookzwImunify Hooks v1.0 configuration.
.. deprecated:: 4.10 A new notification system was implemented in DEF-11680
c e Zd Zej ZdZdS )EventHook.Meta
event_hookN)__name__
__module__ __qualname__r dbdatabasedb_table U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/event_hook.pyMetar
s ; r r F)nullc 8 t t S N)intr r r r <lambda>zEventHook.<lambda> s s466{{ r )r default)r c | }|dk r | | j |k }t | S )Nall)selectwhereeventlistdicts)clsr# qs r list_eventszEventHook.list_events sD JJLL E>> U*++AAGGII r c | | j |k | j |k z }| rd S | ||| }| S )N)r# pathnative)r! r" r# r* existscreateas_dict)r& r# r* r+ r' hooks r add_hookzEventHook.add_hook$ sj JJLL U 2sx47G H I I 88:: 4zzDz@@||~~ r c " | | j |k | j |k z }| sd S | }| }| |S r )r! r" r# r* r, getr. delete_instance)r& r# r* r' r/ datas r delete_hookzEventHook.delete_hook, sv JJLL U 2sx47G H I Ixxzz 4uuww||~~ r c 8 | j | j | j | j dS )Nr* r# createdr+ r7 )selfs r r. zEventHook.as_dict6 s% IZ|k
r N)F)r r r __doc__r r r* r r# r r8 r r+ classmethodr( r0 r5 r. r r r r r s
=e $ $ $D I5 ! ! !El/B/BCCCG \%
(
(
(F [ [ [
r r N) r peeweer r r defence360agent.modelr r $defence360agent.model.simplificationr r r r r <module>r? s 8 8 8 8 8 8 8 8 8 8 1 1 1 1 1 1 1 1 > > > > > >3
3
3
3
3
3
3
3
3
3
r defence360agent/model/__pycache__/event_hook.cpython-311.pyc 0000644 0000000 0000000 00000006763 00000000000 020735 0 ustar
r_j ^ d dl m Z d dlmZmZmZ d dlmZmZ d dlm Z G d de Z
dS ) )time) CharField IntegerField BooleanField)instanceModel)
FilenameFieldc e Zd ZdZ G d d Z ed Z ed Z e dd Z
e d Z e
d Ze
dd
Ze
d Zd Zd
S ) EventHookzwImunify Hooks v1.0 configuration.
.. deprecated:: 4.10 A new notification system was implemented in DEF-11680
c e Zd Zej ZdZdS )EventHook.Meta
event_hookN)__name__
__module__ __qualname__r dbdatabasedb_table U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/event_hook.pyMetar
s ; r r F)nullc 8 t t S N)intr r r r <lambda>zEventHook.<lambda> s s466{{ r )r default)r c | }|dk r | | j |k }t | S )Nall)selectwhereeventlistdicts)clsr# qs r list_eventszEventHook.list_events sD JJLL E>> U*++AAGGII r c | | j |k | j |k z }| rd S | ||| }| S )N)r# pathnative)r! r" r# r* existscreateas_dict)r& r# r* r+ r' hooks r add_hookzEventHook.add_hook$ sj JJLL U 2sx47G H I I 88:: 4zzDz@@||~~ r c " | | j |k | j |k z }| sd S | }| }| |S r )r! r" r# r* r, getr. delete_instance)r& r# r* r' r/ datas r delete_hookzEventHook.delete_hook, sv JJLL U 2sx47G H I Ixxzz 4uuww||~~ r c 8 | j | j | j | j dS )Nr* r# createdr+ r7 )selfs r r. zEventHook.as_dict6 s% IZ|k
r N)F)r r r __doc__r r r* r r# r r8 r r+ classmethodr( r0 r5 r. r r r r r s
=e $ $ $D I5 ! ! !El/B/BCCCG \%
(
(
(F [ [ [
r r N) r peeweer r r defence360agent.modelr r $defence360agent.model.simplificationr r r r r <module>r? s 8 8 8 8 8 8 8 8 8 8 1 1 1 1 1 1 1 1 > > > > > >3
3
3
3
3
3
3
3
3
3
r defence360agent/model/__pycache__/icontact.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004725 00000000000 021333 0 ustar
r_j d dl Z d dlmZmZmZ d dlmZ d dlmZm Z d dl
m Z m Z ej
e ej e iZ G d de ZdS ) N) CharField IntegerField CompositeKey)IContactMessageType)Modelinstance)DAYWEEKc e Zd Z G d d Z e Z ed Z ed Ze d
d Z
e d
d Z dS ) IContactThrottlec 8 e Zd Zej ZdZ edd ZdS )IContactThrottle.Metaicontact_throttle message_typeuserN) __name__
__module__ __qualname__r dbdatabasedb_tabler primary_key S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/icontact.pyMetar s+ ;&"l>6:: r r T)nullr )defaultNc t | || \ }}t j |j z
|k S )N)r r )
get_or_createtime timestamp)clsr period_limitr obj_s r may_be_notifiedz IContactThrottle.may_be_notified s6 "" 4"HHQ cm+|;;r c | t j | j |k || j d n
| j |k d S )N)r" T)updater! wherer r is_nullexecute)r# r r s r refreshzIContactThrottle.refresh sh
TY[[
))// ,&*lCH T " " "D8H
')))))r )N) r r r r r r r r r" classmethodr' r- r r r r r s ; ; ; ; ; ; ; ;
9;;L 9$ D Q'''I< < < [< [ r r )r! peeweer r r defence360agent.contracts.configr defence360agent.modelr r defence360agent.utils.commonr r
MALWARE_FOUNDSCAN_NOT_SCHEDULEDTHROTTLING_PERIODr r r r <module>r6 s 8 8 8 8 8 8 8 8 8 8 @ @ @ @ @ @ 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 %s*D u r defence360agent/model/__pycache__/icontact.cpython-311.pyc 0000644 0000000 0000000 00000004725 00000000000 020374 0 ustar
r_j d dl Z d dlmZmZmZ d dlmZ d dlmZm Z d dl
m Z m Z ej
e ej e iZ G d de ZdS ) N) CharField IntegerField CompositeKey)IContactMessageType)Modelinstance)DAYWEEKc e Zd Z G d d Z e Z ed Z ed Ze d
d Z
e d
d Z dS ) IContactThrottlec 8 e Zd Zej ZdZ edd ZdS )IContactThrottle.Metaicontact_throttle message_typeuserN) __name__
__module__ __qualname__r dbdatabasedb_tabler primary_key S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/icontact.pyMetar s+ ;&"l>6:: r r T)nullr )defaultNc t | || \ }}t j |j z
|k S )N)r r )
get_or_createtime timestamp)clsr period_limitr obj_s r may_be_notifiedz IContactThrottle.may_be_notified s6 "" 4"HHQ cm+|;;r c | t j | j |k || j d n
| j |k d S )N)r" T)updater! wherer r is_nullexecute)r# r r s r refreshzIContactThrottle.refresh sh
TY[[
))// ,&*lCH T " " "D8H
')))))r )N) r r r r r r r r r" classmethodr' r- r r r r r s ; ; ; ; ; ; ; ;
9;;L 9$ D Q'''I< < < [< [ r r )r! peeweer r r defence360agent.contracts.configr defence360agent.modelr r defence360agent.utils.commonr r
MALWARE_FOUNDSCAN_NOT_SCHEDULEDTHROTTLING_PERIODr r r r <module>r6 s 8 8 8 8 8 8 8 8 8 8 @ @ @ @ @ @ 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 %s*D u r defence360agent/model/__pycache__/infected_domain.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000013257 00000000000 022637 0 ustar
r_j d dl Z d dlZd dlZd dlmZmZmZmZ d dlm Z m
Z
ej e Z
G d de
ZdS ) N) CharField
FloatField IntegerField TextField)instanceModelc e Zd ZdZ ed Z ed Z ed Z ed Z e
Z e d Z
G d d Zed
d
Zed Zd S )InfectedDomainListzDDomains with bad reputation, used for Reputation Management feature.T) primary_key)nullFc e Zd Zej ZdZdS )InfectedDomainList.Metainfected_domain_listN)__name__
__module__ __qualname__r dbdatabasedb_table Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/infected_domain.pyMetar ! s ;)r r r 2 c | | j | j | j }fd| D }t j |d }d}g }t | D ]P\ } }
|dz
}t | |k r3| |k r-|
\ } } | \ }
}| |
|d | D d Q||fS )Nc 3 0 K | ]}|d v |V dS )usernameNr ).0rowexisting_userss r <genexpr>z1InfectedDomainList.get_by_user.<locals>.<genexpr>, s:
C
O~,M,MC,M,M,M,M
r c " | d | d fS )Nr namer )r s r <lambda>z0InfectedDomainList.get_by_user.<locals>.<lambda>0 s s:F .L r )keyr c > g | ]}|d |d |d dS ) threat_typevendor timestamp)typer) r* r )r ts r
<listcomp>z2InfectedDomainList.get_by_user.<locals>.<listcomp>> sG $ $ $ !" )*-(8*+H+-.{^ $ $ $r )r domainthreats) selectorder_byr r# r* descdicts itertoolsgroupby enumeratelenappend)clsr offsetlimitqueryfiltered_by_usergrouped max_countresultivaluegroupr/ r r# s ` r get_by_userz InfectedDomainList.get_by_user% s;
%% L#(CM$6$6$8$8
;;==
# "L"L
!'** HAu NIF e##!v++!&w!&$
$,"&$ $ &-
$ $ $
y r c
d | D }t j 5 | t j }|D ]}|d }||vr t d| *|| D ]h}|d }|dv r|d d } n|dk r |d } n |d v rd
} nd } |
|| |f| }
| ||| ||
i d
d
d
d
S # 1 swxY w Y d
S )a
Update domain reputatuion info. If threat info already exists, do not
update timestamp
:param domains: reputation data from server
:param domains_to_users: domain -> users mapping from hosting panel
:return:
c J i | ] }|d |d |d f|d !S )r# r( r) r* r )r rs r
<dictcomp>z6InfectedDomainList.refresh_domains.<locals>.<dictcomp>T sB
vY-(!H+ 6+
r r< z Users for domain %s not found.r) )zgoogle-safe-browsingzyandex-safe-browsingdetailsr( spamhaus) phishtank openphishz spam domainTHREAT_TYPE_UNSPECIFIED)r r# r( r) r* N) r0 r3 r r atomicdeleteexecutetimeloggerwarninggetcreate) r9 domainsdomains_to_usersexistingnow domain_infor. userr) r( r* s r refresh_domainsz"InfectedDomainList.refresh_domainsJ s
ZZ\\''))
[
!
! JJLL " " ")++C &
$W-!111NN#CVLLL ,V 4 D ( 2F " '2)&<]&K :--&1)&< #===&3 &? ( f5s! !I JJ!% #$/ %"+ #
s CD55D9<D9N)r r )r r r __doc__r idr r r# r( r r* r r) r classmethodrD r\ r r r r
r
s NN $ ' ' 'Byd###H 9% D )'''K
I
YD
!
!
!F* * * * * * * * "! "! "! ["!H , , [, , ,r r
)r4 loggingrQ peeweer r r r defence360agent.modelr r getLoggerr rR r
r r r <module>rd s 2 1 1 1 1 1 1 1 8 $ $f f f f f f f f f fr defence360agent/model/__pycache__/infected_domain.cpython-311.pyc 0000644 0000000 0000000 00000013257 00000000000 021700 0 ustar
r_j d dl Z d dlZd dlZd dlmZmZmZmZ d dlm Z m
Z
ej e Z
G d de
ZdS ) N) CharField
FloatField IntegerField TextField)instanceModelc e Zd ZdZ ed Z ed Z ed Z ed Z e
Z e d Z
G d d Zed
d
Zed Zd S )InfectedDomainListzDDomains with bad reputation, used for Reputation Management feature.T) primary_key)nullFc e Zd Zej ZdZdS )InfectedDomainList.Metainfected_domain_listN)__name__
__module__ __qualname__r dbdatabasedb_table Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/infected_domain.pyMetar ! s ;)r r r 2 c | | j | j | j }fd| D }t j |d }d}g }t | D ]P\ } }
|dz
}t | |k r3| |k r-|
\ } } | \ }
}| |
|d | D d Q||fS )Nc 3 0 K | ]}|d v |V dS )usernameNr ).0rowexisting_userss r <genexpr>z1InfectedDomainList.get_by_user.<locals>.<genexpr>, s:
C
O~,M,MC,M,M,M,M
r c " | d | d fS )Nr namer )r s r <lambda>z0InfectedDomainList.get_by_user.<locals>.<lambda>0 s s:F .L r )keyr c > g | ]}|d |d |d dS ) threat_typevendor timestamp)typer) r* r )r ts r
<listcomp>z2InfectedDomainList.get_by_user.<locals>.<listcomp>> sG $ $ $ !" )*-(8*+H+-.{^ $ $ $r )r domainthreats) selectorder_byr r# r* descdicts itertoolsgroupby enumeratelenappend)clsr offsetlimitqueryfiltered_by_usergrouped max_countresultivaluegroupr/ r r# s ` r get_by_userz InfectedDomainList.get_by_user% s;
%% L#(CM$6$6$8$8
;;==
# "L"L
!'** HAu NIF e##!v++!&w!&$
$,"&$ $ &-
$ $ $
y r c
d | D }t j 5 | t j }|D ]}|d }||vr t d| *|| D ]h}|d }|dv r|d d } n|dk r |d } n |d v rd
} nd } |
|| |f| }
| ||| ||
i d
d
d
d
S # 1 swxY w Y d
S )a
Update domain reputatuion info. If threat info already exists, do not
update timestamp
:param domains: reputation data from server
:param domains_to_users: domain -> users mapping from hosting panel
:return:
c J i | ] }|d |d |d f|d !S )r# r( r) r* r )r rs r
<dictcomp>z6InfectedDomainList.refresh_domains.<locals>.<dictcomp>T sB
vY-(!H+ 6+
r r< z Users for domain %s not found.r) )zgoogle-safe-browsingzyandex-safe-browsingdetailsr( spamhaus) phishtank openphishz spam domainTHREAT_TYPE_UNSPECIFIED)r r# r( r) r* N) r0 r3 r r atomicdeleteexecutetimeloggerwarninggetcreate) r9 domainsdomains_to_usersexistingnow domain_infor. userr) r( r* s r refresh_domainsz"InfectedDomainList.refresh_domainsJ s
ZZ\\''))
[
!
! JJLL " " ")++C &
$W-!111NN#CVLLL ,V 4 D ( 2F " '2)&<]&K :--&1)&< #===&3 &? ( f5s! !I JJ!% #$/ %"+ #
s CD55D9<D9N)r r )r r r __doc__r idr r r# r( r r* r r) r classmethodrD r\ r r r r
r
s NN $ ' ' 'Byd###H 9% D )'''K
I
YD
!
!
!F* * * * * * * * "! "! "! ["!H , , [, , ,r r
)r4 loggingrQ peeweer r r r defence360agent.modelr r getLoggerr rR r
r r r <module>rd s 2 1 1 1 1 1 1 1 8 $ $f f f f f f f f f fr defence360agent/model/__pycache__/instance.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000760 00000000000 021326 0 ustar
r_j B d dl mc mZ ej dg dd ZdS ) N)) journal_modewal) foreign_keysON) busy_timeouti' T)pragmasregexp_function) defence360agent.model.tls_checkmodel tls_checkSqliteDatabaseWrapperdb S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/instance.py<module>r sV 3 3 3 3 3 3 3 3 3 %Y$
r defence360agent/model/__pycache__/instance.cpython-311.pyc 0000644 0000000 0000000 00000000760 00000000000 020367 0 ustar
r_j B d dl mc mZ ej dg dd ZdS ) N)) journal_modewal) foreign_keysON) busy_timeouti' T)pragmasregexp_function) defence360agent.model.tls_checkmodel tls_checkSqliteDatabaseWrapperdb S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/instance.py<module>r sV 3 3 3 3 3 3 3 3 3 %Y$
r defence360agent/model/__pycache__/messages_to_send.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000010027 00000000000 023041 0 ustar
r_jC N d dl mZ d dlmZmZ d dlmZmZ G d de ZdS ) )
namedtuple)
FloatField BlobField)instanceModelc e Zd ZdZ G d d Z ed Z ed Z e dd Z
e d Z e d Z
e d
Ze dd Ze d fd Z xZS )
MessageToSendzc
Storage for messages to be sent to server
while connection to server is not available
c e Zd Zej ZdZdS )MessageToSend.Metamessages_to_send_nrN)__name__
__module__ __qualname__r dbdatabasedb_table [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/messages_to_send.pyMetar s ;(r r F)nullMessageToSendTztimestamp messagec | | j | j | j | j | j S N)selectid timestampmessageorder_by)clss r get_all_orderedz MessageToSend.get_all_ordered s9 zz#&#-==FF M36
r c | | | j |k S )N)r )updatewherer execute)r
message_idr s r set_messagezMessageToSend.set_message s;
JJwJ ' ' - -cf
.B C C K K M M
r c | | j | }| S r )deleter$ r in_r% )r queryqs r delete_inzMessageToSend.delete_in$ s9 JJLL svzz% 0 0 1 1yy{{r c & | | j | }| | j | }| S r ) r r r limitr) r$ r r* r% )r r0 oldr, s r
delete_oldzMessageToSend.delete_old) sb jjll##CM2288?? JJLL svzz# / /yy{{r returnNc t dt | d D ]G} fd|||dz D } t j |fi | Hd S )Nr d c H g | ] } j | S r )r _asdict).0rowr s r
<listcomp>z-MessageToSend.insert_many.<locals>.<listcomp>3 s= 7:""C(0022 r )rangelensuper insert_manyr% )r rowskwargsidata __class__s ` r r> zMessageToSend.insert_many/ s q#d))S)) : :A >B1q3w;>O D
EGG / / / / 7 7 9 9 9 9 : :r )r. )r3 N)r
r r __doc__r r r r r r r classmethodr! r' r- r2 r>
__classcell__)rC s @r r r s#
) ) ) ) ) ) ) )
&&&IiU###G Z 02EFFN
[
[
[ [
: : : : : [: : : : :r r N) collectionsr peeweer r defence360agent.modelr r r r r r <module>rJ s{ " " " " " " ( ( ( ( ( ( ( ( 1 1 1 1 1 1 1 1.: .: .: .: .:E .: .: .: .: .:r defence360agent/model/__pycache__/messages_to_send.cpython-311.pyc 0000644 0000000 0000000 00000010027 00000000000 022102 0 ustar
r_jC N d dl mZ d dlmZmZ d dlmZmZ G d de ZdS ) )
namedtuple)
FloatField BlobField)instanceModelc e Zd ZdZ G d d Z ed Z ed Z e dd Z
e d Z e d Z
e d
Ze dd Ze d fd Z xZS )
MessageToSendzc
Storage for messages to be sent to server
while connection to server is not available
c e Zd Zej ZdZdS )MessageToSend.Metamessages_to_send_nrN)__name__
__module__ __qualname__r dbdatabasedb_table [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/messages_to_send.pyMetar s ;(r r F)nullMessageToSendTztimestamp messagec | | j | j | j | j | j S N)selectid timestampmessageorder_by)clss r get_all_orderedz MessageToSend.get_all_ordered s9 zz#&#-==FF M36
r c | | | j |k S )N)r )updatewherer execute)r
message_idr s r set_messagezMessageToSend.set_message s;
JJwJ ' ' - -cf
.B C C K K M M
r c | | j | }| S r )deleter$ r in_r% )r queryqs r delete_inzMessageToSend.delete_in$ s9 JJLL svzz% 0 0 1 1yy{{r c & | | j | }| | j | }| S r ) r r r limitr) r$ r r* r% )r r0 oldr, s r
delete_oldzMessageToSend.delete_old) sb jjll##CM2288?? JJLL svzz# / /yy{{r returnNc t dt | d D ]G} fd|||dz D } t j |fi | Hd S )Nr d c H g | ] } j | S r )r _asdict).0rowr s r
<listcomp>z-MessageToSend.insert_many.<locals>.<listcomp>3 s= 7:""C(0022 r )rangelensuper insert_manyr% )r rowskwargsidata __class__s ` r r> zMessageToSend.insert_many/ s q#d))S)) : :A >B1q3w;>O D
EGG / / / / 7 7 9 9 9 9 : :r )r. )r3 N)r
r r __doc__r r r r r r r classmethodr! r' r- r2 r>
__classcell__)rC s @r r r s#
) ) ) ) ) ) ) )
&&&IiU###G Z 02EFFN
[
[
[ [
: : : : : [: : : : :r r N) collectionsr peeweer r defence360agent.modelr r r r r r <module>rJ s{ " " " " " " ( ( ( ( ( ( ( ( 1 1 1 1 1 1 1 1.: .: .: .: .:E .: .: .: .: .:r defence360agent/model/__pycache__/simplification.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000023041 00000000000 022531 0 ustar
r_j
B d dl Z d dlZd dlZd dlZd dlmZmZmZmZm Z m
Z
d dl m Z m
Z
dZ ej e Z G d de Z G d de Z G d d
e
Zd Zd e
d
ededefdZ G d de
Zd Zd Z G d d Z e Z dS ) N) BlobField CharField DateFieldForeignKeyField IntegerFieldPeeweeException)instanceModeliQ c e Zd ZdZd Zd ZdS )
FilenameFieldz/
Class to store file names in database
c * t j | S N)osfsencodeselfvalues Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/simplification.pydb_valuezFilenameField.db_value {5!!! c * t j | S r )r fsdecoder s r python_valuezFilenameField.python_value r r N)__name__
__module__ __qualname____doc__r r r r r r s< " " "" " " " "r r c e Zd ZdZd ZdS )
ScanPathField
list_of_filesc > t |t r| j S |S r )
isinstancelistREALTIME_SCAN_PATH_STUBr s r r zScanPathField.db_value& s" eT " " 0/ / r N)r r r r& r r r r r! r! # s) - r r! c e Zd ZdZdS )
ModelErrorzf
Model exception. Please use this one from other modules instead
PeeweeException directly
N)r r r r r r r r( r( , s
Dr r( c K || S )z0
Fake run_in_executor() test (DEF-4541)
r )loopcbargss r run_in_executorr- 5 s 2t9r tablenum_days max_countreturnc 4 t | dd }|s"t d | t j |t z z
}| | j | j |
| j |k }|
| j |
}|S )z
Removes records that is older that *num_days* days and
all others that are out of range *max_count* from *table*.
Returns count of rows deleted.
timestampFz#No 'timestamp' column in table {!r})getattr
ValueErrorformattime POSIX_DAYselectr3 order_bydesclimitwheredeletenot_inexecute)r. r/ r0
has_timestamp
end_save_timeto_keep
deleted_counts r remove_old_and_truncaterE < s E;66M N>EEeLLMMM IKK(Y"66M
U_%% %/&&(( ) ) y u . / / U_ 3 3G < <==EEGG r c e Zd ZdZ G d d Z ed Z edd Ze de
fd Z e d d
Z dS ) EulazKeeps track of updates and acceptions of end user license agreement.
Admins will be asked to accept EULA if the latest version is not accepted
yet.
c e Zd Zej ZdZdS ) Eula.MetaeulaN)r r r r dbdatabasedb_tabler r r MetarI ^ s ;r rN T) primary_keyN)nulldefaultr1 c t t | | j | j d d }|d u S )N ) nextiterr9 r= acceptedis_nullr: updatedr< )cls
unaccepteds r is_acceptedzEula.is_acceptedg sp
s|++--..#+&&q
T!!r c | t j | j d S )N)rV )updater7 r= rV rW r@ )rY s r acceptz Eula.acceptt sI
DIKK
((.. L " "
')))))r )r1 N)
r r r r rN r rX r rV classmethodboolr[ r^ r r r rG rG W s
iD)))G|t444H
"D
"
"
" [
" [ r rG c B d t j | d D S )Nc g | ]\ }}|S r r ).0_objs r
<listcomp>z get_models.<locals>.<listcomp>| s, As r c j t j | o t | t o
| t k S r )inspectisclass
issubclassr
)re s r <lambda>z get_models.<locals>.<lambda> s1 ,, 3&& u r )rh
getmembersmodules r
get_modelsro { s= (
r c t j t j t | d d S )NT)safe)r rK connect
create_tablesro rm s r rs rs s? K K j 0 0t <<<<<r c T e Zd Zededefd Zededefd Zd Z dS ) ApplyOrderBy column_namer1 c t | t r| j n| }dt |dd }| t ||fd st ||d }||fS )z
:param _model: peewee.Model or peewee.ForeignKeyField
:param column_name: str
:return: tuple<peewee.Node>
r OrderByNc S r r )nodess r rk z,ApplyOrderBy.resolve_nodes.<locals>.<lambda> s % r )r$ r rel_modelr4 )_modelrv modelcustom_order_bynoderz s @r
resolve_nodeszApplyOrderBy.resolve_nodes s !+6? C C OF !%D99 &HGO[----HHJJE 5+t44D r column_namesc |d |dd }}t | | }g }|D ]M}|r4t || D ]}| | 8| | N|S )z
:param model: peewee.Model or peewee.ForeignKeyField
:param column_names: list<str>
:return: list<peewee.Node>
r rS N)ru r get_nodesappend)r} r rv restrz result
node_or_modelr s r r zApplyOrderBy.get_nodes s )O\!""-=T **5+>> " - -M
- ( 2 2=$ G G ( (DMM$''''(
m,,,,
r c g }|D ]j}t ||j d }|D ]2}| |j r| n| 3k |j | S )z
:param order_by: list<OrderBy>
:param model: peewee.Model or peewee.ForeignKeyField
:param query_builder: peewee.Query
:return: peewee.Query with applied order_by
.)ru r rv splitr r; r: )r r: r}
query_builderordersorderrz r s r __call__zApplyOrderBy.__call__ s C CE **5%2C2I2I#2N2NOOE
C
C
UZ AdiikkkTBBBB
C &}%v..r N)
r r r staticmethodstrtupler r% r r r r r ru ru s} 3 5 \& t \$
/
/
/
/
/r ru ) rh loggingr r7 peeweer r r r r r defence360agent.modelr r
r8 getLoggerr loggerr r! r( r- intrE rG ro rs ru apply_order_byr r r <module>r s 2 1 1 1 1 1 1 1
8 $ $ " " " " "I " " " I ,/ 6! ! ! ! !5 ! ! !H = = =
5/ 5/ 5/ 5/ 5/ 5/ 5/ 5/p r defence360agent/model/__pycache__/simplification.cpython-311.pyc 0000644 0000000 0000000 00000023041 00000000000 021572 0 ustar
r_j
B d dl Z d dlZd dlZd dlZd dlmZmZmZmZm Z m
Z
d dl m Z m
Z
dZ ej e Z G d de Z G d de Z G d d
e
Zd Zd e
d
ededefdZ G d de
Zd Zd Z G d d Z e Z dS ) N) BlobField CharField DateFieldForeignKeyField IntegerFieldPeeweeException)instanceModeliQ c e Zd ZdZd Zd ZdS )
FilenameFieldz/
Class to store file names in database
c * t j | S N)osfsencodeselfvalues Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/simplification.pydb_valuezFilenameField.db_value {5!!! c * t j | S r )r fsdecoder s r python_valuezFilenameField.python_value r r N)__name__
__module__ __qualname____doc__r r r r r r s< " " "" " " " "r r c e Zd ZdZd ZdS )
ScanPathField
list_of_filesc > t |t r| j S |S r )
isinstancelistREALTIME_SCAN_PATH_STUBr s r r zScanPathField.db_value& s" eT " " 0/ / r N)r r r r& r r r r r! r! # s) - r r! c e Zd ZdZdS )
ModelErrorzf
Model exception. Please use this one from other modules instead
PeeweeException directly
N)r r r r r r r r( r( , s
Dr r( c K || S )z0
Fake run_in_executor() test (DEF-4541)
r )loopcbargss r run_in_executorr- 5 s 2t9r tablenum_days max_countreturnc 4 t | dd }|s"t d | t j |t z z
}| | j | j |
| j |k }|
| j |
}|S )z
Removes records that is older that *num_days* days and
all others that are out of range *max_count* from *table*.
Returns count of rows deleted.
timestampFz#No 'timestamp' column in table {!r})getattr
ValueErrorformattime POSIX_DAYselectr3 order_bydesclimitwheredeletenot_inexecute)r. r/ r0
has_timestamp
end_save_timeto_keep
deleted_counts r remove_old_and_truncaterE < s E;66M N>EEeLLMMM IKK(Y"66M
U_%% %/&&(( ) ) y u . / / U_ 3 3G < <==EEGG r c e Zd ZdZ G d d Z ed Z edd Ze de
fd Z e d d
Z dS ) EulazKeeps track of updates and acceptions of end user license agreement.
Admins will be asked to accept EULA if the latest version is not accepted
yet.
c e Zd Zej ZdZdS ) Eula.MetaeulaN)r r r r dbdatabasedb_tabler r r MetarI ^ s ;r rN T) primary_keyN)nulldefaultr1 c t t | | j | j d d }|d u S )N ) nextiterr9 r= acceptedis_nullr: updatedr< )cls
unaccepteds r is_acceptedzEula.is_acceptedg sp
s|++--..#+&&q
T!!r c | t j | j d S )N)rV )updater7 r= rV rW r@ )rY s r acceptz Eula.acceptt sI
DIKK
((.. L " "
')))))r )r1 N)
r r r r rN r rX r rV classmethodboolr[ r^ r r r rG rG W s
iD)))G|t444H
"D
"
"
" [
" [ r rG c B d t j | d D S )Nc g | ]\ }}|S r r ).0_objs r
<listcomp>z get_models.<locals>.<listcomp>| s, As r c j t j | o t | t o
| t k S r )inspectisclass
issubclassr
)re s r <lambda>z get_models.<locals>.<lambda> s1 ,, 3&& u r )rh
getmembersmodules r
get_modelsro { s= (
r c t j t j t | d d S )NT)safe)r rK connect
create_tablesro rm s r rs rs s? K K j 0 0t <<<<<r c T e Zd Zededefd Zededefd Zd Z dS ) ApplyOrderBy column_namer1 c t | t r| j n| }dt |dd }| t ||fd st ||d }||fS )z
:param _model: peewee.Model or peewee.ForeignKeyField
:param column_name: str
:return: tuple<peewee.Node>
r OrderByNc S r r )nodess r rk z,ApplyOrderBy.resolve_nodes.<locals>.<lambda> s % r )r$ r rel_modelr4 )_modelrv modelcustom_order_bynoderz s @r
resolve_nodeszApplyOrderBy.resolve_nodes s !+6? C C OF !%D99 &HGO[----HHJJE 5+t44D r column_namesc |d |dd }}t | | }g }|D ]M}|r4t || D ]}| | 8| | N|S )z
:param model: peewee.Model or peewee.ForeignKeyField
:param column_names: list<str>
:return: list<peewee.Node>
r rS N)ru r get_nodesappend)r} r rv restrz result
node_or_modelr s r r zApplyOrderBy.get_nodes s )O\!""-=T **5+>> " - -M
- ( 2 2=$ G G ( (DMM$''''(
m,,,,
r c g }|D ]j}t ||j d }|D ]2}| |j r| n| 3k |j | S )z
:param order_by: list<OrderBy>
:param model: peewee.Model or peewee.ForeignKeyField
:param query_builder: peewee.Query
:return: peewee.Query with applied order_by
.)ru r rv splitr r; r: )r r: r}
query_builderordersorderrz r s r __call__zApplyOrderBy.__call__ s C CE **5%2C2I2I#2N2NOOE
C
C
UZ AdiikkkTBBBB
C &}%v..r N)
r r r staticmethodstrtupler r% r r r r r ru ru s} 3 5 \& t \$
/
/
/
/
/r ru ) rh loggingr r7 peeweer r r r r r defence360agent.modelr r
r8 getLoggerr loggerr r! r( r- intrE rG ro rs ru apply_order_byr r r <module>r s 2 1 1 1 1 1 1 1
8 $ $ " " " " "I " " " I ,/ 6! ! ! ! !5 ! ! !H = = =
5/ 5/ 5/ 5/ 5/ 5/ 5/ 5/p r defence360agent/model/__pycache__/tls_check.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000011073 00000000000 021460 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlmZ d dlmZ G d de Z e j
e Z ej
ZdZ G d d Z G d d
e Zd
d Zd ZdS ) N)SqliteExtDatabase)gc e Zd ZdZdS )OverridingResetz
Overriding reset could be a signal of logic error
thus need to be explicitly handled in all places where
this exception is expected to occur.
N)__name__
__module__ __qualname____doc__ T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/tls_check.pyr r s Dr r g @c & e Zd ZdefdZd Zd ZdS ) _TimedAtomicinnerc 0 || _ d| _ d| _ d S )Ng )_inner_start_caller)selfr s r
__init__z_TimedAtomic.__init__ s r c t j | _ d t j d d d | _ | j S )Nr )limit) time monotonicr join traceback format_stackr r __enter__)r s r
r! z_TimedAtomic.__enter__! sO n&& wwy 5A > > >ss CDD {$$&&&r c | j j | }t j | j z
}|t
k r!t d|| j |S )Nz"Slow transaction held for %.2fs
%s) r __exit__r r r _SLOW_TXN_THRESHOLD_Sloggerwarningr )r argsresultelapseds r
r# z_TimedAtomic.__exit__& s[ %%t,.""T[0 * * * NN5
r N)r r r objectr r! r# r r r
r r sM f
' ' '
r r c 0 e Zd Z fdZddef fd
Z xZS )SqliteDatabaseWrapperc N t |i | t j |i |S N) _validatesuper execute_sql)r r' kwargs __class__s r
r1 z!SqliteDatabaseWrapper.execute_sql3 s2 4"6""""uww"D3F333r IMMEDIATE lock_typec t | }t j d rt | S |S )NDEBUG)r0 atomicr getr )r r5 r r3 s r
r8 z SqliteDatabaseWrapper.atomic7 s; y)) 5>> ' && & r )r4 )r r r r1 strr8
__classcell__)r3 s @r
r, r, 2 sb 4 4 4 4 4 r r, c t t d rt | pt j t _ d S )Nthread_ident_memo)hasattr_thread_local_storager threading get_identr= ) new_values r
resetrC > sC $&9:: *Y(** +++r c t t dd }| t d d S |t j k r1t d|t j | | d S d S )Nr= z7wrong thread or _validate() was not preceded by reset()zFthread_ident_memo check failed [%r != %r]
context:
args: %s
kwargs: %s)getattrr? r% errorr@ rA )r' r2 r= s r
r/ r/ G s 2D NOOOOO i 1 3 3 3 3
- ! !
4 3r r. )loggingr@ r r playhouse.sqlite_extr &defence360agent.internals.global_scoper Exceptionr getLoggerr r% localr? r$ r r, rC r/ r r r
<module>rM s' 2 2 2 2 2 2 4 4 4 4 4 4 i
8 $ $' )) . -
r defence360agent/model/__pycache__/tls_check.cpython-311.pyc 0000644 0000000 0000000 00000011073 00000000000 020521 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlmZ d dlmZ G d de Z e j
e Z ej
ZdZ G d d Z G d d
e Zd
d Zd ZdS ) N)SqliteExtDatabase)gc e Zd ZdZdS )OverridingResetz
Overriding reset could be a signal of logic error
thus need to be explicitly handled in all places where
this exception is expected to occur.
N)__name__
__module__ __qualname____doc__ T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/tls_check.pyr r s Dr r g @c & e Zd ZdefdZd Zd ZdS ) _TimedAtomicinnerc 0 || _ d| _ d| _ d S )Ng )_inner_start_caller)selfr s r
__init__z_TimedAtomic.__init__ s r c t j | _ d t j d d d | _ | j S )Nr )limit) time monotonicr join traceback format_stackr r __enter__)r s r
r! z_TimedAtomic.__enter__! sO n&& wwy 5A > > >ss CDD {$$&&&r c | j j | }t j | j z
}|t
k r!t d|| j |S )Nz"Slow transaction held for %.2fs
%s) r __exit__r r r _SLOW_TXN_THRESHOLD_Sloggerwarningr )r argsresultelapseds r
r# z_TimedAtomic.__exit__& s[ %%t,.""T[0 * * * NN5
r N)r r r objectr r! r# r r r
r r sM f
' ' '
r r c 0 e Zd Z fdZddef fd
Z xZS )SqliteDatabaseWrapperc N t |i | t j |i |S N) _validatesuper execute_sql)r r' kwargs __class__s r
r1 z!SqliteDatabaseWrapper.execute_sql3 s2 4"6""""uww"D3F333r IMMEDIATE lock_typec t | }t j d rt | S |S )NDEBUG)r0 atomicr getr )r r5 r r3 s r
r8 z SqliteDatabaseWrapper.atomic7 s; y)) 5>> ' && & r )r4 )r r r r1 strr8
__classcell__)r3 s @r
r, r, 2 sb 4 4 4 4 4 r r, c t t d rt | pt j t _ d S )Nthread_ident_memo)hasattr_thread_local_storager threading get_identr= ) new_values r
resetrC > sC $&9:: *Y(** +++r c t t dd }| t d d S |t j k r1t d|t j | | d S d S )Nr= z7wrong thread or _validate() was not preceded by reset()zFthread_ident_memo check failed [%r != %r]
context:
args: %s
kwargs: %s)getattrr? r% errorr@ rA )r' r2 r= s r
r/ r/ G s 2D NOOOOO i 1 3 3 3 3
- ! !
4 3r r. )loggingr@ r r playhouse.sqlite_extr &defence360agent.internals.global_scoper Exceptionr getLoggerr r% localr? r$ r r, rC r/ r r r
<module>rM s' 2 2 2 2 2 2 4 4 4 4 4 4 i
8 $ $' )) . -
r defence360agent/model/__pycache__/wordpress.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006320 00000000000 021550 0 ustar
r_j ~ d dl mZ d dlmZ d dlmZmZmZmZ d dl m
Z
m Z G d de Z G d de Z
d S )
) annotations)
NamedTuple) CharField
FloatField IntegerFieldTimestampField)instanceModelc h e Zd ZU ded< ded< ded< dZded< edd Zdd Zd
Zd Z dS )WPSitestrdocrootdomainintuid1.0.0versionsite
WordpressSitereturnc H | |j |j |j |j S )z7Create a WPSite instance from a WordpressSite instance.r r r r r )clsr s T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/wordpress.pyfrom_wordpress_sitezWPSite.from_wordpress_site s1 sL;L
c F t | j | j | j | S )z5Create a new WPSite instance with an updated version.r )r r r r )selfr s r build_with_versionzWPSite.build_with_version s+ L;
r c t |t st S | j | j | j f|j |j |j fk S N)
isinstancer NotImplementedr r r )r others r __eq__z
WPSite.__eq__! sH %(( "! ! dk484 M L I9
r c D t | j | j | j f S r! )hashr r r )r s r __hash__zWPSite.__hash__+ s T\4;9:::r N)r r r r )r r
r r )
__name__
__module__ __qualname____annotations__r classmethodr r r% r( r r r r s LLLKKK HHHG
[
; ; ; ; ;r r c e Zd Z G d d Z edd Z ed Z ed Z e dd Z
ed d Z e dd
Z
dS ) r c e Zd Zej ZdZdS )WordpressSite.Metawordpress_siteN)r) r* r+ r dbdatabasedb_tabler. r r Metar1 0 s ;#r r6 TF) primary_keynull)r8 N)defaultr8 r )r8 r9 )r) r* r+ r6 r r r r r r manually_deleted_atr r disabled_rules_sync_tsr. r r r r / s $ $ $ $ $ $ $ $ iDu555G
YE
"
"
"F
,E
"
"
"C(.DAAAie444G 'ZT4 @ @ @r r N)
__future__r typingr peeweer r r r defence360agent.modelr r
r r r. r r <module>r@ s " " " " " " F F F F F F F F F F F F 1 1 1 1 1 1 1 1$; $; $; $; $;Z $; $; $;N
A
A
A
A
AE
A
A
A
A
Ar defence360agent/model/__pycache__/wordpress.cpython-311.pyc 0000644 0000000 0000000 00000006320 00000000000 020611 0 ustar
r_j ~ d dl mZ d dlmZ d dlmZmZmZmZ d dl m
Z
m Z G d de Z G d de Z
d S )
) annotations)
NamedTuple) CharField
FloatField IntegerFieldTimestampField)instanceModelc h e Zd ZU ded< ded< ded< dZded< edd Zdd Zd
Zd Z dS )WPSitestrdocrootdomainintuid1.0.0versionsite
WordpressSitereturnc H | |j |j |j |j S )z7Create a WPSite instance from a WordpressSite instance.r r r r r )clsr s T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/wordpress.pyfrom_wordpress_sitezWPSite.from_wordpress_site s1 sL;L
c F t | j | j | j | S )z5Create a new WPSite instance with an updated version.r )r r r r )selfr s r build_with_versionzWPSite.build_with_version s+ L;
r c t |t st S | j | j | j f|j |j |j fk S N)
isinstancer NotImplementedr r r )r others r __eq__z
WPSite.__eq__! sH %(( "! ! dk484 M L I9
r c D t | j | j | j f S r! )hashr r r )r s r __hash__zWPSite.__hash__+ s T\4;9:::r N)r r r r )r r
r r )
__name__
__module__ __qualname____annotations__r classmethodr r r% r( r r r r s LLLKKK HHHG
[
; ; ; ; ;r r c e Zd Z G d d Z edd Z ed Z ed Z e dd Z
ed d Z e dd
Z
dS ) r c e Zd Zej ZdZdS )WordpressSite.Metawordpress_siteN)r) r* r+ r dbdatabasedb_tabler. r r Metar1 0 s ;#r r6 TF) primary_keynull)r8 N)defaultr8 r )r8 r9 )r) r* r+ r6 r r r r r r manually_deleted_atr r disabled_rules_sync_tsr. r r r r / s $ $ $ $ $ $ $ $ iDu555G
YE
"
"
"F
,E
"
"
"C(.DAAAie444G 'ZT4 @ @ @r r N)
__future__r typingr peeweer r r r defence360agent.modelr r
r r r. r r <module>r@ s " " " " " " F F F F F F F F F F F F 1 1 1 1 1 1 1 1$; $; $; $; $;Z $; $; $;N
A
A
A
A
AE
A
A
A
A
Ar defence360agent/model/__pycache__/wordpress_incident.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000063402 00000000000 023431 0 ustar
r_jM " d Z ddlZddlZddlZddlmZ ddlmZmZ ddl m
Z
ddl m Z m
Z
ddlmZmZmZmZmZmZmZ ddlmZmZ dd lmZ dd
lm Z m Z dd l m Z dd l m!Z! dd
l"m#Z#m$Z$ ej% e& Z' e( Z)dZ*dZ+dZ,dZ- G d de Z.de/de/de/fdZ0e)fde/de/de/fdZ1ed Z2de3dz de3dz fdZ4de/de/de.fd Z5d e6e/ de6e/ fd Z7d e.de/fd Z8 d=d#e9d$e9d%e9dz d&e3dz d'e3dz d(e3dz d)e3dz d*e3dz d+e9dz d,e9dz d-e6dz d.e:fd/Z;d0e6e/ de9fd1Z< d>d#e9d3e e9 de6e/ fd4Z=d5e
e9e9f de9fd6Z>e-fd7e9d#e9dz fd8Z?de/de3fd9Z@d:e3dz de9fd;ZAde3dz fd<ZBdS )?a0 Helper functions for WordPress CVE protection incidents.
WordPress incidents are stored in a dedicated wordpress_incident table with
plugin-specific data stored in the extra_info JSON field.
This module provides helper functions to work with WordPress incidents.
Available for both AV and IM360 modes.
N) defaultdict) ExitStackcontextmanager) timedelta)IterableMapping)EXCLUDEDSQL CharField
FloatField IntegerField TextFieldfn) JSONFieldr )geo)Modelinstance)apply_order_by)OrderBy)CHUNK_SIZE_SQL_QUERYsplit_for_chunk< )abusernamepluginruleseveritydomainbucket2 i c e Zd ZdZ edd Z ed Z ed Z e d Z
ed Z ed Z ed Z
ed Z ed Z edd Z edd Z ed Z ed Z ed d
d ed g Z G d
d ZdS )WordpressIncidentaI
WordPress incident model for CVE protection.
Uses dedicated wordpress_incident table created in migration 191.
Repeats of the same attack are aggregated per minute: the unique
constraint on (abuser, name, plugin, rule, severity, domain, bucket)
keeps one row per aggregation window, counted by retries.
T) primary_keynull)r$
country_id)r$ column_nameN)r$ defaultFr z DEFAULT 0)r$ r' index constraintsc * e Zd Zej ZdZedffZdS )WordpressIncident.Metawordpress_incidentTN) __name__
__module__ __qualname__r dbdatabasedb_table
AGGREGATE_KEYindexes ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/wordpress_incident.pyMetar+ ^ s' ;'!4(*r6 r8 )r- r. r/ __doc__r
idr r r r timestampretriesr r r descriptionr countryr r
extra_infor r
unsent_retriesr8 r5 r6 r7 r" r" : si
$T 2 2 2B
YD
!
!
!F 9$ D
%%%Il%%%G|&&&H 9$ D)&&&K
YD
!
!
!FiT|<<<G
YD$
/
/
/F%%%J
\t
$
$
$F "\
S%%& N+ + + + + + + + + +r6 r"
incident_data site_inforeturnc t | d }t | d }t | d }i d| d d| d d| d d| d d| d d | d d
| d
d | d d | d d
| d d| d d| d d| d d| d d| d d| d d| d | d |||| d d S ) aI
Build extra_info dict from incident data and site information.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username, user_id)
Returns:
Dict with all WordPress-specific fields for extra_info JSON column
FILES GET_NAMES
POST_NAMEScvemodetargetslugversionuser_logged_inusernameuser_id site_pathrequest_methodREQUEST_METHODscript_filenameSCRIPT_FILENAMEphp_selfPHP_SELF path_info PATH_INFO request_uri REQUEST_URI query_string QUERY_STRINGhttp_x_forwarded_forHTTP_X_FORWARDED_FORhttp_user_agentHTTP_USER_AGENT HTTP_REFERERRAW_DATA) http_refererfiles get_names
post_namesraw_data)serialize_json_fieldget)rA rB
files_jsonget_names_jsonpost_names_jsons r7 build_extra_inform d sR &m&7&7&@&@AAJ)-*;*;K*H*HIIN*=+<+<\+J+JKKO
} ''
!!&)) -##H--
!!&)) =$$Y//
-++,<== IMM*-- 9==++ Y]];// -++,<== =,,->?? M%%j11 ]&&{33 }(( 77! "
)).99# $
1 12H I I% & =,,->??' ( &)).99#%!%%j113 r6 c
| d pt | }t | | }| d p| d }|t u r7t 5 }t || }ddd n # 1 swxY w Y nt || }t
| dd }d| dd |t |t z d
t | d d | d
d |||| d |d S )a
Build complete incident dict ready for database insertion.
This is used for both single incident creation and bulk insertion.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username, user_id)
geo_reader: An open geo Reader (or None) to resolve the abuser country.
Pass one from country_reader() when building many incidents in a
loop to avoid reopening the mmdb per incident. When omitted, a
short-lived reader is opened for this single call.
Returns:
Dict with all fields ready for Incident.create() or bulk insert
message REMOTE_ADDR attacker_ipNtsr wordpressrule_idunknown rI zWordPress CVE: rH Unknownr ) r r r; r r< r r r= r r> r r? )
ri build_message_fallbackrm _UNSETcountry_reader
_country_codefloatintBUCKET_SECONDScalculate_severity) rA rB
geo_readerro r? abuser_ipreaderr> r; s r7 build_incident_dictr s & ** .D/ /G "-;;J !!-00 M4E4E5 5I V
7#FI66G 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7
I66m''a0011I !!)Y77 i>122&}'8'8'@'@AAG-"3"3E9"E"EGG --)) s 6BBBc # 4 K t 5 } | t j }nB# t $ r5}t
d| dV Y d}~ddd dS d}~ww xY w|V ddd dS # 1 swxY w Y dS )zYield an open geo Reader, or None when the mmdb can't be opened.
Lets bulk callers open the mmap'd reader once instead of per incident,
while keeping enrichment non-blocking when the geo bundle is missing.
z GeoIP reader unavailable: %sN)r
enter_contextr r Exceptionloggerdebug)stackr excs r7 rz rz s
(( 66FF LL7 = = =JJJ FFF
s7 B
&:B
A9 A4#B
4A99B
BBipc | |sd S | | S # t $ r'}t d|| Y d }~d S d }~ww xY w)Nz GeoIP lookup failed for %s: %s)get_coder r r )r r r s r7 r{ r{ sj
~R~tr""" 5r3???ttttts
A A Ac D t | | }t j di |S )aD
Create a WordPress incident in the wordpress_incident table.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username)
Returns:
WordpressIncident instance with WordPress fields populated in extra_info
r5 )r r" create)rA rB
incident_dicts r7 create_wordpress_incidentr s* (
yAAM # 4 4m 4 44r6 incident_dictsc R i }| D ]t fdt D }| | }|t ||< L|dxx d z
cc< t |d d |d< t | S )zACollapse incidents sharing an aggregate key into one counted row.c 3 ( K | ] }| V
d S )Nr5 ).0fieldr s r7 <genexpr>z+aggregate_incident_dicts.<locals>.<genexpr> s( DDUM%(DDDDDDr6 Nr< r; )tupler3 ri dictminlistvalues)r groupskeygroupr s @r7 aggregate_incident_dictsr s !#F'
DDDDmDDDDD
3 = }--F3K
iM) 44 +
k :
k
r6 incidentc
| j | j | j | j | j | j | j | j | j | j | j
| j d S )z
Convert a WordpressIncident model instance to a dictionary.
Args:
incident: WordpressIncident model instance
Returns:
Dictionary representation of the incident
r: r r r; r< r r r= r r> r r? r )r s r7 wordpress_incident_to_dictr sU k/
'# %
+/#/ )
r6 FlimitoffsetrO by_abuser_ipby_country_code by_domainsearch site_searchsincetoorder_byinclude_hiddenc t t t j dk } | sR| t j t j d z } |6| t j t j d |k } |2| t j
| } |#| t j |k } |2| t j
| } || t j | t j | z t j
| z t j
| z } |6| t j t j d |k } |6| t j d |k } | 6| t j d | k } |
pg }
|
D ]T}t% |t& r(|
t+ j | ?|
| Ut/ |
t | } n1| t j } | | } | | } d | D S )a
Get WordPress incidents as dictionaries.
Args:
limit: Maximum number of incidents to return
offset: Offset for pagination
user_id: Filter by user ID (None = all)
by_abuser_ip: Filter by abuser IP address (None = all)
by_country_code: Filter by country code (None = all)
by_domain: Filter by domain (None = all)
search: Search in IP address, name, description, or domain (None = all)
site_search: Filter by site path in extra_info (None = all)
since: Filter by timestamp >= this value (unix timestamp, None = all)
to: Filter by timestamp <= this value (unix timestamp, None = all)
order_by: List of fields to order by (None = default order by timestamp desc).
Can be either strings (e.g., ["timestamp+", "severity-"]) or
OrderBy objects. Strings are automatically converted.
include_hidden: When False (default), exclude incidents whose rule has
the TEST- prefix (internal probe rules that the WordPress
plugin hides from its admin UI).
Returns:
List of incident dictionaries
rs zTEST-Nz $.user_idz $.site_pathREALc , g | ]}t | S r5 )r )r incs r7
<listcomp>z+get_wordpress_incidents.<locals>.<listcomp> s! G G G &s + + G G Gr6 ) r" selectwherer r is_null
startswithr json_extractr? r containsr> r r r= r; cast
isinstancestrappendr
fromstringr r descr r execute)r r rO r r r r r r r r r queryconverted_order_byitems r7 get_wordpress_incidentsr s L
$ $%6 7 7 = = ![ 0
E
" * * , , %00999
:
O - 8+ F F
- 4 = =l K KLL" - 5 HII - 4 = =i H HII
" + +F 3 3 +44V<<
= &//77
8 &//77
8
O - 8- H H
- 7 < <V D D MNN ~ - 7 < <V D D JKK 0 0D$$$
0"))'*<T*B*BCCCC"))$//// 13DeLL 0 : ? ? A ABB KK E LL E G Gu}} G G GGr6 incidents_datac | sdS d t D }d | D }t j j 5 t dt
| t D ]}|||t z }t | |t j
t j
t j
z t j t j t j
z t j
t j t j
t j
i ddd n # 1 swxY w Y t
| S )z@Store aggregated incidents, merging repeats into the stored row.r c 8 g | ]}t t | S r5 )getattrr" )r r s r7 r z3bulk_create_wordpress_incidents.<locals>.<listcomp> s0 .3!5)) r6 c H g | ] }i |d | d pdi S )r@ r< rv )ri )r r s r7 r z3bulk_create_wordpress_incidents.<locals>.<listcomp> sJ E8D%x||I'>'>'C!DD r6 )conflict_targetupdateN)r3 r" _metar1 atomicrangelenINSERT_CHUNK_SIZE insert_many on_conflictr< r r@ r; peewee_fnMINr )r r rowsstartchunks r7 bulk_create_wordpress_incidentsr s q 7D O
& D
) 0 0 2 2 1c$ii):;; E):!::;E ) )% 0 0 < < /%-)1H4DD
&4)88;KK%/ )3X5G2 2
=
giiii% * ~ s C3EE E r5 exclude_idsc J t | }t t t j dk t j dk z t j t j
| t | z }g }|D ]N}|j |v r | i t | d|j i t | | k r nO|S )zGet incidents carrying occurrences correlation has not acknowledged
yet, oldest first.
Unlike get_wordpress_incidents() this keeps TEST- rules: they are hidden
from the WordPress admin UI but still belong in correlation.
rs r r@ )setr" r r r r@ r r; ascr: r r r r )r r r incidentsrows r7 get_unsent_wordpress_incidentsr s/ k""K
!233
%
4 /!3
5
' + + - -/@/C/G/G/I/I
us;''' ( ( I 6[
,S11
#"4
y>>U " " E # r6 reportedc t t }| D ]&\ }}|dk r|| | 'd}t j j 5 | D ]\ }}t |t D ]}|t
t j dt j
|z
t j | z
} ddd n # 1 swxY w Y |S )zDiscount the occurrences correlation acknowledged.
Subtracts instead of clearing so that occurrences merged into a row while
its message was in flight stay pending rather than being dropped.
r )
chunk_size)r@ N)r r itemsr r" r r1 r r r r r MAXr@ r r: in_r )r by_amount incident_idamountsettled incident_idsr s r7 #settle_wordpress_incidents_reportedr s D!!I '~~ / / 2 2 V A:: f $ $[ 1 1 1G
) 0 0 2 2
$-OO$5$5 FL( )=
%,,')v 0 ?& H( ( -
U,/33E::;; WYY
Ns 5B4D66D:=D:daysc t j t | z
}t j dk }t j d |k }|ot t j t j
d | d u}|rt t j
| t j
| }|t j
| z }t ||z S )N)r rs r rv )timer
total_secondsr" r r; r r r r r r scalarr: r not_indeleter )r r cutoff_time is_wordpressstaleover_capkeeps r7 delete_old_wordpress_incidentsr sc )++ t 4 4 4 B B D DDK$+{:L ' , ,V 4 4{ BE $ $%6%@ A A
X'16688
9
9
U1XX
VE]]
VXX
3 $ $%6%9 : :
UE6]]
X'16688
9
9
U5\\
"%,,T222 # # % % + +L5,@ A A I I K KKr6 c dg}| d r| | d | d r| | d | d r| | d | d r| | d | d r| | d d | S )z=Build message if plugin didn't provide one (per spec format).z
IM WP plugin:rt rH rK rL rI )ri r join)rA partss r7 rx rx s
E## /
]9-... +
]5)*** ,
]6*+++## /
]9-... ,
]6*+++ 88E??r6 rI c & | dk rdS | dk rdS dS )z!Calculate severity based on mode.block pass r5 )rI s r7 r r . s# wq
qqr6 c ` | dS t | t r| S t j | S )z>Serialize a value to JSON string if it's not already a string.N)r r jsondumps)values r7 rh rh 8 s3 }t% :e r6 ) r r NNNNNNNNNF)r5 )Cr9 loggingr r collectionsr
contextlibr r datetimer typingr r peeweer r
r r r
r r r playhouse.sqlite_extr defence360agent.internalsr defence360agent.modelr r $defence360agent.model.simplificationr "defence360agent.rpc_tools.validater defence360agent.utilsr r getLoggerr- r objectry r~ r3 r MAX_STORED_INCIDENTSr" r rm r rz r r{ r r r r r} boolr r r r r rx r rh r5 r6 r7 <module>r s # # # # # # 0 0 0 0 0 0 0 0 $ $ $ $ $ $ $ $ / . . . . . . . ) ) ) ) ) ) 1 1 1 1 1 1 1 1 ? ? ? ? ? ? 6 6 6 6 6 6 G G G G G G G G 8 $ $
'+ '+ '+ '+ '+ '+ '+ '+T*D *T *d * * * *\ 6<2 22$(2 2 2 2 2j
cDj S4Z 55$(55 5 5 5"!T$Z !DJ ! ! ! !(): t 6 #"& " dH dH dH dH 4ZdH * dH
4Z dH Tz
dH
$JdH tdH :dH d
dH TkdH dH dH dH dHN& DJ & 3 & & & & V "$( ( (# (
$Z( ( ( (V '#s(2C @ $8 L L
LDj L L L LD$ 3 $S4Z C 3: r6 defence360agent/model/__pycache__/wordpress_incident.cpython-311.pyc 0000644 0000000 0000000 00000063402 00000000000 022472 0 ustar
r_jM " d Z ddlZddlZddlZddlmZ ddlmZmZ ddl m
Z
ddl m Z m
Z
ddlmZmZmZmZmZmZmZ ddlmZmZ dd lmZ dd
lm Z m Z dd l m Z dd l m!Z! dd
l"m#Z#m$Z$ ej% e& Z' e( Z)dZ*dZ+dZ,dZ- G d de Z.de/de/de/fdZ0e)fde/de/de/fdZ1ed Z2de3dz de3dz fdZ4de/de/de.fd Z5d e6e/ de6e/ fd Z7d e.de/fd Z8 d=d#e9d$e9d%e9dz d&e3dz d'e3dz d(e3dz d)e3dz d*e3dz d+e9dz d,e9dz d-e6dz d.e:fd/Z;d0e6e/ de9fd1Z< d>d#e9d3e e9 de6e/ fd4Z=d5e
e9e9f de9fd6Z>e-fd7e9d#e9dz fd8Z?de/de3fd9Z@d:e3dz de9fd;ZAde3dz fd<ZBdS )?a0 Helper functions for WordPress CVE protection incidents.
WordPress incidents are stored in a dedicated wordpress_incident table with
plugin-specific data stored in the extra_info JSON field.
This module provides helper functions to work with WordPress incidents.
Available for both AV and IM360 modes.
N) defaultdict) ExitStackcontextmanager) timedelta)IterableMapping)EXCLUDEDSQL CharField
FloatField IntegerField TextFieldfn) JSONFieldr )geo)Modelinstance)apply_order_by)OrderBy)CHUNK_SIZE_SQL_QUERYsplit_for_chunk< )abusernamepluginruleseveritydomainbucket2 i c e Zd ZdZ edd Z ed Z ed Z e d Z
ed Z ed Z ed Z
ed Z ed Z edd Z edd Z ed Z ed Z ed d
d ed g Z G d
d ZdS )WordpressIncidentaI
WordPress incident model for CVE protection.
Uses dedicated wordpress_incident table created in migration 191.
Repeats of the same attack are aggregated per minute: the unique
constraint on (abuser, name, plugin, rule, severity, domain, bucket)
keeps one row per aggregation window, counted by retries.
T) primary_keynull)r$
country_id)r$ column_nameN)r$ defaultFr z DEFAULT 0)r$ r' index constraintsc * e Zd Zej ZdZedffZdS )WordpressIncident.Metawordpress_incidentTN) __name__
__module__ __qualname__r dbdatabasedb_table
AGGREGATE_KEYindexes ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/wordpress_incident.pyMetar+ ^ s' ;'!4(*r6 r8 )r- r. r/ __doc__r
idr r r r timestampretriesr r r descriptionr countryr r
extra_infor r
unsent_retriesr8 r5 r6 r7 r" r" : si
$T 2 2 2B
YD
!
!
!F 9$ D
%%%Il%%%G|&&&H 9$ D)&&&K
YD
!
!
!FiT|<<<G
YD$
/
/
/F%%%J
\t
$
$
$F "\
S%%& N+ + + + + + + + + +r6 r"
incident_data site_inforeturnc t | d }t | d }t | d }i d| d d| d d| d d| d d| d d | d d
| d
d | d d | d d
| d d| d d| d d| d d| d d| d d| d d| d | d |||| d d S ) aI
Build extra_info dict from incident data and site information.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username, user_id)
Returns:
Dict with all WordPress-specific fields for extra_info JSON column
FILES GET_NAMES
POST_NAMEScvemodetargetslugversionuser_logged_inusernameuser_id site_pathrequest_methodREQUEST_METHODscript_filenameSCRIPT_FILENAMEphp_selfPHP_SELF path_info PATH_INFO request_uri REQUEST_URI query_string QUERY_STRINGhttp_x_forwarded_forHTTP_X_FORWARDED_FORhttp_user_agentHTTP_USER_AGENT HTTP_REFERERRAW_DATA) http_refererfiles get_names
post_namesraw_data)serialize_json_fieldget)rA rB
files_jsonget_names_jsonpost_names_jsons r7 build_extra_inform d sR &m&7&7&@&@AAJ)-*;*;K*H*HIIN*=+<+<\+J+JKKO
} ''
!!&)) -##H--
!!&)) =$$Y//
-++,<== IMM*-- 9==++ Y]];// -++,<== =,,->?? M%%j11 ]&&{33 }(( 77! "
)).99# $
1 12H I I% & =,,->??' ( &)).99#%!%%j113 r6 c
| d pt | }t | | }| d p| d }|t u r7t 5 }t || }ddd n # 1 swxY w Y nt || }t
| dd }d| dd |t |t z d
t | d d | d
d |||| d |d S )a
Build complete incident dict ready for database insertion.
This is used for both single incident creation and bulk insertion.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username, user_id)
geo_reader: An open geo Reader (or None) to resolve the abuser country.
Pass one from country_reader() when building many incidents in a
loop to avoid reopening the mmdb per incident. When omitted, a
short-lived reader is opened for this single call.
Returns:
Dict with all fields ready for Incident.create() or bulk insert
message REMOTE_ADDR attacker_ipNtsr wordpressrule_idunknown rI zWordPress CVE: rH Unknownr ) r r r; r r< r r r= r r> r r? )
ri build_message_fallbackrm _UNSETcountry_reader
_country_codefloatintBUCKET_SECONDScalculate_severity) rA rB
geo_readerro r? abuser_ipreaderr> r; s r7 build_incident_dictr s & ** .D/ /G "-;;J !!-00 M4E4E5 5I V
7#FI66G 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7
I66m''a0011I !!)Y77 i>122&}'8'8'@'@AAG-"3"3E9"E"EGG --)) s 6BBBc # 4 K t 5 } | t j }nB# t $ r5}t
d| dV Y d}~ddd dS d}~ww xY w|V ddd dS # 1 swxY w Y dS )zYield an open geo Reader, or None when the mmdb can't be opened.
Lets bulk callers open the mmap'd reader once instead of per incident,
while keeping enrichment non-blocking when the geo bundle is missing.
z GeoIP reader unavailable: %sN)r
enter_contextr r Exceptionloggerdebug)stackr excs r7 rz rz s
(( 66FF LL7 = = =JJJ FFF
s7 B
&:B
A9 A4#B
4A99B
BBipc | |sd S | | S # t $ r'}t d|| Y d }~d S d }~ww xY w)Nz GeoIP lookup failed for %s: %s)get_coder r r )r r r s r7 r{ r{ sj
~R~tr""" 5r3???ttttts
A A Ac D t | | }t j di |S )aD
Create a WordPress incident in the wordpress_incident table.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username)
Returns:
WordpressIncident instance with WordPress fields populated in extra_info
r5 )r r" create)rA rB
incident_dicts r7 create_wordpress_incidentr s* (
yAAM # 4 4m 4 44r6 incident_dictsc R i }| D ]t fdt D }| | }|t ||< L|dxx d z
cc< t |d d |d< t | S )zACollapse incidents sharing an aggregate key into one counted row.c 3 ( K | ] }| V
d S )Nr5 ).0fieldr s r7 <genexpr>z+aggregate_incident_dicts.<locals>.<genexpr> s( DDUM%(DDDDDDr6 Nr< r; )tupler3 ri dictminlistvalues)r groupskeygroupr s @r7 aggregate_incident_dictsr s !#F'
DDDDmDDDDD
3 = }--F3K
iM) 44 +
k :
k
r6 incidentc
| j | j | j | j | j | j | j | j | j | j | j
| j d S )z
Convert a WordpressIncident model instance to a dictionary.
Args:
incident: WordpressIncident model instance
Returns:
Dictionary representation of the incident
r: r r r; r< r r r= r r> r r? r )r s r7 wordpress_incident_to_dictr sU k/
'# %
+/#/ )
r6 FlimitoffsetrO by_abuser_ipby_country_code by_domainsearch site_searchsincetoorder_byinclude_hiddenc t t t j dk } | sR| t j t j d z } |6| t j t j d |k } |2| t j
| } |#| t j |k } |2| t j
| } || t j | t j | z t j
| z t j
| z } |6| t j t j d |k } |6| t j d |k } | 6| t j d | k } |
pg }
|
D ]T}t% |t& r(|
t+ j | ?|
| Ut/ |
t | } n1| t j } | | } | | } d | D S )a
Get WordPress incidents as dictionaries.
Args:
limit: Maximum number of incidents to return
offset: Offset for pagination
user_id: Filter by user ID (None = all)
by_abuser_ip: Filter by abuser IP address (None = all)
by_country_code: Filter by country code (None = all)
by_domain: Filter by domain (None = all)
search: Search in IP address, name, description, or domain (None = all)
site_search: Filter by site path in extra_info (None = all)
since: Filter by timestamp >= this value (unix timestamp, None = all)
to: Filter by timestamp <= this value (unix timestamp, None = all)
order_by: List of fields to order by (None = default order by timestamp desc).
Can be either strings (e.g., ["timestamp+", "severity-"]) or
OrderBy objects. Strings are automatically converted.
include_hidden: When False (default), exclude incidents whose rule has
the TEST- prefix (internal probe rules that the WordPress
plugin hides from its admin UI).
Returns:
List of incident dictionaries
rs zTEST-Nz $.user_idz $.site_pathREALc , g | ]}t | S r5 )r )r incs r7
<listcomp>z+get_wordpress_incidents.<locals>.<listcomp> s! G G G &s + + G G Gr6 ) r" selectwherer r is_null
startswithr json_extractr? r containsr> r r r= r; cast
isinstancestrappendr
fromstringr r descr r execute)r r rO r r r r r r r r r queryconverted_order_byitems r7 get_wordpress_incidentsr s L
$ $%6 7 7 = = ![ 0
E
" * * , , %00999
:
O - 8+ F F
- 4 = =l K KLL" - 5 HII - 4 = =i H HII
" + +F 3 3 +44V<<
= &//77
8 &//77
8
O - 8- H H
- 7 < <V D D MNN ~ - 7 < <V D D JKK 0 0D$$$
0"))'*<T*B*BCCCC"))$//// 13DeLL 0 : ? ? A ABB KK E LL E G Gu}} G G GGr6 incidents_datac | sdS d t D }d | D }t j j 5 t dt
| t D ]}|||t z }t | |t j
t j
t j
z t j t j t j
z t j
t j t j
t j
i ddd n # 1 swxY w Y t
| S )z@Store aggregated incidents, merging repeats into the stored row.r c 8 g | ]}t t | S r5 )getattrr" )r r s r7 r z3bulk_create_wordpress_incidents.<locals>.<listcomp> s0 .3!5)) r6 c H g | ] }i |d | d pdi S )r@ r< rv )ri )r r s r7 r z3bulk_create_wordpress_incidents.<locals>.<listcomp> sJ E8D%x||I'>'>'C!DD r6 )conflict_targetupdateN)r3 r" _metar1 atomicrangelenINSERT_CHUNK_SIZE insert_many on_conflictr< r r@ r; peewee_fnMINr )r r rowsstartchunks r7 bulk_create_wordpress_incidentsr s q 7D O
& D
) 0 0 2 2 1c$ii):;; E):!::;E ) )% 0 0 < < /%-)1H4DD
&4)88;KK%/ )3X5G2 2
=
giiii% * ~ s C3EE E r5 exclude_idsc J t | }t t t j dk t j dk z t j t j
| t | z }g }|D ]N}|j |v r | i t | d|j i t | | k r nO|S )zGet incidents carrying occurrences correlation has not acknowledged
yet, oldest first.
Unlike get_wordpress_incidents() this keeps TEST- rules: they are hidden
from the WordPress admin UI but still belong in correlation.
rs r r@ )setr" r r r r@ r r; ascr: r r r r )r r r incidentsrows r7 get_unsent_wordpress_incidentsr s/ k""K
!233
%
4 /!3
5
' + + - -/@/C/G/G/I/I
us;''' ( ( I 6[
,S11
#"4
y>>U " " E # r6 reportedc t t }| D ]&\ }}|dk r|| | 'd}t j j 5 | D ]\ }}t |t D ]}|t
t j dt j
|z
t j | z
} ddd n # 1 swxY w Y |S )zDiscount the occurrences correlation acknowledged.
Subtracts instead of clearing so that occurrences merged into a row while
its message was in flight stay pending rather than being dropped.
r )
chunk_size)r@ N)r r itemsr r" r r1 r r r r r MAXr@ r r: in_r )r by_amount incident_idamountsettled incident_idsr s r7 #settle_wordpress_incidents_reportedr s D!!I '~~ / / 2 2 V A:: f $ $[ 1 1 1G
) 0 0 2 2
$-OO$5$5 FL( )=
%,,')v 0 ?& H( ( -
U,/33E::;; WYY
Ns 5B4D66D:=D:daysc t j t | z
}t j dk }t j d |k }|ot t j t j
d | d u}|rt t j
| t j
| }|t j
| z }t ||z S )N)r rs r rv )timer
total_secondsr" r r; r r r r r r scalarr: r not_indeleter )r r cutoff_time is_wordpressstaleover_capkeeps r7 delete_old_wordpress_incidentsr sc )++ t 4 4 4 B B D DDK$+{:L ' , ,V 4 4{ BE $ $%6%@ A A
X'16688
9
9
U1XX
VE]]
VXX
3 $ $%6%9 : :
UE6]]
X'16688
9
9
U5\\
"%,,T222 # # % % + +L5,@ A A I I K KKr6 c dg}| d r| | d | d r| | d | d r| | d | d r| | d | d r| | d d | S )z=Build message if plugin didn't provide one (per spec format).z
IM WP plugin:rt rH rK rL rI )ri r join)rA partss r7 rx rx s
E## /
]9-... +
]5)*** ,
]6*+++## /
]9-... ,
]6*+++ 88E??r6 rI c & | dk rdS | dk rdS dS )z!Calculate severity based on mode.block pass r5 )rI s r7 r r . s# wq
qqr6 c ` | dS t | t r| S t j | S )z>Serialize a value to JSON string if it's not already a string.N)r r jsondumps)values r7 rh rh 8 s3 }t% :e r6 ) r r NNNNNNNNNF)r5 )Cr9 loggingr r collectionsr
contextlibr r datetimer typingr r peeweer r
r r r
r r r playhouse.sqlite_extr defence360agent.internalsr defence360agent.modelr r $defence360agent.model.simplificationr "defence360agent.rpc_tools.validater defence360agent.utilsr r getLoggerr- r objectry r~ r3 r MAX_STORED_INCIDENTSr" r rm r rz r r{ r r r r r} boolr r r r r rx r rh r5 r6 r7 <module>r s # # # # # # 0 0 0 0 0 0 0 0 $ $ $ $ $ $ $ $ / . . . . . . . ) ) ) ) ) ) 1 1 1 1 1 1 1 1 ? ? ? ? ? ? 6 6 6 6 6 6 G G G G G G G G 8 $ $
'+ '+ '+ '+ '+ '+ '+ '+T*D *T *d * * * *\ 6<2 22$(2 2 2 2 2j
cDj S4Z 55$(55 5 5 5"!T$Z !DJ ! ! ! !(): t 6 #"& " dH dH dH dH 4ZdH * dH
4Z dH Tz
dH
$JdH tdH :dH d
dH TkdH dH dH dH dHN& DJ & 3 & & & & V "$( ( (# (
$Z( ( ( (V '#s(2C @ $8 L L
LDj L L L LD$ 3 $S4Z C 3: r6 defence360agent/model/__pycache__/wp_disabled_rule.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000043352 00000000000 023032 0 ustar
r_j< d Z ddlmZ ddlZddlZddlmZmZmZm Z m
Z
m Z ddl m
Z
mZ ej e Z G d de
Zdee d dfd
ZdS ) a WordPress-specific disabled rules data model.
This module provides a separate data model for WordPress disabled rules,
independent of the existing DisabledRule/DisabledRuleDomain models used
by modsec/ossec plugins.
Disable Behavior:
Global and domain-level disables are independent and can coexist.
A rule is considered effectively disabled for a given WordPress domain
if EITHER of these conditions is true:
- A global disable exists for the rule (applies to all domains)
- A domain-specific disable exists for the rule and that domain
Enabling a rule at one scope does not affect disables at the other scope.
For example, removing a global disable leaves any domain-specific disables
intact, and vice versa.
)IteratorN) CharField
FloatField IntegerFieldIntegrityErrorPrimaryKeyFieldfn)Modelinstancec e Zd ZdZ G d d Z e Z ed Z ed Z ed Z
e d Z ed Z
ed ZdZdZd Zd
Ze d$d ed
ee d z dededed z def d Zed ededededef
d Zed ed
ee dedededef d Zed ededed z dededede fd Z ed ed
ee d z defd Z ed$d eded z de fd Z e d%dede dee fd Z ede!e fd Z"ed ee d z de fd Z#e d&d!ed"ed ee d z de de$eee% f f
d# Z&d S )'WPDisabledRulezStores disabled WordPress protection rules.
Uses a scope-based design:
- scope='global', scope_value=NULL: Rule disabled for all domains (root only)
- scope='domain', scope_value='example.com': Rule disabled for specific domain
c $ e Zd Zej ZdZdZdS )WPDisabledRule.Metawp_disabled_rules)))rule_idscope scope_valueTN)__name__
__module__ __qualname__r dbdatabasedb_tableindexes [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/wp_disabled_rule.pyMetar - s ;&@r r F)nullTglobaldomain wordpressagentNr domainssourceuser_id timestampreturnc |t j }|r| ||||| S | |||| S )a>
Disable a rule globally or for specific domains.
Args:
rule_id: The rule identifier (e.g., "CVE-2025-001")
domains: List of domains to disable for, or None/empty for global disable
source: Origin of the action ("wordpress" or "agent")
user_id: UID of the user performing the action (0 for root)
timestamp: Unix timestamp for when the rule was disabled.
If None, uses current time.
Returns:
Number of new entries created (0 if all were no-ops).
)time_disable_for_domains_disable_globally)clsr r$ r% r& r' s r storezWPDisabledRule.storeH s\ . I ++)VW
$$WiIIIr c | || j d||| }|r t d||| t | S )zADisable a rule globally (independent of domain-specific entries).Nr r r disabled_atr% r& z1Disabled rule %s globally (source=%s, user_id=%s))_create_if_not_exists SCOPE_GLOBALloggerdebugint)r- r r' r% r& createds r r, z WPDisabledRule._disable_globallyh sm ++" !
,
LLC
7||r c d}|D ]G}| || j |||| }|r#|dz
}t d|||| H|S )zBDisable a rule for specific domains (independent of global state).r r0 z6Disabled rule %s for domain %s (source=%s, user_id=%s))r2 SCOPE_DOMAINr4 r5 ) r- r r$ r' r% r& countr! r7 s r r+ z#WPDisabledRule._disable_for_domains s F// & " %
0 G
L r r r r1 c | |||||| dS # t $ r Y dS w xY w)z
Create a new disabled rule entry if it doesn't already exist.
Returns:
True if a new entry was created, False if it already existed (no-op)
)r r r r1 r% created_by_user_idTF)insertexecuter )r- r r r r1 r% r& s r r2 z$WPDisabledRule._create_if_not_exists sc JJ ' ' #*
giii4 55 s -1
??c |so| | j |k | j | j k }|rt d| n| | j |k | j | j k | j
| }|r t d|| |S )a
Re-enable a rule globally or for specific domains.
Args:
rule_id: The rule identifier
domains: List of domains to enable for, or None/empty to enable globally
Returns:
Number of rows deleted
zEnabled rule %s globallyz Enabled rule %s for %d domain(s)) deletewherer r r3 r? r4 r5 r: r in_)r- r r$ r; s r removezWPDisabledRule.remove s
K7*I!11
B 7AAA
K7*I!11O''00
6
r c |Q| | j |k | j | j k S | | j |k | j | j k | j | j k | j |k z z S )a"
Check if a rule is disabled globally or for a specific domain.
Args:
rule_id: The rule identifier
domain: The domain to check. If None, only checks global disable.
Returns:
True if the rule is disabled, False otherwise
)selectrB r r r3 existsr: r )r- r r! s r is_rule_disabledz WPDisabledRule.is_rule_disabled s >
K7*I!11
JJLL
U w&Y#"22 c&66 ?f46 VXX
r include_globalc ~ |rk| | j | j | j k | j | j k | j |k z z }nE| | j | j | j k | j |k }d |D S )a
Get all rule IDs that are disabled for a specific domain.
Args:
domain: The domain to get disabled rules for
include_global: If True, also include globally disabled rules.
If False (default), only return domain-specific disables.
Returns:
List of rule IDs that are disabled for the domain
c g | ] }|j
S r r .0rows r
<listcomp>z6WPDisabledRule.get_domain_disabled.<locals>.<listcomp>/ s --- ---r )rF r rB r r3 r: r distinct)r- r! rI querys r get_domain_disabledz"WPDisabledRule.get_domain_disabled s
3;''Y#"22 c&66 ?f46
E JJs{++11 S --6) E .-u----r c | | j | j | j k }d |D S )z
Get all rule IDs that are disabled globally.
Returns:
Iterator of globally disabled rule IDs
c 3 $ K | ] }|j V d S NrL rM s r <genexpr>z5WPDisabledRule.get_global_disabled.<locals>.<genexpr>: s$ -- ------r )rF r rB r r3 )r- rR s r get_global_disabledz"WPDisabledRule.get_global_disabled1 sC
3;''--ci3;K.KLL--u----r user_domainsc |B| j | j k | j | z }|r| j | j k |z S |S |s| j | j k S dS )z
Build the WHERE condition for filtering rules.
Returns:
A Peewee expression for the WHERE clause, or None if no filter needed.
N)r r: r rC r3 )r- rY rI domain_matchs r _build_filter_conditionz&WPDisabledRule._build_filter_condition< st # I)9 9##L11 L
F S%55 EE 19 00 0tr r limitoffsetc | || }| | j | j t j | j }|| | }|
}d | | | D }|s|g fS | | j
| } || | } i }
| D ]z} | j |
vr| j dg d|
| j < | j | j k rd|
| j d< ?| j | j k r+|
| j d | j {g } |D ]7}
|
|
}t' |d |d< | | 8|| fS )a>
List disabled rules with aggregation by rule_id.
Multiple domain entries for the same rule are aggregated into a single
result with a list of domains. Results are ordered by most recently
disabled first (using the latest disabled_at timestamp per rule_id).
Uses a two-pass approach for efficiency:
1. First pass: Get rule_ids ordered by latest disabled_at with pagination
2. Second pass: Fetch only rows for the paginated rule_ids
Args:
limit: Maximum number of rules to return
offset: Number of rules to skip
user_domains: If provided, only return rules for these domains.
If None, return all rules (for root users).
include_global: Whether to include global rules in the result
Returns:
Tuple of (total_count, list of rule dicts)
Each dict has: {"rule_id": str, "is_global": bool, "domains": list[str]}
is_global is True if rule has a global disable, domains lists domain-specific disables
Nc g | ] }|j
S r rL rM s r rP z(WPDisabledRule.fetch.<locals>.<listcomp> s'
CK
r F)r is_globalr$ Tra r$ )r\ rF r group_byorder_byr MAXr1 descrB r; r^ r] rC r r3 r: appendr sorted)r- r] r^ rY rI conditionrule_ids_query total_countpaginated_rule_ids
rows_query rules_by_idrO resultr rule_datas r fetchzWPDisabledRule.fetchS s @ // nMM
JJs{ # #
Xck
"
"
XbfS_--2244
5
5
+ 1 1) < <N %**,,
#1#8#8#@#@#F#Fu#M#M
" # ? " ZZ\\'' 8J(K(KLL
#)))44J (* L LC{+-- "{!& !, , CK( yC ,,,8< CK(55c ...CK(3::3?KKK ) % %G#G,I#))I*>#?#?Ii MM) $ $ $ $F""r rV )F)r NF)'r r r __doc__r r idr r r r r r1 r% r r= r3 r: SOURCE_WORDPRESS SOURCE_AGENT classmethodstrlistr6 floatr. r, r+ boolr2 rD rH rS r rX r\ tupledictrp r r r r
r
% s A A A A A A A A
BiU###G I5 ! ! !E)&&&K *%(((K
YE
"
"
"F% 5111 LL #L #'
J J J cT! J J
J 4<
J
J J J [ J>
[ 2 c
[ < 4Z
[: (S (49t+; ( ( ( ( [(T "
"
s "
C$J "
$ "
"
"
["
H 16 . . .*. .
c . . . [ .B .HSM . . . [. 3i$& [, )- $ O# O#O# O# 3i$& O#
O#
sDJ
O# O# O# [O# O# O#r r
incidentsr( c ` d | D }|s | D ]}d|d< dS d | D }t j t j k }|r=|t j t j k t j | z z }t t j t j t j t j | | }t }t }|D ]S}|j t j k r|
|j 2|
|j |j f T| D ]N}| d } | d }
t | duo
| |v p |
duo| |
f|v |d< OdS )a Set is_rule_disabled on each incident dict in place.
A rule is considered disabled for an incident when wp_disabled_rules has
a row with rule_id == incident["rule"] AND (scope='global' OR
(scope='domain' AND scope_value == incident["domain"])). Incidents with
a NULL rule (legacy/imported rows) always get False.
Runs at most one SELECT regardless of the input length.
c H h | ] }| d |d S )rulegetrN incs r <setcomp>z7enrich_incidents_with_disabled_state.<locals>.<setcomp> s2 CGGFOO,GF ,G,G,Gr FrH Nc H h | ] }| d |d S )r! r r s r r z7enrich_incidents_with_disabled_state.<locals>.<setcomp> s4 cggh.?.?.KH
.K.K.Kr r r! )
r
r r3 r: r rC rF r rB setaddr ry ) r| rule_idsr r$ rh rR globally_disableddomain_disabledrO r r! s r $enrich_incidents_with_disabled_stater s ( H , ,C&+C" # # !* G $(CCI
!^%@
@ )--g66
8
! ! "
eN " & &x 0 0)<<
#&%%,/EEO @ @ 93 3 3 ! !#+ . . . . co > ? ? ? ?
wwv"""&
)) N$&LD&>_+L #
#
r )rq collections.abcr loggingr* peeweer r r r r r defence360agent.modelr
r getLoggerr r4 r
rw r{ r r r r <module>r s $ % $ $ $ $ $ 2 1 1 1 1 1 1 1 8 $ $~# ~# ~# ~# ~#U ~# ~# ~#B 3
DJ 3
4 3
3
3
3
3
3
r defence360agent/model/__pycache__/wp_disabled_rule.cpython-311.pyc 0000644 0000000 0000000 00000043352 00000000000 022073 0 ustar
r_j< d Z ddlmZ ddlZddlZddlmZmZmZm Z m
Z
m Z ddl m
Z
mZ ej e Z G d de
Zdee d dfd
ZdS ) a WordPress-specific disabled rules data model.
This module provides a separate data model for WordPress disabled rules,
independent of the existing DisabledRule/DisabledRuleDomain models used
by modsec/ossec plugins.
Disable Behavior:
Global and domain-level disables are independent and can coexist.
A rule is considered effectively disabled for a given WordPress domain
if EITHER of these conditions is true:
- A global disable exists for the rule (applies to all domains)
- A domain-specific disable exists for the rule and that domain
Enabling a rule at one scope does not affect disables at the other scope.
For example, removing a global disable leaves any domain-specific disables
intact, and vice versa.
)IteratorN) CharField
FloatField IntegerFieldIntegrityErrorPrimaryKeyFieldfn)Modelinstancec e Zd ZdZ G d d Z e Z ed Z ed Z ed Z
e d Z ed Z
ed ZdZdZd Zd
Ze d$d ed
ee d z dededed z def d Zed ededededef
d Zed ed
ee dedededef d Zed ededed z dededede fd Z ed ed
ee d z defd Z ed$d eded z de fd Z e d%dede dee fd Z ede!e fd Z"ed ee d z de fd Z#e d&d!ed"ed ee d z de de$eee% f f
d# Z&d S )'WPDisabledRulezStores disabled WordPress protection rules.
Uses a scope-based design:
- scope='global', scope_value=NULL: Rule disabled for all domains (root only)
- scope='domain', scope_value='example.com': Rule disabled for specific domain
c $ e Zd Zej ZdZdZdS )WPDisabledRule.Metawp_disabled_rules)))rule_idscope scope_valueTN)__name__
__module__ __qualname__r dbdatabasedb_tableindexes [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/wp_disabled_rule.pyMetar - s ;&@r r F)nullTglobaldomain wordpressagentNr domainssourceuser_id timestampreturnc |t j }|r| ||||| S | |||| S )a>
Disable a rule globally or for specific domains.
Args:
rule_id: The rule identifier (e.g., "CVE-2025-001")
domains: List of domains to disable for, or None/empty for global disable
source: Origin of the action ("wordpress" or "agent")
user_id: UID of the user performing the action (0 for root)
timestamp: Unix timestamp for when the rule was disabled.
If None, uses current time.
Returns:
Number of new entries created (0 if all were no-ops).
)time_disable_for_domains_disable_globally)clsr r$ r% r& r' s r storezWPDisabledRule.storeH s\ . I ++)VW
$$WiIIIr c | || j d||| }|r t d||| t | S )zADisable a rule globally (independent of domain-specific entries).Nr r r disabled_atr% r& z1Disabled rule %s globally (source=%s, user_id=%s))_create_if_not_exists SCOPE_GLOBALloggerdebugint)r- r r' r% r& createds r r, z WPDisabledRule._disable_globallyh sm ++" !
,
LLC
7||r c d}|D ]G}| || j |||| }|r#|dz
}t d|||| H|S )zBDisable a rule for specific domains (independent of global state).r r0 z6Disabled rule %s for domain %s (source=%s, user_id=%s))r2 SCOPE_DOMAINr4 r5 ) r- r r$ r' r% r& countr! r7 s r r+ z#WPDisabledRule._disable_for_domains s F// & " %
0 G
L r r r r1 c | |||||| dS # t $ r Y dS w xY w)z
Create a new disabled rule entry if it doesn't already exist.
Returns:
True if a new entry was created, False if it already existed (no-op)
)r r r r1 r% created_by_user_idTF)insertexecuter )r- r r r r1 r% r& s r r2 z$WPDisabledRule._create_if_not_exists sc JJ ' ' #*
giii4 55 s -1
??c |so| | j |k | j | j k }|rt d| n| | j |k | j | j k | j
| }|r t d|| |S )a
Re-enable a rule globally or for specific domains.
Args:
rule_id: The rule identifier
domains: List of domains to enable for, or None/empty to enable globally
Returns:
Number of rows deleted
zEnabled rule %s globallyz Enabled rule %s for %d domain(s)) deletewherer r r3 r? r4 r5 r: r in_)r- r r$ r; s r removezWPDisabledRule.remove s
K7*I!11
B 7AAA
K7*I!11O''00
6
r c |Q| | j |k | j | j k S | | j |k | j | j k | j | j k | j |k z z S )a"
Check if a rule is disabled globally or for a specific domain.
Args:
rule_id: The rule identifier
domain: The domain to check. If None, only checks global disable.
Returns:
True if the rule is disabled, False otherwise
)selectrB r r r3 existsr: r )r- r r! s r is_rule_disabledz WPDisabledRule.is_rule_disabled s >
K7*I!11
JJLL
U w&Y#"22 c&66 ?f46 VXX
r include_globalc ~ |rk| | j | j | j k | j | j k | j |k z z }nE| | j | j | j k | j |k }d |D S )a
Get all rule IDs that are disabled for a specific domain.
Args:
domain: The domain to get disabled rules for
include_global: If True, also include globally disabled rules.
If False (default), only return domain-specific disables.
Returns:
List of rule IDs that are disabled for the domain
c g | ] }|j
S r r .0rows r
<listcomp>z6WPDisabledRule.get_domain_disabled.<locals>.<listcomp>/ s --- ---r )rF r rB r r3 r: r distinct)r- r! rI querys r get_domain_disabledz"WPDisabledRule.get_domain_disabled s
3;''Y#"22 c&66 ?f46
E JJs{++11 S --6) E .-u----r c | | j | j | j k }d |D S )z
Get all rule IDs that are disabled globally.
Returns:
Iterator of globally disabled rule IDs
c 3 $ K | ] }|j V d S NrL rM s r <genexpr>z5WPDisabledRule.get_global_disabled.<locals>.<genexpr>: s$ -- ------r )rF r rB r r3 )r- rR s r get_global_disabledz"WPDisabledRule.get_global_disabled1 sC
3;''--ci3;K.KLL--u----r user_domainsc |B| j | j k | j | z }|r| j | j k |z S |S |s| j | j k S dS )z
Build the WHERE condition for filtering rules.
Returns:
A Peewee expression for the WHERE clause, or None if no filter needed.
N)r r: r rC r3 )r- rY rI domain_matchs r _build_filter_conditionz&WPDisabledRule._build_filter_condition< st # I)9 9##L11 L
F S%55 EE 19 00 0tr r limitoffsetc | || }| | j | j t j | j }|| | }|
}d | | | D }|s|g fS | | j
| } || | } i }
| D ]z} | j |
vr| j dg d|
| j < | j | j k rd|
| j d< ?| j | j k r+|
| j d | j {g } |D ]7}
|
|
}t' |d |d< | | 8|| fS )a>
List disabled rules with aggregation by rule_id.
Multiple domain entries for the same rule are aggregated into a single
result with a list of domains. Results are ordered by most recently
disabled first (using the latest disabled_at timestamp per rule_id).
Uses a two-pass approach for efficiency:
1. First pass: Get rule_ids ordered by latest disabled_at with pagination
2. Second pass: Fetch only rows for the paginated rule_ids
Args:
limit: Maximum number of rules to return
offset: Number of rules to skip
user_domains: If provided, only return rules for these domains.
If None, return all rules (for root users).
include_global: Whether to include global rules in the result
Returns:
Tuple of (total_count, list of rule dicts)
Each dict has: {"rule_id": str, "is_global": bool, "domains": list[str]}
is_global is True if rule has a global disable, domains lists domain-specific disables
Nc g | ] }|j
S r rL rM s r rP z(WPDisabledRule.fetch.<locals>.<listcomp> s'
CK
r F)r is_globalr$ Tra r$ )r\ rF r group_byorder_byr MAXr1 descrB r; r^ r] rC r r3 r: appendr sorted)r- r] r^ rY rI conditionrule_ids_query total_countpaginated_rule_ids
rows_query rules_by_idrO resultr rule_datas r fetchzWPDisabledRule.fetchS s @ // nMM
JJs{ # #
Xck
"
"
XbfS_--2244
5
5
+ 1 1) < <N %**,,
#1#8#8#@#@#F#Fu#M#M
" # ? " ZZ\\'' 8J(K(KLL
#)))44J (* L LC{+-- "{!& !, , CK( yC ,,,8< CK(55c ...CK(3::3?KKK ) % %G#G,I#))I*>#?#?Ii MM) $ $ $ $F""r rV )F)r NF)'r r r __doc__r r idr r r r r r1 r% r r= r3 r: SOURCE_WORDPRESS SOURCE_AGENT classmethodstrlistr6 floatr. r, r+ boolr2 rD rH rS r rX r\ tupledictrp r r r r
r
% s A A A A A A A A
BiU###G I5 ! ! !E)&&&K *%(((K
YE
"
"
"F% 5111 LL #L #'
J J J cT! J J
J 4<
J
J J J [ J>
[ 2 c
[ < 4Z
[: (S (49t+; ( ( ( ( [(T "
"
s "
C$J "
$ "
"
"
["
H 16 . . .*. .
c . . . [ .B .HSM . . . [. 3i$& [, )- $ O# O#O# O# 3i$& O#
O#
sDJ
O# O# O# [O# O# O#r r
incidentsr( c ` d | D }|s | D ]}d|d< dS d | D }t j t j k }|r=|t j t j k t j | z z }t t j t j t j t j | | }t }t }|D ]S}|j t j k r|
|j 2|
|j |j f T| D ]N}| d } | d }
t | duo
| |v p |
duo| |
f|v |d< OdS )a Set is_rule_disabled on each incident dict in place.
A rule is considered disabled for an incident when wp_disabled_rules has
a row with rule_id == incident["rule"] AND (scope='global' OR
(scope='domain' AND scope_value == incident["domain"])). Incidents with
a NULL rule (legacy/imported rows) always get False.
Runs at most one SELECT regardless of the input length.
c H h | ] }| d |d S )rulegetrN incs r <setcomp>z7enrich_incidents_with_disabled_state.<locals>.<setcomp> s2 CGGFOO,GF ,G,G,Gr FrH Nc H h | ] }| d |d S )r! r r s r r z7enrich_incidents_with_disabled_state.<locals>.<setcomp> s4 cggh.?.?.KH
.K.K.Kr r r! )
r
r r3 r: r rC rF r rB setaddr ry ) r| rule_idsr r$ rh rR globally_disableddomain_disabledrO r r! s r $enrich_incidents_with_disabled_stater s ( H , ,C&+C" # # !* G $(CCI
!^%@
@ )--g66
8
! ! "
eN " & &x 0 0)<<
#&%%,/EEO @ @ 93 3 3 ! !#+ . . . . co > ? ? ? ?
wwv"""&
)) N$&LD&>_+L #
#
r )rq collections.abcr loggingr* peeweer r r r r r defence360agent.modelr
r getLoggerr r4 r
rw r{ r r r r <module>r s $ % $ $ $ $ $ 2 1 1 1 1 1 1 1 8 $ $~# ~# ~# ~# ~#U ~# ~# ~#B 3
DJ 3
4 3
3
3
3
3
3
r defence360agent/model/analyst_cleanup.py 0000644 0000000 0000000 00000006633 00000000000 015412 0 ustar import peewee as pw
from defence360agent.model import Model, instance
from datetime import datetime, timezone, timedelta
class AnalystCleanupRequest(Model):
"""
Model for storing analyst cleanup requests.
Tracks request details and status for each cleanup request submitted.
"""
class Meta:
database = instance.db
db_table = "analyst_cleanup_requests"
id = pw.AutoField()
username = pw.CharField(null=False)
zendesk_id = pw.CharField(null=False)
ticket_link = pw.TextField(null=False)
created_at = pw.TimestampField(
null=False, default=datetime.now(timezone.utc)
)
status = pw.CharField(
null=False,
default="pending",
constraints=[
pw.Check("status in ('pending','in_progress','completed')")
],
)
last_updated = pw.TimestampField(
null=False, default=datetime.now(timezone.utc)
)
@classmethod
def create_request(cls, username, zendesk_id, ticket_link):
"""Create a new cleanup request"""
return cls.create(
username=username, zendesk_id=zendesk_id, ticket_link=ticket_link
)
@classmethod
def get_user_requests(cls, username, limit=50, offset=0):
"""Get all requests for a specific user"""
return (
cls.select()
.where(cls.username == username)
.order_by(cls.created_at.desc())
.limit(limit)
.offset(offset)
)
@classmethod
def get_all_requests(cls, limit=50, offset=0):
"""Get all requests for a sever"""
return (
cls.select()
.order_by(cls.created_at.desc())
.limit(limit)
.offset(offset)
)
@classmethod
def get_active_request_link(cls, username) -> str | None:
"""
Gets user requests for a user and checks if there are requests
with [pending | in_progress] state. If found, returns ticket_link,
otherwise returns None
"""
active_request = (
cls.select()
.where(
(cls.username == username)
& (cls.status.in_(["pending", "in_progress"]))
)
.limit(1)
).first()
return active_request.ticket_link if active_request else None
@classmethod
def update_status(cls, zendesk_id, new_status, last_updated):
"""Update the status of a request"""
return (
cls.update(status=new_status, last_updated=last_updated)
.where(cls.zendesk_id == zendesk_id)
.execute()
)
@classmethod
def get_all_relevant_requests(cls):
"""
Returns a query to fetch active cleanup requests and recently completed
requests for the specified users.
"""
# Calculate the cutoff date for "recently completed" (3 days ago)
three_days_ago = datetime.now(timezone.utc) - timedelta(days=3)
return AnalystCleanupRequest.select(
AnalystCleanupRequest.username,
AnalystCleanupRequest.zendesk_id,
AnalystCleanupRequest.status,
AnalystCleanupRequest.last_updated,
).where(
(AnalystCleanupRequest.status.in_(["pending", "in_progress"]))
| (
(AnalystCleanupRequest.status == "completed")
& (AnalystCleanupRequest.last_updated >= three_days_ago)
)
)
defence360agent/model/event_hook.py 0000644 0000000 0000000 00000003367 00000000000 014372 0 ustar from time import time
from peewee import CharField, IntegerField, BooleanField
from defence360agent.model import instance, Model
from defence360agent.model.simplification import FilenameField
class EventHook(Model):
"""Imunify Hooks v1.0 configuration.
.. deprecated:: 4.10 A new notification system was implemented in DEF-11680
"""
class Meta:
database = instance.db
db_table = "event_hook"
#: The path to the hook script.
path = FilenameField(null=False)
#: The event for which it should trigger.
event = CharField(null=False)
#: Timestamp when the hook was added.
created = IntegerField(null=False, default=lambda: int(time()))
#: Native hooks can be imported and executed as Python directly, without
#: creating a separate process.
native = BooleanField(default=False)
@classmethod
def list_events(cls, event):
q = cls.select()
if event != "all":
q = q.where(cls.event == event)
return list(q.dicts())
@classmethod
def add_hook(cls, event, path, native=False):
q = cls.select().where((cls.event == event) & (cls.path == path))
if q.exists():
return None
hook = cls.create(event=event, path=path, native=native)
return hook.as_dict()
@classmethod
def delete_hook(cls, event, path):
q = cls.select().where((cls.event == event) & (cls.path == path))
if not q.exists():
return None
hook = q.get()
data = hook.as_dict()
hook.delete_instance()
return data
def as_dict(self):
return {
"path": self.path,
"event": self.event,
"created": self.created,
"native": self.native,
}
defence360agent/model/icontact.py 0000644 0000000 0000000 00000002237 00000000000 014030 0 ustar import time
from peewee import CharField, IntegerField, CompositeKey
from defence360agent.contracts.config import IContactMessageType
from defence360agent.model import Model, instance
from defence360agent.utils.common import DAY, WEEK
THROTTLING_PERIOD = {
IContactMessageType.MALWARE_FOUND: DAY,
IContactMessageType.SCAN_NOT_SCHEDULED: WEEK,
}
class IContactThrottle(Model):
class Meta:
database = instance.db
db_table = "icontact_throttle"
primary_key = CompositeKey("message_type", "user")
message_type = CharField()
user = CharField(null=True)
#: The last time we sent a notification about :attr:`message_type`
timestamp = IntegerField(default=0)
@classmethod
def may_be_notified(cls, message_type, period_limit, user=None):
obj, _ = cls.get_or_create(message_type=message_type, user=user)
return (time.time() - obj.timestamp) > period_limit
@classmethod
def refresh(cls, message_type, user=None):
cls.update(timestamp=time.time()).where(
cls.message_type == message_type,
cls.user.is_null(True) if user is None else cls.user == user,
).execute()
defence360agent/model/infected_domain.py 0000644 0000000 0000000 00000010362 00000000000 015332 0 ustar import itertools
import logging
import time
from peewee import (
CharField,
FloatField,
IntegerField,
TextField,
)
from defence360agent.model import instance, Model
logger = logging.getLogger(__name__)
class InfectedDomainList(Model):
"""Domains with bad reputation, used for Reputation Management feature."""
id = IntegerField(primary_key=True)
#: Username associated with the domain in hosting panel.
username = CharField(null=True)
#: Domain name.
name = CharField(null=False)
#: The kind of threat reported by reputation engine,
#: e.g. "SOCIAL_ENGINEERING".
threat_type = CharField(null=False)
#: The time when Imunify first detected that the domain has bad reputation.
timestamp = FloatField()
#: The name of the reputation engine, e.g. "google-safe-browsing".
vendor = TextField(null=True)
class Meta:
database = instance.db
db_table = "infected_domain_list"
@classmethod
def get_by_user(cls, existing_users, offset=0, limit=50):
# to be able to filter query results using existing_users,
# limit/offset os applied on python side
query = cls.select().order_by(
cls.username, cls.name, cls.timestamp.desc()
)
filtered_by_user = (
row for row in query.dicts() if row["username"] in existing_users
)
grouped = itertools.groupby(
filtered_by_user, key=lambda row: (row["username"], row["name"])
)
max_count = 0
result = []
for i, value in enumerate(grouped):
max_count += 1
if (len(result) < limit) and (i >= offset):
group, threats = value
username, name = group
result.append(
{
"username": username,
"domain": name,
"threats": [
{
"type": t["threat_type"],
"vendor": t["vendor"],
"timestamp": t["timestamp"],
}
for t in threats
],
}
)
return result, max_count
@classmethod
def refresh_domains(cls, domains, domains_to_users):
"""
Update domain reputatuion info. If threat info already exists, do not
update timestamp
:param domains: reputation data from server
:param domains_to_users: domain -> users mapping from hosting panel
:return:
"""
existing = {
(r["name"], r["threat_type"], r["vendor"]): r["timestamp"]
for r in cls.select().dicts()
}
with instance.db.atomic():
cls.delete().execute()
now = time.time()
for domain_info in domains:
domain = domain_info["query"]
if domain not in domains_to_users:
logger.warning("Users for domain %s not found.", domain)
continue
for user in domains_to_users[domain]:
vendor = domain_info["vendor"]
if vendor in (
"google-safe-browsing",
"yandex-safe-browsing",
):
threat_type = domain_info["details"]["threat_type"]
elif vendor == "spamhaus":
threat_type = domain_info["details"]
elif vendor in ("phishtank", "openphish"):
# https://cloudlinux.atlassian.net/wiki/spaces/IPT/pages/929759302/4.1+Multiple+vendors+in+Reputation+Management+ver.4.2 # noqa: E501
threat_type = "spam domain"
else:
threat_type = "THREAT_TYPE_UNSPECIFIED"
timestamp = existing.get(
(domain, threat_type, vendor), now
)
cls.create(
username=user,
name=domain,
threat_type=threat_type,
vendor=vendor,
timestamp=timestamp,
)
defence360agent/model/instance.py 0000644 0000000 0000000 00000001031 00000000000 014017 0 ustar import defence360agent.model.tls_check as tls_check
# actual database connection is done during runtime, to prevent
# 'locking protocol' error when bringing database connection though
# fork() (during demonization)
# See https://stackoverflow.com/questions/46331178/causes-of-sqlite3-operationalerror-locking-protocol-exception # noqa E501
db = tls_check.SqliteDatabaseWrapper(
None,
pragmas=[
("journal_mode", "wal"),
("foreign_keys", "ON"),
("busy_timeout", 10000),
],
regexp_function=True,
)
defence360agent/model/messages_to_send.py 0000644 0000000 0000000 00000003103 00000000000 015537 0 ustar from collections import namedtuple
from peewee import FloatField, BlobField
from defence360agent.model import instance, Model
class MessageToSend(Model):
"""
Storage for messages to be sent to server
while connection to server is not available
"""
class Meta:
database = instance.db
db_table = "messages_to_send_nr"
#: When the message was added to the queue to be sent to the server.
timestamp = FloatField(null=False)
#: The message itself.
message = BlobField(null=False)
MessageToSendT = namedtuple("MessageToSendT", "timestamp message")
@classmethod
def get_all_ordered(cls):
return cls.select(cls.id, cls.timestamp, cls.message).order_by(
cls.timestamp, cls.id
)
@classmethod
def set_message(cls, message_id, message):
return (
cls.update(message=message).where(cls.id == message_id).execute()
)
@classmethod
def delete_in(cls, query):
q = cls.delete().where(cls.id.in_(query))
return q.execute()
@classmethod
def delete_old(cls, limit=1):
old = cls.select().order_by(cls.timestamp).limit(limit)
q = cls.delete().where(cls.id.in_(old))
return q.execute()
@classmethod
def insert_many(cls, rows, **kwargs) -> None:
# sqlite may have internal limit of variables-per-query
for i in range(0, len(rows), 100):
data = [
cls.MessageToSendT(*row)._asdict() for row in rows[i : i + 100]
]
super().insert_many(data, **kwargs).execute()
defence360agent/model/simplification.py 0000644 0000000 0000000 00000012015 00000000000 015231 0 ustar import inspect
import logging
import os
import time
from peewee import (
BlobField,
CharField,
DateField,
ForeignKeyField,
IntegerField,
PeeweeException,
)
from defence360agent.model import instance, Model
#: seconds in a POSIX day
POSIX_DAY = 24 * 60 * 60
logger = logging.getLogger(__name__)
class FilenameField(BlobField):
"""
Class to store file names in database
"""
def db_value(self, value):
return os.fsencode(value)
def python_value(self, value):
return os.fsdecode(value)
class ScanPathField(CharField):
REALTIME_SCAN_PATH_STUB = "list_of_files"
def db_value(self, value):
if isinstance(value, list):
return self.REALTIME_SCAN_PATH_STUB
return value
class ModelError(PeeweeException):
"""
Model exception. Please use this one from other modules instead
PeeweeException directly
"""
pass
async def run_in_executor(loop, cb, *args):
"""
Fake run_in_executor() test (DEF-4541)
"""
return cb(*args)
def remove_old_and_truncate(
table: Model, num_days: int, max_count: int
) -> int:
"""
Removes records that is older that *num_days* days and
all others that are out of range *max_count* from *table*.
Returns count of rows deleted.
"""
has_timestamp = getattr(table, "timestamp", False)
if not has_timestamp:
raise ValueError("No 'timestamp' column in table {!r}".format(table))
# keep no more than *max_count* rows that are newer than *num_days*
end_save_time = time.time() - num_days * POSIX_DAY
to_keep = (
table.select(table.timestamp)
.order_by(table.timestamp.desc())
.limit(max_count)
.where(table.timestamp > end_save_time)
)
deleted_count = (
table.delete().where(table.timestamp.not_in(to_keep)).execute()
)
return deleted_count
class Eula(Model):
"""Keeps track of updates and acceptions of end user license agreement.
Admins will be asked to accept EULA if the latest version is not accepted
yet.
"""
class Meta:
database = instance.db
db_table = "eula"
#: Date when EULA was updated.
updated = DateField(primary_key=True)
#: Timestamp when EULA was accepted.
accepted = IntegerField(null=True, default=None)
@classmethod
def is_accepted(cls) -> bool:
unaccepted = next(
iter(
cls.select()
.where(cls.accepted.is_null())
.order_by(cls.updated)
.limit(1)
),
None,
)
return unaccepted is None
@classmethod
def accept(cls) -> None:
cls.update(accepted=time.time()).where(
cls.accepted.is_null()
).execute()
def get_models(module):
return [
obj
for _, obj in inspect.getmembers(
module,
lambda obj: inspect.isclass(obj)
and issubclass(obj, Model)
and obj != Model,
)
]
def create_tables(module):
instance.db.connect()
instance.db.create_tables(get_models(module), safe=True)
class ApplyOrderBy:
@staticmethod
def resolve_nodes(_model, column_name: str) -> tuple:
"""
:param _model: peewee.Model or peewee.ForeignKeyField
:param column_name: str
:return: tuple<peewee.Node>
"""
model = (
_model.rel_model if isinstance(_model, ForeignKeyField) else _model
)
nodes = ()
custom_order_by = getattr(model, "OrderBy", None)
if custom_order_by is not None:
nodes = getattr(custom_order_by, column_name, lambda: nodes)()
if not nodes:
node = getattr(model, column_name, None)
if node is not None:
nodes = (node,) # type: ignore
return nodes
@staticmethod
def get_nodes(model, column_names: list) -> list:
"""
:param model: peewee.Model or peewee.ForeignKeyField
:param column_names: list<str>
:return: list<peewee.Node>
"""
column_name, rest = column_names[0], column_names[1:]
nodes = ApplyOrderBy.resolve_nodes(model, column_name)
result = []
for node_or_model in nodes:
if rest: # model
for node in ApplyOrderBy.get_nodes(node_or_model, rest):
result.append(node)
else: # node
result.append(node_or_model)
return result
def __call__(self, order_by, model, query_builder):
"""
:param order_by: list<OrderBy>
:param model: peewee.Model or peewee.ForeignKeyField
:param query_builder: peewee.Query
:return: peewee.Query with applied order_by
"""
orders = []
for order in order_by:
nodes = ApplyOrderBy.get_nodes(model, order.column_name.split("."))
for node in nodes:
orders.append(node.desc() if order.desc else node)
return query_builder.order_by(*orders)
apply_order_by = ApplyOrderBy()
defence360agent/model/tls_check.py 0000644 0000000 0000000 00000004354 00000000000 014165 0 ustar import logging
import threading
import time
import traceback
from playhouse.sqlite_ext import SqliteExtDatabase
from defence360agent.internals.global_scope import g
class OverridingReset(Exception):
"""
Overriding reset could be a signal of logic error
thus need to be explicitly handled in all places where
this exception is expected to occur.
"""
pass
logger = logging.getLogger(__name__)
_thread_local_storage = threading.local()
_SLOW_TXN_THRESHOLD_S = 5.0
class _TimedAtomic:
def __init__(self, inner: object):
self._inner = inner
self._start: float = 0.0
self._caller: str = ""
def __enter__(self):
self._start = time.monotonic()
self._caller = "".join(traceback.format_stack(limit=4)[:-1])
return self._inner.__enter__()
def __exit__(self, *args):
result = self._inner.__exit__(*args)
elapsed = time.monotonic() - self._start
if elapsed > _SLOW_TXN_THRESHOLD_S:
logger.warning(
"Slow transaction held for %.2fs\n%s",
elapsed,
self._caller,
)
return result
class SqliteDatabaseWrapper(SqliteExtDatabase):
def execute_sql(self, *args, **kwargs):
_validate(*args, **kwargs)
return super().execute_sql(*args, **kwargs)
def atomic(self, lock_type: str = "IMMEDIATE"):
inner = super().atomic(lock_type)
if g.get("DEBUG"):
return _TimedAtomic(inner)
return inner
def reset(new_value=None):
if hasattr(_thread_local_storage, "thread_ident_memo"):
raise OverridingReset()
_thread_local_storage.thread_ident_memo = (
new_value or threading.get_ident()
)
def _validate(*args, **kwargs):
thread_ident_memo = getattr(
_thread_local_storage, "thread_ident_memo", None
)
if thread_ident_memo is None:
logger.error("wrong thread or _validate() was not preceded by reset()")
elif thread_ident_memo != threading.get_ident():
logger.error(
"thread_ident_memo check failed [%r != %r]\n"
"context:\nargs: %s\nkwargs: %s",
thread_ident_memo,
threading.get_ident(),
args,
kwargs,
)
defence360agent/model/wordpress.py 0000644 0000000 0000000 00000003247 00000000000 014256 0 ustar from __future__ import annotations
from typing import NamedTuple
from peewee import CharField, FloatField, IntegerField, TimestampField
from defence360agent.model import instance, Model
class WPSite(NamedTuple):
docroot: str
domain: str
uid: int
version: str = "1.0.0"
@classmethod
def from_wordpress_site(cls, site: WordpressSite) -> WPSite:
"""Create a WPSite instance from a WordpressSite instance."""
return cls(
docroot=site.docroot,
domain=site.domain,
uid=site.uid,
version=site.version,
)
def build_with_version(self, version: str) -> WPSite:
"""Create a new WPSite instance with an updated version."""
return WPSite(
docroot=self.docroot,
domain=self.domain,
uid=self.uid,
version=version,
)
def __eq__(self, other):
if not isinstance(other, WPSite):
return NotImplemented
# Ignore version and manually_deleted_at for equality check.
return (self.docroot, self.domain, self.uid) == (
other.docroot,
other.domain,
other.uid,
)
def __hash__(self):
return hash((self.docroot, self.domain, self.uid))
class WordpressSite(Model):
class Meta:
database = instance.db
db_table = "wordpress_site"
docroot = CharField(primary_key=True, null=False)
domain = CharField(null=False)
uid = IntegerField(null=False)
manually_deleted_at = TimestampField(default=None, null=True)
version = CharField(default="1.0.0", null=False)
disabled_rules_sync_ts = FloatField(null=True, default=None)
defence360agent/model/wordpress_incident.py 0000644 0000000 0000000 00000046732 00000000000 016141 0 ustar """Helper functions for WordPress CVE protection incidents.
WordPress incidents are stored in a dedicated wordpress_incident table with
plugin-specific data stored in the extra_info JSON field.
This module provides helper functions to work with WordPress incidents.
Available for both AV and IM360 modes.
"""
import logging
import time
import json
from collections import defaultdict
from contextlib import ExitStack, contextmanager
from datetime import timedelta
from typing import Iterable, Mapping
from peewee import (
EXCLUDED,
SQL,
CharField,
FloatField,
IntegerField,
TextField,
fn as peewee_fn,
)
from playhouse.sqlite_ext import JSONField, fn
from defence360agent.internals import geo
from defence360agent.model import Model, instance
from defence360agent.model.simplification import apply_order_by
from defence360agent.rpc_tools.validate import OrderBy
from defence360agent.utils import CHUNK_SIZE_SQL_QUERY, split_for_chunk
logger = logging.getLogger(__name__)
_UNSET = object()
#: Width of an aggregation window, matching the resident agent's flush interval.
BUCKET_SECONDS = 60
AGGREGATE_KEY = (
"abuser",
"name",
"plugin",
"rule",
"severity",
"domain",
"bucket",
)
INSERT_CHUNK_SIZE = 50
#: Upper bound on stored rows, mirroring the resident agent's incident table.
MAX_STORED_INCIDENTS = 100_000
class WordpressIncident(Model):
"""
WordPress incident model for CVE protection.
Uses dedicated wordpress_incident table created in migration 191.
Repeats of the same attack are aggregated per minute: the unique
constraint on (abuser, name, plugin, rule, severity, domain, bucket)
keeps one row per aggregation window, counted by retries.
"""
id = IntegerField(primary_key=True, null=True)
plugin = CharField(null=True)
rule = CharField(null=True)
timestamp = FloatField(null=True)
retries = IntegerField(null=True)
severity = IntegerField(null=True)
name = CharField(null=True)
description = TextField(null=True)
abuser = CharField(null=True)
country = CharField(null=True, column_name="country_id")
domain = TextField(null=True, default=None)
extra_info = JSONField(null=True)
bucket = IntegerField(null=True)
# occurrences correlation has not acknowledged yet; the periodic task
# re-sends the row until it reaches zero. A counter rather than a flag so
# that occurrences merged into an already-reported row are still reported.
# The DEFAULT is in the schema, not just in peewee, because
# src/rpm-tests/test_wordpress/test_list_incidents.py inserts rows with
# raw SQL that names its columns explicitly.
unsent_retries = IntegerField(
null=False,
default=0,
index=True,
constraints=[SQL("DEFAULT 0")],
)
class Meta:
database = instance.db
db_table = "wordpress_incident"
indexes = ((AGGREGATE_KEY, True),)
def build_extra_info(incident_data: dict, site_info: dict) -> dict:
"""
Build extra_info dict from incident data and site information.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username, user_id)
Returns:
Dict with all WordPress-specific fields for extra_info JSON column
"""
# Serialize JSON fields
files_json = serialize_json_field(incident_data.get("FILES"))
get_names_json = serialize_json_field(incident_data.get("GET_NAMES"))
post_names_json = serialize_json_field(incident_data.get("POST_NAMES"))
return {
# WordPress plugin-populated fields
"cve": incident_data.get("cve"),
"mode": incident_data.get("mode"),
"target": incident_data.get("target"),
"slug": incident_data.get("slug"),
"version": incident_data.get("version"),
"user_logged_in": incident_data.get("user_logged_in"),
"username": site_info.get("username"),
"user_id": site_info.get("user_id"),
"site_path": site_info.get("site_path"),
# HTTP request details
"request_method": incident_data.get("REQUEST_METHOD"),
"script_filename": incident_data.get("SCRIPT_FILENAME"),
"php_self": incident_data.get("PHP_SELF"),
"path_info": incident_data.get("PATH_INFO"),
"request_uri": incident_data.get("REQUEST_URI"),
"query_string": incident_data.get("QUERY_STRING"),
"http_x_forwarded_for": incident_data.get("HTTP_X_FORWARDED_FOR"),
"http_user_agent": incident_data.get("HTTP_USER_AGENT"),
"http_referer": incident_data.get("HTTP_REFERER"),
# Request data
"files": files_json,
"get_names": get_names_json,
"post_names": post_names_json,
"raw_data": incident_data.get("RAW_DATA"),
}
def build_incident_dict(
incident_data: dict, site_info: dict, geo_reader=_UNSET
) -> dict:
"""
Build complete incident dict ready for database insertion.
This is used for both single incident creation and bulk insertion.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username, user_id)
geo_reader: An open geo Reader (or None) to resolve the abuser country.
Pass one from country_reader() when building many incidents in a
loop to avoid reopening the mmdb per incident. When omitted, a
short-lived reader is opened for this single call.
Returns:
Dict with all fields ready for Incident.create() or bulk insert
"""
message = incident_data.get("message") or build_message_fallback(
incident_data
)
extra_info = build_extra_info(incident_data, site_info)
abuser_ip = incident_data.get("REMOTE_ADDR") or incident_data.get(
"attacker_ip"
)
if geo_reader is _UNSET:
with country_reader() as reader:
country = _country_code(reader, abuser_ip)
else:
country = _country_code(geo_reader, abuser_ip)
timestamp = float(incident_data.get("ts", 0))
return {
# Standard incident fields
"plugin": "wordpress",
"rule": incident_data.get("rule_id", "unknown"),
"timestamp": timestamp,
"bucket": int(timestamp // BUCKET_SECONDS),
"retries": 1,
"severity": calculate_severity(incident_data.get("mode")),
"name": f"WordPress CVE: {incident_data.get('cve', 'Unknown')}",
"description": message,
"abuser": abuser_ip,
"country": country,
"domain": site_info.get("domain"),
# JSONField automatically handles serialization - just pass the dict
"extra_info": extra_info,
}
@contextmanager
def country_reader():
"""Yield an open geo Reader, or None when the mmdb can't be opened.
Lets bulk callers open the mmap'd reader once instead of per incident,
while keeping enrichment non-blocking when the geo bundle is missing.
"""
with ExitStack() as stack:
try:
reader = stack.enter_context(geo.reader())
except Exception as exc:
logger.debug("GeoIP reader unavailable: %s", exc)
yield None
return
yield reader
def _country_code(reader, ip: str | None) -> str | None:
if reader is None or not ip:
return None
try:
return reader.get_code(ip)
except Exception as exc:
logger.debug("GeoIP lookup failed for %s: %s", ip, exc)
return None
def create_wordpress_incident(
incident_data: dict, site_info: dict
) -> WordpressIncident:
"""
Create a WordPress incident in the wordpress_incident table.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username)
Returns:
WordpressIncident instance with WordPress fields populated in extra_info
"""
incident_dict = build_incident_dict(incident_data, site_info)
return WordpressIncident.create(**incident_dict)
def aggregate_incident_dicts(incident_dicts: list[dict]) -> list[dict]:
"""Collapse incidents sharing an aggregate key into one counted row."""
# The window comes from the incident's own timestamp, so a backlogged
# file yields the same rows as live collection.
groups: dict[tuple, dict] = {}
for incident_dict in incident_dicts:
key = tuple(incident_dict[field] for field in AGGREGATE_KEY)
group = groups.get(key)
if group is None:
groups[key] = dict(incident_dict)
continue
group["retries"] += incident_dict["retries"]
group["timestamp"] = min(
group["timestamp"], incident_dict["timestamp"]
)
return list(groups.values())
def wordpress_incident_to_dict(incident: WordpressIncident) -> dict:
"""
Convert a WordpressIncident model instance to a dictionary.
Args:
incident: WordpressIncident model instance
Returns:
Dictionary representation of the incident
"""
return {
"id": incident.id,
"plugin": incident.plugin,
"rule": incident.rule,
"timestamp": incident.timestamp,
"retries": incident.retries,
"severity": incident.severity,
"name": incident.name,
"description": incident.description,
"abuser": incident.abuser,
"country": incident.country,
"domain": incident.domain,
"extra_info": incident.extra_info,
}
def get_wordpress_incidents(
limit: int = 1000,
offset: int = 0,
user_id: int | None = None,
by_abuser_ip: str | None = None,
by_country_code: str | None = None,
by_domain: str | None = None,
search: str | None = None,
site_search: str | None = None,
since: int | None = None,
to: int | None = None,
order_by: list | None = None,
include_hidden: bool = False,
):
"""
Get WordPress incidents as dictionaries.
Args:
limit: Maximum number of incidents to return
offset: Offset for pagination
user_id: Filter by user ID (None = all)
by_abuser_ip: Filter by abuser IP address (None = all)
by_country_code: Filter by country code (None = all)
by_domain: Filter by domain (None = all)
search: Search in IP address, name, description, or domain (None = all)
site_search: Filter by site path in extra_info (None = all)
since: Filter by timestamp >= this value (unix timestamp, None = all)
to: Filter by timestamp <= this value (unix timestamp, None = all)
order_by: List of fields to order by (None = default order by timestamp desc).
Can be either strings (e.g., ["timestamp+", "severity-"]) or
OrderBy objects. Strings are automatically converted.
include_hidden: When False (default), exclude incidents whose rule has
the TEST- prefix (internal probe rules that the WordPress
plugin hides from its admin UI).
Returns:
List of incident dictionaries
"""
query = WordpressIncident.select(WordpressIncident).where(
(WordpressIncident.plugin == "wordpress")
)
if not include_hidden:
query = query.where(
WordpressIncident.rule.is_null()
| ~WordpressIncident.rule.startswith("TEST-")
)
if user_id is not None:
query = query.where(
fn.json_extract(WordpressIncident.extra_info, "$.user_id")
== user_id
)
if by_abuser_ip is not None:
query = query.where(WordpressIncident.abuser.contains(by_abuser_ip))
if by_country_code is not None:
query = query.where(WordpressIncident.country == by_country_code)
if by_domain is not None:
query = query.where(WordpressIncident.domain.contains(by_domain))
if search is not None:
query = query.where(
WordpressIncident.name.contains(search)
| WordpressIncident.description.contains(search)
| WordpressIncident.domain.contains(search)
| WordpressIncident.abuser.contains(search)
)
if site_search is not None:
query = query.where(
fn.json_extract(WordpressIncident.extra_info, "$.site_path")
== site_search
)
if since is not None:
query = query.where(WordpressIncident.timestamp.cast("REAL") >= since)
if to is not None:
query = query.where(WordpressIncident.timestamp.cast("REAL") <= to)
# Apply ordering
if order_by is not None:
# Convert string format to OrderBy objects if needed
converted_order_by = []
for item in order_by:
if isinstance(item, str):
converted_order_by.append(OrderBy.fromstring(item))
else:
converted_order_by.append(item)
query = apply_order_by(converted_order_by, WordpressIncident, query)
else:
# Default order by timestamp descending
query = query.order_by(WordpressIncident.timestamp.desc())
query = query.limit(limit)
query = query.offset(offset)
return [wordpress_incident_to_dict(inc) for inc in query.execute()]
def bulk_create_wordpress_incidents(incidents_data: list[dict]) -> int:
"""Store aggregated incidents, merging repeats into the stored row."""
if not incidents_data:
return 0
conflict_target = [
getattr(WordpressIncident, field) for field in AGGREGATE_KEY
]
# every occurrence a fresh row carries is still unreported
rows = [
{**incident, "unsent_retries": incident.get("retries") or 1}
for incident in incidents_data
]
# Every chunk shares one transaction, so a failure leaves the table
# untouched and the batch can be retried without double counting.
with WordpressIncident._meta.database.atomic():
for start in range(0, len(rows), INSERT_CHUNK_SIZE):
chunk = rows[start : start + INSERT_CHUNK_SIZE]
WordpressIncident.insert_many(chunk).on_conflict(
conflict_target=conflict_target,
update={
WordpressIncident.retries: (
WordpressIncident.retries + EXCLUDED.retries
),
# occurrences merged into an already-reported row are
# unreported again, which is what keeps them from being
# swallowed by a row correlation already acknowledged
WordpressIncident.unsent_retries: (
WordpressIncident.unsent_retries + EXCLUDED.retries
),
WordpressIncident.timestamp: peewee_fn.MIN(
WordpressIncident.timestamp, EXCLUDED.timestamp
),
},
).execute()
return len(incidents_data)
def get_unsent_wordpress_incidents(
limit: int,
exclude_ids: Iterable[int] = (),
) -> list[dict]:
"""Get incidents carrying occurrences correlation has not acknowledged
yet, oldest first.
Unlike get_wordpress_incidents() this keeps TEST- rules: they are hidden
from the WordPress admin UI but still belong in correlation.
"""
exclude_ids = set(exclude_ids)
# in-flight rows are skipped in python rather than with a NOT IN: the set
# grows with every unacknowledged batch, and binding thousands of ids per
# cycle costs more than over-fetching by its size
rows = (
WordpressIncident.select(WordpressIncident)
.where(
(WordpressIncident.plugin == "wordpress")
& (WordpressIncident.unsent_retries > 0)
)
.order_by(
WordpressIncident.timestamp.asc(), WordpressIncident.id.asc()
)
.limit(limit + len(exclude_ids))
)
incidents = []
for row in rows:
if row.id in exclude_ids:
continue
# attached here rather than in wordpress_incident_to_dict: the UI
# reads that shape too and has no use for delivery bookkeeping
incidents.append(
{
**wordpress_incident_to_dict(row),
"unsent_retries": row.unsent_retries,
}
)
if len(incidents) == limit:
break
return incidents
def settle_wordpress_incidents_reported(reported: Mapping[int, int]) -> int:
"""Discount the occurrences correlation acknowledged.
Subtracts instead of clearing so that occurrences merged into a row while
its message was in flight stay pending rather than being dropped.
"""
by_amount = defaultdict(list)
for incident_id, amount in reported.items():
if amount > 0:
by_amount[amount].append(incident_id)
settled = 0
# chunked because sqlite caps the variables one query may bind, and the
# acknowledged set is only bounded by how large a batch the sender built
with WordpressIncident._meta.database.atomic():
for amount, incident_ids in by_amount.items():
for chunk in split_for_chunk(
incident_ids, chunk_size=CHUNK_SIZE_SQL_QUERY
):
settled += (
WordpressIncident.update(
unsent_retries=fn.MAX(
0, WordpressIncident.unsent_retries - amount
)
)
.where(WordpressIncident.id.in_(chunk))
.execute()
)
return settled
def delete_old_wordpress_incidents(
days: int, limit: int | None = MAX_STORED_INCIDENTS
):
cutoff_time = time.time() - timedelta(days=days).total_seconds()
is_wordpress = WordpressIncident.plugin == "wordpress"
stale = WordpressIncident.timestamp.cast("REAL") < cutoff_time
# Probing for the oldest row worth keeping costs an indexed lookup; the
# keep-set below matches every row against it, so only run that when the
# probe says the table is actually over the cap.
over_cap = (
limit
and (
WordpressIncident.select(WordpressIncident.timestamp)
.order_by(WordpressIncident.timestamp.desc())
.limit(1)
.offset(limit)
.scalar()
)
is not None
)
if over_cap:
keep = (
WordpressIncident.select(WordpressIncident.id)
.where(~stale)
.order_by(WordpressIncident.timestamp.desc())
.limit(limit)
)
stale |= WordpressIncident.id.not_in(keep)
return WordpressIncident.delete().where(is_wordpress & stale).execute()
def build_message_fallback(incident_data: dict) -> str:
"""Build message if plugin didn't provide one (per spec format)."""
parts = ["IM WP plugin:"]
if incident_data.get("rule_id"):
parts.append(incident_data["rule_id"])
if incident_data.get("cve"):
parts.append(incident_data["cve"])
if incident_data.get("slug"):
parts.append(incident_data["slug"])
if incident_data.get("version"):
parts.append(incident_data["version"])
if incident_data.get("mode"):
parts.append(incident_data["mode"])
return " ".join(parts)
def calculate_severity(mode: str | None) -> int:
"""Calculate severity based on mode."""
if mode == "block":
return 8 # Higher severity for blocked attacks
elif mode == "pass":
return 5 # Medium severity for monitored attacks
else:
return 5 # Default
def serialize_json_field(value) -> str | None:
"""Serialize a value to JSON string if it's not already a string."""
if value is None:
return None
if isinstance(value, str):
return value
return json.dumps(value)
defence360agent/model/wp_disabled_rule.py 0000644 0000000 0000000 00000036016 00000000000 015532 0 ustar """WordPress-specific disabled rules data model.
This module provides a separate data model for WordPress disabled rules,
independent of the existing DisabledRule/DisabledRuleDomain models used
by modsec/ossec plugins.
Disable Behavior:
Global and domain-level disables are independent and can coexist.
A rule is considered effectively disabled for a given WordPress domain
if EITHER of these conditions is true:
- A global disable exists for the rule (applies to all domains)
- A domain-specific disable exists for the rule and that domain
Enabling a rule at one scope does not affect disables at the other scope.
For example, removing a global disable leaves any domain-specific disables
intact, and vice versa.
"""
from collections.abc import Iterator
import logging
import time
from peewee import (
CharField,
FloatField,
IntegerField,
IntegrityError,
PrimaryKeyField,
fn,
)
from defence360agent.model import Model, instance
logger = logging.getLogger(__name__)
class WPDisabledRule(Model):
"""Stores disabled WordPress protection rules.
Uses a scope-based design:
- scope='global', scope_value=NULL: Rule disabled for all domains (root only)
- scope='domain', scope_value='example.com': Rule disabled for specific domain
"""
class Meta:
database = instance.db
db_table = "wp_disabled_rules"
indexes = ((("rule_id", "scope", "scope_value"), True),)
id = PrimaryKeyField()
# The rule identifier (e.g., "CVE-2025-001")
rule_id = CharField(null=False)
# The scope type: "global" or "domain"
scope = CharField(null=False)
# The scope value: NULL for global, domain name for domain scope
scope_value = CharField(null=True)
# Unix timestamp when the rule was disabled
disabled_at = FloatField(null=False)
# Origin of the disable action: "wordpress" (from wordpress admin ui) or "agent" (from CLI/RPC)
source = CharField(null=False)
# UID of the user who disabled the rule (0 for root)
created_by_user_id = IntegerField(null=False)
# Scope constants
SCOPE_GLOBAL = "global"
SCOPE_DOMAIN = "domain"
# Source constants
SOURCE_WORDPRESS = "wordpress"
SOURCE_AGENT = "agent"
@classmethod
def store(
cls,
rule_id: str,
domains: list[str] | None,
source: str,
user_id: int,
timestamp: float | None = None,
) -> int:
"""
Disable a rule globally or for specific domains.
Args:
rule_id: The rule identifier (e.g., "CVE-2025-001")
domains: List of domains to disable for, or None/empty for global disable
source: Origin of the action ("wordpress" or "agent")
user_id: UID of the user performing the action (0 for root)
timestamp: Unix timestamp for when the rule was disabled.
If None, uses current time.
Returns:
Number of new entries created (0 if all were no-ops).
"""
if timestamp is None:
timestamp = time.time()
if domains:
return cls._disable_for_domains(
rule_id, domains, timestamp, source, user_id
)
return cls._disable_globally(rule_id, timestamp, source, user_id)
@classmethod
def _disable_globally(
cls,
rule_id: str,
timestamp: float,
source: str,
user_id: int,
) -> int:
"""Disable a rule globally (independent of domain-specific entries)."""
created = cls._create_if_not_exists(
rule_id=rule_id,
scope=cls.SCOPE_GLOBAL,
scope_value=None,
disabled_at=timestamp,
source=source,
user_id=user_id,
)
if created:
logger.debug(
"Disabled rule %s globally (source=%s, user_id=%s)",
rule_id,
source,
user_id,
)
return int(created)
@classmethod
def _disable_for_domains(
cls,
rule_id: str,
domains: list[str],
timestamp: float,
source: str,
user_id: int,
) -> int:
"""Disable a rule for specific domains (independent of global state)."""
count = 0
for domain in domains:
created = cls._create_if_not_exists(
rule_id=rule_id,
scope=cls.SCOPE_DOMAIN,
scope_value=domain,
disabled_at=timestamp,
source=source,
user_id=user_id,
)
if created:
count += 1
logger.debug(
"Disabled rule %s for domain %s (source=%s, user_id=%s)",
rule_id,
domain,
source,
user_id,
)
return count
@classmethod
def _create_if_not_exists(
cls,
rule_id: str,
scope: str,
scope_value: str | None,
disabled_at: float,
source: str,
user_id: int,
) -> bool:
"""
Create a new disabled rule entry if it doesn't already exist.
Returns:
True if a new entry was created, False if it already existed (no-op)
"""
try:
cls.insert(
rule_id=rule_id,
scope=scope,
scope_value=scope_value,
disabled_at=disabled_at,
source=source,
created_by_user_id=user_id,
).execute()
return True
except IntegrityError:
# Rule already disabled for this scope - no-op
return False
@classmethod
def remove(cls, rule_id: str, domains: list[str] | None) -> int:
"""
Re-enable a rule globally or for specific domains.
Args:
rule_id: The rule identifier
domains: List of domains to enable for, or None/empty to enable globally
Returns:
Number of rows deleted
"""
if not domains:
# Enable globally - remove ONLY the global entry
count = (
cls.delete()
.where(
cls.rule_id == rule_id,
cls.scope == cls.SCOPE_GLOBAL,
)
.execute()
)
if count:
logger.debug("Enabled rule %s globally", rule_id)
else:
# Enable for specific domains
count = (
cls.delete()
.where(
cls.rule_id == rule_id,
cls.scope == cls.SCOPE_DOMAIN,
cls.scope_value.in_(domains),
)
.execute()
)
if count:
logger.debug(
"Enabled rule %s for %d domain(s)",
rule_id,
count,
)
return count
@classmethod
def is_rule_disabled(cls, rule_id: str, domain: str | None = None) -> bool:
"""
Check if a rule is disabled globally or for a specific domain.
Args:
rule_id: The rule identifier
domain: The domain to check. If None, only checks global disable.
Returns:
True if the rule is disabled, False otherwise
"""
if domain is None:
return (
cls.select()
.where(
cls.rule_id == rule_id,
cls.scope == cls.SCOPE_GLOBAL,
)
.exists()
)
return (
cls.select()
.where(
cls.rule_id == rule_id,
(
(cls.scope == cls.SCOPE_GLOBAL)
| (
(cls.scope == cls.SCOPE_DOMAIN)
& (cls.scope_value == domain)
)
),
)
.exists()
)
@classmethod
def get_domain_disabled(
cls, domain: str, include_global: bool = False
) -> list[str]:
"""
Get all rule IDs that are disabled for a specific domain.
Args:
domain: The domain to get disabled rules for
include_global: If True, also include globally disabled rules.
If False (default), only return domain-specific disables.
Returns:
List of rule IDs that are disabled for the domain
"""
if include_global:
query = (
cls.select(cls.rule_id)
.where(
(cls.scope == cls.SCOPE_GLOBAL)
| (
(cls.scope == cls.SCOPE_DOMAIN)
& (cls.scope_value == domain)
)
)
.distinct()
)
else:
query = cls.select(cls.rule_id).where(
cls.scope == cls.SCOPE_DOMAIN,
cls.scope_value == domain,
)
return [row.rule_id for row in query]
@classmethod
def get_global_disabled(cls) -> Iterator[str]:
"""
Get all rule IDs that are disabled globally.
Returns:
Iterator of globally disabled rule IDs
"""
query = cls.select(cls.rule_id).where(cls.scope == cls.SCOPE_GLOBAL)
return (row.rule_id for row in query)
@classmethod
def _build_filter_condition(
cls,
user_domains: list[str] | None,
include_global: bool,
):
"""
Build the WHERE condition for filtering rules.
Returns:
A Peewee expression for the WHERE clause, or None if no filter needed.
"""
if user_domains is not None:
domain_match = (cls.scope == cls.SCOPE_DOMAIN) & (
cls.scope_value.in_(user_domains)
)
if include_global:
return (cls.scope == cls.SCOPE_GLOBAL) | domain_match
return domain_match
if not include_global:
return cls.scope == cls.SCOPE_DOMAIN
return None
@classmethod
def fetch(
cls,
limit: int,
offset: int = 0,
user_domains: list[str] | None = None,
include_global: bool = False,
) -> tuple[int, list[dict]]:
"""
List disabled rules with aggregation by rule_id.
Multiple domain entries for the same rule are aggregated into a single
result with a list of domains. Results are ordered by most recently
disabled first (using the latest disabled_at timestamp per rule_id).
Uses a two-pass approach for efficiency:
1. First pass: Get rule_ids ordered by latest disabled_at with pagination
2. Second pass: Fetch only rows for the paginated rule_ids
Args:
limit: Maximum number of rules to return
offset: Number of rules to skip
user_domains: If provided, only return rules for these domains.
If None, return all rules (for root users).
include_global: Whether to include global rules in the result
Returns:
Tuple of (total_count, list of rule dicts)
Each dict has: {"rule_id": str, "is_global": bool, "domains": list[str]}
is_global is True if rule has a global disable, domains lists domain-specific disables
"""
# Build filter condition
condition = cls._build_filter_condition(user_domains, include_global)
# First pass: get rule_ids ordered by latest disabled_at (most recent first)
rule_ids_query = (
cls.select(cls.rule_id)
.group_by(cls.rule_id)
.order_by(fn.MAX(cls.disabled_at).desc())
)
if condition is not None:
rule_ids_query = rule_ids_query.where(condition)
# Get total count of distinct rule_ids
total_count = rule_ids_query.count()
# Apply pagination at DB level
paginated_rule_ids = [
row.rule_id for row in rule_ids_query.offset(offset).limit(limit)
]
if not paginated_rule_ids:
return total_count, []
# Second pass: fetch rows for the paginated rule_ids
rows_query = cls.select().where(cls.rule_id.in_(paginated_rule_ids))
if condition is not None:
rows_query = rows_query.where(condition)
# Aggregate domains by rule_id
rules_by_id: dict[str, dict] = {}
for row in rows_query:
if row.rule_id not in rules_by_id:
rules_by_id[row.rule_id] = {
"rule_id": row.rule_id,
"is_global": False,
"domains": [],
}
if row.scope == cls.SCOPE_GLOBAL:
rules_by_id[row.rule_id]["is_global"] = True
elif row.scope == cls.SCOPE_DOMAIN:
rules_by_id[row.rule_id]["domains"].append(row.scope_value)
# Build result in order from first query (preserves DB ordering)
result = []
for rule_id in paginated_rule_ids:
rule_data = rules_by_id[rule_id]
rule_data["domains"] = sorted(rule_data["domains"])
result.append(rule_data)
return total_count, result
def enrich_incidents_with_disabled_state(incidents: list[dict]) -> None:
"""Set is_rule_disabled on each incident dict in place.
A rule is considered disabled for an incident when wp_disabled_rules has
a row with rule_id == incident["rule"] AND (scope='global' OR
(scope='domain' AND scope_value == incident["domain"])). Incidents with
a NULL rule (legacy/imported rows) always get False.
Runs at most one SELECT regardless of the input length.
"""
rule_ids = {
inc["rule"] for inc in incidents if inc.get("rule") is not None
}
if not rule_ids:
for inc in incidents:
inc["is_rule_disabled"] = False
return
domains = {
inc["domain"] for inc in incidents if inc.get("domain") is not None
}
condition = WPDisabledRule.scope == WPDisabledRule.SCOPE_GLOBAL
if domains:
condition = condition | (
(WPDisabledRule.scope == WPDisabledRule.SCOPE_DOMAIN)
& (WPDisabledRule.scope_value.in_(domains))
)
query = WPDisabledRule.select(
WPDisabledRule.rule_id,
WPDisabledRule.scope,
WPDisabledRule.scope_value,
).where(WPDisabledRule.rule_id.in_(rule_ids), condition)
globally_disabled: set[str] = set()
domain_disabled: set[tuple[str, str]] = set()
for row in query:
if row.scope == WPDisabledRule.SCOPE_GLOBAL:
globally_disabled.add(row.rule_id)
else:
domain_disabled.add((row.rule_id, row.scope_value))
for inc in incidents:
rule = inc.get("rule")
domain = inc.get("domain")
inc["is_rule_disabled"] = bool(
rule is not None
and (
rule in globally_disabled
or (domain is not None and (rule, domain) in domain_disabled)
)
)
defence360agent/mr_proper/ 0000755 0000000 0000000 00000000000 00000000000 012553 5 ustar defence360agent/mr_proper/__init__.py 0000644 0000000 0000000 00000000741 00000000000 014666 0 ustar """
This package contains the definitions for cleaners. A cleaner can be
used to delete old files, database entries, etc.
All cleaners:
- inherit from BaseCleaner (implement the interface)
- should be used in the MrProper plugin to have any effect
"""
from abc import ABC, abstractmethod
class BaseCleaner(ABC):
@property
@classmethod
@abstractmethod
def PERIOD(cls):
pass
@classmethod
@abstractmethod
async def cleanup(cls):
pass
defence360agent/mr_proper/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 014763 5 ustar defence360agent/mr_proper/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002310 00000000000 022157 0 ustar
r_j 6 d Z ddlmZmZ G d de ZdS )z
This package contains the definitions for cleaners. A cleaner can be
used to delete old files, database entries, etc.
All cleaners:
- inherit from BaseCleaner (implement the interface)
- should be used in the MrProper plugin to have any effect
)ABCabstractmethodc j e Zd Zeeed Zeed ZdS ) BaseCleanerc d S N clss W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/mr_proper/__init__.pyPERIODzBaseCleaner.PERIOD s
c
K d S r r r
s r cleanupzBaseCleaner.cleanup s
r N)__name__
__module__ __qualname__property classmethodr r
r r r r r r sf
^ [ X
^ [
r r N)__doc__abcr r r r r r <module>r s] $ # # # # # # #
#
r defence360agent/mr_proper/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000002310 00000000000 021220 0 ustar
r_j 6 d Z ddlmZmZ G d de ZdS )z
This package contains the definitions for cleaners. A cleaner can be
used to delete old files, database entries, etc.
All cleaners:
- inherit from BaseCleaner (implement the interface)
- should be used in the MrProper plugin to have any effect
)ABCabstractmethodc j e Zd Zeeed Zeed ZdS ) BaseCleanerc d S N clss W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/mr_proper/__init__.pyPERIODzBaseCleaner.PERIOD s
c
K d S r r r
s r cleanupzBaseCleaner.cleanup s
r N)__name__
__module__ __qualname__property classmethodr r
r r r r r r sf
^ [ X
^ [
r r N)__doc__abcr r r r r r <module>r s] $ # # # # # # #
#
r defence360agent/myimunify/ 0000755 0000000 0000000 00000000000 00000000000 012574 5 ustar defence360agent/myimunify/__init__.py 0000644 0000000 0000000 00000000000 00000000000 014673 0 ustar defence360agent/myimunify/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 015004 5 ustar defence360agent/myimunify/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000304 00000000000 022201 0 ustar
r_j d S )N r W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/__init__.py<module>r s r defence360agent/myimunify/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000304 00000000000 021242 0 ustar
r_j d S )N r W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/__init__.py<module>r s r defence360agent/myimunify/__pycache__/billing.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004765 00000000000 022101 0 ustar
r_j d dl mZmZ d dlmZ e G d d Ze G d d Ze G d d Zd Zd
Z d S ) ) dataclassasdict)configc e Zd ZdZdS )
MILicenseTypeFreemiumN)__name__
__module__ __qualname__FREEMIUM V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/billing.pyr r s HHHr r c e Zd ZdZdZdS )IncompatibilityIDz=
Contains unique incompatibilities IDs for a billing
LICENSE_IS_NOT_SUPPORTEDN)r r
r __doc__UNSUPPORTED_LICENSEr
r r r r
s" 5r r c > e Zd ZU dZeed< eed< ed ZdS )CompatibilityIssuezC
Generic class for keeping compatibility issues with WHMCS
type descriptionc t | S N)r )selfs r dict_reprz CompatibilityIssue.dict_repr s d||r N)r r
r r str__annotations__propertyr r
r r r r sP III
X r r c D t j r t j S d S r )r is_mi_freemium_licenser r r
r r get_license_typer" ! s!
$&& & %% 4r c K g } t t j k r3| t t
j d j | S )z
Collects all incompatibilities for WHMCS:
1. No Freemium license means WHMCS cannot configure current server
2. ....
z5There is no supported MyImunify license on the server)r r )r" r r appendr r r r )issuess r !collect_billing_incompatibilitiesr& ' s^ F] 333
&:K
Mr N)
dataclassesr r defence360agent.contractsr r r r r" r& r
r r <module>r) s ) ) ) ) ) ) ) ) , , , , , , 5 5 5 5 5 5 5 5
r defence360agent/myimunify/__pycache__/billing.cpython-311.pyc 0000644 0000000 0000000 00000004765 00000000000 021142 0 ustar
r_j d dl mZmZ d dlmZ e G d d Ze G d d Ze G d d Zd Zd
Z d S ) ) dataclassasdict)configc e Zd ZdZdS )
MILicenseTypeFreemiumN)__name__
__module__ __qualname__FREEMIUM V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/billing.pyr r s HHHr r c e Zd ZdZdZdS )IncompatibilityIDz=
Contains unique incompatibilities IDs for a billing
LICENSE_IS_NOT_SUPPORTEDN)r r
r __doc__UNSUPPORTED_LICENSEr
r r r r
s" 5r r c > e Zd ZU dZeed< eed< ed ZdS )CompatibilityIssuezC
Generic class for keeping compatibility issues with WHMCS
type descriptionc t | S N)r )selfs r dict_reprz CompatibilityIssue.dict_repr s d||r N)r r
r r str__annotations__propertyr r
r r r r sP III
X r r c D t j r t j S d S r )r is_mi_freemium_licenser r r
r r get_license_typer" ! s!
$&& & %% 4r c K g } t t j k r3| t t
j d j | S )z
Collects all incompatibilities for WHMCS:
1. No Freemium license means WHMCS cannot configure current server
2. ....
z5There is no supported MyImunify license on the server)r r )r" r r appendr r r r )issuess r !collect_billing_incompatibilitiesr& ' s^ F] 333
&:K
Mr N)
dataclassesr r defence360agent.contractsr r r r r" r& r
r r <module>r) s ) ) ) ) ) ) ) ) , , , , , , 5 5 5 5 5 5 5 5
r defence360agent/myimunify/__pycache__/constants.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000333 00000000000 022460 0 ustar
r_j
d Z dS ) myimunifyN) MYIMUNIFY X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/constants.py<module>r s r defence360agent/myimunify/__pycache__/constants.cpython-311.pyc 0000644 0000000 0000000 00000000333 00000000000 021521 0 ustar
r_j
d Z dS ) myimunifyN) MYIMUNIFY X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/constants.py<module>r s r defence360agent/myimunify/__pycache__/model.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000016242 00000000000 021552 0 ustar
r_j N d dl Z d dlZd dlZd dlmZmZ d dlmZmZ d dl m
c m c m Z
d dlmZ d dlmZmZ d dlmZ d dlmZmZ d dlmZ ej d d
d Z ej e Z G d d
e Z d Z ddee! de"de"fdZ#de"fdZ$dee! de"fdZ%dS ) N)ListOptional) BooleanField CharField) MessageType)Modelinstance)run_in_executor)execute_iterable_expressionimporter
update_configzimav.malwarelib.model
MalwareHit)modulenamedefaultc e Zd ZdZ G d d Z ed Z edd Ze de
e d e fd
Z
e d ee d e fd
ZdS ) MyImunifyz Secure-site related settingsc e Zd Zej ZdZdS )MyImunify.Meta myimunifyN)__name__
__module__ __qualname__r dbdatabasedb_table T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/model.pyMetar s ; r r! T)uniqueF)nullr userreturnc \ ||dk rdS | |ddi \ }}|j S )z%Get SecureSite protection by usernameNrootT
protectionF)r$ defaults)
get_or_creater( )clsr$ perm_s r get_protectionzMyImunify.get_protection$ s? <46>>4## u8M#NNa r usersstatusc | fd|D | j gg | j i d S )Nc g | ]}|d S ))r$ r( r ).0r$ r0 s r
<listcomp>z5MyImunify.update_users_protection.<locals>.<listcomp>1 s! D D Ddd&
1
1 D D Dr )conflict_targetpreserveupdate) insert_many on_conflictr$ r( execute)r+ r/ r0 s `r update_users_protectionz!MyImunify.update_users_protection. sd D D D De D D D
+ XJNF+
')))))r N)r r r __doc__r! r r$ r r( classmethodr strboolr. r r; r r r r r s && 9D ! ! !D 5%888J (3- D [ DI t [ r r c K t d S t |d }|r0| t j | d {V d S d S )NT)r$ cleanup)hits)r malicious_selectprocess_messager MalwareCleanupTask)sinkr$ rB s r malware_cleanuprG 9 sx & &D$ & ? ?D N"";#At#L#L#LMMMMMMMMMMMN Nr Fr/ r0 force_config_updatec K t d fd d {V d sd|rt ddii g}n fdD }r| fdD z
}t j | d {V d S )Nc : t S N)r r; )r0 r/ s r <lambda>z)update_users_protection.<locals>.<lambda>F s 11%@@ r LOGPROACTIVE_DEFENCEmodec : g | ]}t d dii| S )rN rO r
)r3 r$ proactive_moderF s r r4 z+update_users_protection.<locals>.<listcomp>T sH
$v~&>?
r c 0 g | ]}t | S r )rG )r3 r$ rF s r r4 z+update_users_protection.<locals>.<listcomp>^ s# @@@$/$--@@@r )r
r asynciogather)rF r/ r0 rH tasksrQ s ``` @r r; r; A s @@@@@ N
$v~&>?
A
@@@@%@@@@
.%
r c K t j d{V }t | || d{V dS )z#Set protection status for all usersN)hp HostingPanel get_usersr; )rF r0 panel_userss r #set_protection_status_for_all_usersr[ c s[ ))3355555555K
!$ V
<
<<<<<<<<<<r r% c K t | }t t j }t t j | }||z
}|r;t d| d }t |t | ||z
}|r2t d| t | |d d{V t | pt | S )z5Synchronize existing permissions with myimunify userszRemove myimunify users %sc t t j | S rK )r deletewherer$ in_)users_to_removes r
expressionz sync_users.<locals>.expressionu s9 ##%%++""?33
r zAdd permissions to users %sFN)
setr selectr$ itertoolschaintuplesloggerinfor listr; r? )rF r/ rZ myimunify_usersra rb users_to_adds r
sync_usersrm i s e**K &&y~66O)/?+A+A+C+CDEEO% 3O G / AAA
$J_0E0EFFF 0L : 1<@@@%dE5999999999 6o!6!66r )F)&rS re loggingtypingr r peeweer r +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelrW "defence360agent.contracts.messagesr defence360agent.modelr r $defence360agent.model.simplificationr
defence360agent.utilsr r defence360agent.utils.configr getr getLoggerr rh r rG r> r? r; r[ rm r r r <module>r| s ! ! ! ! ! ! ! ! * * * * * * * * 8 8 8 8 8 8 8 8 8 8 8 8 : : : : : : 1 1 1 1 1 1 1 1 @ @ @ @ @ @ G G G G G G G G 6 6 6 6 6 6
X\ " t
8 $ $ FN N N GL ! !c !$( !?C ! ! ! !D=D = = = = 7$s) 7 7 7 7 7 7 7r defence360agent/myimunify/__pycache__/model.cpython-311.pyc 0000644 0000000 0000000 00000016242 00000000000 020613 0 ustar
r_j N d dl Z d dlZd dlZd dlmZmZ d dlmZmZ d dl m
c m c m Z
d dlmZ d dlmZmZ d dlmZ d dlmZmZ d dlmZ ej d d
d Z ej e Z G d d
e Z d Z ddee! de"de"fdZ#de"fdZ$dee! de"fdZ%dS ) N)ListOptional) BooleanField CharField) MessageType)Modelinstance)run_in_executor)execute_iterable_expressionimporter
update_configzimav.malwarelib.model
MalwareHit)modulenamedefaultc e Zd ZdZ G d d Z ed Z edd Ze de
e d e fd
Z
e d ee d e fd
ZdS ) MyImunifyz Secure-site related settingsc e Zd Zej ZdZdS )MyImunify.Meta myimunifyN)__name__
__module__ __qualname__r dbdatabasedb_table T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/model.pyMetar s ; r r! T)uniqueF)nullr userreturnc \ ||dk rdS | |ddi \ }}|j S )z%Get SecureSite protection by usernameNrootT
protectionF)r$ defaults)
get_or_creater( )clsr$ perm_s r get_protectionzMyImunify.get_protection$ s? <46>>4## u8M#NNa r usersstatusc | fd|D | j gg | j i d S )Nc g | ]}|d S ))r$ r( r ).0r$ r0 s r
<listcomp>z5MyImunify.update_users_protection.<locals>.<listcomp>1 s! D D Ddd&
1
1 D D Dr )conflict_targetpreserveupdate) insert_many on_conflictr$ r( execute)r+ r/ r0 s `r update_users_protectionz!MyImunify.update_users_protection. sd D D D De D D D
+ XJNF+
')))))r N)r r r __doc__r! r r$ r r( classmethodr strboolr. r r; r r r r r s && 9D ! ! !D 5%888J (3- D [ DI t [ r r c K t d S t |d }|r0| t j | d {V d S d S )NT)r$ cleanup)hits)r malicious_selectprocess_messager MalwareCleanupTask)sinkr$ rB s r malware_cleanuprG 9 sx & &D$ & ? ?D N"";#At#L#L#LMMMMMMMMMMMN Nr Fr/ r0 force_config_updatec K t d fd d {V d sd|rt ddii g}n fdD }r| fdD z
}t j | d {V d S )Nc : t S N)r r; )r0 r/ s r <lambda>z)update_users_protection.<locals>.<lambda>F s 11%@@ r LOGPROACTIVE_DEFENCEmodec : g | ]}t d dii| S )rN rO r
)r3 r$ proactive_moderF s r r4 z+update_users_protection.<locals>.<listcomp>T sH
$v~&>?
r c 0 g | ]}t | S r )rG )r3 r$ rF s r r4 z+update_users_protection.<locals>.<listcomp>^ s# @@@$/$--@@@r )r
r asynciogather)rF r/ r0 rH tasksrQ s ``` @r r; r; A s @@@@@ N
$v~&>?
A
@@@@%@@@@
.%
r c K t j d{V }t | || d{V dS )z#Set protection status for all usersN)hp HostingPanel get_usersr; )rF r0 panel_userss r #set_protection_status_for_all_usersr[ c s[ ))3355555555K
!$ V
<
<<<<<<<<<<r r% c K t | }t t j }t t j | }||z
}|r;t d| d }t |t | ||z
}|r2t d| t | |d d{V t | pt | S )z5Synchronize existing permissions with myimunify userszRemove myimunify users %sc t t j | S rK )r deletewherer$ in_)users_to_removes r
expressionz sync_users.<locals>.expressionu s9 ##%%++""?33
r zAdd permissions to users %sFN)
setr selectr$ itertoolschaintuplesloggerinfor listr; r? )rF r/ rZ myimunify_usersra rb users_to_adds r
sync_usersrm i s e**K &&y~66O)/?+A+A+C+CDEEO% 3O G / AAA
$J_0E0EFFF 0L : 1<@@@%dE5999999999 6o!6!66r )F)&rS re loggingtypingr r peeweer r +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelrW "defence360agent.contracts.messagesr defence360agent.modelr r $defence360agent.model.simplificationr
defence360agent.utilsr r defence360agent.utils.configr getr getLoggerr rh r rG r> r? r; r[ rm r r r <module>r| s ! ! ! ! ! ! ! ! * * * * * * * * 8 8 8 8 8 8 8 8 8 8 8 8 : : : : : : 1 1 1 1 1 1 1 1 @ @ @ @ @ @ G G G G G G G G 6 6 6 6 6 6
X\ " t
8 $ $ FN N N GL ! !c !$( !?C ! ! ! !D=D = = = = 7$s) 7 7 7 7 7 7 7r defence360agent/myimunify/advice/ 0000755 0000000 0000000 00000000000 00000000000 014027 5 ustar defence360agent/myimunify/advice/__init__.py 0000644 0000000 0000000 00000000000 00000000000 016126 0 ustar defence360agent/myimunify/advice/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 016237 5 ustar defence360agent/myimunify/advice/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000313 00000000000 023434 0 ustar
r_j d S )N r ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/advice/__init__.py<module>r s r defence360agent/myimunify/advice/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000313 00000000000 022475 0 ustar
r_j d S )N r ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/advice/__init__.py<module>r s r defence360agent/myimunify/advice/__pycache__/advice_manager.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000020726 00000000000 024634 0 ustar
r_j d dl Z d dlZd dlmZ d dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
d dlmZ d d lmZ e j e Zd
Zd Zd Zd
efdZd
egfdZdS ) N)
find_wp_paths) EventsAPI)config)get_myimunify_users)get_upgrade_url_link) HostingPanel)MyImunifyWPAdvice) MyImunifyIMUNIFY_PROTECTIONc | g}t j t j | }|r |d dd rdS dS )Nr
protectionFactiveno)r
selectwhereuserin_dictsget)usernameitemresponses d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/advice/advice_manager.py get_myimunify_protection_statusr sl :D !!'' (:(:4(@(@AAGGIIH HQKOOL%88 xt c z K g }| d }t | }| d }| d }| d }| d }| d }| d } t | d{V }
t | D ]} d | } t j | d
| d
| d }
| d |
}t d"i d
|d|d| d|
dz d|dt ddd|d|ddddd d d |d|d d d!d }|
| |S )#a
imunify advice item:
{"id": 123,
"server_id": null,
"type": "malware_found_myimun_2",
"date": 123,
"severity": 1,
"translation_id": "1",
"parameters": {},
"description": null,
"link_text": null,
"link": null,
"dashboard": false,
"popup": false,
"snoozed_until": 0,
"popup_title": null,
"popup_description": null,
"config_action": {}, "ignore": {},
"notification": false,
"smartadvice": true,
"smartadvice_title": "Web hosting user account is infected",
"smartadvice_description": "
Imunify detected live malware on the user account hosting this website:
* inf1
* inf2
",
"smartadvice_user": "isuser",
"smartadvice_domain": "isuser.com",
"smartadvice_docroot": "/",
"ts": 123,
"first_generated": 123,
"iaid": "agent-iaid-123",
"notification_body_html": null,
"notification_period_limit": 0,
"notification_subject": null,
"notification_user": null}
->
{
"created_at": "2024-10-02T01:22:11.918688+00:00",
"updated_at": "2024-10-02T01:22:11.918688+00:00",
"metadata": {
"app": "imunify"
"username": "tkcpanel",
"domain": "tk-cpanel.com",
"website": "/",
"panel_url": "https://10.193.176.2:2083/cpsess0000000000/frontend/paper_lantern/lveversion/wpos.live.pl",
},
"advice": {
"id": "287718",
"type": "CPCSS",
"status": "review",
"description": "Turn on Critical Path CSS",
"is_premium": true,
"module_name": "critical_css",
"license_status": "NOT_REQUIRED",
"subscription": {
"status": "active",
"upgrade_url": "https://whmcs.dev.cloudlinux.com?username=tkcpanel&domain=tk-cpanel.com&server_ip=10.193.176.2&m=cloudlinux_advantage&action=provisioning&suite=accelerate_wp_premium"
},
"total_stages": 0,
"completed_stages": 0,
"detailed_description": "Critical Path CSS eliminates render-blocking CSS on your website and improves browser page render performance. Your website will load much faster for your visitors.
Note: Applying the current advice will also enable the AccelerateWP feature."
}
}
smartadvice_usersmartadvice_domainsmartadvice_docroot upgrade_urlsmartadvice_titlesmartadvice_descriptioniaidN/-zutf-8_r domainwebsite panel_urlz?show_cleanup_dialog=trueidtypestatusreview descriptiondetailed_description
is_premiumF module_nameimunifylicense_status NOT_REQUIREDsubscription_status total_stagesr completed_stages ) r r panel_user_linkr hashlibmd5encode hexdigestr ADV_TYPEappend to_advice)imunify_adviceadvices_by_docrootr protection_statusr' infected_docrootr r. r/ r# r) siter(
hashed_udwadv_idim360_protection_advices r _make_advicerI s | 01H7AA
0
1F%&;< /K !45K)*CD & !D"nn44X>>>>>>>>I .// G G d** [ , ,& , ,7 , , 3 3G < <
)++ '':''"3 #
#
#
X#
6#
G#
)* * #
v
#
#
8#
$ #
"6!5#
u#
" #
*>#
!2 1 #
$ #
!#
" Q##
& !!"9"C"C"E"EFFFF r returnc K g } t d {V }t dt | |r~|D ]{} t | d {V }nM# t
$ r@}t dt | t | Y d }~^d }~ww xY w| | || S )NzIM360 advice list: %sz<Unable to make advice based on item: %s, malformed error: %s)get_advice_notificationsloggerinfostrrI KeyErrorerrorextend)advices advice_listr advice_itemes r make_advicerW s G022222222K
KK'[)9)9::: ( ( (D
$0$6$6 6 6 6 6 6 6
!IIFF
NN; ' ' ' ' Ns A
B((6B##B(c F K t d t d {V D t } D ]A}t j | }| dd s| | B| z
t
j d {V }t dt | t fd|D }|D ];}t | d | d |d< <|S ) Nc . g | ]}|d
|d S )r
r r8 ).0r s r
<listcomp>z,get_advice_notifications.<locals>.<listcomp> s8
%
r
CONTROL_PANELsmart_advice_allowedzLSmart Advice events API response with notifications: %s, users to report: %sc B g | ]}| d v | S )r )r )rZ eventusers_to_reports r r[ z,get_advice_notifications.<locals>.<listcomp> s; 99' ( (O ; ; ; ; ;r r r r ) setr r
ConfigFiler addr
smart_advicesrM rN rO r ) users_to_popr confr datar r` s @r rL rL so
1 3 3333333
O 55L # # &&xx)?@@ # T " " "% 4O ,........H
KK 6 H
O D
2 HH' ( ($((3G*H*H
] Kr ) loggingr: clcommon.clwpos_libr !defence360agent.api.server.eventsr defence360agent.contractsr &defence360agent.contracts.myimunify_idr defence360agent.utils.whmcsr +defence360agent.subsys.panels.hosting_panelr *defence360agent.myimunify.advice.dataclassr defence360agent.myimunify.modelr
getLogger__name__rM r> r rI listrW dictrL r8 r r <module>ru s% - - - - - - 7 7 7 7 7 7 , , , , , , F F F F F F < < < < < < D D D D D D I H H H H H 5 5 5 5 5 5 8 $ $ c c c L4 ( r defence360agent/myimunify/advice/__pycache__/advice_manager.cpython-311.pyc 0000644 0000000 0000000 00000020726 00000000000 023675 0 ustar
r_j d dl Z d dlZd dlmZ d dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
d dlmZ d d lmZ e j e Zd
Zd Zd Zd
efdZd
egfdZdS ) N)
find_wp_paths) EventsAPI)config)get_myimunify_users)get_upgrade_url_link) HostingPanel)MyImunifyWPAdvice) MyImunifyIMUNIFY_PROTECTIONc | g}t j t j | }|r |d dd rdS dS )Nr
protectionFactiveno)r
selectwhereuserin_dictsget)usernameitemresponses d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/advice/advice_manager.py get_myimunify_protection_statusr sl :D !!'' (:(:4(@(@AAGGIIH HQKOOL%88 xt c z K g }| d }t | }| d }| d }| d }| d }| d }| d } t | d{V }
t | D ]} d | } t j | d
| d
| d }
| d |
}t d"i d
|d|d| d|
dz d|dt ddd|d|ddddd d d |d|d d d!d }|
| |S )#a
imunify advice item:
{"id": 123,
"server_id": null,
"type": "malware_found_myimun_2",
"date": 123,
"severity": 1,
"translation_id": "1",
"parameters": {},
"description": null,
"link_text": null,
"link": null,
"dashboard": false,
"popup": false,
"snoozed_until": 0,
"popup_title": null,
"popup_description": null,
"config_action": {}, "ignore": {},
"notification": false,
"smartadvice": true,
"smartadvice_title": "Web hosting user account is infected",
"smartadvice_description": "
Imunify detected live malware on the user account hosting this website:
* inf1
* inf2
",
"smartadvice_user": "isuser",
"smartadvice_domain": "isuser.com",
"smartadvice_docroot": "/",
"ts": 123,
"first_generated": 123,
"iaid": "agent-iaid-123",
"notification_body_html": null,
"notification_period_limit": 0,
"notification_subject": null,
"notification_user": null}
->
{
"created_at": "2024-10-02T01:22:11.918688+00:00",
"updated_at": "2024-10-02T01:22:11.918688+00:00",
"metadata": {
"app": "imunify"
"username": "tkcpanel",
"domain": "tk-cpanel.com",
"website": "/",
"panel_url": "https://10.193.176.2:2083/cpsess0000000000/frontend/paper_lantern/lveversion/wpos.live.pl",
},
"advice": {
"id": "287718",
"type": "CPCSS",
"status": "review",
"description": "Turn on Critical Path CSS",
"is_premium": true,
"module_name": "critical_css",
"license_status": "NOT_REQUIRED",
"subscription": {
"status": "active",
"upgrade_url": "https://whmcs.dev.cloudlinux.com?username=tkcpanel&domain=tk-cpanel.com&server_ip=10.193.176.2&m=cloudlinux_advantage&action=provisioning&suite=accelerate_wp_premium"
},
"total_stages": 0,
"completed_stages": 0,
"detailed_description": "Critical Path CSS eliminates render-blocking CSS on your website and improves browser page render performance. Your website will load much faster for your visitors.
Note: Applying the current advice will also enable the AccelerateWP feature."
}
}
smartadvice_usersmartadvice_domainsmartadvice_docroot upgrade_urlsmartadvice_titlesmartadvice_descriptioniaidN/-zutf-8_r domainwebsite panel_urlz?show_cleanup_dialog=trueidtypestatusreview descriptiondetailed_description
is_premiumF module_nameimunifylicense_status NOT_REQUIREDsubscription_status total_stagesr completed_stages ) r r panel_user_linkr hashlibmd5encode hexdigestr ADV_TYPEappend to_advice)imunify_adviceadvices_by_docrootr protection_statusr' infected_docrootr r. r/ r# r) siter(
hashed_udwadv_idim360_protection_advices r _make_advicerI s | 01H7AA
0
1F%&;< /K !45K)*CD & !D"nn44X>>>>>>>>I .// G G d** [ , ,& , ,7 , , 3 3G < <
)++ '':''"3 #
#
#
X#
6#
G#
)* * #
v
#
#
8#
$ #
"6!5#
u#
" #
*>#
!2 1 #
$ #
!#
" Q##
& !!"9"C"C"E"EFFFF r returnc K g } t d {V }t dt | |r~|D ]{} t | d {V }nM# t
$ r@}t dt | t | Y d }~^d }~ww xY w| | || S )NzIM360 advice list: %sz<Unable to make advice based on item: %s, malformed error: %s)get_advice_notificationsloggerinfostrrI KeyErrorerrorextend)advices advice_listr advice_itemes r make_advicerW s G022222222K
KK'[)9)9::: ( ( (D
$0$6$6 6 6 6 6 6 6
!IIFF
NN; ' ' ' ' Ns A
B((6B##B(c F K t d t d {V D t } D ]A}t j | }| dd s| | B| z
t
j d {V }t dt | t fd|D }|D ];}t | d | d |d< <|S ) Nc . g | ]}|d
|d S )r
r r8 ).0r s r
<listcomp>z,get_advice_notifications.<locals>.<listcomp> s8
%
r
CONTROL_PANELsmart_advice_allowedzLSmart Advice events API response with notifications: %s, users to report: %sc B g | ]}| d v | S )r )r )rZ eventusers_to_reports r r[ z,get_advice_notifications.<locals>.<listcomp> s; 99' ( (O ; ; ; ; ;r r r r ) setr r
ConfigFiler addr
smart_advicesrM rN rO r ) users_to_popr confr datar r` s @r rL rL so
1 3 3333333
O 55L # # &&xx)?@@ # T " " "% 4O ,........H
KK 6 H
O D
2 HH' ( ($((3G*H*H
] Kr ) loggingr: clcommon.clwpos_libr !defence360agent.api.server.eventsr defence360agent.contractsr &defence360agent.contracts.myimunify_idr defence360agent.utils.whmcsr +defence360agent.subsys.panels.hosting_panelr *defence360agent.myimunify.advice.dataclassr defence360agent.myimunify.modelr
getLogger__name__rM r> r rI listrW dictrL r8 r r <module>ru s% - - - - - - 7 7 7 7 7 7 , , , , , , F F F F F F < < < < < < D D D D D D I H H H H H 5 5 5 5 5 5 8 $ $ c c c L4 ( r defence360agent/myimunify/advice/__pycache__/dataclass.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005225 00000000000 023643 0 ustar
r_j \ d dl mZmZ d dlmZmZ d dlmZ e G d d ZdS ) ) dataclassfield)datetimetimezone)Optionalc e Zd ZU eed< eed< eed< eed< eed< eed< eed< eed< eed < eed
< eed < eed < eed
< eed< eed< eed< ed Zee ed< ed Z
ee ed< d Z dS )MyImunifyWPAdviceusernamedomainwebsite panel_urlidtypestatus descriptiondetailed_description
is_premium module_namelicense_statussubscription_status upgrade_url total_stagescompleted_stagesc b t j t j S Nr nowr utc isoformat _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/advice/dataclass.py<lambda>zMyImunifyWPAdvice.<lambda> X\ : : D D F F r! )default_factory
created_atc b t j t j S r r r r! r" r# zMyImunifyWPAdvice.<lambda> r$ r!
updated_atc | j | j d| j | j | j | j d| j | j | j | j | j
| j | j | j
| j d| j | j | j d dS )Nimunify)appr
r r r
)r r ) r r r r r r r subscriptionr r r )r& r( metadataadvice)r& r( r
r r r
r r r r r r r r r r r r )selfs r" to_advicezMyImunifyWPAdvice.to_advice s / / M + < !^ g + # / "o # /"&"5 " 6#'#3! ! !% 1$($9(,(A
r! N) __name__
__module__ __qualname__str__annotations__intr r& r r r( r0 r r! r" r r s3 MMM KKK
LLLNNN GGG
III KKK OOO %*UFF& & &J" &+UFF& & &J"
r! r N) dataclassesr r r r typingr r r r! r" <module>r9 s ( ( ( ( ( ( ( ( ' ' ' ' ' ' ' ' 3
3
3
3
3
3
3
3
3
3
r! defence360agent/myimunify/advice/__pycache__/dataclass.cpython-311.pyc 0000644 0000000 0000000 00000005225 00000000000 022704 0 ustar
r_j \ d dl mZmZ d dlmZmZ d dlmZ e G d d ZdS ) ) dataclassfield)datetimetimezone)Optionalc e Zd ZU eed< eed< eed< eed< eed< eed< eed< eed< eed < eed
< eed < eed < eed
< eed< eed< eed< ed Zee ed< ed Z
ee ed< d Z dS )MyImunifyWPAdviceusernamedomainwebsite panel_urlidtypestatus descriptiondetailed_description
is_premium module_namelicense_statussubscription_status upgrade_url total_stagescompleted_stagesc b t j t j S Nr nowr utc isoformat _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/advice/dataclass.py<lambda>zMyImunifyWPAdvice.<lambda> X\ : : D D F F r! )default_factory
created_atc b t j t j S r r r r! r" r# zMyImunifyWPAdvice.<lambda> r$ r!
updated_atc | j | j d| j | j | j | j d| j | j | j | j | j
| j | j | j
| j d| j | j | j d dS )Nimunify)appr
r r r
)r r ) r r r r r r r subscriptionr r r )r& r( metadataadvice)r& r( r
r r r
r r r r r r r r r r r r )selfs r" to_advicezMyImunifyWPAdvice.to_advice s / / M + < !^ g + # / "o # /"&"5 " 6#'#3! ! !% 1$($9(,(A
r! N) __name__
__module__ __qualname__str__annotations__intr r& r r r( r0 r r! r" r r s3 MMM KKK
LLLNNN GGG
III KKK OOO %*UFF& & &J" &+UFF& & &J"
r! r N) dataclassesr r r r typingr r r r! r" <module>r9 s ( ( ( ( ( ( ( ( ' ' ' ' ' ' ' ' 3
3
3
3
3
3
3
3
3
3
r! defence360agent/myimunify/advice/__pycache__/hosting_smart_advice_api.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002475 00000000000 026735 0 ustar
r_jp T d dl Z d dlZd dlmZmZ ej e ZdZdZ d Z
dS ) N)
CheckRunError check_runzcl-hosting-smart-adviceimunifyc 4 K t j | } t t ddt d|g d {V }t j | }| dd S # t $ r&}t d| Y d }~dS d }~ww xY w)Nsyncz--appz--jsonsuccessFz9Failed to sync advices with `cl-hosting-smart-advice`: %s)
jsondumpsr
EXECUTABLEAPP_NAMEloadsgetr loggerwarning)advicespayloadoutresultes n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/advice/hosting_smart_advice_api.py sync_advicesr s j!!G ,
(Hg F
C zz)U+++ G
uuuuu s %A' '
B1BB) r loggingdefence360agent.utilsr r getLogger__name__r r r r r <module>r sd : : : : : : : : 8 $ $
&
,
,
,
,
,r defence360agent/myimunify/advice/__pycache__/hosting_smart_advice_api.cpython-311.pyc 0000644 0000000 0000000 00000002475 00000000000 025776 0 ustar
r_jp T d dl Z d dlZd dlmZmZ ej e ZdZdZ d Z
dS ) N)
CheckRunError check_runzcl-hosting-smart-adviceimunifyc 4 K t j | } t t ddt d|g d {V }t j | }| dd S # t $ r&}t d| Y d }~dS d }~ww xY w)Nsyncz--appz--jsonsuccessFz9Failed to sync advices with `cl-hosting-smart-advice`: %s)
jsondumpsr
EXECUTABLEAPP_NAMEloadsgetr loggerwarning)advicespayloadoutresultes n/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/myimunify/advice/hosting_smart_advice_api.py sync_advicesr s j!!G ,
(Hg F
C zz)U+++ G
uuuuu s %A' '
B1BB) r loggingdefence360agent.utilsr r getLogger__name__r r r r r <module>r sd : : : : : : : : 8 $ $
&
,
,
,
,
,r defence360agent/myimunify/advice/advice_manager.py 0000644 0000000 0000000 00000014312 00000000000 017327 0 ustar import logging
import hashlib
from clcommon.clwpos_lib import find_wp_paths
from defence360agent.api.server.events import EventsAPI
from defence360agent.contracts import config
from defence360agent.contracts.myimunify_id import get_myimunify_users
from defence360agent.utils.whmcs import get_upgrade_url_link
from defence360agent.subsys.panels.hosting_panel import HostingPanel
from defence360agent.myimunify.advice.dataclass import MyImunifyWPAdvice
from defence360agent.myimunify.model import MyImunify
logger = logging.getLogger(__name__)
ADV_TYPE = "IMUNIFY_PROTECTION"
def get_myimunify_protection_status(username):
item = [username]
response = MyImunify.select().where(MyImunify.user.in_(item)).dicts()
if response and response[0].get("protection", False):
return "active"
else:
return "no"
async def _make_advice(imunify_advice):
"""
imunify advice item:
{"id": 123,
"server_id": null,
"type": "malware_found_myimun_2",
"date": 123,
"severity": 1,
"translation_id": "1",
"parameters": {},
"description": null,
"link_text": null,
"link": null,
"dashboard": false,
"popup": false,
"snoozed_until": 0,
"popup_title": null,
"popup_description": null,
"config_action": {}, "ignore": {},
"notification": false,
"smartadvice": true,
"smartadvice_title": "Web hosting user account is infected",
"smartadvice_description": "\nImunify detected live malware on the user account hosting this website:\n\n* inf1\n\n* inf2\n",
"smartadvice_user": "isuser",
"smartadvice_domain": "isuser.com",
"smartadvice_docroot": "/",
"ts": 123,
"first_generated": 123,
"iaid": "agent-iaid-123",
"notification_body_html": null,
"notification_period_limit": 0,
"notification_subject": null,
"notification_user": null}
->
{
"created_at": "2024-10-02T01:22:11.918688+00:00",
"updated_at": "2024-10-02T01:22:11.918688+00:00",
"metadata": {
"app": "imunify"
"username": "tkcpanel",
"domain": "tk-cpanel.com",
"website": "/",
"panel_url": "https://10.193.176.2:2083/cpsess0000000000/frontend/paper_lantern/lveversion/wpos.live.pl",
},
"advice": {
"id": "287718",
"type": "CPCSS",
"status": "review",
"description": "Turn on Critical Path CSS",
"is_premium": true,
"module_name": "critical_css",
"license_status": "NOT_REQUIRED",
"subscription": {
"status": "active",
"upgrade_url": "https://whmcs.dev.cloudlinux.com?username=tkcpanel&domain=tk-cpanel.com&server_ip=10.193.176.2&m=cloudlinux_advantage&action=provisioning&suite=accelerate_wp_premium"
},
"total_stages": 0,
"completed_stages": 0,
"detailed_description": "Critical Path CSS eliminates render-blocking CSS on your website and improves browser page render performance. Your website will load much faster for your visitors.\nNote: Applying the current advice will also enable the AccelerateWP feature."
}
}
"""
advices_by_docroot = []
username = imunify_advice["smartadvice_user"]
protection_status = get_myimunify_protection_status(username)
domain = imunify_advice["smartadvice_domain"]
infected_docroot = imunify_advice["smartadvice_docroot"]
upgrade_url = imunify_advice["upgrade_url"]
description = imunify_advice["smartadvice_title"]
detailed_description = imunify_advice["smartadvice_description"]
iaid = imunify_advice["iaid"]
panel_url = await HostingPanel().panel_user_link(username)
for site in find_wp_paths(infected_docroot):
website = f"/{site}"
# for analytics: iaid-hash(username-domain-website)
hashed_udw = hashlib.md5(
f"{username}-{domain}-{website}".encode("utf-8")
).hexdigest()
adv_id = f"{iaid}_{hashed_udw}"
im360_protection_advice = MyImunifyWPAdvice(
username=username,
domain=domain,
website=website,
panel_url=panel_url
+ "?show_cleanup_dialog=true", # Flag tells UI to display cleanup dialog
id=adv_id,
type=ADV_TYPE,
status="review",
description=description,
detailed_description=detailed_description,
is_premium=False,
module_name="imunify",
license_status="NOT_REQUIRED",
subscription_status=protection_status,
upgrade_url=upgrade_url,
total_stages=0,
completed_stages=0,
)
advices_by_docroot.append(im360_protection_advice.to_advice())
return advices_by_docroot
async def make_advice() -> list:
advices = []
advice_list = await get_advice_notifications()
logger.info("IM360 advice list: %s", str(advice_list))
if advice_list:
for item in advice_list:
try:
advice_item = await _make_advice(item)
except KeyError as e:
logger.error(
"Unable to make advice based on item: %s, malformed"
" error: %s",
str(item),
str(e),
)
continue
advices.extend(advice_item)
return advices
async def get_advice_notifications() -> [dict]:
users_to_report = set(
[
item["username"]
for item in await get_myimunify_users()
if not item["protection"]
]
)
users_to_pop = set()
for user in users_to_report:
conf = config.ConfigFile(user)
if not conf.get("CONTROL_PANEL", "smart_advice_allowed"):
users_to_pop.add(user)
users_to_report = users_to_report - users_to_pop
response = await EventsAPI.smart_advices()
logger.info(
"Smart Advice events API response "
"with notifications: %s, users to report: %s",
str(response),
str(users_to_report),
)
data = [
event
for event in response
if event.get("smartadvice_user") in users_to_report
]
for item in data:
item["upgrade_url"] = get_upgrade_url_link(
item.get("smartadvice_user"), item.get("smartadvice_domain")
)
return data
defence360agent/myimunify/advice/dataclass.py 0000644 0000000 0000000 00000003364 00000000000 016346 0 ustar from dataclasses import dataclass, field
from datetime import datetime, timezone
from typing import Optional
@dataclass
class MyImunifyWPAdvice:
username: str
domain: str
website: str
panel_url: str
id: int
type: str
status: str
description: str
detailed_description: str
is_premium: str
module_name: str
license_status: str
subscription_status: str
upgrade_url: str
total_stages: int
completed_stages: int
created_at: Optional[datetime] = field(
default_factory=lambda: datetime.now(timezone.utc).isoformat()
)
updated_at: Optional[datetime] = field(
default_factory=lambda: datetime.now(timezone.utc).isoformat()
)
def to_advice(self):
return {
"created_at": self.created_at,
"updated_at": self.updated_at,
"metadata": {
"app": "imunify",
"username": self.username,
"domain": self.domain,
"website": self.website,
"panel_url": self.panel_url,
},
"advice": {
"id": self.id,
"type": self.type,
"status": self.status,
"description": self.description,
"is_premium": self.is_premium,
"module_name": self.module_name,
"license_status": self.license_status,
"subscription": {
"status": self.subscription_status,
"upgrade_url": self.upgrade_url,
},
"total_stages": self.total_stages,
"completed_stages": self.completed_stages,
"detailed_description": self.detailed_description,
},
}
defence360agent/myimunify/advice/hosting_smart_advice_api.py 0000644 0000000 0000000 00000001160 00000000000 021424 0 ustar import json
import logging
from defence360agent.utils import CheckRunError, check_run
logger = logging.getLogger(__name__)
EXECUTABLE = "cl-hosting-smart-advice"
APP_NAME = "imunify"
async def sync_advices(advices):
payload = json.dumps(advices)
try:
out = await check_run(
[EXECUTABLE, "sync", "--app", APP_NAME, "--json", payload]
)
except CheckRunError as e:
logger.warning(
"Failed to sync advices with `cl-hosting-smart-advice`: %s", e
)
return False
else:
result = json.loads(out)
return result.get("success", False)
defence360agent/myimunify/billing.py 0000644 0000000 0000000 00000002267 00000000000 014575 0 ustar from dataclasses import dataclass, asdict
from defence360agent.contracts import config
@dataclass
class MILicenseType:
FREEMIUM = "Freemium"
@dataclass
class IncompatibilityID:
"""
Contains unique incompatibilities IDs for a billing
"""
UNSUPPORTED_LICENSE = "LICENSE_IS_NOT_SUPPORTED"
@dataclass
class CompatibilityIssue:
"""
Generic class for keeping compatibility issues with WHMCS
"""
type: str
description: str
@property
def dict_repr(self):
return asdict(self)
def get_license_type():
if config.is_mi_freemium_license():
return MILicenseType.FREEMIUM
return None
async def collect_billing_incompatibilities():
"""
Collects all incompatibilities for WHMCS:
1. No Freemium license means WHMCS cannot configure current server
2. ....
"""
issues = []
if get_license_type() != MILicenseType.FREEMIUM:
issues.append(
CompatibilityIssue(
type=IncompatibilityID.UNSUPPORTED_LICENSE,
description=(
"There is no supported MyImunify license on the server"
),
).dict_repr
)
return issues
defence360agent/myimunify/constants.py 0000644 0000000 0000000 00000000030 00000000000 015153 0 ustar MYIMUNIFY = "myimunify"
defence360agent/myimunify/model.py 0000644 0000000 0000000 00000007437 00000000000 014261 0 ustar import asyncio
import itertools
import logging
from typing import List, Optional
from peewee import BooleanField, CharField
import defence360agent.subsys.panels.hosting_panel as hp
from defence360agent.contracts.messages import MessageType
from defence360agent.model import Model, instance
from defence360agent.model.simplification import run_in_executor
from defence360agent.utils import execute_iterable_expression, importer
from defence360agent.utils.config import update_config
MalwareHit = importer.get(
module="imav.malwarelib.model", name="MalwareHit", default=None
)
logger = logging.getLogger(__name__)
class MyImunify(Model):
"""Secure-site related settings"""
class Meta:
database = instance.db
db_table = "myimunify"
#: The username of the end-user, or an empty string for the default value
#: for all new users.
user = CharField(unique=True)
#: Is MyImunify protection enabled/disabled to the end-user.
protection = BooleanField(null=False, default=False)
@classmethod
def get_protection(cls, user: Optional[str]) -> bool:
"""Get SecureSite protection by username"""
if user is None or user == "root":
# root
return True
perm, _ = cls.get_or_create(user=user, defaults={"protection": False})
return perm.protection
@classmethod
def update_users_protection(cls, users: List[str], status: bool):
cls.insert_many(
[{"user": user, "protection": status} for user in users]
).on_conflict(
conflict_target=[cls.user],
preserve=[],
update={cls.protection: status},
).execute()
async def malware_cleanup(sink, user):
if MalwareHit is None:
return
hits = MalwareHit.malicious_select(user=user, cleanup=True)
if hits:
await sink.process_message(MessageType.MalwareCleanupTask(hits=hits))
async def update_users_protection(
sink, users: List[str], status: bool, force_config_update: bool = False
):
await run_in_executor(
None,
lambda: MyImunify.update_users_protection(users, status),
)
proactive_mode = None
if not status:
proactive_mode = "LOG"
if force_config_update:
tasks = [
update_config(
sink,
{"PROACTIVE_DEFENCE": {"mode": proactive_mode}},
)
]
else:
tasks = [
update_config(
sink,
{"PROACTIVE_DEFENCE": {"mode": proactive_mode}},
user,
)
for user in users
]
if status:
tasks += [malware_cleanup(sink, user) for user in users]
await asyncio.gather(*tasks)
async def set_protection_status_for_all_users(sink, status: bool):
"""Set protection status for all users"""
panel_users = await hp.HostingPanel().get_users()
await update_users_protection(sink, panel_users, status)
async def sync_users(sink, users: List[str]) -> bool:
"""Synchronize existing permissions with myimunify users"""
panel_users = set(users)
myimunify_users = MyImunify.select(MyImunify.user)
myimunify_users = set(itertools.chain(*myimunify_users.tuples()))
users_to_remove = myimunify_users - panel_users
if users_to_remove:
logger.info("Remove myimunify users %s", users_to_remove)
def expression(users_to_remove):
return MyImunify.delete().where(
MyImunify.user.in_(users_to_remove)
)
execute_iterable_expression(expression, list(users_to_remove))
users_to_add = panel_users - myimunify_users
if users_to_add:
logger.info("Add permissions to users %s", users_to_add)
await update_users_protection(sink, users, False)
return bool(users_to_add) or bool(users_to_remove)
defence360agent/plugins/ 0000755 0000000 0000000 00000000000 00000000000 012227 5 ustar defence360agent/plugins/__init__.py 0000644 0000000 0000000 00000000000 00000000000 014326 0 ustar defence360agent/plugins/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 014437 5 ustar defence360agent/plugins/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000302 00000000000 021632 0 ustar
r_j d S )N r U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/__init__.py<module>r s r defence360agent/plugins/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000302 00000000000 020673 0 ustar
r_j d S )N r U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/__init__.py<module>r s r defence360agent/plugins/__pycache__/accumulate.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000014177 00000000000 022235 0 ustar
r_j d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZm Z m
Z
d dl m Z m
Z
mZ d dlmZmZ ee Z G d de e
ZdS ) N) getLogger)
inactivity)
Accumulatable MessageType
Splittable) MessageSink
MessageSourceexpect)recurring_checksafe_cancel_taskc & e Zd Zej j ZdZ ee j
dd Z ee j
dd Z
e e
f fd Zd Zd Zd Zd
Z eej d efd Zd
Z xZS )
Accumulate %IMUNIFY360_AGGREGATE_MESSAGES_TIMEOUT< *IMUNIFY360_AGGREGATE_SHUTDOWN_SEND_TIMEOUT2 c t j di | || _ || _ t j t | _ d S )N )super__init___period_shutdown_timeout collections defaultdictlist_data)selfperiodshutdown_timeoutkwargs __class__s W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/accumulate.pyr zAccumulate.__init__" sG ""6""" !1 ,T22
c K || _ || _ | j dk rd n<| t | j | j | _ d S )Nr )_loop_sinkr create_taskr _flush_task)r loopsinks r#
create_sourcezAccumulate.create_source- sf
|q
D!!"L"?/$,"?"? "L"L"N"NOO
r$ c K || _ d S )N)r& )r r+ s r# create_sinkzAccumulate.create_sink6 s
r$ c $ K t j | | j d {V d S # t j $ rH t
d| j | j t | j d {V Y d S Y d S w xY w)Nz5Timeout (%ss) sending messages to server on shutdown.) asynciowait_forstopr TimeoutErrorloggererrorr* r r s r# shutdownzAccumulate.shutdown9 s 3"499;;0FGG G G G G G G G G G# 3 3 3 LLG&
z%&tz222222222222 &%%
3s 28 ABBc K t d | j t | j d {V t d | d {V d S )Nz Accumulate.stop cancel _taskzAccumulate.stop wait lock)r5 infor* r r) r7 s r# r3 zAccumulate.stopE s| 2333 : !"4:.. . . . . . . . /000kkmmr$ messagec D K t |j t r|j n|j f}| r`t j d 5 |D ]"}| j | | # d d d d S # 1 swxY w Y d S d S )N
accumulate)
isinstance
LIST_CLASStuple
do_accumulater tracktaskr append)r r;
list_types list_types r# collectzAccumulate.collectM s ',e44
'G $&
" " :!&&|44
:
:!+ : :IJy)009999:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
: : :s &BBBc
K | j }t j t | _ | D ]\ }}t |t r| | n|f}|D ]}t d|j
dt | d | j
|| d {V a# t $ r t d|| w xY wd S )NzPrepare z(<items=z>) for further processing)itemsz%s, %s)r r r r rI
issubclassr batchedr5 r: __name__lenr' process_message TypeErrorr6 )r copy_datarF messagesrK batchs r# r) zAccumulate._flushY sB J ,T22
#,??#4#4 Ix i44! !!(+++ [
!
-y 1 - -3u:: - - - *44YYU5K5K5KLLLLLLLLLL LL9e<<<
s &*C(C9)rL
__module__ __qualname__r ProcessingOrderPOST_PROCESS_MESSAGEPROCESSING_ORDERSHUTDOWN_PRIORITYintosenvirongetDEFAULT_AGGREGATE_TIMEOUTSHUTDOWN_SEND_TIMEOUTr r- r/ r8 r3 r
r r rG r)
__classcell__)r" s @r# r r s) "2G !$
>CC! ! C
CRHH ). 3 3 3 3 3 3
3
3
3 VK %&& :] : : : '& : r$ r )r1 r rZ loggingr defence360agent.apir "defence360agent.contracts.messagesr r r !defence360agent.contracts.pluginsr r r
defence360agent.utilsr r rL r5 r r r$ r# <module>re s * * * * * *
D C C C C C C C 8 Z Z Z Z Zm Z Z Z Z Zr$ defence360agent/plugins/__pycache__/accumulate.cpython-311.pyc 0000644 0000000 0000000 00000014177 00000000000 021276 0 ustar
r_j d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZm Z m
Z
d dl m Z m
Z
mZ d dlmZmZ ee Z G d de e
ZdS ) N) getLogger)
inactivity)
Accumulatable MessageType
Splittable) MessageSink
MessageSourceexpect)recurring_checksafe_cancel_taskc & e Zd Zej j ZdZ ee j
dd Z ee j
dd Z
e e
f fd Zd Zd Zd Zd
Z eej d efd Zd
Z xZS )
Accumulate %IMUNIFY360_AGGREGATE_MESSAGES_TIMEOUT< *IMUNIFY360_AGGREGATE_SHUTDOWN_SEND_TIMEOUT2 c t j di | || _ || _ t j t | _ d S )N )super__init___period_shutdown_timeout collections defaultdictlist_data)selfperiodshutdown_timeoutkwargs __class__s W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/accumulate.pyr zAccumulate.__init__" sG ""6""" !1 ,T22
c K || _ || _ | j dk rd n<| t | j | j | _ d S )Nr )_loop_sinkr create_taskr _flush_task)r loopsinks r#
create_sourcezAccumulate.create_source- sf
|q
D!!"L"?/$,"?"? "L"L"N"NOO
r$ c K || _ d S )N)r& )r r+ s r# create_sinkzAccumulate.create_sink6 s
r$ c $ K t j | | j d {V d S # t j $ rH t
d| j | j t | j d {V Y d S Y d S w xY w)Nz5Timeout (%ss) sending messages to server on shutdown.) asynciowait_forstopr TimeoutErrorloggererrorr* r r s r# shutdownzAccumulate.shutdown9 s 3"499;;0FGG G G G G G G G G G# 3 3 3 LLG&
z%&tz222222222222 &%%
3s 28 ABBc K t d | j t | j d {V t d | d {V d S )Nz Accumulate.stop cancel _taskzAccumulate.stop wait lock)r5 infor* r r) r7 s r# r3 zAccumulate.stopE s| 2333 : !"4:.. . . . . . . . /000kkmmr$ messagec D K t |j t r|j n|j f}| r`t j d 5 |D ]"}| j | | # d d d d S # 1 swxY w Y d S d S )N
accumulate)
isinstance
LIST_CLASStuple
do_accumulater tracktaskr append)r r;
list_types list_types r# collectzAccumulate.collectM s ',e44
'G $&
" " :!&&|44
:
:!+ : :IJy)009999:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
: : :s &BBBc
K | j }t j t | _ | D ]\ }}t |t r| | n|f}|D ]}t d|j
dt | d | j
|| d {V a# t $ r t d|| w xY wd S )NzPrepare z(<items=z>) for further processing)itemsz%s, %s)r r r r rI
issubclassr batchedr5 r: __name__lenr' process_message TypeErrorr6 )r copy_datarF messagesrK batchs r# r) zAccumulate._flushY sB J ,T22
#,??#4#4 Ix i44! !!(+++ [
!
-y 1 - -3u:: - - - *44YYU5K5K5KLLLLLLLLLL LL9e<<<
s &*C(C9)rL
__module__ __qualname__r ProcessingOrderPOST_PROCESS_MESSAGEPROCESSING_ORDERSHUTDOWN_PRIORITYintosenvirongetDEFAULT_AGGREGATE_TIMEOUTSHUTDOWN_SEND_TIMEOUTr r- r/ r8 r3 r
r r rG r)
__classcell__)r" s @r# r r s) "2G !$
>CC! ! C
CRHH ). 3 3 3 3 3 3
3
3
3 VK %&& :] : : : '& : r$ r )r1 r rZ loggingr defence360agent.apir "defence360agent.contracts.messagesr r r !defence360agent.contracts.pluginsr r r
defence360agent.utilsr r rL r5 r r r$ r# <module>re s * * * * * *
D C C C C C C C 8 Z Z Z Z Zm Z Z Z Z Zr$ defence360agent/plugins/__pycache__/analyst_cleanup_update.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000020424 00000000000 024626 0 ustar
r_j $ d dl Z d dlZd dlmZ d dlmZ d dlmZ d dlmZ d dl m
Z
m Z d dl m
Z
d dlmZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lmZ e j e Z e
de j Z edg d Z G d de Z dS ) N)datetime)
namedtuple)OperationalError)
MessageSource)register_lock_fileScope)AnalystCleanupRequest)recurring_check)DAY)
check_lock)AnalystCleanupAPI)remove_pub_key)IAIDTokenErrorzanalyst-cleanup-updateUpdateStatusRow)
zendesk_id
new_status
updated_atc f e Zd Zd Zd Zededz fd Zededz gfd Zd Z dS ) AnalystCleanupUpdatec
K || _ || _ | t t dt
dz t | j | _ d S )NT )check_period_firstcheck_lock_period lock_file) _loop_sink create_taskr
r r LOCK_FILE _update_task_task)selfloopsinks c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/analyst_cleanup_update.py
create_sourcez"AnalystCleanupUpdate.create_source sv
%%
!
O#'"%'#
!
!
#
#
c V K | j | j d {V d S N)r cancel)r! s r$ shutdownz AnalystCleanupUpdate.shutdown( s:
jr& returnNc
K |4 d {V | j }||vr2t d| d d d d d {V d S || }|d }t j |d dd }dddd |d
}|r|| j k rt d | d | j d
| d |dk rHt d| j d t j t | j d {V t ||| cd d d d {V S d d d d {V d S # 1 d {V swxY w Y d S )NzTicket z" not found in Zendesk API responsestatusr Zz+00:00pending completed)newsolvedclosed in_progresszUpdating ticket z status from 'z' to ''zRemoving SSH key for user ')r loggerwarningr
fromisoformatreplacegetr- infousernameasyncio to_threadr r ) old_requestnew_tickets_map semaphorer ticket
ticket_statusr r s r$ _processz AnalystCleanupUpdate._process- s- & K & K & K & K & K & K & K & K$/J 00LjLLL & K & K & K & K & K & K & K & K & K & K & K & K & K & K %Z0F "8 ,M!/|$,,S(;; J !%% c- //
KjK,> > > Az A A$+A A3=A A A ,,KKMk6JMMM "+& (< 'z:zJJM& K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & Ks +E C,E
E%(E%rowsc ` | D ]*}|st j |j |j |j +d S r( )r
update_statusr r r )rE rB s r$ _update_db_statusesz(AnalystCleanupUpdate._update_db_statusesY sP F
! /!6#4f6G
r& c T K t j }|s t d dS na# t $ rT}dt | v rt d n t d| Y d}~dS d}~ww xY wd |D } t j | d{V }|s t d dS d |D t j d fd
|D }t j | d{V }t j
j | d{V dS # t $ r(}t d | Y d}~dS d}~wt $ r(}t d | Y d}~dS d}~ww xY w)
a
Gets all active and recently closed requests (for case if reopened).
And asks all the requests status from zendesk API.
Updates the state of the tickets in the database if changed.
If any completed tickets, removes public key from relevant user.
z4No relevant analyst cleanup requests found to updateNz
no such tablez Database hasn't been updated yetz,Can't get data from analyst cleanup table: c g | ] }|j
S )r ).0requests r$
<listcomp>z5AnalystCleanupUpdate._update_task.<locals>.<listcomp>~ s JJJgw)JJJr& z4Didn't get tickets info from imunifyAPI but expectedc : i | ]}t |d |S )id)str)rL rB s r$
<dictcomp>z5AnalystCleanupUpdate._update_task.<locals>.<dictcomp> s3 .4F4L!!6 r& c > g | ]} | S rK )rD )rL r? r@ r! rA s r$ rN z5AnalystCleanupUpdate._update_task.<locals>.<listcomp> s9
k?IFF r& zIAIDTokenError: z)Error updating analyst cleanup requests: )r get_all_relevant_requestsr6 r; r rQ errorr
get_ticketsr7 r= Semaphoregatherr> rH r Exception) r! current_requestse zendesk_ids new_ticketstasksresultsr@ rA s ` @@r$ r z!AnalystCleanupUpdate._update_taskb sp %?AA
$
J
#a&&(( >???? F1FF
FFFFF KJ9IJJJ J 1 =k J JJJJJJJK
J 8C O )!,,I #3 E
$NE 2222222G#D$<gFF F F F F F F F F F 1 1 1 LL/A// 0 0 0 0 0 0 0 0 0 J J J LLHQHH I I I I I I I I I JsA /9
BA BB'6E A$E
F' E22
F'? F""F')
__name__
__module__ __qualname__r% r* staticmethodr rD rH r rK r& r$ r r s
)K 4 )K )K )K \)KV ?T#9": \8J 8J 8J 8J 8Jr& r )!loggingr= r collectionsr peeweer !defence360agent.contracts.pluginsr 'defence360agent.subsys.persistent_stater r %defence360agent.model.analyst_cleanupr defence360agent.utilsr
defence360agent.utils.commonr defence360agent.utils.check_lockr *defence360agent.api.server.analyst_cleanupr
defence360agent.utils.sshutilr defence360agent.internals.iaidr getLoggerra r6 IM360r r r rK r& r$ <module>rs s " " " " " " # # # # # # ; ; ; ; ; ; M M M M M M M M G G G G G G 1 1 1 1 1 1 , , , , , , 7 7 7 7 7 7 H H H H H H 8 8 8 8 8 8 9 9 9 9 9 9
8 $ $ 7 E E *AAA
J J J J J= J J J J Jr& defence360agent/plugins/__pycache__/analyst_cleanup_update.cpython-311.pyc 0000644 0000000 0000000 00000020424 00000000000 023667 0 ustar
r_j $ d dl Z d dlZd dlmZ d dlmZ d dlmZ d dlmZ d dl m
Z
m Z d dl m
Z
d dlmZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lmZ e j e Z e
de j Z edg d Z G d de Z dS ) N)datetime)
namedtuple)OperationalError)
MessageSource)register_lock_fileScope)AnalystCleanupRequest)recurring_check)DAY)
check_lock)AnalystCleanupAPI)remove_pub_key)IAIDTokenErrorzanalyst-cleanup-updateUpdateStatusRow)
zendesk_id
new_status
updated_atc f e Zd Zd Zd Zededz fd Zededz gfd Zd Z dS ) AnalystCleanupUpdatec
K || _ || _ | t t dt
dz t | j | _ d S )NT )check_period_firstcheck_lock_period lock_file) _loop_sink create_taskr
r r LOCK_FILE _update_task_task)selfloopsinks c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/analyst_cleanup_update.py
create_sourcez"AnalystCleanupUpdate.create_source sv
%%
!
O#'"%'#
!
!
#
#
c V K | j | j d {V d S N)r cancel)r! s r$ shutdownz AnalystCleanupUpdate.shutdown( s:
jr& returnNc
K |4 d {V | j }||vr2t d| d d d d d {V d S || }|d }t j |d dd }dddd |d
}|r|| j k rt d | d | j d
| d |dk rHt d| j d t j t | j d {V t ||| cd d d d {V S d d d d {V d S # 1 d {V swxY w Y d S )NzTicket z" not found in Zendesk API responsestatusr Zz+00:00pending completed)newsolvedclosed in_progresszUpdating ticket z status from 'z' to ''zRemoving SSH key for user ')r loggerwarningr
fromisoformatreplacegetr- infousernameasyncio to_threadr r ) old_requestnew_tickets_map semaphorer ticket
ticket_statusr r s r$ _processz AnalystCleanupUpdate._process- s- & K & K & K & K & K & K & K & K$/J 00LjLLL & K & K & K & K & K & K & K & K & K & K & K & K & K & K %Z0F "8 ,M!/|$,,S(;; J !%% c- //
KjK,> > > Az A A$+A A3=A A A ,,KKMk6JMMM "+& (< 'z:zJJM& K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & K & Ks +E C,E
E%(E%rowsc ` | D ]*}|st j |j |j |j +d S r( )r
update_statusr r r )rE rB s r$ _update_db_statusesz(AnalystCleanupUpdate._update_db_statusesY sP F
! /!6#4f6G
r& c T K t j }|s t d dS na# t $ rT}dt | v rt d n t d| Y d}~dS d}~ww xY wd |D } t j | d{V }|s t d dS d |D t j d fd
|D }t j | d{V }t j
j | d{V dS # t $ r(}t d | Y d}~dS d}~wt $ r(}t d | Y d}~dS d}~ww xY w)
a
Gets all active and recently closed requests (for case if reopened).
And asks all the requests status from zendesk API.
Updates the state of the tickets in the database if changed.
If any completed tickets, removes public key from relevant user.
z4No relevant analyst cleanup requests found to updateNz
no such tablez Database hasn't been updated yetz,Can't get data from analyst cleanup table: c g | ] }|j
S )r ).0requests r$
<listcomp>z5AnalystCleanupUpdate._update_task.<locals>.<listcomp>~ s JJJgw)JJJr& z4Didn't get tickets info from imunifyAPI but expectedc : i | ]}t |d |S )id)str)rL rB s r$
<dictcomp>z5AnalystCleanupUpdate._update_task.<locals>.<dictcomp> s3 .4F4L!!6 r& c > g | ]} | S rK )rD )rL r? r@ r! rA s r$ rN z5AnalystCleanupUpdate._update_task.<locals>.<listcomp> s9
k?IFF r& zIAIDTokenError: z)Error updating analyst cleanup requests: )r get_all_relevant_requestsr6 r; r rQ errorr
get_ticketsr7 r= Semaphoregatherr> rH r Exception) r! current_requestse zendesk_ids new_ticketstasksresultsr@ rA s ` @@r$ r z!AnalystCleanupUpdate._update_taskb sp %?AA
$
J
#a&&(( >???? F1FF
FFFFF KJ9IJJJ J 1 =k J JJJJJJJK
J 8C O )!,,I #3 E
$NE 2222222G#D$<gFF F F F F F F F F F 1 1 1 LL/A// 0 0 0 0 0 0 0 0 0 J J J LLHQHH I I I I I I I I I JsA /9
BA BB'6E A$E
F' E22
F'? F""F')
__name__
__module__ __qualname__r% r* staticmethodr rD rH r rK r& r$ r r s
)K 4 )K )K )K \)KV ?T#9": \8J 8J 8J 8J 8Jr& r )!loggingr= r collectionsr peeweer !defence360agent.contracts.pluginsr 'defence360agent.subsys.persistent_stater r %defence360agent.model.analyst_cleanupr defence360agent.utilsr
defence360agent.utils.commonr defence360agent.utils.check_lockr *defence360agent.api.server.analyst_cleanupr
defence360agent.utils.sshutilr defence360agent.internals.iaidr getLoggerra r6 IM360r r r rK r& r$ <module>rs s " " " " " " # # # # # # ; ; ; ; ; ; M M M M M M M M G G G G G G 1 1 1 1 1 1 , , , , , , 7 7 7 7 7 7 H H H H H H 8 8 8 8 8 8 9 9 9 9 9 9
8 $ $ 7 E E *AAA
J J J J J= J J J J Jr& defence360agent/plugins/__pycache__/backup_info_sender.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000014172 00000000000 023725 0 ustar
r_j
d dl Z d dlZd dlmZ d dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZ d dlmZmZ d d lmZmZmZ ee Z e ed
Zd Z G d
de Z dS ) N) timedelta) getLogger)Union) MessageType)
MessageSource)get_current_backendget_last_backup_timestamp)
load_state
save_state)Scoperecurring_checksafe_cancel_task )hours c e Zd ZdZej Zd Zd Ze de
e e f de
fd Zdde
e e f fd Zd
Z ee d Z ed d
Zd ZdS )BackupInfoSenderz.Send user backup statistics to CH periodicallyc L K || _ || _ t j | _ | | _ | j | | _ | j |
| _ d S N) _loop_sinkasyncioEvent _send_eventload_last_send_timestamp_last_send_timestamp create_task _recurring_check_data_to_send _check_task_recurring_send_stat_send_stat_task)selfloopsinks _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/backup_info_sender.py
create_sourcez BackupInfoSender.create_source s
"=??$($A$A$C$C! :11 . . 0 0
$z 5 5 % % ' '
c ~ K | j | j fD ]}t | d {V | d S r )r r! r save_last_send_timestamp)r" tasks r% shutdownzBackupInfoSender.shutdown' s[ %t';< ) )D"4(( ( ( ( ( ( ( ( ( %%'''''r' timestampreturnc F t | t t f o| dk S )Nr )
isinstanceintfloat)r, s r% is_valid_timestampz#BackupInfoSender.is_valid_timestamp, s )c5\22Dy1}Dr' Ntsc || j n|}| | s t d| d S t dd|i d S )NzInvalid timestamp: %sr last_send_timestamp)r r2 loggerwarningr )r" r3 r, s r% r) z)BackupInfoSender.save_last_send_timestamp0 s` 13D-- &&y11 NN2I > > > F%(=y'IJJJJJr' c t d d }| | s t d d}|S )Nr r5 z(Invalid timestamp loaded, resetting to 0r )r
getr2 r6 r7 )r" r, s r% r z)BackupInfoSender.load_last_send_timestamp7 sS 122667LMM &&y11 NNE F F FIr' c K t j | j z
t k r| j d S d S r )timer
SEND_INTERVALr set)r" s r% r z.BackupInfoSender._recurring_check_data_to_send> sC 9;;2 2m C C " " " " " D Cr' r c K | j d {V | d {V n2# t $ r%}t d| Y d }~nd }~ww xY wt
j | _ | j d S # t
j | _ | j w xY w)Nz!Failed to collect backup info: %s) r wait_send_server_config Exceptionr6 exceptionr; r clear)r" es r% r z%BackupInfoSender._recurring_send_statC s ##%%%%%%%%% %**,, , , , , , , , , E E E @! D D D D D D D D E )- D % " " $ $ $ $ $ )- D % " " $ $ $ $s, > B#
A-A(#B# (A--B# #3Cc K t j t t d {V }| j | d {V d S )N)backup_provider_typelast_backup_timestamp)r
BackupInfor r r process_message)r" confg_msgs r% r@ z$BackupInfoSender._send_server_configO sq *!4!6!6(A(C(C"C"C"C"C"C"C
j((33333333333r' r )__name__
__module__ __qualname____doc__r IM360SCOPEr& r+ staticmethodr r0 r1 boolr2 r) r r
RECURRING_CHECK_INTERVALr r r@ r' r% r r s 88 KE
( ( (
EeCJ&7 ED E E E \EK K5e+< K K K K _-..# # /.# _Q % % %4 4 4 4 4r' r ) r r; datetimer loggingr typingr "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr %defence360agent.subsys.backup_systemsr r 'defence360agent.subsys.persistent_stater
r defence360agent.utilsr r
r rK r6 r0
total_secondsr< rS r rT r' r% <module>r^ sC : : : : : : ; ; ; ; ; ; K J J J J J J J J J J J J J J J J J 8 IIB'''557788
>4 >4 >4 >4 >4} >4 >4 >4 >4 >4r' defence360agent/plugins/__pycache__/backup_info_sender.cpython-311.pyc 0000644 0000000 0000000 00000014172 00000000000 022766 0 ustar
r_j
d dl Z d dlZd dlmZ d dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZ d dlmZmZ d d lmZmZmZ ee Z e ed
Zd Z G d
de Z dS ) N) timedelta) getLogger)Union) MessageType)
MessageSource)get_current_backendget_last_backup_timestamp)
load_state
save_state)Scoperecurring_checksafe_cancel_task )hours c e Zd ZdZej Zd Zd Ze de
e e f de
fd Zdde
e e f fd Zd
Z ee d Z ed d
Zd ZdS )BackupInfoSenderz.Send user backup statistics to CH periodicallyc L K || _ || _ t j | _ | | _ | j | | _ | j |
| _ d S N) _loop_sinkasyncioEvent _send_eventload_last_send_timestamp_last_send_timestamp create_task _recurring_check_data_to_send _check_task_recurring_send_stat_send_stat_task)selfloopsinks _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/backup_info_sender.py
create_sourcez BackupInfoSender.create_source s
"=??$($A$A$C$C! :11 . . 0 0
$z 5 5 % % ' '
c ~ K | j | j fD ]}t | d {V | d S r )r r! r save_last_send_timestamp)r" tasks r% shutdownzBackupInfoSender.shutdown' s[ %t';< ) )D"4(( ( ( ( ( ( ( ( ( %%'''''r' timestampreturnc F t | t t f o| dk S )Nr )
isinstanceintfloat)r, s r% is_valid_timestampz#BackupInfoSender.is_valid_timestamp, s )c5\22Dy1}Dr' Ntsc || j n|}| | s t d| d S t dd|i d S )NzInvalid timestamp: %sr last_send_timestamp)r r2 loggerwarningr )r" r3 r, s r% r) z)BackupInfoSender.save_last_send_timestamp0 s` 13D-- &&y11 NN2I > > > F%(=y'IJJJJJr' c t d d }| | s t d d}|S )Nr r5 z(Invalid timestamp loaded, resetting to 0r )r
getr2 r6 r7 )r" r, s r% r z)BackupInfoSender.load_last_send_timestamp7 sS 122667LMM &&y11 NNE F F FIr' c K t j | j z
t k r| j d S d S r )timer
SEND_INTERVALr set)r" s r% r z.BackupInfoSender._recurring_check_data_to_send> sC 9;;2 2m C C " " " " " D Cr' r c K | j d {V | d {V n2# t $ r%}t d| Y d }~nd }~ww xY wt
j | _ | j d S # t
j | _ | j w xY w)Nz!Failed to collect backup info: %s) r wait_send_server_config Exceptionr6 exceptionr; r clear)r" es r% r z%BackupInfoSender._recurring_send_statC s ##%%%%%%%%% %**,, , , , , , , , , E E E @! D D D D D D D D E )- D % " " $ $ $ $ $ )- D % " " $ $ $ $s, > B#
A-A(#B# (A--B# #3Cc K t j t t d {V }| j | d {V d S )N)backup_provider_typelast_backup_timestamp)r
BackupInfor r r process_message)r" confg_msgs r% r@ z$BackupInfoSender._send_server_configO sq *!4!6!6(A(C(C"C"C"C"C"C"C
j((33333333333r' r )__name__
__module__ __qualname____doc__r IM360SCOPEr& r+ staticmethodr r0 r1 boolr2 r) r r
RECURRING_CHECK_INTERVALr r r@ r' r% r r s 88 KE
( ( (
EeCJ&7 ED E E E \EK K5e+< K K K K _-..# # /.# _Q % % %4 4 4 4 4r' r ) r r; datetimer loggingr typingr "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr %defence360agent.subsys.backup_systemsr r 'defence360agent.subsys.persistent_stater
r defence360agent.utilsr r
r rK r6 r0
total_secondsr< rS r rT r' r% <module>r^ sC : : : : : : ; ; ; ; ; ; K J J J J J J J J J J J J J J J J J 8 IIB'''557788
>4 >4 >4 >4 >4} >4 >4 >4 >4 >4r' defence360agent/plugins/__pycache__/cagefs.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000017117 00000000000 021337 0 ustar
r_j d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z
mZ ddlmZmZ ddlmZ d Zd
Z ej e Z G d d e
ZdS )
a
Goal: Invoke
/usr/sbin/cagefsctl --update-etc
/usr/sbin/cagefsctl --force-update-etc
asynchronously. As far production scale `cagefsctl --force-update-etc`
tends last for too long, e.g. -
# time cagefsctl --force-update-etc
Updating users ...
Updating user user523 ...
Updating user user804 ...
...
Updating user user269 ...
Updating user user116 ...
Updating user user121 ...
Updating user user117 ...
real 2m44.454s
user 0m26.233s
sys 0m19.972s
N)Optional)
inactivity) MessageType) MessageSinkexpect)
load_state
save_state)timefunz/usr/sbin/cagefsctlz --wait-lockc e Zd Zdej fdZd Z eej d Z
d Z e e
j dee fd Zed Zd
S ) CageFSloopc K || _ t j | _ t d dd | _ | j | | _ d S )Nr last_force_update_tsr )
_loopasyncioQueue_queuer get_last_force_update_ts create_task _consumer_consumer_task)selfr
s S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/cagefs.py create_sinkzCageFS.create_sink, si
moo %/%9%9%=%= "A&
&
" #j 4 4T^^5E5E F F c K | j | j d {V | j r2t d| j t
dd| j i d S )Nz %d item(s) were not consumedr r )r cancelr qsizeloggerwarningr r )r s r shutdownzCageFS.shutdown4 s ""$$$!!!!!!!! ; P NN94;;L;L;N;N O O O -t/IJ
r c K |d }t |dd }|| | j r | j | d S d S )Nconfusername)getattrmodified_sincer r
put_nowait)r messageconfigr% s r put_to_queuezCageFS.put_to_queue? si 6:t44 6#8#8 &$
$
K " "8 , , , , , r c N K | j d{V }t j t
sF|h} | | j -# t j $ r Y nw xY wt j d 5 |D ] }|
| d{V ddd n # 1 swxY w Y n<# t j $ r Y dS t $ r t d Y w xY w#)z
:raise never:
TNcagefszSomething went wrong)r r ospathexists_CAGEFSCTL_TOOLadd
get_nowaitr
QueueEmptyr tracktask
_commitconfigCancelledError Exceptionr exception)r commitconfig_usernameuniqr% s r r zCageFS._consumerM s
.2koo.?.?(?(?(?(?(?(?% w~~o66 ..; !7!7!9!9:::; ) D %**844 ; ;$( ; ; " 0 0 : :::::::::;; ; ; ; ; ; ; ; ; ; ; ; ; ; ; )
!7888
/ s` AC) C)
.A; ;B
C) B
"C) /!C C) C!!C) $C!%C) )D";#D"!D")logr% c N K |rt t d|g}nt t dg}t j } t j |t
j t
j t
j dd d{V }| |t j
|j }| |t j |j
}t j || d{V | d{V \ }}| d{V } | t" d dS | r t" d|| || dS t" d|| | || _ dS dS # t j $ r t" d | w xY w)
zJ
:raise asyncio.CancelledError:
:raise Exception:
z --update-etcz--force-update-etcF)stdinstdoutstderrstart_new_sessionNz+logic error: process has not terminated yetz,%r failed with rc [%s], stdout=%s, stderr=%sz%r succeeded with rc [%s]z"%r is terminated by CancelledError)r1
_WAIT_LOCKtimer create_subprocess_exec
subprocessDEVNULLPIPE
_passthru_logloggingDEBUGr@ WARNrA gather communicatewaitr errorinfor r8 r! )
r r% cmd
started_atprocfuture1future2outerrrcs
r r7 zCageFS._commitconfign s F"JICC"J0DEC Y[[
" < 7 (!! #( D ((gmT[IIG((glDKHHG.'22 2 2 2 2 2 2 2 ! - - / ///////HCyy{{""""""B
z JKKKKK
< B 7bAAA#1;D... $#! % NN? E E E s CE8 8,F$c K | d {V }|sd S t |d| | <)NTz%r: %r)readliner r= )rR loglevel streamreaderlines r rI zCageFS._passthru_log sX 6%..00000000D
JJx3 5 5 5 6r N)__name__
__module__ __qualname__r AbstractEventLoopr r" r r ConfigUpdater+ r r
r rQ r strr7 staticmethodrI r r r r + s Gg&? G G G G
VK $%% - - &% - B
W .<HSM .< .< .< .<` 6 6 \6 6 6r r )__doc__r rJ r. rF rD typingr defence360agent.apir "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r 'defence360agent.subsys.persistent_stater r defence360agent.utilsr
r1 rC getLoggerr_ r r rf r r <module>ro s . * * * * * * : : : : : : A A A A A A A A J J J J J J J J ) ) ) ) ) )'
8 $ $z6 z6 z6 z6 z6[ z6 z6 z6 z6 z6r defence360agent/plugins/__pycache__/cagefs.cpython-311.pyc 0000644 0000000 0000000 00000017117 00000000000 020400 0 ustar
r_j d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z
mZ ddlmZmZ ddlmZ d Zd
Z ej e Z G d d e
ZdS )
a
Goal: Invoke
/usr/sbin/cagefsctl --update-etc
/usr/sbin/cagefsctl --force-update-etc
asynchronously. As far production scale `cagefsctl --force-update-etc`
tends last for too long, e.g. -
# time cagefsctl --force-update-etc
Updating users ...
Updating user user523 ...
Updating user user804 ...
...
Updating user user269 ...
Updating user user116 ...
Updating user user121 ...
Updating user user117 ...
real 2m44.454s
user 0m26.233s
sys 0m19.972s
N)Optional)
inactivity) MessageType) MessageSinkexpect)
load_state
save_state)timefunz/usr/sbin/cagefsctlz --wait-lockc e Zd Zdej fdZd Z eej d Z
d Z e e
j dee fd Zed Zd
S ) CageFSloopc K || _ t j | _ t d dd | _ | j | | _ d S )Nr last_force_update_tsr )
_loopasyncioQueue_queuer get_last_force_update_ts create_task _consumer_consumer_task)selfr
s S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/cagefs.py create_sinkzCageFS.create_sink, si
moo %/%9%9%=%= "A&
&
" #j 4 4T^^5E5E F F c K | j | j d {V | j r2t d| j t
dd| j i d S )Nz %d item(s) were not consumedr r )r cancelr qsizeloggerwarningr r )r s r shutdownzCageFS.shutdown4 s ""$$$!!!!!!!! ; P NN94;;L;L;N;N O O O -t/IJ
r c K |d }t |dd }|| | j r | j | d S d S )Nconfusername)getattrmodified_sincer r
put_nowait)r messageconfigr% s r put_to_queuezCageFS.put_to_queue? si 6:t44 6#8#8 &$
$
K " "8 , , , , , r c N K | j d{V }t j t
sF|h} | | j -# t j $ r Y nw xY wt j d 5 |D ] }|
| d{V ddd n # 1 swxY w Y n<# t j $ r Y dS t $ r t d Y w xY w#)z
:raise never:
TNcagefszSomething went wrong)r r ospathexists_CAGEFSCTL_TOOLadd
get_nowaitr
QueueEmptyr tracktask
_commitconfigCancelledError Exceptionr exception)r commitconfig_usernameuniqr% s r r zCageFS._consumerM s
.2koo.?.?(?(?(?(?(?(?% w~~o66 ..; !7!7!9!9:::; ) D %**844 ; ;$( ; ; " 0 0 : :::::::::;; ; ; ; ; ; ; ; ; ; ; ; ; ; ; )
!7888
/ s` AC) C)
.A; ;B
C) B
"C) /!C C) C!!C) $C!%C) )D";#D"!D")logr% c N K |rt t d|g}nt t dg}t j } t j |t
j t
j t
j dd d{V }| |t j
|j }| |t j |j
}t j || d{V | d{V \ }}| d{V } | t" d dS | r t" d|| || dS t" d|| | || _ dS dS # t j $ r t" d | w xY w)
zJ
:raise asyncio.CancelledError:
:raise Exception:
z --update-etcz--force-update-etcF)stdinstdoutstderrstart_new_sessionNz+logic error: process has not terminated yetz,%r failed with rc [%s], stdout=%s, stderr=%sz%r succeeded with rc [%s]z"%r is terminated by CancelledError)r1
_WAIT_LOCKtimer create_subprocess_exec
subprocessDEVNULLPIPE
_passthru_logloggingDEBUGr@ WARNrA gather communicatewaitr errorinfor r8 r! )
r r% cmd
started_atprocfuture1future2outerrrcs
r r7 zCageFS._commitconfign s F"JICC"J0DEC Y[[
" < 7 (!! #( D ((gmT[IIG((glDKHHG.'22 2 2 2 2 2 2 2 ! - - / ///////HCyy{{""""""B
z JKKKKK
< B 7bAAA#1;D... $#! % NN? E E E s CE8 8,F$c K | d {V }|sd S t |d| | <)NTz%r: %r)readliner r= )rR loglevel streamreaderlines r rI zCageFS._passthru_log sX 6%..00000000D
JJx3 5 5 5 6r N)__name__
__module__ __qualname__r AbstractEventLoopr r" r r ConfigUpdater+ r r
r rQ r strr7 staticmethodrI r r r r + s Gg&? G G G G
VK $%% - - &% - B
W .<HSM .< .< .< .<` 6 6 \6 6 6r r )__doc__r rJ r. rF rD typingr defence360agent.apir "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r 'defence360agent.subsys.persistent_stater r defence360agent.utilsr
r1 rC getLoggerr_ r r rf r r <module>ro s . * * * * * * : : : : : : A A A A A A A A J J J J J J J J ) ) ) ) ) )'
8 $ $z6 z6 z6 z6 z6[ z6 z6 z6 z6 z6r defence360agent/plugins/__pycache__/checkpoint.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004206 00000000000 022231 0 ustar
r_j F d dl mZ d dlmZ d dlmZ G d de ZdS ) ) MessageSink)db)recurring_checkc 6 e Zd ZdZdZeeddZd Zd Zd Z dS )
CheckpointzU
Checkpoint imunify360.db periodically to limit unexpected WAL file growing.
iQ )checkpoint_periodr c 0 || _ || _ d | _ d S N)_checkpoint_period_db_task)selfr r s W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/checkpoint.py__init__zCheckpoint.__init__
s "3
c K || _ | j t | j | j | _ d S r
)_loop create_taskr r _checkpointr
)r loops r create_sinkzCheckpoint.create_sink sN
Z++ F 4OD 3 4 4T5E F F H H
r c K | j d c}| _ || rd S | | d {V d S r
)r
cancelledcancel)r tasks r shutdownzCheckpoint.shutdown sP :tdj <4>>++< F
r c > K | j d d S )Nz PRAGMA wal_checkpoint(TRUNCATE))r execute_sql)r s r r zCheckpoint._checkpoint s%
>?????r N)
__name__
__module__ __qualname____doc__ONE_DAYr r r r r r r r r su G,3
@ @ @ @ @r r N)!defence360agent.contracts.pluginsr defence360agent.model.instancer defence360agent.utilsr r r$ r r <module>r( sy 9 9 9 9 9 9 - - - - - - 1 1 1 1 1 1 @ @ @ @ @ @ @ @ @ @r defence360agent/plugins/__pycache__/checkpoint.cpython-311.pyc 0000644 0000000 0000000 00000004206 00000000000 021272 0 ustar
r_j F d dl mZ d dlmZ d dlmZ G d de ZdS ) ) MessageSink)db)recurring_checkc 6 e Zd ZdZdZeeddZd Zd Zd Z dS )
CheckpointzU
Checkpoint imunify360.db periodically to limit unexpected WAL file growing.
iQ )checkpoint_periodr c 0 || _ || _ d | _ d S N)_checkpoint_period_db_task)selfr r s W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/checkpoint.py__init__zCheckpoint.__init__
s "3
c K || _ | j t | j | j | _ d S r
)_loop create_taskr r _checkpointr
)r loops r create_sinkzCheckpoint.create_sink sN
Z++ F 4OD 3 4 4T5E F F H H
r c K | j d c}| _ || rd S | | d {V d S r
)r
cancelledcancel)r tasks r shutdownzCheckpoint.shutdown sP :tdj <4>>++< F
r c > K | j d d S )Nz PRAGMA wal_checkpoint(TRUNCATE))r execute_sql)r s r r zCheckpoint._checkpoint s%
>?????r N)
__name__
__module__ __qualname____doc__ONE_DAYr r r r r r r r r su G,3
@ @ @ @ @r r N)!defence360agent.contracts.pluginsr defence360agent.model.instancer defence360agent.utilsr r r$ r r <module>r( sy 9 9 9 9 9 9 - - - - - - 1 1 1 1 1 1 @ @ @ @ @ @ @ @ @ @r defence360agent/plugins/__pycache__/client.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000067377 00000000000 021402 0 ustar
r_jQL d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZmZ d dlmZ d dlmZ d dlmZmZmZmZ d dlmZmZ d dl m Z m Z d d l m Z m!Z! d d
l"m#Z#m$Z$ d d l%m&Z& d d l'm(Z(m)Z)m*Z*m+Z+ d d
l,m-Z- ej. e/ Z0 e# Z1 e# Z2 e# Z3 G d d Z4 G d de4e Z5dS ) N) Generator)APIErrorAPIErrorTooManyRequests
APITokenError send_message)license)Core)GeneralMetricsMessage MessageList MessageType) MessageSinkexpect) delivery_ack
feature_flags) MESSAGE_LOSS_OBSERVABILITY_FLAG
is_enabled)Gen publisher)PersistentMessagesQueue)log_future_errorsrecurring_checksafe_cancel_taskScope)ServerJSONEncoderc & e Zd ZdZ eej dd ZdZ dZ
dZ dZ dZ
d Z fd
Zd ej fd Z ee d
ZdefdZdefdZd ZdedefdZd%dZ d Z e d Z e j! de"e#j$ ddf fd Z% e&e'j( deddfd Z) ee d Z*de+fdZ, ed d Z-d ede.fd Z/de.defd Z0d! Z1d" Z2d# Z3d%d$Z4 xZ5S )&SendToServerClienta Send messages to server.
* process Reportable messages;
* add them to a pending messages list;
* send all pending messages to server when list is full (contains
_PENDING_MESSAGES_LIMIT items or more) or when the oldest pending
message has waited the max send delay (0 unless batching is
enabled via the feature flag);
* send all pending messages on plugin shutdown. IMUNIFYAV_MESSAGES_COUNT_TO_SEND g message_send_batching< i, 2 c H t j |i | i | _ d S N)super__init___unsent_metrics)selfargskwargs __class__s S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/client.pyr' zSendToServerClient.__init__I s- $)&))) ! loopc K || _ t | _ t j | _ t j | _ t j | _ d | _ |
| | _ |
|
| _ |
| | _ d S r% )_loopr _pendingasyncioEvent _try_sendLock_lock_shutting_down_flush_deadline create_task_report_metrics
_metrics_task_send _sender_task_invoke_send_message_invoke_send_message_task)r) r/ s r- create_sinkz SendToServerClient.create_sinkM s
/11
\^^
%moo # ! - -d.B.B.D.D E E , ,TZZ\\ : :)-)9)9 % % ' '*
*
&&&r. c > K | d {V d S r% )
_emit_metricsr) s r- r; z"SendToServerClient._report_metricsZ s0 """""""""""r. returnc | j t j t j dS )N)z agent.persistent_queue.evictedzagent.msg_status.droppedz!agent.send.method_missing_dropped)r2 pop_evictedr pop_droppedr pop_method_missing_droppedrD s r- _collect_metricsz#SendToServerClient._collect_metrics^ s: .2m.G.G.I.I(1(=(?(? 799
r. c r | j | j j t j dS )N)zagent.persistent_queue.sizez#agent.persistent_queue.storage_sizezagent.msg_status.queue_size)r2 qsize storage_sizer queue_depthrD s r- _collect_gaugesz"SendToServerClient._collect_gaugesg s6 +/=+>+>+@+@37=3M+4+@+B+B
r. c K | j }i | _ | }t t sd S | D ]#\ }}|r | |d |z ||< $d} i || }t d | D }t j |d< t j
j |d< | j 4 d {V |
| d {V }d d d d {V n# 1 d {V swxY w Y nH# t j $ r || _ t $ r%}t" d| Y d }~nd }~ww xY w|s || _ d S d S )Nr Fc g | ]
\ }}||d S ))namevalue ).0rR rS s r-
<listcomp>z4SendToServerClient._emit_metrics.<locals>.<listcomp> s4 #e "E22 r. timestamp
message_idz"Failed to deliver loss metrics: %r)r( rJ r r itemsgetrO r
timeuuiduuid4hexr7 _send_metrics_directr3 CancelledError Exceptionloggerwarning) r) metrics collectedrR rS sentpayloadmessageexcs r- rC z SendToServerClient._emit_metricsn s & ! ))++ 9:: F$??,, = =KD%
= ' D! 4 4u <
F <;D$8$8$:$:;G$ '.}} G $(9;;GK $(JLL$4GL !
z
@
@
@
@
@
@
@
@ ! 6 6w ? ???????
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@% $+D F F F NN? E E E E E E E E F +#*D + +s= 6BD7 7 D%D7 %
D//D7 2D/3D7 7 E<E77E<rh c K | 5 }| t j | | fg d {V d d d n # 1 swxY w Y dS )NT)_get_api
send_messagesr[ _encode_data_to_put_in_queuer) rh apis r- r_ z'SendToServerClient._send_metrics_direct s
]]__ ##)++t @ @ I IJK
ts AA&&A*-A*Nc x K | j t j | | j d{V nh# t j $ rV t d| j | j
st | j d{V Y nw xY w| j j
dk rrt d| j j
| j t d| j dS dS )a~
When shutdown begins it signals any in-flight HTTP sends to
abort immediately (via _shutting_down event), then gives 50
seconds to finish the stop() sequence. If stop() isn't done
in 50 seconds it force-cancels the sender task.
Finally, any messages still in the buffer are flushed to
persistent storage so nothing is lost.
Nz5Timeout (%ds) sending messages to server on shutdown.r z&Save %s messages to persistent storagezStored queue %r)r8 setr3 wait_forstop_SHUTDOWN_SEND_TIMEOUT TimeoutErrorrb errorr> cancelledr r2 buffer_sizerc push_buffer_to_storagerL rD s r- shutdownzSendToServerClient.shutdown sJ
!!! :"499;;0KLL L L L L L L L L# : : : LLG+
$..00
:&t'8999999999 : = $q ( ( NN8
)
M 0 0 2 2 2 NN,dm.A.A.C.C D D D D D
) (s 2A A"B54B5c K t d t | j d{V | j t | j d{V t d | j 4 d{V t d t | j d{V | j | d{V ddd d{V n# 1 d{V swxY w Y | j kt j t j
5 t j | | j d{V ddd dS # 1 swxY w Y dS dS )aq
Stop sending.
1. wait for the lock being available
i.e., while _sender_task finishes the current round
of sending message (if it takes too long, then
the timeout in shutdown() is triggered
2. once the sending round complete (we got the lock),
cancel the next iteration of the _sender_task (it exits)
3. send _pending messages (again, if it takes too long,
the timeout in shutdown() is triggered
and the coroutine is cancelled
That method makes sure that the coroutine
that was started in it has ended.
It excludes a situation when:
-> The result of a coroutine that started
BEFORE shutdown() is started.
-> And the process of sending messages
from _pending is interrupted because of it
z2SendToServer.stop cancel _invoke_send_message_taskNzSendToServer.stop wait lockz4SendToServer.stop lock acquired, cancel _sender_task)rb infor r@ r< r7 r> r8 clear_send_pending_messages
contextlibsuppressr3 ru rr rC _METRICS_FLUSH_TIMEOUTrD s r- rs zSendToServerClient.stop s{ 0 HIII t =>>>>>>>>> )"4#566 6 6 6 6 6 6 6 1222: 0 0 0 0 0 0 0 0
KKN O O O"4#455 5 5 5 5 5 5 5
% % ' ' '--// / / / / / / / 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ) $W%9::
&&&(($*E
* )s% ?A(C99
DD/3E//E36E3c , | t j | t j | t j | S r% )set_product_namer
LicenseCLNget_product_name
set_server_id
get_server_id set_license get_token)ro s r- _set_api_attrsz!SendToServerClient._set_api_attrs sn W / @ @ B BCCC ',::<<=== *4466777
r. c # * K t j d }t j d 5 }t
j t j || }|
| V d d d d S # 1 swxY w Y d S )NIMUNIFYAV_API_BASE ) max_workers)executor) osenvironrZ
concurrentfuturesThreadPoolExecutorr SendMessageAPIr VERSIONr )r) base_urlr ro s r- rk zSendToServerClient._get_api s :>>"677
2
2q
2
A
A +X - h C %%c** * * * + + + + + + + + + + + + + + + + + +s 9BB B c @ K d|vrt j |d< d|vrt j j |d< | j | | | j t j
|t d d S )NrW rX z agent-queuedstage) r[ r\ r] r^ r2 putrm r5 rq r report_reporter_gen_queued)r) rh s r- send_to_serverz!SendToServerClient.send_to_server s g % %#'9;;GK w & &$(JLL$4GL !
$;;GDDEEE "6nMMMMMMr. c < K | j d S r% )r5 rq rD s r- r? z'SendToServerClient._invoke_send_message s r. c t j | j r=t j | j D ]#} t | c S # t
$ r Y w xY w| j S r% )r r _BATCHING_FLAG
get_paramsfloat
ValueError_MAX_SEND_DELAY)r) rS s r- _max_send_delayz"SendToServerClient._max_send_delay su #D$7 8 8 &1$2EFF
<<'''! D##s A
AAr c K | j | j d {V nt d| j | j z
}t
j t j 5 t j
| j | d {V d d d n # 1 swxY w Y | j | j
}|dk r d | _ d S | j 3| j | z | _ || j k r$| j | j k rd S d | _ t d d }| j 4 d {V t d | d {V n8# t j $ r&}t d |}Y d }~nd }~ww xY wd d d d {V n# 1 d {V swxY w Y t d |r|d S )Nr z SendToServer._send wait lockz SendToServer._send lock acquiredz&SendToServer._send cancelled unlockingz SendToServer._send lock released)r9 r5 waitmaxr1 r[ r r r3 ru rr r} r2 rL r _PENDING_MESSAGES_LIMITrb r| r7 r~ r` )r) timeoutrL need_to_canceles r- r= zSendToServerClient._send! s' '.%%'' ' ' ' ' ' ' ' '!T 1DJOO4E4E EFFG$W%9::
G
G &t~':':'<'<gFFFFFFFFF
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
##%% A::#'D F '#':??#4#4t7K7K7M7M#MD D0 0 0
!!D$888 F # 2333 : # # # # # # # # KK: ; ; ;
#113333333333)
#
#
# DEEE!"
# # # # # # # # # # # # # # # # # # # # # # # # # # # # 6777 ! ! !sN 73B66B:=B:H 7GH H! H=H HH
H&)H&datac f t j |t dz }| S )N)cls
)jsondumpsr encode)r) r msgs r- rm z/SendToServerClient._encode_data_to_put_in_queueD s* j#4555<zz||r. c t j | }| d rHt |d }| d | D |S t
| S )Nlistc & i | ]\ }}|d k ||S )r rT )rU kvs r-
<dictcomp>z6SendToServerClient._decode_message.<locals>.<dictcomp>L s# EEEAf1r. )r loadsrZ r updaterY r )r) rh r r s r- _decode_messagez"SendToServerClient._decode_messageH sp z'"" 88F d6l++C JJEE EEE F F FJt}} r. c | dd dz |d< | | }|7| j || | j d S | j || d S )Napi_retries_countr )rW )rZ rm r2 r ry update_message)r) rX rW rh encodeds r- _persist_failedz"SendToServerClient._persist_failedP s '.{{3F'J'JQ'N#$33G<< M g ; ; ; M 0 0 2 2 2 2 2 M ( (W = = = = =r. c K t j | | }| d t j | j } t j ||ht j d{V \ }}n<# t j $ r* | | w xY w|D ]}t | d{V ||v r|
dS dS )zRace the HTTP send against the shutdown signal.
Returns True on success, raises on API error,
or returns False if shutdown interrupted the send.
c 6 t | t j S r% )r rb debug)tasks r- <lambda>z6SendToServerClient._send_one_message.<locals>.<lambda>c s *4 >> r. ) return_whenNTF) r3
ensure_futurer add_done_callbackr8 r FIRST_COMPLETEDr` cancelr result)r) ro rh send_task
shutdown_taskdone
pending_tasksr s r- _send_one_messagez$SendToServerClient._send_one_messageZ sW )#*:*:7*C*CDD ## > >
-d.A.F.F.H.HII
(/ M* # 3) ) ) # # # # # # D-- % " " " " ) )D"4(( ( ( ( ( ( ( ( ( 4 us ,+B 9Cc K | j r t d dS | | }| d | d d} t
j |t d | || d{V }|s t d dS |d rit
j |t d
t d | t j
| d || j |g d S # t" t$ f$ r>}t d
|| | ||| Y d}~dS d}~wt( $ r>}t d
|| | ||| Y d}~dS d}~ww xY w)zDeliver one message and return (stop, failed); message_id is None
for a fresh memory-only message, set for a stored row.z4Shutdown signal received, keeping remaining messages)TFmethodrX )r rX z
agent-sendingr Nz@Shutdown signal received during send, keeping remaining messagesz
agent-sentzmessage sent %s)FFz'Failed to send message %s to server: %s)TT)FT)r8 is_setrb rc r rZ r r _reporter_gen_sendingr _reporter_gen_sentr| r registryconfirmr2 deleter r r r ) r) ro rX rW
message_bytesrh msg_inforf ri s r-
_try_send_onez SendToServerClient._try_send_onez sG % % ' ' NNF
;&&}55 kk(++!++l33
! .o
//W========D
#2 #{ !
I /| -x888 %--gkk,.G.GHHH%
$$j\222 <' 7 NN98S
Y @ @ @ ::::: NN98S
Y @ @ @ ;;;;; s, 9AE BE G403F))
G463G//G4c K | 5 }|j d d d d S t | j d | j D z }t dt | d}d} |D ]R\ }}}| |||| d {V \ }} |r| s n&|dz
}| r|dz
}|r|t | |z
z
} nSd ||d D }
|
r3| j
|
| j nO# d ||d D }
|
r4| j
|
| j w w xY wt d| d d d d S # 1 swxY w Y d S )Nc g | ]
\ }}d ||f S r% rT )rU rW r s r- rV z=SendToServerClient._send_pending_messages.<locals>.<listcomp> s3 9 9 9,I} y-09 9 9r. zSending %s messagesr r c " g | ] \ }}}|||f
S r% rT )rU midtsmbs r- rV z=SendToServerClient._send_pending_messages.<locals>.<listcomp> s/ % % %#R{ H"{{r. z Unsuccessful to send %s messages) rk server_idr r2 peek_stored drain_bufferrb r| lenr put_manyry ) r) ro batch
failure_count processedrX rW r rs failedunattempted_freshs r- r~ z)SendToServerClient._send_pending_messages s
]]__ % K}$% K % K % K % K % K % K % K % K 224455 9 904
0J0J0L0L9 9 9 E
KK-s5zz : : : MI
;<A 8J =)-););ZM* * $ $ $ $ $ $LD& F NI +%*
%Ui)??
% %',YZZ'8% % %!
% ;M**+<===M88:::% %',YZZ'8% % %!
% ;M**+<===M88::::;
KK:M J J JK% K % K % K % K % K % K % K % K % K % K % K % K % K % K % K % K % K % Ks2 F:A6F:$AE9A
F:A F F::F>F>)rE N)6__name__
__module__ __qualname____doc__intr r rZ r r r _SEND_MESSAGE_RECURRING_TIME_METRICS_REPORT_INTERVALrt r r' r3 AbstractEventLooprA r r; dictrJ rO rC r boolr_ rz rs staticmethodr r contextmanagerr r r rk r r
Reportabler r? r r r= bytesrm r r r r r~
__classcell__)r, s @r- r r 2 s 7 7 "c
92>> O,N#% % " " " " "
g&?
_-..# # /.#
$
,+ ,+ ,+\' d !E !E !E !EF. . .` \ +)L$?t$KL + + + + VK "## NG N N N N $# N _122 32 $ $ $ $ $ _Q ! ! !D U u > > > @/ / / b&K &K &K &K &K &K &K &Kr. r c 0 e Zd Zej ZdZdedefdZ dS ) SendToServeri rh rE c K | 5 }|j d d d dS | | d {V d d d n # 1 swxY w Y dS )NFT)rk r r rn s r- r_ z!SendToServer._send_metrics_direct s
]]__ ,}$ , , , , , , , , ""7++ + + + + + + + , , , , , , , , , , , , , , , ts AAAAN)
r r r r AVSCOPESHUTDOWN_PRIORITYr r r_ rT r. r- r r sC HE' d r. r )6r3 concurrent.futuresr r r loggingr r[ r\ typingr defence360agent.api.serverr r r r defence360agent.contractsr defence360agent.contracts.configr "defence360agent.contracts.messagesr
r r r
!defence360agent.contracts.pluginsr r defence360agent.internalsr r 'defence360agent.internals.feature_flagsr r 2defence360agent.internals.message_status_publisherr r ,defence360agent.internals.persistent_messager defence360agent.utilsr r r r defence360agent.utils.jsonr getLoggerr rb r r r r r rT r. r- <module>r s . - - - - - 1 1 1 1 1 1 B A A A A A A A A A A A A A A A N M M M M M M M 9 8 8 8 8 8 8 $ $suu SUU _K _K _K _K _K _K _K _KD
%{ r. defence360agent/plugins/__pycache__/client.cpython-311.pyc 0000644 0000000 0000000 00000067377 00000000000 020443 0 ustar
r_jQL d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZmZ d dlmZ d dlmZ d dlmZmZmZmZ d dlmZmZ d dl m Z m Z d d l m Z m!Z! d d
l"m#Z#m$Z$ d d l%m&Z& d d l'm(Z(m)Z)m*Z*m+Z+ d d
l,m-Z- ej. e/ Z0 e# Z1 e# Z2 e# Z3 G d d Z4 G d de4e Z5dS ) N) Generator)APIErrorAPIErrorTooManyRequests
APITokenError send_message)license)Core)GeneralMetricsMessage MessageList MessageType) MessageSinkexpect) delivery_ack
feature_flags) MESSAGE_LOSS_OBSERVABILITY_FLAG
is_enabled)Gen publisher)PersistentMessagesQueue)log_future_errorsrecurring_checksafe_cancel_taskScope)ServerJSONEncoderc & e Zd ZdZ eej dd ZdZ dZ
dZ dZ dZ
d Z fd
Zd ej fd Z ee d
ZdefdZdefdZd ZdedefdZd%dZ d Z e d Z e j! de"e#j$ ddf fd Z% e&e'j( deddfd Z) ee d Z*de+fdZ, ed d Z-d ede.fd Z/de.defd Z0d! Z1d" Z2d# Z3d%d$Z4 xZ5S )&SendToServerClienta Send messages to server.
* process Reportable messages;
* add them to a pending messages list;
* send all pending messages to server when list is full (contains
_PENDING_MESSAGES_LIMIT items or more) or when the oldest pending
message has waited the max send delay (0 unless batching is
enabled via the feature flag);
* send all pending messages on plugin shutdown. IMUNIFYAV_MESSAGES_COUNT_TO_SEND g message_send_batching< i, 2 c H t j |i | i | _ d S N)super__init___unsent_metrics)selfargskwargs __class__s S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/client.pyr' zSendToServerClient.__init__I s- $)&))) ! loopc K || _ t | _ t j | _ t j | _ t j | _ d | _ |
| | _ |
|
| _ |
| | _ d S r% )_loopr _pendingasyncioEvent _try_sendLock_lock_shutting_down_flush_deadline create_task_report_metrics
_metrics_task_send _sender_task_invoke_send_message_invoke_send_message_task)r) r/ s r- create_sinkz SendToServerClient.create_sinkM s
/11
\^^
%moo # ! - -d.B.B.D.D E E , ,TZZ\\ : :)-)9)9 % % ' '*
*
&&&r. c > K | d {V d S r% )
_emit_metricsr) s r- r; z"SendToServerClient._report_metricsZ s0 """""""""""r. returnc | j t j t j dS )N)z agent.persistent_queue.evictedzagent.msg_status.droppedz!agent.send.method_missing_dropped)r2 pop_evictedr pop_droppedr pop_method_missing_droppedrD s r- _collect_metricsz#SendToServerClient._collect_metrics^ s: .2m.G.G.I.I(1(=(?(? 799
r. c r | j | j j t j dS )N)zagent.persistent_queue.sizez#agent.persistent_queue.storage_sizezagent.msg_status.queue_size)r2 qsize storage_sizer queue_depthrD s r- _collect_gaugesz"SendToServerClient._collect_gaugesg s6 +/=+>+>+@+@37=3M+4+@+B+B
r. c K | j }i | _ | }t t sd S | D ]#\ }}|r | |d |z ||< $d} i || }t d | D }t j |d< t j
j |d< | j 4 d {V |
| d {V }d d d d {V n# 1 d {V swxY w Y nH# t j $ r || _ t $ r%}t" d| Y d }~nd }~ww xY w|s || _ d S d S )Nr Fc g | ]
\ }}||d S ))namevalue ).0rR rS s r-
<listcomp>z4SendToServerClient._emit_metrics.<locals>.<listcomp> s4 #e "E22 r. timestamp
message_idz"Failed to deliver loss metrics: %r)r( rJ r r itemsgetrO r
timeuuiduuid4hexr7 _send_metrics_directr3 CancelledError Exceptionloggerwarning) r) metrics collectedrR rS sentpayloadmessageexcs r- rC z SendToServerClient._emit_metricsn s & ! ))++ 9:: F$??,, = =KD%
= ' D! 4 4u <
F <;D$8$8$:$:;G$ '.}} G $(9;;GK $(JLL$4GL !
z
@
@
@
@
@
@
@
@ ! 6 6w ? ???????
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@
@% $+D F F F NN? E E E E E E E E F +#*D + +s= 6BD7 7 D%D7 %
D//D7 2D/3D7 7 E<E77E<rh c K | 5 }| t j | | fg d {V d d d n # 1 swxY w Y dS )NT)_get_api
send_messagesr[ _encode_data_to_put_in_queuer) rh apis r- r_ z'SendToServerClient._send_metrics_direct s
]]__ ##)++t @ @ I IJK
ts AA&&A*-A*Nc x K | j t j | | j d{V nh# t j $ rV t d| j | j
st | j d{V Y nw xY w| j j
dk rrt d| j j
| j t d| j dS dS )a~
When shutdown begins it signals any in-flight HTTP sends to
abort immediately (via _shutting_down event), then gives 50
seconds to finish the stop() sequence. If stop() isn't done
in 50 seconds it force-cancels the sender task.
Finally, any messages still in the buffer are flushed to
persistent storage so nothing is lost.
Nz5Timeout (%ds) sending messages to server on shutdown.r z&Save %s messages to persistent storagezStored queue %r)r8 setr3 wait_forstop_SHUTDOWN_SEND_TIMEOUT TimeoutErrorrb errorr> cancelledr r2 buffer_sizerc push_buffer_to_storagerL rD s r- shutdownzSendToServerClient.shutdown sJ
!!! :"499;;0KLL L L L L L L L L# : : : LLG+
$..00
:&t'8999999999 : = $q ( ( NN8
)
M 0 0 2 2 2 NN,dm.A.A.C.C D D D D D
) (s 2A A"B54B5c K t d t | j d{V | j t | j d{V t d | j 4 d{V t d t | j d{V | j | d{V ddd d{V n# 1 d{V swxY w Y | j kt j t j
5 t j | | j d{V ddd dS # 1 swxY w Y dS dS )aq
Stop sending.
1. wait for the lock being available
i.e., while _sender_task finishes the current round
of sending message (if it takes too long, then
the timeout in shutdown() is triggered
2. once the sending round complete (we got the lock),
cancel the next iteration of the _sender_task (it exits)
3. send _pending messages (again, if it takes too long,
the timeout in shutdown() is triggered
and the coroutine is cancelled
That method makes sure that the coroutine
that was started in it has ended.
It excludes a situation when:
-> The result of a coroutine that started
BEFORE shutdown() is started.
-> And the process of sending messages
from _pending is interrupted because of it
z2SendToServer.stop cancel _invoke_send_message_taskNzSendToServer.stop wait lockz4SendToServer.stop lock acquired, cancel _sender_task)rb infor r@ r< r7 r> r8 clear_send_pending_messages
contextlibsuppressr3 ru rr rC _METRICS_FLUSH_TIMEOUTrD s r- rs zSendToServerClient.stop s{ 0 HIII t =>>>>>>>>> )"4#566 6 6 6 6 6 6 6 1222: 0 0 0 0 0 0 0 0
KKN O O O"4#455 5 5 5 5 5 5 5
% % ' ' '--// / / / / / / / 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ) $W%9::
&&&(($*E
* )s% ?A(C99
DD/3E//E36E3c , | t j | t j | t j | S r% )set_product_namer
LicenseCLNget_product_name
set_server_id
get_server_id set_license get_token)ro s r- _set_api_attrsz!SendToServerClient._set_api_attrs sn W / @ @ B BCCC ',::<<=== *4466777
r. c # * K t j d }t j d 5 }t
j t j || }|
| V d d d d S # 1 swxY w Y d S )NIMUNIFYAV_API_BASE ) max_workers)executor) osenvironrZ
concurrentfuturesThreadPoolExecutorr SendMessageAPIr VERSIONr )r) base_urlr ro s r- rk zSendToServerClient._get_api s :>>"677
2
2q
2
A
A +X - h C %%c** * * * + + + + + + + + + + + + + + + + + +s 9BB B c @ K d|vrt j |d< d|vrt j j |d< | j | | | j t j
|t d d S )NrW rX z agent-queuedstage) r[ r\ r] r^ r2 putrm r5 rq r report_reporter_gen_queued)r) rh s r- send_to_serverz!SendToServerClient.send_to_server s g % %#'9;;GK w & &$(JLL$4GL !
$;;GDDEEE "6nMMMMMMr. c < K | j d S r% )r5 rq rD s r- r? z'SendToServerClient._invoke_send_message s r. c t j | j r=t j | j D ]#} t | c S # t
$ r Y w xY w| j S r% )r r _BATCHING_FLAG
get_paramsfloat
ValueError_MAX_SEND_DELAY)r) rS s r- _max_send_delayz"SendToServerClient._max_send_delay su #D$7 8 8 &1$2EFF
<<'''! D##s A
AAr c K | j | j d {V nt d| j | j z
}t
j t j 5 t j
| j | d {V d d d n # 1 swxY w Y | j | j
}|dk r d | _ d S | j 3| j | z | _ || j k r$| j | j k rd S d | _ t d d }| j 4 d {V t d | d {V n8# t j $ r&}t d |}Y d }~nd }~ww xY wd d d d {V n# 1 d {V swxY w Y t d |r|d S )Nr z SendToServer._send wait lockz SendToServer._send lock acquiredz&SendToServer._send cancelled unlockingz SendToServer._send lock released)r9 r5 waitmaxr1 r[ r r r3 ru rr r} r2 rL r _PENDING_MESSAGES_LIMITrb r| r7 r~ r` )r) timeoutrL need_to_canceles r- r= zSendToServerClient._send! s' '.%%'' ' ' ' ' ' ' ' '!T 1DJOO4E4E EFFG$W%9::
G
G &t~':':'<'<gFFFFFFFFF
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
##%% A::#'D F '#':??#4#4t7K7K7M7M#MD D0 0 0
!!D$888 F # 2333 : # # # # # # # # KK: ; ; ;
#113333333333)
#
#
# DEEE!"
# # # # # # # # # # # # # # # # # # # # # # # # # # # # 6777 ! ! !sN 73B66B:=B:H 7GH H! H=H HH
H&)H&datac f t j |t dz }| S )N)cls
)jsondumpsr encode)r) r msgs r- rm z/SendToServerClient._encode_data_to_put_in_queueD s* j#4555<zz||r. c t j | }| d rHt |d }| d | D |S t
| S )Nlistc & i | ]\ }}|d k ||S )r rT )rU kvs r-
<dictcomp>z6SendToServerClient._decode_message.<locals>.<dictcomp>L s# EEEAf1r. )r loadsrZ r updaterY r )r) rh r r s r- _decode_messagez"SendToServerClient._decode_messageH sp z'"" 88F d6l++C JJEE EEE F F FJt}} r. c | dd dz |d< | | }|7| j || | j d S | j || d S )Napi_retries_countr )rW )rZ rm r2 r ry update_message)r) rX rW rh encodeds r- _persist_failedz"SendToServerClient._persist_failedP s '.{{3F'J'JQ'N#$33G<< M g ; ; ; M 0 0 2 2 2 2 2 M ( (W = = = = =r. c K t j | | }| d t j | j } t j ||ht j d{V \ }}n<# t j $ r* | | w xY w|D ]}t | d{V ||v r|
dS dS )zRace the HTTP send against the shutdown signal.
Returns True on success, raises on API error,
or returns False if shutdown interrupted the send.
c 6 t | t j S r% )r rb debug)tasks r- <lambda>z6SendToServerClient._send_one_message.<locals>.<lambda>c s *4 >> r. ) return_whenNTF) r3
ensure_futurer add_done_callbackr8 r FIRST_COMPLETEDr` cancelr result)r) ro rh send_task
shutdown_taskdone
pending_tasksr s r- _send_one_messagez$SendToServerClient._send_one_messageZ sW )#*:*:7*C*CDD ## > >
-d.A.F.F.H.HII
(/ M* # 3) ) ) # # # # # # D-- % " " " " ) )D"4(( ( ( ( ( ( ( ( ( 4 us ,+B 9Cc K | j r t d dS | | }| d | d d} t
j |t d | || d{V }|s t d dS |d rit
j |t d
t d | t j
| d || j |g d S # t" t$ f$ r>}t d
|| | ||| Y d}~dS d}~wt( $ r>}t d
|| | ||| Y d}~dS d}~ww xY w)zDeliver one message and return (stop, failed); message_id is None
for a fresh memory-only message, set for a stored row.z4Shutdown signal received, keeping remaining messages)TFmethodrX )r rX z
agent-sendingr Nz@Shutdown signal received during send, keeping remaining messagesz
agent-sentzmessage sent %s)FFz'Failed to send message %s to server: %s)TT)FT)r8 is_setrb rc r rZ r r _reporter_gen_sendingr _reporter_gen_sentr| r registryconfirmr2 deleter r r r ) r) ro rX rW
message_bytesrh msg_inforf ri s r-
_try_send_onez SendToServerClient._try_send_onez sG % % ' ' NNF
;&&}55 kk(++!++l33
! .o
//W========D
#2 #{ !
I /| -x888 %--gkk,.G.GHHH%
$$j\222 <' 7 NN98S
Y @ @ @ ::::: NN98S
Y @ @ @ ;;;;; s, 9AE BE G403F))
G463G//G4c K | 5 }|j d d d d S t | j d | j D z }t dt | d}d} |D ]R\ }}}| |||| d {V \ }} |r| s n&|dz
}| r|dz
}|r|t | |z
z
} nSd ||d D }
|
r3| j
|
| j nO# d ||d D }
|
r4| j
|
| j w w xY wt d| d d d d S # 1 swxY w Y d S )Nc g | ]
\ }}d ||f S r% rT )rU rW r s r- rV z=SendToServerClient._send_pending_messages.<locals>.<listcomp> s3 9 9 9,I} y-09 9 9r. zSending %s messagesr r c " g | ] \ }}}|||f
S r% rT )rU midtsmbs r- rV z=SendToServerClient._send_pending_messages.<locals>.<listcomp> s/ % % %#R{ H"{{r. z Unsuccessful to send %s messages) rk server_idr r2 peek_stored drain_bufferrb r| lenr put_manyry ) r) ro batch
failure_count processedrX rW r rs failedunattempted_freshs r- r~ z)SendToServerClient._send_pending_messages s
]]__ % K}$% K % K % K % K % K % K % K % K 224455 9 904
0J0J0L0L9 9 9 E
KK-s5zz : : : MI
;<A 8J =)-););ZM* * $ $ $ $ $ $LD& F NI +%*
%Ui)??
% %',YZZ'8% % %!
% ;M**+<===M88:::% %',YZZ'8% % %!
% ;M**+<===M88::::;
KK:M J J JK% K % K % K % K % K % K % K % K % K % K % K % K % K % K % K % K % K % Ks2 F:A6F:$AE9A
F:A F F::F>F>)rE N)6__name__
__module__ __qualname____doc__intr r rZ r r r _SEND_MESSAGE_RECURRING_TIME_METRICS_REPORT_INTERVALrt r r' r3 AbstractEventLooprA r r; dictrJ rO rC r boolr_ rz rs staticmethodr r contextmanagerr r r rk r r
Reportabler r? r r r= bytesrm r r r r r~
__classcell__)r, s @r- r r 2 s 7 7 "c
92>> O,N#% % " " " " "
g&?
_-..# # /.#
$
,+ ,+ ,+\' d !E !E !E !EF. . .` \ +)L$?t$KL + + + + VK "## NG N N N N $# N _122 32 $ $ $ $ $ _Q ! ! !D U u > > > @/ / / b&K &K &K &K &K &K &K &Kr. r c 0 e Zd Zej ZdZdedefdZ dS ) SendToServeri rh rE c K | 5 }|j d d d dS | | d {V d d d n # 1 swxY w Y dS )NFT)rk r r rn s r- r_ z!SendToServer._send_metrics_direct s
]]__ ,}$ , , , , , , , , ""7++ + + + + + + + , , , , , , , , , , , , , , , ts AAAAN)
r r r r AVSCOPESHUTDOWN_PRIORITYr r r_ rT r. r- r r sC HE' d r. r )6r3 concurrent.futuresr r r loggingr r[ r\ typingr defence360agent.api.serverr r r r defence360agent.contractsr defence360agent.contracts.configr "defence360agent.contracts.messagesr
r r r
!defence360agent.contracts.pluginsr r defence360agent.internalsr r 'defence360agent.internals.feature_flagsr r 2defence360agent.internals.message_status_publisherr r ,defence360agent.internals.persistent_messager defence360agent.utilsr r r r defence360agent.utils.jsonr getLoggerr rb r r r r r rT r. r- <module>r s . - - - - - 1 1 1 1 1 1 B A A A A A A A A A A A A A A A N M M M M M M M 9 8 8 8 8 8 8 $ $suu SUU _K _K _K _K _K _K _K _KD
%{ r. defence360agent/plugins/__pycache__/config_merger.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004247 00000000000 022715 0 ustar
r_j< v d dl Z d dlmZmZ d dlmZ d dlmZmZ e j e
Z G d de Z dS ) N)ConfigValidationErrorMerger) MessageType) MessageSinkexpectc d e Zd Zej j Zd Zd Z e e
j d Z dS ) ConfigMergerc d | _ d S Nloop)selfs Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/config_merger.py__init__zConfigMerger.__init__
s
c K || _ d S r r )r r
s r create_sinkzConfigMerger.create_sink s r c T K t j n2# t $ r%}t d| Y d }~nd }~ww xY w| d x}r| d S d S # | d x}r| w w xY w)Nz&Config is invalid. Will not update: %sevent)r update_merged_configr loggererrorgetset)r messageerrr s r r z!ConfigMerger.update_merged_config s ' ) ) ) )$ H H H LLA3 G G G G G G G G H G,,,u
G,,,u
s* A9
AAA9 AA9 9.B'N)
__name__
__module__ __qualname__r ProcessingOrderPRE_PROCESS_MESSAGEPROCESSING_ORDERr r r r ConfigUpdater r r r r
sg "2F VK $%% &% r r )
logging defence360agent.contracts.configr r "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r getLoggerr r r r$ r r <module>r* s J J J J J J J J : : : : : : A A A A A A A A 8 $ $ ; r defence360agent/plugins/__pycache__/config_merger.cpython-311.pyc 0000644 0000000 0000000 00000004247 00000000000 021756 0 ustar
r_j< v d dl Z d dlmZmZ d dlmZ d dlmZmZ e j e
Z G d de Z dS ) N)ConfigValidationErrorMerger) MessageType) MessageSinkexpectc d e Zd Zej j Zd Zd Z e e
j d Z dS ) ConfigMergerc d | _ d S Nloop)selfs Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/config_merger.py__init__zConfigMerger.__init__
s
c K || _ d S r r )r r
s r create_sinkzConfigMerger.create_sink s r c T K t j n2# t $ r%}t d| Y d }~nd }~ww xY w| d x}r| d S d S # | d x}r| w w xY w)Nz&Config is invalid. Will not update: %sevent)r update_merged_configr loggererrorgetset)r messageerrr s r r z!ConfigMerger.update_merged_config s ' ) ) ) )$ H H H LLA3 G G G G G G G G H G,,,u
G,,,u
s* A9
AAA9 AA9 9.B'N)
__name__
__module__ __qualname__r ProcessingOrderPRE_PROCESS_MESSAGEPROCESSING_ORDERr r r r ConfigUpdater r r r r
sg "2F VK $%% &% r r )
logging defence360agent.contracts.configr r "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r getLoggerr r r r$ r r <module>r* s J J J J J J J J : : : : : : A A A A A A A A 8 $ $ ; r defence360agent/plugins/__pycache__/config_watcher.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006531 00000000000 023067 0 ustar
r_j d dl Z d dlmZ d dlmZ d dlmZmZmZ d dl m
Z
m Z ej dd Z
G d d ee ZdS )
N)config) MessageType) MessageSink
MessageSourceexpect)recurring_checkScope READ_CONFIG_POLLING_INTERVAL c e Zd ZdZej Zd Zd Z e e
j d Z d Z
d Z ee d ZdS )
ConfigWatcherzSend ConfigUpdate message on [root's] config update.
The config update is detected by polling config file's
modification time.
c ` t j | _ d| _ d | _ d | _ d S )Nr )r
ConfigFile_config_last_notify_time_sink_task)selfs [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/config_watcher.py__init__zConfigWatcher.__init__ s, (** !"
c
K dS )zplugins.MessageSink methodN )r loops r create_sinkzConfigWatcher.create_sink s
r c $ K |d | _ d S )N timestamp)r r messages r on_config_update_messagez&ConfigWatcher.on_config_update_message! s ")!5 r c p K || _ | | | _ d S N)r create_task
_check_configr )r r sinks r
create_sourcezConfigWatcher.create_source' s2
%%d&8&8&:&:;;
r c | K | j +| j d c}| _ | | d {V d | _ d S r" )r cancelr )r ts r shutdownzConfigWatcher.shutdown+ sF : ! JMAtz
HHJJJGGGGGGG
r c K t j | j r[t j | j t
j }| j | d {V |d | _ d S d S )N)confr r ) r any_layer_modified_sincer r ConfigUpdater timer process_messager s r r$ zConfigWatcher._check_config2 s *4+A B B :!.\TY[[ G *,,W55 5 5 5 5 5 5 5 &-[%9D " " " : :r N)__name__
__module__ __qualname____doc__r AVSCOPEr r r r r. r r& r* r POLLING_INTERVALr$ r r r r
r
s
HE % % % VK $%%6 6 &%6
< < < _%&& : : '& : : :r r
)r/ defence360agent.contractsr "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r r defence360agent.utilsr r int_from_envvarr7 r
r r r <module>r= s , , , , , , : : : : : :
9 8 8 8 8 8 8 8)6)*H"MM .: .: .: .: .:K .: .: .: .: .:r defence360agent/plugins/__pycache__/config_watcher.cpython-311.pyc 0000644 0000000 0000000 00000006531 00000000000 022130 0 ustar
r_j d dl Z d dlmZ d dlmZ d dlmZmZmZ d dl m
Z
m Z ej dd Z
G d d ee ZdS )
N)config) MessageType) MessageSink
MessageSourceexpect)recurring_checkScope READ_CONFIG_POLLING_INTERVAL c e Zd ZdZej Zd Zd Z e e
j d Z d Z
d Z ee d ZdS )
ConfigWatcherzSend ConfigUpdate message on [root's] config update.
The config update is detected by polling config file's
modification time.
c ` t j | _ d| _ d | _ d | _ d S )Nr )r
ConfigFile_config_last_notify_time_sink_task)selfs [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/config_watcher.py__init__zConfigWatcher.__init__ s, (** !"
c
K dS )zplugins.MessageSink methodN )r loops r create_sinkzConfigWatcher.create_sink s
r c $ K |d | _ d S )N timestamp)r r messages r on_config_update_messagez&ConfigWatcher.on_config_update_message! s ")!5 r c p K || _ | | | _ d S N)r create_task
_check_configr )r r sinks r
create_sourcezConfigWatcher.create_source' s2
%%d&8&8&:&:;;
r c | K | j +| j d c}| _ | | d {V d | _ d S r" )r cancelr )r ts r shutdownzConfigWatcher.shutdown+ sF : ! JMAtz
HHJJJGGGGGGG
r c K t j | j r[t j | j t
j }| j | d {V |d | _ d S d S )N)confr r ) r any_layer_modified_sincer r ConfigUpdater timer process_messager s r r$ zConfigWatcher._check_config2 s *4+A B B :!.\TY[[ G *,,W55 5 5 5 5 5 5 5 &-[%9D " " " : :r N)__name__
__module__ __qualname____doc__r AVSCOPEr r r r r. r r& r* r POLLING_INTERVALr$ r r r r
r
s
HE % % % VK $%%6 6 &%6
< < < _%&& : : '& : : :r r
)r/ defence360agent.contractsr "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r r defence360agent.utilsr r int_from_envvarr7 r
r r r <module>r= s , , , , , , : : : : : :
9 8 8 8 8 8 8 8)6)*H"MM .: .: .: .: .:K .: .: .: .: .:r defence360agent/plugins/__pycache__/event_hook_executor.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003437 00000000000 024166 0 ustar
r_j d dl mZ d dlmZmZmZ d dlmZ ej ej ej
ej ej fZ
G d dee ZdS ) ) HookEvent) MessageSink
MessageSourceexpect)
execute_hooksc N e Zd Zej j Zd Zd Z e e
d Z dS )EventHookExecutorc K || _ d S N)_loop)selfloops `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/event_hook_executor.py create_sinkz EventHookExecutor.create_sink s
c & K || _ || _ d S r )r _sink)r
r sinks r
create_sourcez EventHookExecutor.create_source s
r c X K | j t | d S r )r create_taskr )r
events r
receive_eventz EventHookExecutor.receive_event s*
}U 3 344444r N) __name__
__module__ __qualname__r ProcessingOrder
EVENT_HOOKPROCESSING_ORDERr r r EVENTSr r r r r s_ "2= VV_5 5 _5 5 5r r N)%defence360agent.contracts.hook_eventsr !defence360agent.contracts.pluginsr r r defence360agent.hooks.executer AgentStartedAgentMisconfigLicenseExpiredLicenseExpiringLicenseRenewedr r r! r r <module>r* s ; ; ; ; ; ;
8 7 7 7 7 7
5 5 5 5 5 ] 5 5 5 5 5r defence360agent/plugins/__pycache__/event_hook_executor.cpython-311.pyc 0000644 0000000 0000000 00000003437 00000000000 023227 0 ustar
r_j d dl mZ d dlmZmZmZ d dlmZ ej ej ej
ej ej fZ
G d dee ZdS ) ) HookEvent) MessageSink
MessageSourceexpect)
execute_hooksc N e Zd Zej j Zd Zd Z e e
d Z dS )EventHookExecutorc K || _ d S N)_loop)selfloops `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/event_hook_executor.py create_sinkz EventHookExecutor.create_sink s
c & K || _ || _ d S r )r _sink)r
r sinks r
create_sourcez EventHookExecutor.create_source s
r c X K | j t | d S r )r create_taskr )r
events r
receive_eventz EventHookExecutor.receive_event s*
}U 3 344444r N) __name__
__module__ __qualname__r ProcessingOrder
EVENT_HOOKPROCESSING_ORDERr r r EVENTSr r r r r s_ "2= VV_5 5 _5 5 5r r N)%defence360agent.contracts.hook_eventsr !defence360agent.contracts.pluginsr r r defence360agent.hooks.executer AgentStartedAgentMisconfigLicenseExpiredLicenseExpiringLicenseRenewedr r r! r r <module>r* s ; ; ; ; ; ;
8 7 7 7 7 7
5 5 5 5 5 ] 5 5 5 5 5r defence360agent/plugins/__pycache__/event_monitor.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000014121 00000000000 022767 0 ustar
r_j d dl Z d dlmZ d dlmZ d dlmZ d dlmZm Z m
Z
d dl m Z d dl
mZ d dlmZ d d lmZ d d
lmZmZ d d lmZmZ ee Z G d d
ee ZdS ) N)ABC) getLogger)Path)DictListOptional)Core) MessageType)
MessageSource)%NativeFeatureManagementSettingsChange)EventProcessorBaseUserConfigProcessor)recurring_checksafe_cancel_taskc e Zd Zej ZdZd Zd Zd Z e
de fd Z e
de de
fd Zdeej fd Z ed
d Zd S )
EventMonitorz *.*.*.*.jsonc > d | _ d | _ g | _ d | _ d S N)_loop_sink _processors_processing_taskselfs Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/event_monitor.py__init__zEventMonitor.__init__ s&
57 $ c $ K || _ || _ | j t | | j t | | j | | _ d S r ) r r r appendr r create_task#_check_inbox_folder_generate_eventsr )r loopsinks r
create_sourcezEventMonitor.create_source s
Ed K KLLL 3D 9 9::: $
6 6 4 4 6 6!
!
r c > K t | j d {V d S r )r r r s r shutdownzEventMonitor.shutdown) s/ t 455555555555r filec | d S # t $ r Y d S t $ r'}t d| | Y d }~d S d }~ww xY w)NzCouldn't remove file %s %s)unlinkFileNotFoundError Exceptionloggerwarning)r' es r _rmfilezEventMonitor._rmfile, s~ B KKMMMMM DD B B B NN7q A A A A A A A A A Bs
A A AAreturnc N t j | S r )jsonloads read_text)r' s r
_from_jsonzEventMonitor._from_json5 s z$..**+++r c |j d ^}}}}}t |dz |z }n,# t $ r t d| Y d S w xY w t j |||| | S # t $ r t d| Y n/t j $ r t d| Y nw xY wd S )N.z+hook-event-file detected with wrong name %s)usernamehooktsfieldszhook file disappeared %sz hook file have broken json %s)
namesplitfloat
ValueErrorr, r- r
cPanelEventfrom_hook_eventr5 r* r2 JSONDecodeError)r r' r8 r9 ts1ts2_r: s r _event_to_messagez EventMonitor._event_to_message9 s$ +/9??3+?+? (HdCqsSy3''BB NNH$ O O O44 B *::!t,, ;
! = = = NN5t < < < < <# B B B NN:D A A A A A B ts' 47 %A A $5B %C-)C-,C- c K t | j d D ]} | | }|9| j D ]1}| d {V r| | 2n2# t $ r%}t d| Y d }~nd }~ww xY w|
| # |
| w xY w| j D ] }| d {V d S )Nz
*.*.*.jsonz Failed to process %s hook event) r EVENT_DIRglobrF r
is_enabled add_messager+ r, errorr/ process_messages)r r' message processorexcs r r! z0EventMonitor._check_inbox_folder_generate_eventsO sR ((--l;;
#
#D
# 0066&%)%5 ; ; !*!5!5!7!7777777 ; % 1 1' : : :
E
E
E >DDDDDDDD
E T"""" T"""" ) / /I,,.. . . . . . . . . / /s0 AA>=C>
B-B(#C(B--CC N)__name__
__module__ __qualname__r INBOX_HOOKS_DIRrI PATTERNr r$ r& staticmethodr r/ r r5 r r
r@ rF r r! r r r r s $I G% % %
6 6 6 Bd B B B \B , ,$ , , , \,+2I)J , _R
/
/
/
/
/r r ) r2 abcr loggingr pathlibr typingr r r defence360agent.contracts.configr "defence360agent.contracts.messagesr
!defence360agent.contracts.pluginsr 1defence360agent.feature_management.plugins.nativer 7defence360agent.plugins.event_monitor_message_processorr
r defence360agent.utilsr r rR r, r rX r r <module>rc sH ' ' ' ' ' ' ' ' ' ' 1 1 1 1 1 1 : : : : : : ; ; ; ; ; ; D C C C C C C C 8 G/ G/ G/ G/ G/=# G/ G/ G/ G/ G/r defence360agent/plugins/__pycache__/event_monitor.cpython-311.pyc 0000644 0000000 0000000 00000014121 00000000000 022030 0 ustar
r_j d dl Z d dlmZ d dlmZ d dlmZ d dlmZm Z m
Z
d dl m Z d dl
mZ d dlmZ d d lmZ d d
lmZmZ d d lmZmZ ee Z G d d
ee ZdS ) N)ABC) getLogger)Path)DictListOptional)Core) MessageType)
MessageSource)%NativeFeatureManagementSettingsChange)EventProcessorBaseUserConfigProcessor)recurring_checksafe_cancel_taskc e Zd Zej ZdZd Zd Zd Z e
de fd Z e
de de
fd Zdeej fd Z ed
d Zd S )
EventMonitorz *.*.*.*.jsonc > d | _ d | _ g | _ d | _ d S N)_loop_sink _processors_processing_taskselfs Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/event_monitor.py__init__zEventMonitor.__init__ s&
57 $ c $ K || _ || _ | j t | | j t | | j | | _ d S r ) r r r appendr r create_task#_check_inbox_folder_generate_eventsr )r loopsinks r
create_sourcezEventMonitor.create_source s
Ed K KLLL 3D 9 9::: $
6 6 4 4 6 6!
!
r c > K t | j d {V d S r )r r r s r shutdownzEventMonitor.shutdown) s/ t 455555555555r filec | d S # t $ r Y d S t $ r'}t d| | Y d }~d S d }~ww xY w)NzCouldn't remove file %s %s)unlinkFileNotFoundError Exceptionloggerwarning)r' es r _rmfilezEventMonitor._rmfile, s~ B KKMMMMM DD B B B NN7q A A A A A A A A A Bs
A A AAreturnc N t j | S r )jsonloads read_text)r' s r
_from_jsonzEventMonitor._from_json5 s z$..**+++r c |j d ^}}}}}t |dz |z }n,# t $ r t d| Y d S w xY w t j |||| | S # t $ r t d| Y n/t j $ r t d| Y nw xY wd S )N.z+hook-event-file detected with wrong name %s)usernamehooktsfieldszhook file disappeared %sz hook file have broken json %s)
namesplitfloat
ValueErrorr, r- r
cPanelEventfrom_hook_eventr5 r* r2 JSONDecodeError)r r' r8 r9 ts1ts2_r: s r _event_to_messagez EventMonitor._event_to_message9 s$ +/9??3+?+? (HdCqsSy3''BB NNH$ O O O44 B *::!t,, ;
! = = = NN5t < < < < <# B B B NN:D A A A A A B ts' 47 %A A $5B %C-)C-,C- c K t | j d D ]} | | }|9| j D ]1}| d {V r| | 2n2# t $ r%}t d| Y d }~nd }~ww xY w|
| # |
| w xY w| j D ] }| d {V d S )Nz
*.*.*.jsonz Failed to process %s hook event) r EVENT_DIRglobrF r
is_enabled add_messager+ r, errorr/ process_messages)r r' message processorexcs r r! z0EventMonitor._check_inbox_folder_generate_eventsO sR ((--l;;
#
#D
# 0066&%)%5 ; ; !*!5!5!7!7777777 ; % 1 1' : : :
E
E
E >DDDDDDDD
E T"""" T"""" ) / /I,,.. . . . . . . . . / /s0 AA>=C>
B-B(#C(B--CC N)__name__
__module__ __qualname__r INBOX_HOOKS_DIRrI PATTERNr r$ r& staticmethodr r/ r r5 r r
r@ rF r r! r r r r s $I G% % %
6 6 6 Bd B B B \B , ,$ , , , \,+2I)J , _R
/
/
/
/
/r r ) r2 abcr loggingr pathlibr typingr r r defence360agent.contracts.configr "defence360agent.contracts.messagesr
!defence360agent.contracts.pluginsr 1defence360agent.feature_management.plugins.nativer 7defence360agent.plugins.event_monitor_message_processorr
r defence360agent.utilsr r rR r, r rX r r <module>rc sH ' ' ' ' ' ' ' ' ' ' 1 1 1 1 1 1 : : : : : : ; ; ; ; ; ; D C C C C C C C 8 G/ G/ G/ G/ G/=# G/ G/ G/ G/ G/r defence360agent/plugins/__pycache__/event_monitor_message_processor.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000032206 00000000000 026576 0 ustar
r_jo d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm Z m
Z
d dl m Z d dl
mZ d dlmZ d dlmZmZ d d lmZmZ ej Z G d
d ee Z G d d
ee Z G d de ZdS ) N)ABCabstractmethod) defaultdict)heappopheappush)Dict)Core) MessageType)BaseMessageProcessorexpect)is_safe_subdir_namermtreec e Zd Zd Zd Zd Z eej d Z d Z
e d Z e d Z
e d Ze d Ze d
Ze d Zd S )
EventProcessorBasec F t t | _ || _ d S N)r list_msg_buf_loop)selfloops l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/event_monitor_message_processor.py__init__zEventProcessorBase.__init__ s #D))
c X t | j |d |d |f d S )Nusername timestamp)r r r messages r add_messagez EventProcessorBase.add_message s9 M'*- .1Ew0O
r c z K t j fd j D d {V d S )Nc 3 B K | ]} | V d S r )process_user_messages).0
user_messagesr s r <genexpr>z6EventProcessorBase.process_messages.<locals>.<genexpr> sE ! **=99 r )asynciogatherr valuesr s `r process_messagesz#EventProcessorBase.process_messages sr n %)]%9%9%;%;
r c x K | | sd S |j dk r | | d {V d S |j dk r | | d {V d S |j dk r | | d {V d S |j dk r | | d {V d S d S )NModifyCreatechange_packageRemove)_message_is_relatablehook_process_modify_process_create_process_change_package_process_account_removedr s r
process_eventz EventProcessorBase.process_event$ s ))'22 F <8 # #&&w// / / / / / / / / /
\X
%
%&&w// / / / / / / / / /
\ -
-
-..w77 7 7 7 7 7 7 7 7 7
\X
%
%//88 8 8 8 8 8 8 8 8 8 &
%r c K t t | D ]0}| t | d d {V 1d S )N )rangelenprocess_messager )r messages_s r r# z(EventProcessorBase.process_user_messages2 sc s8}}%% = =A&&wx'8'8';<< < < < < < < < < = =r c
K dS )z Modify hookN r s r r3 z"EventProcessorBase._process_modify6
r c
K dS z Create hookNr@ r s r r4 z"EventProcessorBase._process_create: rA r c
K dS zchange_package hookNr@ r s r r5 z*EventProcessorBase._process_change_package> rA r c
K dS )z Remove hookNr@ r s r r6 z+EventProcessorBase._process_account_removedB rA r c dS z'Whether the message should be processedNr@ r s r r1 z(EventProcessorBase._message_is_relatableF r c
K dS z$Whether messages should be processedNr@ r* s r
is_enabledz EventProcessorBase.is_enabledJ rA r N)__name__
__module__ __qualname__r r r+ r r
cPanelEventr7 r# r r3 r4 r5 r6 r1 rL r@ r r r r s
VK #$$ 9 9 %$ 9= = = ^ ^ " " ^" ^ 6 6 ^6 3 3 ^3 3 3r r c
e Zd ZdZd Zd Zd Zd Z ddede d d
fd Z
d Z e d
Z
e d Zee d eeef fd Ze d Zee dede d eeef fd Ze d Zd
S )SettingsChangeBasez'Process hook event messages from cPanelc \ K d|j v rdnd}| || d {V d S )Nplanexclude)data_get_settings_and_update)r r
package_fields r r3 z"SettingsChangeBase._process_modifyR sI "(GL"8"8i
++G]CCCCCCCCCCCr c D K | |dd d {V d S )NrT TrW r s r r4 z"SettingsChangeBase._process_createV s6 ++GVTBBBBBBBBBBBr c D K | |dd d {V d S )Nnew_pkgTrZ r s r r5 z*SettingsChangeBase._process_change_packageY s6 ++GYEEEEEEEEEEEr c
K d S r r@ r s r r6 z+SettingsChangeBase._process_account_removed\ s r FrX add_to_packagereturnNc K t d| | | d {V }| |||| d {V d S )NzGet settings from %s)loggerinfo_get_settings_from_message_apply_settings)r r rX r^ settingss r rW z+SettingsChangeBase._get_settings_and_update_ s *G444 88AAAAAAAA"" ]NH
r c K t d| | d 9|d dk r-t d | D rd S t | s |j | }| || d {V }n># t $ r1 t d | }Y nw xY w|
D ]\ }}| || ||< t d||d |
D ](\ }}| |d || d {V )d S ) Nz
Step 1 %s rT r2 r- c 3 K | ]}|d u V d S r r@ )r$ values r r& z5SettingsChangeBase._apply_settings.<locals>.<genexpr>t s& AAeETMAAAAAAr z'No information about package in messagez,Settings specified in hook message %s for %sr ) ra rb getallr) rV _get_package_settingsKeyErrorwarning_default_settingsitemson_settings_change) r r rX r^ re package_namefallback_settingsfeaturerh s r rd z"SettingsChangeBase._apply_settingsk s L(+++
KK '8++AAx/@/@AAAAA ,
F8??$$%% C
&|M :
+/*D*D .+ + % % % % % %!!
=
=
= HIII$($:$:$<$<!!!
= #+.."2"2
C
C=(9'(BHW% : J
'nn . . O ONGU))'**=wNN N N N N N N N N O Os
B8 88C32C3c dS rH r@ r s r r1 z(SettingsChangeBase._message_is_relatable rI r c
K dS )z9What to do after settings were changed (e.g. sync the DB)Nr@ )r userrs rh s r rp z%SettingsChangeBase.on_settings_change rA r c dS )z Get default package settingsNr@ r@ r r rn z$SettingsChangeBase._default_settings rI r c
K dS )z"Retrieve settings from the messageNr@ r s r rc z-SettingsChangeBase._get_settings_from_message rA r rq c
K dS )z Get current package settingsNr@ )clsrq r^ s r rk z(SettingsChangeBase._get_package_settings rA r c
K dS rK r@ r* s r rL z SettingsChangeBase.is_enabled rA r )F)rM rN rO __doc__r3 r4 r5 r6 strboolrW rd r r1 rp staticmethodr rn rc classmethodrk rL r@ r r rR rR O s 11D D DC C CF F F
%
O O OB 6 6 ^6 H H ^H +tCH~ + + + ^ \+ 1 1 ^1 + +04+
c3h + + + ^ [+
3 3 ^3 3 3r rR c 2 e Zd Zd Zd Zd Zd Zd Zd ZdS )UserConfigProcessorc dS NTr@ r s r r1 z)UserConfigProcessor._message_is_relatable s tr c
K dS r r@ r* s r rL z UserConfigProcessor.is_enabled s tr c t K | d p| d }t | sd S t j t
j | } t | d S # t $ r Y d S t $ r'}t d|| Y d }~d S d }~ww xY w)Nrv r z'Failed to remove user_config dir %s: %s) ri r
ospathjoinr USER_CONFDIRr FileNotFoundErrorOSErrorra rm )r r rv targetes r r6 z,UserConfigProcessor._process_account_removed s {{6""=gkk*&=&="4(( F d /66 6NNNNN DD NN961
s )A: :
B7 B7 B22B7c K |j d }|j }|r t | rt | sd S t j t j t j | t j t j | d S # t $ r Y d S t $ r(}t
d||| Y d }~d S d }~ww xY w)N old_usernamez)Failed to rename user_config %s -> %s: %s)rV ri r r
r renamer r r r r r ra rm )r r r new_usernamer s r r3 z#UserConfigProcessor._process_modify s |''77 ' #L11 $L11
F
I T . == T . ==
! DD NN;
s A%B. .
C,; C, C''C,c
K dS rC r@ r s r r4 z#UserConfigProcessor._process_create rA r c
K dS rE r@ r s r r5 z+UserConfigProcessor._process_change_package rA r N) rM rN rO r1 rL r6 r3 r4 r5 r@ r r r r sn 0 " " " " "r r ) r' loggingr abcr r collectionsr heapqr r typingr defence360agent.contracts.configr "defence360agent.contracts.messagesr
!defence360agent.contracts.pluginsr r defence360agent.utilsr
r getLoggerra r rR r r@ r r <module>r sq # # # # # # # # # # # # # # # # # # # # # # 1 1 1 1 1 1 : : : : : : J J J J J J J J = = = = = = = = ;3 ;3 ;3 ;3 ;3-s ;3 ;3 ;3|W3 W3 W3 W3 W3+S W3 W3 W3t1" 1" 1" 1" 1", 1" 1" 1" 1" 1"r defence360agent/plugins/__pycache__/event_monitor_message_processor.cpython-311.pyc 0000644 0000000 0000000 00000032206 00000000000 025637 0 ustar
r_jo d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm Z m
Z
d dl m Z d dl
mZ d dlmZ d dlmZmZ d d lmZmZ ej Z G d
d ee Z G d d
ee Z G d de ZdS ) N)ABCabstractmethod) defaultdict)heappopheappush)Dict)Core) MessageType)BaseMessageProcessorexpect)is_safe_subdir_namermtreec e Zd Zd Zd Zd Z eej d Z d Z
e d Z e d Z
e d Ze d Ze d
Ze d Zd S )
EventProcessorBasec F t t | _ || _ d S N)r list_msg_buf_loop)selfloops l/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/event_monitor_message_processor.py__init__zEventProcessorBase.__init__ s #D))
c X t | j |d |d |f d S )Nusername timestamp)r r r messages r add_messagez EventProcessorBase.add_message s9 M'*- .1Ew0O
r c z K t j fd j D d {V d S )Nc 3 B K | ]} | V d S r )process_user_messages).0
user_messagesr s r <genexpr>z6EventProcessorBase.process_messages.<locals>.<genexpr> sE ! **=99 r )asynciogatherr valuesr s `r process_messagesz#EventProcessorBase.process_messages sr n %)]%9%9%;%;
r c x K | | sd S |j dk r | | d {V d S |j dk r | | d {V d S |j dk r | | d {V d S |j dk r | | d {V d S d S )NModifyCreatechange_packageRemove)_message_is_relatablehook_process_modify_process_create_process_change_package_process_account_removedr s r
process_eventz EventProcessorBase.process_event$ s ))'22 F <8 # #&&w// / / / / / / / / /
\X
%
%&&w// / / / / / / / / /
\ -
-
-..w77 7 7 7 7 7 7 7 7 7
\X
%
%//88 8 8 8 8 8 8 8 8 8 &
%r c K t t | D ]0}| t | d d {V 1d S )N )rangelenprocess_messager )r messages_s r r# z(EventProcessorBase.process_user_messages2 sc s8}}%% = =A&&wx'8'8';<< < < < < < < < < = =r c
K dS )z Modify hookN r s r r3 z"EventProcessorBase._process_modify6
r c
K dS z Create hookNr@ r s r r4 z"EventProcessorBase._process_create: rA r c
K dS zchange_package hookNr@ r s r r5 z*EventProcessorBase._process_change_package> rA r c
K dS )z Remove hookNr@ r s r r6 z+EventProcessorBase._process_account_removedB rA r c dS z'Whether the message should be processedNr@ r s r r1 z(EventProcessorBase._message_is_relatableF r c
K dS z$Whether messages should be processedNr@ r* s r
is_enabledz EventProcessorBase.is_enabledJ rA r N)__name__
__module__ __qualname__r r r+ r r
cPanelEventr7 r# r r3 r4 r5 r6 r1 rL r@ r r r r s
VK #$$ 9 9 %$ 9= = = ^ ^ " " ^" ^ 6 6 ^6 3 3 ^3 3 3r r c
e Zd ZdZd Zd Zd Zd Z ddede d d
fd Z
d Z e d
Z
e d Zee d eeef fd Ze d Zee dede d eeef fd Ze d Zd
S )SettingsChangeBasez'Process hook event messages from cPanelc \ K d|j v rdnd}| || d {V d S )Nplanexclude)data_get_settings_and_update)r r
package_fields r r3 z"SettingsChangeBase._process_modifyR sI "(GL"8"8i
++G]CCCCCCCCCCCr c D K | |dd d {V d S )NrT TrW r s r r4 z"SettingsChangeBase._process_createV s6 ++GVTBBBBBBBBBBBr c D K | |dd d {V d S )Nnew_pkgTrZ r s r r5 z*SettingsChangeBase._process_change_packageY s6 ++GYEEEEEEEEEEEr c
K d S r r@ r s r r6 z+SettingsChangeBase._process_account_removed\ s r FrX add_to_packagereturnNc K t d| | | d {V }| |||| d {V d S )NzGet settings from %s)loggerinfo_get_settings_from_message_apply_settings)r r rX r^ settingss r rW z+SettingsChangeBase._get_settings_and_update_ s *G444 88AAAAAAAA"" ]NH
r c K t d| | d 9|d dk r-t d | D rd S t | s |j | }| || d {V }n># t $ r1 t d | }Y nw xY w|
D ]\ }}| || ||< t d||d |
D ](\ }}| |d || d {V )d S ) Nz
Step 1 %s rT r2 r- c 3 K | ]}|d u V d S r r@ )r$ values r r& z5SettingsChangeBase._apply_settings.<locals>.<genexpr>t s& AAeETMAAAAAAr z'No information about package in messagez,Settings specified in hook message %s for %sr ) ra rb getallr) rV _get_package_settingsKeyErrorwarning_default_settingsitemson_settings_change) r r rX r^ re package_namefallback_settingsfeaturerh s r rd z"SettingsChangeBase._apply_settingsk s L(+++
KK '8++AAx/@/@AAAAA ,
F8??$$%% C
&|M :
+/*D*D .+ + % % % % % %!!
=
=
= HIII$($:$:$<$<!!!
= #+.."2"2
C
C=(9'(BHW% : J
'nn . . O ONGU))'**=wNN N N N N N N N N O Os
B8 88C32C3c dS rH r@ r s r r1 z(SettingsChangeBase._message_is_relatable rI r c
K dS )z9What to do after settings were changed (e.g. sync the DB)Nr@ )r userrs rh s r rp z%SettingsChangeBase.on_settings_change rA r c dS )z Get default package settingsNr@ r@ r r rn z$SettingsChangeBase._default_settings rI r c
K dS )z"Retrieve settings from the messageNr@ r s r rc z-SettingsChangeBase._get_settings_from_message rA r rq c
K dS )z Get current package settingsNr@ )clsrq r^ s r rk z(SettingsChangeBase._get_package_settings rA r c
K dS rK r@ r* s r rL z SettingsChangeBase.is_enabled rA r )F)rM rN rO __doc__r3 r4 r5 r6 strboolrW rd r r1 rp staticmethodr rn rc classmethodrk rL r@ r r rR rR O s 11D D DC C CF F F
%
O O OB 6 6 ^6 H H ^H +tCH~ + + + ^ \+ 1 1 ^1 + +04+
c3h + + + ^ [+
3 3 ^3 3 3r rR c 2 e Zd Zd Zd Zd Zd Zd Zd ZdS )UserConfigProcessorc dS NTr@ r s r r1 z)UserConfigProcessor._message_is_relatable s tr c
K dS r r@ r* s r rL z UserConfigProcessor.is_enabled s tr c t K | d p| d }t | sd S t j t
j | } t | d S # t $ r Y d S t $ r'}t d|| Y d }~d S d }~ww xY w)Nrv r z'Failed to remove user_config dir %s: %s) ri r
ospathjoinr USER_CONFDIRr FileNotFoundErrorOSErrorra rm )r r rv targetes r r6 z,UserConfigProcessor._process_account_removed s {{6""=gkk*&=&="4(( F d /66 6NNNNN DD NN961
s )A: :
B7 B7 B22B7c K |j d }|j }|r t | rt | sd S t j t j t j | t j t j | d S # t $ r Y d S t $ r(}t
d||| Y d }~d S d }~ww xY w)N old_usernamez)Failed to rename user_config %s -> %s: %s)rV ri r r
r renamer r r r r r ra rm )r r r new_usernamer s r r3 z#UserConfigProcessor._process_modify s |''77 ' #L11 $L11
F
I T . == T . ==
! DD NN;
s A%B. .
C,; C, C''C,c
K dS rC r@ r s r r4 z#UserConfigProcessor._process_create rA r c
K dS rE r@ r s r r5 z+UserConfigProcessor._process_change_package rA r N) rM rN rO r1 rL r6 r3 r4 r5 r@ r r r r sn 0 " " " " "r r ) r' loggingr abcr r collectionsr heapqr r typingr defence360agent.contracts.configr "defence360agent.contracts.messagesr
!defence360agent.contracts.pluginsr r defence360agent.utilsr
r getLoggerra r rR r r@ r r <module>r sq # # # # # # # # # # # # # # # # # # # # # # 1 1 1 1 1 1 : : : : : : J J J J J J J J = = = = = = = = ;3 ;3 ;3 ;3 ;3-s ;3 ;3 ;3|W3 W3 W3 W3 W3+S W3 W3 W3t1" 1" 1" 1" 1", 1" 1" 1" 1" 1"r defence360agent/plugins/__pycache__/feature_flags.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000032535 00000000000 022717 0 ustar
r_j" d Z ddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z ddl m
Z
mZmZmZmZmZmZ ddlmZmZ ddlmZmZ ej e Z dZ d e d
e d e fd Z e!h d
Z" e!h d Z#d e d
e$d e$fdZ% e dd Z& e dd Z' e dd Z( e%dd Z)dZ*de d e fdZ+ G d de Z,dS ) u3
Feature flags synchronisation plugin (AV mode only).
In IM360 mode the Go resident-agent handles feature-flag sync.
In AV mode there is no resident-agent, so this plugin takes over.
Periodically POSTs the local file checksum to the API and writes
back any updated flags to ``/var/imunify360/feature_flags.json`` (legacy map
``{flag: true}`` on disk) and ``/var/imunify360/feature_flags`` (plain names,
one per line). The POSTed checksum is over the canonical JSON **array** of
enabled names, matching the correlation sync API—not over the on-disk map bytes.
N)Core)
MessageSource)
FLAGS_PATHFLAGS_PLAIN_PATHenabled_flag_names_sorted$plain_text_payload_for_enabled_flags$serialize_feature_flags_file_payload!sync_checksum_hex_from_flags_filesync_response_file_bytes)IAIDTokenErrorIndependentAgentIDAPI)Scopeatomic_rewritez/api/sync/v1/feature-flagsnamedefaultreturnc t j | }|s|S t | S # t $ r" t
d| || |cY S w xY w)u Read an int env var tolerantly.
A non-numeric value (empty string, typo, etc.) must NOT raise at
import time — the plugin lives in the AV agent entry point and a
bad env var would otherwise kill the whole agent.
z4feature-flags: %s=%r is not an int, using default %d)osenvirongetint
ValueErrorloggerwarning)r r raws Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/feature_flags.py_env_intr + s|
*..
C 3xx B
s 4 )A A > 1onyestrue> 0noofffalsec t j | }|s|S | }|t
v rdS |t v rdS t d| || |S )NTFz4feature-flags: %s=%r is not a bool, using default %s) r r r striplower _TRUE_VALUES
_FALSE_VALUESr r )r r r
normalizeds r _env_boolr, E s
*..
C ""$$J\!!t]""u
NN> N I360_FEATURE_FLAGS_SYNC_INTERVALi I360_FEATURE_FLAGS_INIT_DELAY
I360_FEATURE_FLAGS_UNREG_DELAY #I360_FEATURE_FLAGS_USE_SERVER_DELAYT server_delayc . t r| dk r| S t S )Nr )_USE_SERVER_DELAY_SYNC_INTERVAL)r4 s r _next_delayr8 ^ s \A - - r- c e Zd Zej Zd Zd ZdefdZ d Z
de fdZ e
dej j defd Ze
d d d
Zd S )
FeatureFlagsSyncc ~ K || _ || _ | | | _ d S N)_loop_sink create_task
_sync_loop_task)selfloopsinks r
create_sourcez FeatureFlagsSync.create_sourceg s7
%%doo&7&788
r- c K | j ?| j | j d {V d S # t j $ r Y d S w xY wd S r< )rA cancelasyncioCancelledErrorrB s r shutdownzFeatureFlagsSync.shutdownl st : ! J
j )
" !s
3 AAr c * t t S r< )r
r rJ s r _local_checksumz FeatureFlagsSync._local_checksumt s 0<<<r- c K t j t d {V t } t j st }n't | d {V }n;# t j $ r t $ r t dd Y nw xY wt j | d {V )NTzfeature flags sync failedexc_info)
rH sleep_INITIAL_DELAYr7 r
is_registered_UNREGISTERED_DELAYr8 _do_syncrI Exceptionr r )rB delays r r@ zFeatureFlagsSync._sync_loopw s mN+++++++++ '"E
K,:<< ? /EE 'dmmoo(=(=(=(=(=(= > >E)
K
K
K :TJJJJJ
K-&& & & & & & & & 's AA. .5B&%B&c
K t j d {V }n+# t $ r t d Y dS w xY wt j }| d | j d {V }t j
d|i }t j
dt j }| d t" z }t$ j ||d|dd } | d | j | d {V }n# t$ j j $ ro} d
| j cxk rd k r+n n(t d | j || j n't d | j || j Y d } ~ dS d } ~ wt$ j j t6 f$ r6} t d
|t9 | d| Y d } ~ dS d } ~ wt: $ r! t d|d Y dS w xY w t j | }
n0# t j $ r t d Y dS w xY w|
dd } |
d du r t ! d | S |
d } |
d pi }
| #| d | j" | |
d {V | S )Nz*no IAID token, skipping feature flags syncr checksumI360_FEATURE_FLAGS_API_URL/zapplication/json)z Content-TypezX-AuthPOST)dataheadersmethodi iX z$feature flags sync HTTP %s on %s: %sz.feature flags sync connection failed on %s: %sreasonz'feature flags sync request failed on %sTrO z&failed to parse feature flags responserW changedFz'feature flags unchanged, skipping writeflagsparams)#r
get_tokenr r r rH get_event_looprun_in_executorrM jsondumpsencoder getenvr API_BASE_URLrstrip _SYNC_URLurllibrequestRequest_blocking_requesterror HTTPErrorcoder` URLError TimeoutErrorgetattrrV loadsJSONDecodeErrorr debug _write_flags)rB tokenrC rY payloadbase_urlurlreq resp_bodyeresultr4 rb rc s r rU zFeatureFlagsSync._do_sync s /9;;;;;;;;EE NNG H H H11 %'' --dD4HIIIIIIII*j( 344;;==9 94;LMMooc""Y.n$$ 2 %
( " 2 2d,c II |% af""""s""""" :FH :FH 11111 %|4
NN@8Q''
11111 LL9
11
Z **FF# LLA B B B11 zz'1-- ::i E ) ) LLB C C C
7##H%%+ &&tT->vNN N N N N N N NsL $AA"D+ +H&?A$F)) H&+G88*H&%H&*H? ?)I,+I,r c t j | t 5 }| cd d d S # 1 swxY w Y d S )N)timeout)rn ro urlopen
_HTTP_TIMEOUTread)r resps r rq z"FeatureFlagsSync._blocking_request s
^
#
#C
#
?
? 499;; s AA A Nc |pi } t | t r;d | D }d | D }t || }nt | }n># t
$ r1 t dt | j Y dS w xY wt t | } t j
t j t d t# t |d t% | }t# t& |d t d | dS # t* $ r t d
d Y dS w xY w) u^ Persist flags + params on disk in the canonical sync-response
shape so the next sync's checksum matches what the server returned.
Falls back to the legacy ``{name: true}`` map when ``flags`` is not
a list (response shape we don't recognise) — keeps the long-standing
on-disk contract from older code paths.
c < g | ]}t |t |S
isinstancestr).0ns r
<listcomp>z1FeatureFlagsSync._write_flags.<locals>.<listcomp> s' @@@qZ3-?-?@@@@r- c i | ]<\ }}t |t t |t /|d |D =S )c < g | ]}t |t |S r r )r vs r r z<FeatureFlagsSync._write_flags.<locals>.<dictcomp>.<listcomp> s' AAAjC.@.@A1AAAr- )r r list)r r valss r
<dictcomp>z1FeatureFlagsSync._write_flags.<locals>.<dictcomp> sa "d!$,, 2<D$1G1GAAdAAA r- z<feature flags sync: unexpected flags type %r, skipping writeNT)exist_okF)backupz%feature flags synced: %d flags activezfailed to write flags filerO )r r itemsr r TypeErrorr r type__name__lenr r makedirspathdirnamer r r r infoOSErrorrr )rb rc namescleanedr] n_activeplains r r{ z FeatureFlagsSync._write_flags s 2 %&&
C@@E@@@ &,llnn
0w??;EBB NNNU $
FF 07788
F K
33d C C C C
:tE : : : :8??E +U5 A A A A KK? J J J J J F F F LL5L E E E E E E Fs% A A& &7B! B!BE &E=<E=r< )r N)r
__module__ __qualname__r AVSCOPErE rK r rM r@ r rU staticmethodrn ro rp bytesrq r{ r r- r r: r: d s HE9 9 9
= = = = =
'
'
' Q Q Q Q Q f v~ 5 % \ %F %F %F %F \%F %F %Fr- r: )-__doc__rH rg loggingr urllib.errorrn urllib.request defence360agent.contracts.configr !defence360agent.contracts.pluginsr 'defence360agent.internals.feature_flagsr r r r r r
r defence360agent.internals.iaidr r
defence360agent.utilsr r getLoggerr r rm r r r frozensetr) r* boolr, r7 rR rT r6 r r8 r: r r- r <module>r s_ 1 1 1 1 1 1 ; ; ; ; ; ; 8 7 7 7 7 7 7 7 8 $ $ ( 3 , y33344 55566
C $ 4 $ <dCC92>> h ?DD I CTJJ
c c `F `F `F `F `F} `F `F `F `F `Fr- defence360agent/plugins/__pycache__/feature_flags.cpython-311.pyc 0000644 0000000 0000000 00000032535 00000000000 021760 0 ustar
r_j" d Z ddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z ddl m
Z
mZmZmZmZmZmZ ddlmZmZ ddlmZmZ ej e Z dZ d e d
e d e fd Z e!h d
Z" e!h d Z#d e d
e$d e$fdZ% e dd Z& e dd Z' e dd Z( e%dd Z)dZ*de d e fdZ+ G d de Z,dS ) u3
Feature flags synchronisation plugin (AV mode only).
In IM360 mode the Go resident-agent handles feature-flag sync.
In AV mode there is no resident-agent, so this plugin takes over.
Periodically POSTs the local file checksum to the API and writes
back any updated flags to ``/var/imunify360/feature_flags.json`` (legacy map
``{flag: true}`` on disk) and ``/var/imunify360/feature_flags`` (plain names,
one per line). The POSTed checksum is over the canonical JSON **array** of
enabled names, matching the correlation sync API—not over the on-disk map bytes.
N)Core)
MessageSource)
FLAGS_PATHFLAGS_PLAIN_PATHenabled_flag_names_sorted$plain_text_payload_for_enabled_flags$serialize_feature_flags_file_payload!sync_checksum_hex_from_flags_filesync_response_file_bytes)IAIDTokenErrorIndependentAgentIDAPI)Scopeatomic_rewritez/api/sync/v1/feature-flagsnamedefaultreturnc t j | }|s|S t | S # t $ r" t
d| || |cY S w xY w)u Read an int env var tolerantly.
A non-numeric value (empty string, typo, etc.) must NOT raise at
import time — the plugin lives in the AV agent entry point and a
bad env var would otherwise kill the whole agent.
z4feature-flags: %s=%r is not an int, using default %d)osenvirongetint
ValueErrorloggerwarning)r r raws Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/feature_flags.py_env_intr + s|
*..
C 3xx B
s 4 )A A > 1onyestrue> 0noofffalsec t j | }|s|S | }|t
v rdS |t v rdS t d| || |S )NTFz4feature-flags: %s=%r is not a bool, using default %s) r r r striplower _TRUE_VALUES
_FALSE_VALUESr r )r r r
normalizeds r _env_boolr, E s
*..
C ""$$J\!!t]""u
NN> N I360_FEATURE_FLAGS_SYNC_INTERVALi I360_FEATURE_FLAGS_INIT_DELAY
I360_FEATURE_FLAGS_UNREG_DELAY #I360_FEATURE_FLAGS_USE_SERVER_DELAYT server_delayc . t r| dk r| S t S )Nr )_USE_SERVER_DELAY_SYNC_INTERVAL)r4 s r _next_delayr8 ^ s \A - - r- c e Zd Zej Zd Zd ZdefdZ d Z
de fdZ e
dej j defd Ze
d d d
Zd S )
FeatureFlagsSyncc ~ K || _ || _ | | | _ d S N)_loop_sink create_task
_sync_loop_task)selfloopsinks r
create_sourcez FeatureFlagsSync.create_sourceg s7
%%doo&7&788
r- c K | j ?| j | j d {V d S # t j $ r Y d S w xY wd S r< )rA cancelasyncioCancelledErrorrB s r shutdownzFeatureFlagsSync.shutdownl st : ! J
j )
" !s
3 AAr c * t t S r< )r
r rJ s r _local_checksumz FeatureFlagsSync._local_checksumt s 0<<<r- c K t j t d {V t } t j st }n't | d {V }n;# t j $ r t $ r t dd Y nw xY wt j | d {V )NTzfeature flags sync failedexc_info)
rH sleep_INITIAL_DELAYr7 r
is_registered_UNREGISTERED_DELAYr8 _do_syncrI Exceptionr r )rB delays r r@ zFeatureFlagsSync._sync_loopw s mN+++++++++ '"E
K,:<< ? /EE 'dmmoo(=(=(=(=(=(= > >E)
K
K
K :TJJJJJ
K-&& & & & & & & & 's AA. .5B&%B&c
K t j d {V }n+# t $ r t d Y dS w xY wt j }| d | j d {V }t j
d|i }t j
dt j }| d t" z }t$ j ||d|dd } | d | j | d {V }n# t$ j j $ ro} d
| j cxk rd k r+n n(t d | j || j n't d | j || j Y d } ~ dS d } ~ wt$ j j t6 f$ r6} t d
|t9 | d| Y d } ~ dS d } ~ wt: $ r! t d|d Y dS w xY w t j | }
n0# t j $ r t d Y dS w xY w|
dd } |
d du r t ! d | S |
d } |
d pi }
| #| d | j" | |
d {V | S )Nz*no IAID token, skipping feature flags syncr checksumI360_FEATURE_FLAGS_API_URL/zapplication/json)z Content-TypezX-AuthPOST)dataheadersmethodi iX z$feature flags sync HTTP %s on %s: %sz.feature flags sync connection failed on %s: %sreasonz'feature flags sync request failed on %sTrO z&failed to parse feature flags responserW changedFz'feature flags unchanged, skipping writeflagsparams)#r
get_tokenr r r rH get_event_looprun_in_executorrM jsondumpsencoder getenvr API_BASE_URLrstrip _SYNC_URLurllibrequestRequest_blocking_requesterror HTTPErrorcoder` URLError TimeoutErrorgetattrrV loadsJSONDecodeErrorr debug _write_flags)rB tokenrC rY payloadbase_urlurlreq resp_bodyeresultr4 rb rc s r rU zFeatureFlagsSync._do_sync s /9;;;;;;;;EE NNG H H H11 %'' --dD4HIIIIIIII*j( 344;;==9 94;LMMooc""Y.n$$ 2 %
( " 2 2d,c II |% af""""s""""" :FH :FH 11111 %|4
NN@8Q''
11111 LL9
11
Z **FF# LLA B B B11 zz'1-- ::i E ) ) LLB C C C
7##H%%+ &&tT->vNN N N N N N N NsL $AA"D+ +H&?A$F)) H&+G88*H&%H&*H? ?)I,+I,r c t j | t 5 }| cd d d S # 1 swxY w Y d S )N)timeout)rn ro urlopen
_HTTP_TIMEOUTread)r resps r rq z"FeatureFlagsSync._blocking_request s
^
#
#C
#
?
? 499;; s AA A Nc |pi } t | t r;d | D }d | D }t || }nt | }n># t
$ r1 t dt | j Y dS w xY wt t | } t j
t j t d t# t |d t% | }t# t& |d t d | dS # t* $ r t d
d Y dS w xY w) u^ Persist flags + params on disk in the canonical sync-response
shape so the next sync's checksum matches what the server returned.
Falls back to the legacy ``{name: true}`` map when ``flags`` is not
a list (response shape we don't recognise) — keeps the long-standing
on-disk contract from older code paths.
c < g | ]}t |t |S
isinstancestr).0ns r
<listcomp>z1FeatureFlagsSync._write_flags.<locals>.<listcomp> s' @@@qZ3-?-?@@@@r- c i | ]<\ }}t |t t |t /|d |D =S )c < g | ]}t |t |S r r )r vs r r z<FeatureFlagsSync._write_flags.<locals>.<dictcomp>.<listcomp> s' AAAjC.@.@A1AAAr- )r r list)r r valss r
<dictcomp>z1FeatureFlagsSync._write_flags.<locals>.<dictcomp> sa "d!$,, 2<D$1G1GAAdAAA r- z<feature flags sync: unexpected flags type %r, skipping writeNT)exist_okF)backupz%feature flags synced: %d flags activezfailed to write flags filerO )r r itemsr r TypeErrorr r type__name__lenr r makedirspathdirnamer r r r infoOSErrorrr )rb rc namescleanedr] n_activeplains r r{ z FeatureFlagsSync._write_flags s 2 %&&
C@@E@@@ &,llnn
0w??;EBB NNNU $
FF 07788
F K
33d C C C C
:tE : : : :8??E +U5 A A A A KK? J J J J J F F F LL5L E E E E E E Fs% A A& &7B! B!BE &E=<E=r< )r N)r
__module__ __qualname__r AVSCOPErE rK r rM r@ r rU staticmethodrn ro rp bytesrq r{ r r- r r: r: d s HE9 9 9
= = = = =
'
'
' Q Q Q Q Q f v~ 5 % \ %F %F %F %F \%F %F %Fr- r: )-__doc__rH rg loggingr urllib.errorrn urllib.request defence360agent.contracts.configr !defence360agent.contracts.pluginsr 'defence360agent.internals.feature_flagsr r r r r r
r defence360agent.internals.iaidr r
defence360agent.utilsr r getLoggerr r rm r r r frozensetr) r* boolr, r7 rR rT r6 r r8 r: r r- r <module>r s_ 1 1 1 1 1 1 ; ; ; ; ; ; 8 7 7 7 7 7 7 7 8 $ $ ( 3 , y33344 55566
C $ 4 $ <dCC92>> h ?DD I CTJJ
c c `F `F `F `F `F} `F `F `F `F `Fr- defence360agent/plugins/__pycache__/files_recurring_update.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005325 00000000000 024631 0 ustar
r_ja ~ d dl Z d dlmZ d dlmZmZ d dlmZ d dlm Z e j
e Z G d de Z
dS ) N)files)configmessages)
MessageSource)recurring_checkc t e Zd Zdej deddfdZd Zd Z e e
j j d Z
dS ) FilesRecurringUpdateTaskindex
is_updatedreturnNc K |rGt j |j | }| j | d {V d S d S N)r MessageType FilesUpdatedtype_sinkprocess_message)selfr
r messages c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/files_recurring_update.py_on_files_updatez)FilesRecurringUpdateTask._on_files_update sb 6 *77
EJJG*,,W55 5 5 5 5 5 5 5 5 5 6 6 c
K || _ || _ | | | _ t
j D ]'}t
j || j (d S r )
_loopr create_task _update_task_taskr Indextypesadd_hookr )r loopsinktype_s r
create_sourcez&FilesRecurringUpdateTask.create_source sz
%%d&7&7&9&9::
[&&(( ? ?E K (= > > > > ? ?r c V K | j | j d {V d S r )r cancelr s r shutdownz!FilesRecurringUpdateTask.shutdown s:
jr c < K t j d {V d S r )r update_and_log_errorr' s r r z%FilesRecurringUpdateTask._update_task s- (***********r )__name__
__module__ __qualname__r r boolr r$ r( r r FilesUpdatePERIODr r r r r s 6[6.26
6 6 6 6? ? ?
_V'.//+ + 0/+ + +r r )loggingdefence360agentr defence360agent.contractsr r !defence360agent.contracts.pluginsr defence360agent.utilsr getLoggerr+ loggerr r1 r r <module>r9 s ! ! ! ! ! ! 6 6 6 6 6 6 6 6 ; ; ; ; ; ; 1 1 1 1 1 1 8 $ $+ + + + +} + + + + +r defence360agent/plugins/__pycache__/files_recurring_update.cpython-311.pyc 0000644 0000000 0000000 00000005325 00000000000 023672 0 ustar
r_ja ~ d dl Z d dlmZ d dlmZmZ d dlmZ d dlm Z e j
e Z G d de Z
dS ) N)files)configmessages)
MessageSource)recurring_checkc t e Zd Zdej deddfdZd Zd Z e e
j j d Z
dS ) FilesRecurringUpdateTaskindex
is_updatedreturnNc K |rGt j |j | }| j | d {V d S d S N)r MessageType FilesUpdatedtype_sinkprocess_message)selfr
r messages c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/files_recurring_update.py_on_files_updatez)FilesRecurringUpdateTask._on_files_update sb 6 *77
EJJG*,,W55 5 5 5 5 5 5 5 5 5 6 6 c
K || _ || _ | | | _ t
j D ]'}t
j || j (d S r )
_loopr create_task _update_task_taskr Indextypesadd_hookr )r loopsinktype_s r
create_sourcez&FilesRecurringUpdateTask.create_source sz
%%d&7&7&9&9::
[&&(( ? ?E K (= > > > > ? ?r c V K | j | j d {V d S r )r cancelr s r shutdownz!FilesRecurringUpdateTask.shutdown s:
jr c < K t j d {V d S r )r update_and_log_errorr' s r r z%FilesRecurringUpdateTask._update_task s- (***********r )__name__
__module__ __qualname__r r boolr r$ r( r r FilesUpdatePERIODr r r r r s 6[6.26
6 6 6 6? ? ?
_V'.//+ + 0/+ + +r r )loggingdefence360agentr defence360agent.contractsr r !defence360agent.contracts.pluginsr defence360agent.utilsr getLoggerr+ loggerr r1 r r <module>r9 s ! ! ! ! ! ! 6 6 6 6 6 6 6 6 ; ; ; ; ; ; 1 1 1 1 1 1 8 $ $+ + + + +} + + + + +r defence360agent/plugins/__pycache__/icontact_sender.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000015775 00000000000 023263 0 ustar
r_j " d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m
Z
d dl m Z m
Z
d dlmZ d dlmZmZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lm Z d dl m Z m Z m Z m!Z!m"Z" d dl#m$Z$ ej% e& Z'd Z( G d dee Z)dS ) N)Path)IAIDTokenError)APIError) EventsAPI)CoreIContactMessageType) MessageType) MessageSink
MessageSource)TheSink)IContactThrottle)cPanel)Plesk) HostingPanel) await_for create_task_and_log_exceptionsrecurring_checkretry_onScope)DAYc b K t d| | t d d S )Nz[Can't get recommendations for the dashboard due to iaid token error, reason: %s. Attempt %sd seconds)loggerwarningr )eis \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/icontact_sender.pyasync_log_on_errorr # s@
NN 3 c c e Zd Zej j Zej Z fdZ
d Z dddZ de
fdZd Z ee ed
d d e
eeed d e
defd Z ee d Z xZS )IContactSenderc t j |i | g | _ t t j dz | _ d S )N icontact_generic_notifications)super__init___tasksr r TMPDIR_notification_flag_path)selfargskwargs __class__s r r' zIContactSender.__init__1 sG $)&))) @ @
$$$r! c
K d S N )r+ loops r create_sinkzIContactSender.create_sink8 s r! Nuserc | K |d S t j ||| sd S | j t j || d {V }|rmt j || t j |t t j
| }| j | d {V d S d S )Nr4 ) message_typeparamsr5 )r7 timestamp
template_args)
r
may_be_notified_panelnotifyr GENERICrefreshr IContactSentinttime_sinkprocess_message)r+ r7 r8 period_limitr5 r: sent_messages r _send_icontact_messagez%IContactSender._send_icontact_message; s F /
F "k 0 0,4 1
; $\ = = = =&3 ) dikk** + L
*,,\:: : : : : : : : : : ; ;r! sinkc K || _ t | _ | j j t j t
j fv r t
|| j g| _ d S d S r0 ) rC r r< NAMEr r r generic_notificationsr( )r+ r2 rH s r
create_sourcez IContactSender.create_sourceY s[
"nn ; UZ 8 8 8.$4 DKKK 9 8r! c ~ K | j D ]}| t j | j ddi d {V d S )Nreturn_exceptionsT)r( cancelasynciogather)r+ tasks r shutdownzIContactSender.shutdownc sU K D KKMMMMndkBTBBBBBBBBBBBr!
r T)on_error max_triessilentlogreturnc K g }| j r;| j j t z t j k r5t
j d {V }| j dd |S )Ni T)modeexist_ok) r* existsstatst_mtimer rB r notificationtouch)r+
notificationss r get_notificationsz IContactSender.get_notificationsh s
,3355 J,1133<sBikk #,"8":": : : : : : :M ( . .ED . I I I r! c : K | d {V x}rzt dt | |D ]Q}| |d |d |d d|d | d d {V Pd S d S ) Nz)Sending %s generic icontact notificationstypenotification_subjectnotification_body_html)subject body_htmlnotification_period_limitnotification_user)r7 r8 rE r5 )rd r infolenrG get)r+ rc ra s r rK z$IContactSender.generic_notifications s "&"8"8":": : : : : : : :=
KK;S =O=O
!.
11!-f!5#/0F#G%12J%K "..I!J%))*=>> 2
r! ) __name__
__module__ __qualname__r
ProcessingOrder
ICONTACT_SENTPROCESSING_ORDERr AV_IM360SCOPEr' r3 rG r rL rS r r r r r r listrd r r rK
__classcell__)r. s @r r# r# - sQ "2@ NE
; ; ; ; ;<g C C C
X2&&& X#
_S r! r# )*rP loggingrB pathlibr defence360agent.internals.iaidr defence360agent.api.serverr !defence360agent.api.server.eventsr defence360agent.contracts.configr r "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr
r "defence360agent.internals.the_sinkr defence360agent.model.icontactr
$defence360agent.subsys.panels.cpanelr #defence360agent.subsys.panels.pleskr +defence360agent.subsys.panels.hosting_panelr defence360agent.utilsr r r r r defence360agent.utils.commonr getLoggerrp r r r# r1 r! r <module>r s 9 9 9 9 9 9 / / / / / / 7 7 7 7 7 7 ; : : : : : 7 6 6 6 6 6 ; ; ; ; ; ; 7 7 7 7 7 7 5 5 5 5 5 5 D D D D D D - , , , , , 8 $ $ d d d d d[- d d d d dr! defence360agent/plugins/__pycache__/icontact_sender.cpython-311.pyc 0000644 0000000 0000000 00000015775 00000000000 022324 0 ustar
r_j " d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m
Z
d dl m Z m
Z
d dlmZ d dlmZmZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lm Z d dl m Z m Z m Z m!Z!m"Z" d dl#m$Z$ ej% e& Z'd Z( G d dee Z)dS ) N)Path)IAIDTokenError)APIError) EventsAPI)CoreIContactMessageType) MessageType) MessageSink
MessageSource)TheSink)IContactThrottle)cPanel)Plesk) HostingPanel) await_for create_task_and_log_exceptionsrecurring_checkretry_onScope)DAYc b K t d| | t d d S )Nz[Can't get recommendations for the dashboard due to iaid token error, reason: %s. Attempt %sd seconds)loggerwarningr )eis \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/icontact_sender.pyasync_log_on_errorr # s@
NN 3 c c e Zd Zej j Zej Z fdZ
d Z dddZ de
fdZd Z ee ed
d d e
eeed d e
defd Z ee d Z xZS )IContactSenderc t j |i | g | _ t t j dz | _ d S )N icontact_generic_notifications)super__init___tasksr r TMPDIR_notification_flag_path)selfargskwargs __class__s r r' zIContactSender.__init__1 sG $)&))) @ @
$$$r! c
K d S N )r+ loops r create_sinkzIContactSender.create_sink8 s r! Nuserc | K |d S t j ||| sd S | j t j || d {V }|rmt j || t j |t t j
| }| j | d {V d S d S )Nr4 ) message_typeparamsr5 )r7 timestamp
template_args)
r
may_be_notified_panelnotifyr GENERICrefreshr IContactSentinttime_sinkprocess_message)r+ r7 r8 period_limitr5 r: sent_messages r _send_icontact_messagez%IContactSender._send_icontact_message; s F /
F "k 0 0,4 1
; $\ = = = =&3 ) dikk** + L
*,,\:: : : : : : : : : : ; ;r! sinkc K || _ t | _ | j j t j t
j fv r t
|| j g| _ d S d S r0 ) rC r r< NAMEr r r generic_notificationsr( )r+ r2 rH s r
create_sourcez IContactSender.create_sourceY s[
"nn ; UZ 8 8 8.$4 DKKK 9 8r! c ~ K | j D ]}| t j | j ddi d {V d S )Nreturn_exceptionsT)r( cancelasynciogather)r+ tasks r shutdownzIContactSender.shutdownc sU K D KKMMMMndkBTBBBBBBBBBBBr!
r T)on_error max_triessilentlogreturnc K g }| j r;| j j t z t j k r5t
j d {V }| j dd |S )Ni T)modeexist_ok) r* existsstatst_mtimer rB r notificationtouch)r+
notificationss r get_notificationsz IContactSender.get_notificationsh s
,3355 J,1133<sBikk #,"8":": : : : : : :M ( . .ED . I I I r! c : K | d {V x}rzt dt | |D ]Q}| |d |d |d d|d | d d {V Pd S d S ) Nz)Sending %s generic icontact notificationstypenotification_subjectnotification_body_html)subject body_htmlnotification_period_limitnotification_user)r7 r8 rE r5 )rd r infolenrG get)r+ rc ra s r rK z$IContactSender.generic_notifications s "&"8"8":": : : : : : : :=
KK;S =O=O
!.
11!-f!5#/0F#G%12J%K "..I!J%))*=>> 2
r! ) __name__
__module__ __qualname__r
ProcessingOrder
ICONTACT_SENTPROCESSING_ORDERr AV_IM360SCOPEr' r3 rG r rL rS r r r r r r listrd r r rK
__classcell__)r. s @r r# r# - sQ "2@ NE
; ; ; ; ;<g C C C
X2&&& X#
_S r! r# )*rP loggingrB pathlibr defence360agent.internals.iaidr defence360agent.api.serverr !defence360agent.api.server.eventsr defence360agent.contracts.configr r "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr
r "defence360agent.internals.the_sinkr defence360agent.model.icontactr
$defence360agent.subsys.panels.cpanelr #defence360agent.subsys.panels.pleskr +defence360agent.subsys.panels.hosting_panelr defence360agent.utilsr r r r r defence360agent.utils.commonr getLoggerrp r r r# r1 r! r <module>r s 9 9 9 9 9 9 / / / / / / 7 7 7 7 7 7 ; : : : : : 7 6 6 6 6 6 ; ; ; ; ; ; 7 7 7 7 7 7 5 5 5 5 5 5 D D D D D D - , , , , , 8 $ $ d d d d d[- d d d d dr! defence360agent/plugins/__pycache__/idle_time_out.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005016 00000000000 022724 0 ustar
r_j | d dl mZ d dlmZ d dlmZ d dlmZ d dlm Z m
Z
m Z ee Z
G d de ZdS ) ) getLogger)
inactivity) SimpleRpc) MessageSink)clipfail_agent_servicerecurring_checkc e Zd Zd Zd Zd ZdS )IdleTimeOutCheckc 4 K || _ t j r{t j | t t t j dz dd | j
| _ d S d | _ d S )N < )lowhigh)period) _loopr SOCKET_ACTIVATIONr track reset_timer create_taskr r INACTIVITY_TIMEOUT_check_timeout_task)selfloops Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/idle_time_out.py create_sinkz IdleTimeOutCheck.create_sink s
& ( ( * * * )) !49qr
' DJJJ DJJJ c h K | j r(| j | j d {V d S d S )N)r cancelr s r shutdownzIdleTimeOutCheck.shutdown sN : J * r c K t dt j t j r*t d t
d S d S )NzPeriodical check %s z Shutting down due to inactivity.)loggerinfor r
is_timeoutwarningr r" s r r z IdleTimeOutCheck._check_timeout" sd *J,<=== & & ( ( ! NN= > > > ! !r N)__name__
__module__ __qualname__r r# r r r r r sA ! ! ! ! !r r N)loggingr defence360agent.apir defence360agent.contracts.configr !defence360agent.contracts.pluginsr defence360agent.utilsr r r r) r% r r, r r <module>r2 s * * * * * * 6 6 6 6 6 6 9 9 9 9 9 9 K K K K K K K K K K 8 ! ! ! ! !{ ! ! ! ! !r defence360agent/plugins/__pycache__/idle_time_out.cpython-311.pyc 0000644 0000000 0000000 00000005016 00000000000 021765 0 ustar
r_j | d dl mZ d dlmZ d dlmZ d dlmZ d dlm Z m
Z
m Z ee Z
G d de ZdS ) ) getLogger)
inactivity) SimpleRpc) MessageSink)clipfail_agent_servicerecurring_checkc e Zd Zd Zd Zd ZdS )IdleTimeOutCheckc 4 K || _ t j r{t j | t t t j dz dd | j
| _ d S d | _ d S )N < )lowhigh)period) _loopr SOCKET_ACTIVATIONr track reset_timer create_taskr r INACTIVITY_TIMEOUT_check_timeout_task)selfloops Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/idle_time_out.py create_sinkz IdleTimeOutCheck.create_sink s
& ( ( * * * )) !49qr
' DJJJ DJJJ c h K | j r(| j | j d {V d S d S )N)r cancelr s r shutdownzIdleTimeOutCheck.shutdown sN : J * r c K t dt j t j r*t d t
d S d S )NzPeriodical check %s z Shutting down due to inactivity.)loggerinfor r
is_timeoutwarningr r" s r r z IdleTimeOutCheck._check_timeout" sd *J,<=== & & ( ( ! NN= > > > ! !r N)__name__
__module__ __qualname__r r# r r r r r sA ! ! ! ! !r r N)loggingr defence360agent.apir defence360agent.contracts.configr !defence360agent.contracts.pluginsr defence360agent.utilsr r r r) r% r r, r r <module>r2 s * * * * * * 6 6 6 6 6 6 9 9 9 9 9 9 K K K K K K K K K K 8 ! ! ! ! !{ ! ! ! ! !r defence360agent/plugins/__pycache__/lve_utils_install.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005350 00000000000 023637 0 ustar
r_j R d dl mZ d dlmZmZmZ d dlmZmZ G d de Z dS ) ) MessageSink)check_run_outside_sandboxrecurring_checkRecurringCheckStop)
is_lve_active
has_lvectlc 0 e Zd ZdZdddZd Zd Zd ZdS ) LveUtilsAutoInstallera
Install lve-utils package on CL with LVE automatically
(according to DEF-11452) to provide tools to limit CPU/IO.
Used tools:
/usr/sbin/lvectl - provided by lve-utils package
/bin/lve_suwrapper - provided by lve-wrappers package
(which is a dependency of lve-utils)
lve-utils package is installed by default on CL,
but for some reason may not exist.
i ) check_periodc " || _ d | _ d S N)
_check_period_task)selfr s ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/lve_utils_install.py__init__z LveUtilsAutoInstaller.__init__ s )
c K || _ | j t | j | j | _ d S r
)_loop create_taskr r _install_lve_utils_if_neededr )r loops r create_sinkz!LveUtilsAutoInstaller.create_sink sY
Z++
/OD . / /1
r c v K | j /| j | j d {V d | _ d S d S r
)r cancelr s r shutdownz LveUtilsAutoInstaller.shutdown$ sO : ! J * DJJJ " !r c K t st t st g d d {V d S d S )N)yumz-yinstallz lve-utils)r r r r r s r r z2LveUtilsAutoInstaller._install_lve_utils_if_needed* sy '$&& &|| ,555
r N)__name__
__module__ __qualname____doc__r r r r r r r
r
si (,
r r
N)
!defence360agent.contracts.pluginsr defence360agent.utilsr r r %defence360agent.utils.resource_limitsr r r
r% r r <module>r) s 9 9 9 9 9 9
L K K K K K K K* * * * *K * * * * *r defence360agent/plugins/__pycache__/lve_utils_install.cpython-311.pyc 0000644 0000000 0000000 00000005350 00000000000 022700 0 ustar
r_j R d dl mZ d dlmZmZmZ d dlmZmZ G d de Z dS ) ) MessageSink)check_run_outside_sandboxrecurring_checkRecurringCheckStop)
is_lve_active
has_lvectlc 0 e Zd ZdZdddZd Zd Zd ZdS ) LveUtilsAutoInstallera
Install lve-utils package on CL with LVE automatically
(according to DEF-11452) to provide tools to limit CPU/IO.
Used tools:
/usr/sbin/lvectl - provided by lve-utils package
/bin/lve_suwrapper - provided by lve-wrappers package
(which is a dependency of lve-utils)
lve-utils package is installed by default on CL,
but for some reason may not exist.
i ) check_periodc " || _ d | _ d S N)
_check_period_task)selfr s ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/lve_utils_install.py__init__z LveUtilsAutoInstaller.__init__ s )
c K || _ | j t | j | j | _ d S r
)_loop create_taskr r _install_lve_utils_if_neededr )r loops r create_sinkz!LveUtilsAutoInstaller.create_sink sY
Z++
/OD . / /1
r c v K | j /| j | j d {V d | _ d S d S r
)r cancelr s r shutdownz LveUtilsAutoInstaller.shutdown$ sO : ! J * DJJJ " !r c K t st t st g d d {V d S d S )N)yumz-yinstallz lve-utils)r r r r r s r r z2LveUtilsAutoInstaller._install_lve_utils_if_needed* sy '$&& &|| ,555
r N)__name__
__module__ __qualname____doc__r r r r r r r
r
si (,
r r
N)
!defence360agent.contracts.pluginsr defence360agent.utilsr r r %defence360agent.utils.resource_limitsr r r
r% r r <module>r) s 9 9 9 9 9 9
L K K K K K K K* * * * *K * * * * *r defence360agent/plugins/__pycache__/myimunify.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006655 00000000000 022142 0 ustar
r_j d dl Z d dlmZ d dlmZ d dlmZmZmZ d dl m
Z
d dl m Z d dl
mZmZ e j e Z G d d ee ZdS )
N)MyImunifyConfig) MessageType) MessageSink
MessageSourceexpect)update_users_protection)
hosting_panel)
load_state
save_statec n e Zd Zd Zd Zd Zd Zd Z ee j
de j
fd Z dS ) MyImunifyPluginc t d d p t j | _ d | _ d | _ d S Nr
myimunify_enabled)r
getr ENABLED_previous_myimunify_status_loop_sinkselfs V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/myimunify.py__init__zMyImunifyPlugin.__init__ sD ( ) ) - -.A B B
' &
'
c 8 K t dd| j i d S r )r r r s r shutdownzMyImunifyPlugin.shutdown s0
$"A B
r c
K d S N )r loops r create_sinkzMyImunifyPlugin.create_sink s r c & K || _ || _ d S r )r r )r r sinks r
create_sourcez MyImunifyPlugin.create_source# s
r c K t j d {V }t | j |dd d {V d S )NFT)force_config_update)r HostingPanel get_usersr r )r existing_userss r _update_myimunify_usersz'MyImunifyPlugin._update_myimunify_users' s| , 9 ; ; E E G GGGGGGG% J4
r messagec K t j }| j }|| _ |r |s| d {V ||k r/t j | d {V d S d S )N)r )r r r r* r r' switch_ui_config)r r+ r previous_statuss r on_config_updatez MyImunifyPlugin.on_config_update- s + 3 9 +<' 1_ 1..00 0 0 0 0 0 0 0 / / ,..??"3 @
0 /r N) __name__
__module__ __qualname__r r r! r$ r* r r ConfigUpdater/ r r r r
r
s
VK $%% k.F &% r r
)logging defence360agent.contracts.configr "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r r defence360agent.myimunify.modelr defence360agent.subsys.panelsr 'defence360agent.subsys.persistent_stater
r getLoggerr0 loggerr
r r r <module>r= s < < < < < < : : : : : :
D C C C C C 7 7 7 7 7 7 J J J J J J J J 8 $ $) ) ) ) )k= ) ) ) ) )r defence360agent/plugins/__pycache__/myimunify.cpython-311.pyc 0000644 0000000 0000000 00000006655 00000000000 021203 0 ustar
r_j d dl Z d dlmZ d dlmZ d dlmZmZmZ d dl m
Z
d dl m Z d dl
mZmZ e j e Z G d d ee ZdS )
N)MyImunifyConfig) MessageType) MessageSink
MessageSourceexpect)update_users_protection)
hosting_panel)
load_state
save_statec n e Zd Zd Zd Zd Zd Zd Z ee j
de j
fd Z dS ) MyImunifyPluginc t d d p t j | _ d | _ d | _ d S Nr
myimunify_enabled)r
getr ENABLED_previous_myimunify_status_loop_sinkselfs V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/myimunify.py__init__zMyImunifyPlugin.__init__ sD ( ) ) - -.A B B
' &
'
c 8 K t dd| j i d S r )r r r s r shutdownzMyImunifyPlugin.shutdown s0
$"A B
r c
K d S N )r loops r create_sinkzMyImunifyPlugin.create_sink s r c & K || _ || _ d S r )r r )r r sinks r
create_sourcez MyImunifyPlugin.create_source# s
r c K t j d {V }t | j |dd d {V d S )NFT)force_config_update)r HostingPanel get_usersr r )r existing_userss r _update_myimunify_usersz'MyImunifyPlugin._update_myimunify_users' s| , 9 ; ; E E G GGGGGGG% J4
r messagec K t j }| j }|| _ |r |s| d {V ||k r/t j | d {V d S d S )N)r )r r r r* r r' switch_ui_config)r r+ r previous_statuss r on_config_updatez MyImunifyPlugin.on_config_update- s + 3 9 +<' 1_ 1..00 0 0 0 0 0 0 0 / / ,..??"3 @
0 /r N) __name__
__module__ __qualname__r r r! r$ r* r r ConfigUpdater/ r r r r
r
s
VK $%% k.F &% r r
)logging defence360agent.contracts.configr "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r r defence360agent.myimunify.modelr defence360agent.subsys.panelsr 'defence360agent.subsys.persistent_stater
r getLoggerr0 loggerr
r r r <module>r= s < < < < < < : : : : : :
D C C C C C 7 7 7 7 7 7 J J J J J J J J 8 $ $) ) ) ) )k= ) ) ) ) )r defence360agent/plugins/__pycache__/ping.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002771 00000000000 021044 0 ustar
r_j D d dl mZ d dlmZmZmZ G d dee ZdS ) ) MessageType) MessageSink
MessageSourceexpectc X e Zd Zd Zd Z eej ej d Z dS )SendPingc K || _ d S N)_loop)selfloops Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/ping.py create_sinkzSendPing.create_sink
s
c & K || _ || _ d S r
)r _sink)r r
sinks r
create_sourcezSendPing.create_source
s
r c l K | j t j d {V d S r
)r process_messager Ping)r _s r send_pingzSendPing.send_ping s= j(()9););<<<<<<<<<<<r N)
__name__
__module__ __qualname__r r r r ServerConnectedServerReconnectedr r r r r sa VK ')FGG= = HG= = =r r N)"defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r r r r r r <module>r" s : : : : : :
=
=
=
=
=}k
=
=
=
=
=r defence360agent/plugins/__pycache__/ping.cpython-311.pyc 0000644 0000000 0000000 00000002771 00000000000 020105 0 ustar
r_j D d dl mZ d dlmZmZmZ G d dee ZdS ) ) MessageType) MessageSink
MessageSourceexpectc X e Zd Zd Zd Z eej ej d Z dS )SendPingc K || _ d S N)_loop)selfloops Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/ping.py create_sinkzSendPing.create_sink
s
c & K || _ || _ d S r
)r _sink)r r
sinks r
create_sourcezSendPing.create_source
s
r c l K | j t j d {V d S r
)r process_messager Ping)r _s r send_pingzSendPing.send_ping s= j(()9););<<<<<<<<<<<r N)
__name__
__module__ __qualname__r r r r ServerConnectedServerReconnectedr r r r r sa VK ')FGG= = HG= = =r r N)"defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r r r r r r <module>r" s : : : : : :
=
=
=
=
=}k
=
=
=
=
=r defence360agent/plugins/__pycache__/send_domain_list.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000012543 00000000000 023420 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZ d dlmZ d dlmZ d d lmZmZmZ ej e Z G d
d e
e ZdS ) N)
AsyncIterator)int_from_envvar)
DomainList)get_myimunify_users) MessageSink
MessageSource)PanelException) HostingPanel)Scoperecurring_checksplit_for_chunkc d e Zd Zej Zd dZd Zd Zd Z de
de
fdZ de e
fd Zd
ZdS ) SendDomainListNc d | _ |r || _ d S t dt t j d | _ d S )N IMUNIFY360_SEND_DOMAIN_PERIOD )days)_task_periodr intdatetime timedelta
total_seconds)selfperiods ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/send_domain_list.py__init__zSendDomainList.__init__ sY
!DLLL*/H&A...<<>>?? DLLL c
K dS )zMessageSink methodN )r loops r create_sinkzSendDomainList.create_sink( s
r c K || _ || _ | j t | j | j | _ d S N)_loop_sink create_taskr r _send_domain_listr )r r! sinks r
create_sourcez SendDomainList.create_source+ sT
Z++ A )ODL ) )$*@ A A C C
r c r K | j -d | j c| _ }| | d {V d S d S r$ )r cancel)r ts r shutdownzSendDomainList.shutdown3 sG : ! $*MDJ
HHJJJGGGGGGGGG " !r
panel_typereturnc 4 ddd || S )Nprimaryalias)mainparked)get)r r/ s r _panel_domain_type_to_imunifyz,SendDomainList._panel_domain_type_to_imunify9 s(
#j*
%
% &r c * K t }t d|j g }t d {V }|D ]}|d }t j | }| | d {V D ]K}| ||j |j
|d |j | |j
d Lt j }t |d D ] } t! }
||
d< | |
d< |
W V d S ) NzHostingsPanel: %susername myimunify_id)r9 docrootnamesecuresite_user_iduidtypei )
chunk_size timestampdomains)r
loggerinfoNAMEr pwdgetpwnamget_user_domains_detailsappendr; domainpw_uidr7 r? timer
r ) r hprB myimunify_usersuserr9 user_pwd domain_datarA chunkmsgs r _create_domain_list_msgz&SendDomainList._create_domain_list_msg? sZ
^^ '111 3 5 5555555# DJ'H|H--H%'%@%@%J%J J J J J J J
$,#.#6 + 2.2>.B ' $ B B ' ,! !
IKK $W>>> E ,,C (C "C NIIIII r c K | 2 3 d {V }| j | d {V (6 d S # t $ r&}t d| Y d }~d S d }~ww xY w)Nz Domain list report skipped: %s)rT r& process_messager rC warning)r rS es r r( z SendDomainList._send_domain_list[ s @ ! 9 9 ; ;
6
6
6
6
6
6
6cj005555555555 < ; ; @ @ @ NN;Q ? ? ? ? ? ? ? ? ? @s! A A #A
A3
A..A3r$ )__name__
__module__ __qualname__r AV_IM360SCOPEr r" r* r. strr7 r r rT r( r r r r r s NE ! ! !
& & & & & & }Z/H 8@ @ @ @ @r r )r loggingrF rL typingr defence360agent.contracts.configr "defence360agent.contracts.messagesr &defence360agent.contracts.myimunify_idr !defence360agent.contracts.pluginsr r "defence360agent.subsys.panels.baser +defence360agent.subsys.panels.hosting_panelr
defence360agent.utilsr r r
getLoggerrY rC r r r r <module>ri s]
: 9 9 9 9 9 F F F F F F > = = = = = D D D D D D
8 $ $E@ E@ E@ E@ E@[- E@ E@ E@ E@ E@r defence360agent/plugins/__pycache__/send_domain_list.cpython-311.pyc 0000644 0000000 0000000 00000012543 00000000000 022461 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZ d dlmZ d dlmZ d d lmZmZmZ ej e Z G d
d e
e ZdS ) N)
AsyncIterator)int_from_envvar)
DomainList)get_myimunify_users) MessageSink
MessageSource)PanelException) HostingPanel)Scoperecurring_checksplit_for_chunkc d e Zd Zej Zd dZd Zd Zd Z de
de
fdZ de e
fd Zd
ZdS ) SendDomainListNc d | _ |r || _ d S t dt t j d | _ d S )N IMUNIFY360_SEND_DOMAIN_PERIOD )days)_task_periodr intdatetime timedelta
total_seconds)selfperiods ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/send_domain_list.py__init__zSendDomainList.__init__ sY
!DLLL*/H&A...<<>>?? DLLL c
K dS )zMessageSink methodN )r loops r create_sinkzSendDomainList.create_sink( s
r c K || _ || _ | j t | j | j | _ d S N)_loop_sink create_taskr r _send_domain_listr )r r! sinks r
create_sourcez SendDomainList.create_source+ sT
Z++ A )ODL ) )$*@ A A C C
r c r K | j -d | j c| _ }| | d {V d S d S r$ )r cancel)r ts r shutdownzSendDomainList.shutdown3 sG : ! $*MDJ
HHJJJGGGGGGGGG " !r
panel_typereturnc 4 ddd || S )Nprimaryalias)mainparked)get)r r/ s r _panel_domain_type_to_imunifyz,SendDomainList._panel_domain_type_to_imunify9 s(
#j*
%
% &r c * K t }t d|j g }t d {V }|D ]}|d }t j | }| | d {V D ]K}| ||j |j
|d |j | |j
d Lt j }t |d D ] } t! }
||
d< | |
d< |
W V d S ) NzHostingsPanel: %susername myimunify_id)r9 docrootnamesecuresite_user_iduidtypei )
chunk_size timestampdomains)r
loggerinfoNAMEr pwdgetpwnamget_user_domains_detailsappendr; domainpw_uidr7 r? timer
r ) r hprB myimunify_usersuserr9 user_pwd domain_datarA chunkmsgs r _create_domain_list_msgz&SendDomainList._create_domain_list_msg? sZ
^^ '111 3 5 5555555# DJ'H|H--H%'%@%@%J%J J J J J J J
$,#.#6 + 2.2>.B ' $ B B ' ,! !
IKK $W>>> E ,,C (C "C NIIIII r c K | 2 3 d {V }| j | d {V (6 d S # t $ r&}t d| Y d }~d S d }~ww xY w)Nz Domain list report skipped: %s)rT r& process_messager rC warning)r rS es r r( z SendDomainList._send_domain_list[ s @ ! 9 9 ; ;
6
6
6
6
6
6
6cj005555555555 < ; ; @ @ @ NN;Q ? ? ? ? ? ? ? ? ? @s! A A #A
A3
A..A3r$ )__name__
__module__ __qualname__r AV_IM360SCOPEr r" r* r. strr7 r r rT r( r r r r r s NE ! ! !
& & & & & & }Z/H 8@ @ @ @ @r r )r loggingrF rL typingr defence360agent.contracts.configr "defence360agent.contracts.messagesr &defence360agent.contracts.myimunify_idr !defence360agent.contracts.pluginsr r "defence360agent.subsys.panels.baser +defence360agent.subsys.panels.hosting_panelr
defence360agent.utilsr r r
getLoggerrY rC r r r r <module>ri s]
: 9 9 9 9 9 F F F F F F > = = = = = D D D D D D
8 $ $E@ E@ E@ E@ E@[- E@ E@ E@ E@ E@r defence360agent/plugins/__pycache__/send_server_config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000047052 00000000000 023754 0 ustar
r_j, d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm Z d dl
m Z d dl m
Z
mZ d dlmZ d dlmZmZmZmZmZmZmZmZ d dlmZ d d l m Z d d
l m Z m Z m!Z! d d l"m#Z# d d l$m%Z%m&Z& d d
l'm(Z( d dl)m*Z* d dl+m,Z, d dl-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4 d dl5m6Z6m7Z7 d dl8m9Z9 dZ: e e; Z<h dZ=d Z> ed d Z?e2d Z@e2d ZAe2d ZBe2d ZCe2d ZDe2d ZEe2d ZFd ZGe2d! ZHd" ZId#e
fd$ZJ G d% d&e e ZKd#e
eLeMf fd'ZNd(eLd#eMfd)ZOd* ZPd#eQfd+ZRd#eLfd,ZSd#eLfd-ZTd#eLfd.ZUdS )/ N) lru_cache) getLogger)Path)DictList)sentry)
ConfigFileCoreCustomBillingConfigMalwareMalwareSignatures SystemConfigint_from_envvarFREEMIUM_FEATURE_FLAG)
LicenseCLN) MessageType) MessageSink
MessageSourceexpect)get_myimunify_users)$is_native_feature_management_enabled&is_native_feature_management_supported)IndependentAgentIDAPI) HostingPanel)cPanel)log_error_and_ignorerecurring_checksafe_cancel_taskScopestub_unexpected_errorsafe_runsystem_packages_info)
load_state
save_state) WhmcsConf)z /var/imunify360/imunify360.dbz!/var/imunify360/imunify360.db-shmz!/var/imunify360/imunify360.db-walz/var/imunify360/gw.dir/> ai-bolit
imunify-ui imunify-coreimunify-commonimunify360-pamimunify-releaseimunify360-venvalt-php-internalimunify-notifierimunify-patchmanimunify360-ossecalt-php-hyperscanimunify-antivirusalt-common-releaseimunify-realtime-avimunify-wp-securityimunify360-firewallimunify360-php-i360app-version-detectorcloudlinux-backup-utilsimunify360-ossec-serverimunify-auditd-log-readerimunify-realtime-av-imrt2imunify360-webshield-bundle imunify360-unified-access-logger rustbolit
minidaemonc | t d 5 } | cd d d S # 1 swxY w Y d S )Nz
/proc/cpuinfo)openread)fs _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/send_server_config.py
read_cpu_inforF ^ s|
o !vvxx s 155 )maxsizec t } t j d| t j }g }i }|D ]-\ }}|dk r |rd|v r| | i }|||< .| | |S )Nz^(.*?)[ ]*:[ ]*(.*)$)flags processor)rF refindallMappend)texttuplesrescurrentkeyvalues rE get_cpu_inforV c s ??D
Z2D
E
E
EFCG
U +
;'11
7### JJw J c i } t D ]H}| d|d x}| vr&t | dd | |< It | S )Nz physical idrK z cpu coresrG )rV getintsumvalues) physical_idsrK physical_ids rE
get_cpu_coresr_ t s L!^^ K K $== +8NOO OK ),IMM+q,I,I(J(JL % |""$$ % %%rW c t d } d | d p| d | d p| d S )Nr z{} {}z
model name ProcessorrJ Features)rV formatrY )rK s rE get_cpu_model_and_flagsrd sX q!I >>
l##=y'=
g 7)J"7 rW c : K | d {V S N)versionhps rE get_hosting_panel_versionrj s& rW c : K | d {V S rf ) users_countrh s rE get_users_amountrm s( !! ! ! ! ! ! !!rW c T K t | d {V S rf )lenget_domain_to_ownerrh s rE get_domains_amountrq s2 R++-------- . ..rW c t j t j r6t t j t j S d S rf )ospathexistsr
AI_BOLIT_HOSTERrZ getmtime rW rE get_malware_db_update_timery sK w~~'788 H27##$5$EFFGGGH HrW c Z K t d {V rt d {V S d S rf )r r rx rW rE
get_nfm_stater{ sN
3
5
5555555 <9;;;;;;;;;< <rW c t d } | r8t j | S d S )Nz/etc/machine-id)r ru hashlibsha256
read_bytes hexdigest)
machine_ids rE get_sha256_machine_idr sR '((J C~j 3 3 5 566@@BBB 4rW c t t d } | dk S )zA
True only if active in whmcs config
otherwise False
statusactive)r% rC rY )activation_states rE $get_myimunify_whmcs_activation_stater s3 !{{''))--h77 x ''rW c
K t t t | d {V t | d {V t | d {V t
j t
j t t d {V t t j
t t d S )N) cpu_corescpuinfohosting_panel_version users_amountdomains_amounttrim_maliciousdays_to_keep_backupmalware_db_update_time!native_feature_management_enabledr myimunify_freemium_flag_existsmyimunify_whmcs_activated)r_ rd rj rm rq r CLEANUP_TRIM CLEANUP_KEEPry r{ r rs rt ru r r rh s rE get_additional_infor s "__*,,'@'D'D!D!D!D!D!D!D .r 2 2222222 22 6 6666666!. & 3"<">">3@??-B-B-B-B-B-B+--*,'.. !+
+
&J%K%K rW returnc , K t } t | d{V }n8# t $ r+ t d t }Y nw xY wt j dt j
}t t j
| D ]K}|j j |v r;t! |j j d ||j j < L|S )zv
Return dict that includes users config values that are explicitly
set in the corresponding config files.
Nz(Failed to get the list of panel's users.*)usernameF) normalize)dict frozenset get_users Exceptionlogger exceptionrs rt joinr
USER_CONFIG_FILE_NAMEr USER_CONFDIRglobparentnamer config_to_dict)ri result
current_users
users_conf
userconf_files rE get_users_configsr s
VVF$! "6"6"6"6"6"677
$ $ $CDDD!
$ c4#=>>J d /0055jAA . .
$
5 50:&-21 1 1 nun--
=', - Ms ': 2A/.A/c e Zd ZdZej Zd
dZd Z e e
j e d Z
d Zd Zd Zd ZdS ) SendServerConfigz
This plugin is to provide central server with
different server metrics. Message is sent on plugin creation,
and then every :period: seconds
Nc d | _ d | _ |r || _ d S t dt t j d dz | _ d S )N$IMUNIFY360_SEND_SERVER_CONFIG_PERIODrG )days )_task_last_send_time_periodr rZ datetime timedelta
total_seconds)selfperiods rE __init__zSendServerConfig.__init__ sf
# !DLLL*6H&A...<<>>BCC DLLLrW c
K dS )zMessageSink methodNrx )r loops rE create_sinkz SendServerConfig.create_sink s
rW c K | j d| _ d S t |d t sd S |d | j r;|d | _ | j | d S d S )Nr conf timestamp)r
isinstancer modified_since_loop create_task_send_server_config)r messages rE on_config_update_messagez)SendServerConfig.on_config_update_message s '#$D F'&/<88
F 6? ) )$*> ? ? ?#*;#7D J " "4#;#;#=#= > > > > > ? ?rW c K || _ || _ | j t | j | j | _ d S rf )r _sinkr r r r r )r r sinks rE
create_sourcez SendServerConfig.create_source sT
Z++ C )ODL ) )$*B C C E E
rW c d K | j &d | j c| _ }t | d {V d S d S rf )r r )r ts rE shutdownzSendServerConfig.shutdown sK : ! $*MDJ"1%% % % % % % % % % % " !rW c K t j t }t }|r||d< t }t j }| t j | t | d {V |j t j k rt d {V |d< t j |d< t j |d< t# d {V t% d {V t' d {V d|d< t) t- z |d< t/ | d {V |d < t1 t2 d {V |d
< t5 t6 d {V |d < | d |d d
< | d |d d< t; d d |d d< t= ddd i |S )N)uname diskstatsusersiaidstatus_license) uptime_sincedevicesmac system_infoagent_global_configagent_users_configspathscomponents_versions upgrade_urlz$CUSTOM_BILLING.effective_upgrade_urlupgrade_url_360z(CUSTOM_BILLING.effective_upgrade_url_360
doctor_keyzCORE.doctor_report) r ServerConfig _uname_info _diskstatr r license_infoupdater tagsr NAMEr r r get_iaidis_valid_uptime_blkid _mac_addressr r r r _get_path_sizesCH_PATHSr" PACKAGES_TO_REPORTrY r# r$ )r msgdiskstatri r s rE _create_server_config_msgz*SendServerConfig._create_server_config_msg s &[]];;; ;; ( 'C
^^!.00
6;==!!!
,R00000000111
7fk ! !!4!6!6666666CL+466F * 3 5 5 ")))OOOOOO #XX~~~~~~% ''''''
M
LL ' ' ) )!##2244
5 !" ,=R+@+@%@%@%@%@%@%@ !" ,X 6 6666666G +? ,
,
&
&
&
&
&
&
!"
] + + !" 2
. / / !" 6
<F <
<
#l
!"#78 <,!5666
rW c z K | j | d {V d {V d S rf )r process_messager )r s rE r z$SendServerConfig._send_server_config< si j((0022 2 2 2 2 2 2
rW rf )__name__
__module__ __qualname____doc__r AVSCOPEr r r r ConfigUpdater r r r r r rx rW rE r r s
HE
! ! ! VK $%%
?
? &%
?
& & &
) ) )V
rW r c l K i }t t j | D ]} t j | rt | }n t j | }|||< W# t $ r1}t d|| |j
||< Y d}~d}~ww xY w|S )zFReturn path->size mapping for *paths*.
Send -errno on error.
z!Can't get size for %s, reason: %sN) maprs fspathrt isdir_compute_dir_sizegetsizeOSErrorr warningerrno)r sizesrt sizees rE r r B s
EBIu%%
w}}T""
-(..wt,,
E$KK # # # NN>a H H H 7(E$KKKKKK #
Ls AA66
B1 'B,,B1directory_pathc d}dt fd}t j | |d D ]b\ }}}|D ]Y}t j || } |t j | z
}F# t $ r}|d }~ww xY wc|S )Nr errc | rf rx )r s rE _onerrorz#_compute_dir_size.<locals>._onerrorY s rW F)onerror followlinks)r rs walkrt r r ) r
total_sizer
root_dirsfiles file_name file_pathr s rE r r V s Jg !ge eU I T955I
bgooi 8 88
s "A33
B=A??Bc t d 5 } | cd d d S # 1 swxY w Y d S # t $ r3}t dt | Y d }~d S d }~ww xY w)Nz/proc/diskstatszCan't get diskstat: %s)rB rC r r r str)rD r s rE r r h s 9
#
$
$ 6688 9 9 9/Q8888888889s- ? 2 ? 6? 6?
A< (A77A<c ^ t t dt j S )N)sysnamenodenamereleaserg machine)r ziprs r rx rW rE r r p s- D HJJ
rW c 4 K t ddg d{V S )zSystem up sinceuptimez--sinceNr! rx rW rE r r y s+ 8Y/00 0 0 0 0 0 00rW c 2 K t dg d{V S )z8Executes utility to locate/print block device attributesblkidNr! rx rW rE r r ~ s( 7)$$ $ $ $ $ $ $$rW c K t j t j dd d S )zOMAC address in formatted way, like it specifies in
/sys/class/net/*/address big:)binasciihexlifyuuidgetnodeto_bytesdecoderx rW rE r r s= DLNN 3 3Au = =s C C J J L LLrW )Vr( r r} rs rL r* functoolsr loggingr pathlibr typingr r defence360agent.contractsr defence360agent.contracts.configr r
r r r
r r r !defence360agent.contracts.licenser "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r r &defence360agent.contracts.myimunify_idr *defence360agent.feature_management.controlr r defence360agent.internals.iaidr +defence360agent.subsys.panels.hosting_panelr $defence360agent.subsys.panels.cpanelr defence360agent.utilsr r r r r r! r" 'defence360agent.subsys.persistent_stater# r$ defence360agent.utils.whmcsr% r r r r rF rV r_ rd rj rm rq ry r{ r r r r r r rZ r r r r r r r r rx rW rE <module>r? s , , , , , , 9 8 8 8 8 8 : : : : : :
G F F F F F A @ @ @ @ @ D D D D D D 7 7 7 7 7 7 K J J J J J J J 1 1 1 1 1 1
8 >
1
& & & " " " / / / H H H
< < <
( ( ( &4 (d
d
d
d
d
{M d
d
d
NDcN (c c $9 9 9T 1s 1 1 1 1
%c % % % %
MC M M M M M MrW defence360agent/plugins/__pycache__/send_server_config.cpython-311.pyc 0000644 0000000 0000000 00000047052 00000000000 023015 0 ustar
r_j, d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm Z d dl
m Z d dl m
Z
mZ d dlmZ d dlmZmZmZmZmZmZmZmZ d dlmZ d d l m Z d d
l m Z m Z m!Z! d d l"m#Z# d d l$m%Z%m&Z& d d
l'm(Z( d dl)m*Z* d dl+m,Z, d dl-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4 d dl5m6Z6m7Z7 d dl8m9Z9 dZ: e e; Z<h dZ=d Z> ed d Z?e2d Z@e2d ZAe2d ZBe2d ZCe2d ZDe2d ZEe2d ZFd ZGe2d! ZHd" ZId#e
fd$ZJ G d% d&e e ZKd#e
eLeMf fd'ZNd(eLd#eMfd)ZOd* ZPd#eQfd+ZRd#eLfd,ZSd#eLfd-ZTd#eLfd.ZUdS )/ N) lru_cache) getLogger)Path)DictList)sentry)
ConfigFileCoreCustomBillingConfigMalwareMalwareSignatures SystemConfigint_from_envvarFREEMIUM_FEATURE_FLAG)
LicenseCLN) MessageType) MessageSink
MessageSourceexpect)get_myimunify_users)$is_native_feature_management_enabled&is_native_feature_management_supported)IndependentAgentIDAPI) HostingPanel)cPanel)log_error_and_ignorerecurring_checksafe_cancel_taskScopestub_unexpected_errorsafe_runsystem_packages_info)
load_state
save_state) WhmcsConf)z /var/imunify360/imunify360.dbz!/var/imunify360/imunify360.db-shmz!/var/imunify360/imunify360.db-walz/var/imunify360/gw.dir/> ai-bolit
imunify-ui imunify-coreimunify-commonimunify360-pamimunify-releaseimunify360-venvalt-php-internalimunify-notifierimunify-patchmanimunify360-ossecalt-php-hyperscanimunify-antivirusalt-common-releaseimunify-realtime-avimunify-wp-securityimunify360-firewallimunify360-php-i360app-version-detectorcloudlinux-backup-utilsimunify360-ossec-serverimunify-auditd-log-readerimunify-realtime-av-imrt2imunify360-webshield-bundle imunify360-unified-access-logger rustbolit
minidaemonc | t d 5 } | cd d d S # 1 swxY w Y d S )Nz
/proc/cpuinfo)openread)fs _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/send_server_config.py
read_cpu_inforF ^ s|
o !vvxx s 155 )maxsizec t } t j d| t j }g }i }|D ]-\ }}|dk r |rd|v r| | i }|||< .| | |S )Nz^(.*?)[ ]*:[ ]*(.*)$)flags processor)rF refindallMappend)texttuplesrescurrentkeyvalues rE get_cpu_inforV c s ??D
Z2D
E
E
EFCG
U +
;'11
7### JJw J c i } t D ]H}| d|d x}| vr&t | dd | |< It | S )Nz physical idrK z cpu coresrG )rV getintsumvalues) physical_idsrK physical_ids rE
get_cpu_coresr_ t s L!^^ K K $== +8NOO OK ),IMM+q,I,I(J(JL % |""$$ % %%rW c t d } d | d p| d | d p| d S )Nr z{} {}z
model name ProcessorrJ Features)rV formatrY )rK s rE get_cpu_model_and_flagsrd sX q!I >>
l##=y'=
g 7)J"7 rW c : K | d {V S N)versionhps rE get_hosting_panel_versionrj s& rW c : K | d {V S rf ) users_countrh s rE get_users_amountrm s( !! ! ! ! ! ! !!rW c T K t | d {V S rf )lenget_domain_to_ownerrh s rE get_domains_amountrq s2 R++-------- . ..rW c t j t j r6t t j t j S d S rf )ospathexistsr
AI_BOLIT_HOSTERrZ getmtime rW rE get_malware_db_update_timery sK w~~'788 H27##$5$EFFGGGH HrW c Z K t d {V rt d {V S d S rf )r r rx rW rE
get_nfm_stater{ sN
3
5
5555555 <9;;;;;;;;;< <rW c t d } | r8t j | S d S )Nz/etc/machine-id)r ru hashlibsha256
read_bytes hexdigest)
machine_ids rE get_sha256_machine_idr sR '((J C~j 3 3 5 566@@BBB 4rW c t t d } | dk S )zA
True only if active in whmcs config
otherwise False
statusactive)r% rC rY )activation_states rE $get_myimunify_whmcs_activation_stater s3 !{{''))--h77 x ''rW c
K t t t | d {V t | d {V t | d {V t
j t
j t t d {V t t j
t t d S )N) cpu_corescpuinfohosting_panel_version users_amountdomains_amounttrim_maliciousdays_to_keep_backupmalware_db_update_time!native_feature_management_enabledr myimunify_freemium_flag_existsmyimunify_whmcs_activated)r_ rd rj rm rq r CLEANUP_TRIM CLEANUP_KEEPry r{ r rs rt ru r r rh s rE get_additional_infor s "__*,,'@'D'D!D!D!D!D!D!D .r 2 2222222 22 6 6666666!. & 3"<">">3@??-B-B-B-B-B-B+--*,'.. !+
+
&J%K%K rW returnc , K t } t | d{V }n8# t $ r+ t d t }Y nw xY wt j dt j
}t t j
| D ]K}|j j |v r;t! |j j d ||j j < L|S )zv
Return dict that includes users config values that are explicitly
set in the corresponding config files.
Nz(Failed to get the list of panel's users.*)usernameF) normalize)dict frozenset get_users Exceptionlogger exceptionrs rt joinr
USER_CONFIG_FILE_NAMEr USER_CONFDIRglobparentnamer config_to_dict)ri result
current_users
users_conf
userconf_files rE get_users_configsr s
VVF$! "6"6"6"6"6"677
$ $ $CDDD!
$ c4#=>>J d /0055jAA . .
$
5 50:&-21 1 1 nun--
=', - Ms ': 2A/.A/c e Zd ZdZej Zd
dZd Z e e
j e d Z
d Zd Zd Zd ZdS ) SendServerConfigz
This plugin is to provide central server with
different server metrics. Message is sent on plugin creation,
and then every :period: seconds
Nc d | _ d | _ |r || _ d S t dt t j d dz | _ d S )N$IMUNIFY360_SEND_SERVER_CONFIG_PERIODrG )days )_task_last_send_time_periodr rZ datetime timedelta
total_seconds)selfperiods rE __init__zSendServerConfig.__init__ sf
# !DLLL*6H&A...<<>>BCC DLLLrW c
K dS )zMessageSink methodNrx )r loops rE create_sinkz SendServerConfig.create_sink s
rW c K | j d| _ d S t |d t sd S |d | j r;|d | _ | j | d S d S )Nr conf timestamp)r
isinstancer modified_since_loop create_task_send_server_config)r messages rE on_config_update_messagez)SendServerConfig.on_config_update_message s '#$D F'&/<88
F 6? ) )$*> ? ? ?#*;#7D J " "4#;#;#=#= > > > > > ? ?rW c K || _ || _ | j t | j | j | _ d S rf )r _sinkr r r r r )r r sinks rE
create_sourcez SendServerConfig.create_source sT
Z++ C )ODL ) )$*B C C E E
rW c d K | j &d | j c| _ }t | d {V d S d S rf )r r )r ts rE shutdownzSendServerConfig.shutdown sK : ! $*MDJ"1%% % % % % % % % % % " !rW c K t j t }t }|r||d< t }t j }| t j | t | d {V |j t j k rt d {V |d< t j |d< t j |d< t# d {V t% d {V t' d {V d|d< t) t- z |d< t/ | d {V |d < t1 t2 d {V |d
< t5 t6 d {V |d < | d |d d
< | d |d d< t; d d |d d< t= ddd i |S )N)uname diskstatsusersiaidstatus_license) uptime_sincedevicesmac system_infoagent_global_configagent_users_configspathscomponents_versions upgrade_urlz$CUSTOM_BILLING.effective_upgrade_urlupgrade_url_360z(CUSTOM_BILLING.effective_upgrade_url_360
doctor_keyzCORE.doctor_report) r ServerConfig _uname_info _diskstatr r license_infoupdater tagsr NAMEr r r get_iaidis_valid_uptime_blkid _mac_addressr r r r _get_path_sizesCH_PATHSr" PACKAGES_TO_REPORTrY r# r$ )r msgdiskstatri r s rE _create_server_config_msgz*SendServerConfig._create_server_config_msg s &[]];;; ;; ( 'C
^^!.00
6;==!!!
,R00000000111
7fk ! !!4!6!6666666CL+466F * 3 5 5 ")))OOOOOO #XX~~~~~~% ''''''
M
LL ' ' ) )!##2244
5 !" ,=R+@+@%@%@%@%@%@%@ !" ,X 6 6666666G +? ,
,
&
&
&
&
&
&
!"
] + + !" 2
. / / !" 6
<F <
<
#l
!"#78 <,!5666
rW c z K | j | d {V d {V d S rf )r process_messager )r s rE r z$SendServerConfig._send_server_config< si j((0022 2 2 2 2 2 2
rW rf )__name__
__module__ __qualname____doc__r AVSCOPEr r r r ConfigUpdater r r r r r rx rW rE r r s
HE
! ! ! VK $%%
?
? &%
?
& & &
) ) )V
rW r c l K i }t t j | D ]} t j | rt | }n t j | }|||< W# t $ r1}t d|| |j
||< Y d}~d}~ww xY w|S )zFReturn path->size mapping for *paths*.
Send -errno on error.
z!Can't get size for %s, reason: %sN) maprs fspathrt isdir_compute_dir_sizegetsizeOSErrorr warningerrno)r sizesrt sizees rE r r B s
EBIu%%
w}}T""
-(..wt,,
E$KK # # # NN>a H H H 7(E$KKKKKK #
Ls AA66
B1 'B,,B1directory_pathc d}dt fd}t j | |d D ]b\ }}}|D ]Y}t j || } |t j | z
}F# t $ r}|d }~ww xY wc|S )Nr errc | rf rx )r s rE _onerrorz#_compute_dir_size.<locals>._onerrorY s rW F)onerror followlinks)r rs walkrt r r ) r
total_sizer
root_dirsfiles file_name file_pathr s rE r r V s Jg !ge eU I T955I
bgooi 8 88
s "A33
B=A??Bc t d 5 } | cd d d S # 1 swxY w Y d S # t $ r3}t dt | Y d }~d S d }~ww xY w)Nz/proc/diskstatszCan't get diskstat: %s)rB rC r r r str)rD r s rE r r h s 9
#
$
$ 6688 9 9 9/Q8888888889s- ? 2 ? 6? 6?
A< (A77A<c ^ t t dt j S )N)sysnamenodenamereleaserg machine)r ziprs r rx rW rE r r p s- D HJJ
rW c 4 K t ddg d{V S )zSystem up sinceuptimez--sinceNr! rx rW rE r r y s+ 8Y/00 0 0 0 0 0 00rW c 2 K t dg d{V S )z8Executes utility to locate/print block device attributesblkidNr! rx rW rE r r ~ s( 7)$$ $ $ $ $ $ $$rW c K t j t j dd d S )zOMAC address in formatted way, like it specifies in
/sys/class/net/*/address big:)binasciihexlifyuuidgetnodeto_bytesdecoderx rW rE r r s= DLNN 3 3Au = =s C C J J L LLrW )Vr( r r} rs rL r* functoolsr loggingr pathlibr typingr r defence360agent.contractsr defence360agent.contracts.configr r
r r r
r r r !defence360agent.contracts.licenser "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r r &defence360agent.contracts.myimunify_idr *defence360agent.feature_management.controlr r defence360agent.internals.iaidr +defence360agent.subsys.panels.hosting_panelr $defence360agent.subsys.panels.cpanelr defence360agent.utilsr r r r r r! r" 'defence360agent.subsys.persistent_stater# r$ defence360agent.utils.whmcsr% r r r r rF rV r_ rd rj rm rq ry r{ r r r r r r rZ r r r r r r r r rx rW rE <module>r? s , , , , , , 9 8 8 8 8 8 : : : : : :
G F F F F F A @ @ @ @ @ D D D D D D 7 7 7 7 7 7 K J J J J J J J 1 1 1 1 1 1
8 >
1
& & & " " " / / / H H H
< < <
( ( ( &4 (d
d
d
d
d
{M d
d
d
NDcN (c c $9 9 9T 1s 1 1 1 1
%c % % % %
MC M M M M M MrW defence360agent/plugins/__pycache__/service_manager.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007662 00000000000 023245 0 ustar
r_j | d Z ddlZddlZddlmZ ddlmZmZ ej e Z
G d dej Z dS )zBase service manager plugin.
Provides the shared start/stop/enable/disable logic that product-specific
service managers (imav, im360) inherit from.
N)utils)messagespluginsc e Zd ZdZd Zd Z ej ej j
dej j
fd Z e j
d d ZdS )
BaseServiceManageru Base service manager: start/stop services based on config changes.
Subclasses populate ``_services`` (list of async check callables)
and ``_units`` (dict of name → unitctl) in their ``__init__``.
c R t j | _ g | _ i | _ d S N)asyncioLock_lock _services_units)selfs \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/service_manager.py__init__zBaseServiceManager.__init__ s! \^^
c > K | j D ]} | d {V d S r )r
)r services r !_ensure_consistent_services_statez4BaseServiceManager._ensure_consistent_services_state s: ~ G'))OOOOOOOO r message_ignoredc K | j 4 d {V | d {V d d d d {V d S # 1 d {V swxY w Y d S r )r r )r r s r on_config_updatez#BaseServiceManager.on_config_update s : ; ; ; ; ; ; ; ;88:: : : : : : : : ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;s >
A AFc K | d {V }||ur|rTt d| | d d {V t d| d S t d| | d d {V t d| d S |r9|r9| d {V t d| d S d S d S )NzA%s is enabled in the config but it is not running. Enabling it...T)nowz
Enabled %szB%s is not enabled in the config but it is running. Disabling it...z Disabled %sz#Reloading %s after config update...) is_activeloggerinfoenabledisablereload)r unitctl service_nameshould_be_runningr
is_runnings r _ensure_service_statusz)BaseServiceManager._ensure_service_status' si #,,........
. . .
9 /
nnn......... L,77777 0
oo$o///////// M<88888
f
nn&&&&&&&&& 9<
r N)F)__name__
__module__ __qualname____doc__r r r expectr MessageType ConfigUpdater r log_error_and_ignorer% r r r r s
W^H(566; ' 3 @; ; ; 76; U !!?D "! r r )
r) r
loggingdefence360agentr defence360agent.contractsr r getLoggerr& r MessageSinkr r. r r <module>r4 s ! ! ! ! ! ! 7 7 7 7 7 7 7 7 8 $ $2 2 2 2 2, 2 2 2 2 2r defence360agent/plugins/__pycache__/service_manager.cpython-311.pyc 0000644 0000000 0000000 00000007662 00000000000 022306 0 ustar
r_j | d Z ddlZddlZddlmZ ddlmZmZ ej e Z
G d dej Z dS )zBase service manager plugin.
Provides the shared start/stop/enable/disable logic that product-specific
service managers (imav, im360) inherit from.
N)utils)messagespluginsc e Zd ZdZd Zd Z ej ej j
dej j
fd Z e j
d d ZdS )
BaseServiceManageru Base service manager: start/stop services based on config changes.
Subclasses populate ``_services`` (list of async check callables)
and ``_units`` (dict of name → unitctl) in their ``__init__``.
c R t j | _ g | _ i | _ d S N)asyncioLock_lock _services_units)selfs \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/service_manager.py__init__zBaseServiceManager.__init__ s! \^^
c > K | j D ]} | d {V d S r )r
)r services r !_ensure_consistent_services_statez4BaseServiceManager._ensure_consistent_services_state s: ~ G'))OOOOOOOO r message_ignoredc K | j 4 d {V | d {V d d d d {V d S # 1 d {V swxY w Y d S r )r r )r r s r on_config_updatez#BaseServiceManager.on_config_update s : ; ; ; ; ; ; ; ;88:: : : : : : : : ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;s >
A AFc K | d {V }||ur|rTt d| | d d {V t d| d S t d| | d d {V t d| d S |r9|r9| d {V t d| d S d S d S )NzA%s is enabled in the config but it is not running. Enabling it...T)nowz
Enabled %szB%s is not enabled in the config but it is running. Disabling it...z Disabled %sz#Reloading %s after config update...) is_activeloggerinfoenabledisablereload)r unitctl service_nameshould_be_runningr
is_runnings r _ensure_service_statusz)BaseServiceManager._ensure_service_status' si #,,........
. . .
9 /
nnn......... L,77777 0
oo$o///////// M<88888
f
nn&&&&&&&&& 9<
r N)F)__name__
__module__ __qualname____doc__r r r expectr MessageType ConfigUpdater r log_error_and_ignorer% r r r r s
W^H(566; ' 3 @; ; ; 76; U !!?D "! r r )
r) r
loggingdefence360agentr defence360agent.contractsr r getLoggerr& r MessageSinkr r. r r <module>r4 s ! ! ! ! ! ! 7 7 7 7 7 7 7 7 8 $ $2 2 2 2 2, 2 2 2 2 2r defence360agent/plugins/__pycache__/wordpress.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000122446 00000000000 022141 0 ustar
r_j d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m
Z
m Z m Z m
Z
mZ d dlmZ d dlmZ d dlmZ d d lmZmZmZ d d
lmZ d d lm Z m Z m Z d d l m Z m!Z!m"Z"m#Z# d d
l$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z, d dl*m-Z- d dl.m/Z/ d dl0m1Z1 d dl2m3Z3 d dl4m5Z5m6Z6 d dl7m8Z8m9Z9m:Z: d dl;m<Z<m=Z= d dl*m>Z>m?Z?m@Z@ d dlAmBZB d dlCmDZD ejE eF ZG e de jH ZI e d e jH ZJ e d e jH ZK e d e jH ZL ed ZM ed ZNeMd!z ZOeMd"z ZP e!jQ d#d$d% ZRd&eSd'eTfd(ZU G d) d*ee ZVdS )+ N)suppress)Path) Coroutine)ANTIVIRUS_MODEConfigValidationError SystemConfig
UserConfig Wordpress) HookEvent)
LicenseCLN) MessageType) MessageSink
MessageSourceexpect)
hosting_panel)
load_stateregister_lock_file
save_state)Scopeimporterrecurring_checksystem_packages_info)
check_lock)IndependentAgentIDAPI)DAY)cli)plugin)_prepare_ai_bot_settings)resolve_ai_bot_protection) tls_check)WPSite
WordpressSite)get_sites_by_pathget_sites_for_userget_installed_sites)is_secret_expired
rotate_secret)ChangelogProcessorIncidentCollectorIncidentSender) update_disabled_rules_on_sites) delete_old_wordpress_incidentsz wp-gen-authzwp-site-processzwp-plugin-statszwp-license-reconvergez-/etc/sysconfig/imunify360/imunify360.config.dzF/opt/imunify360/venv/share/imunify360/11_on_first_install_wp_av.configz 11_on_first_install_wp_av.configz .11_on_first_install_wp_av.flagzimav.malwarelib.model
MalwareHit)modulenamedefaultstarted_timestampreturnc | t t d g S t | S )z
Get malware hits cleaned since the given timestamp with lazy import fallback.
Returns empty list if imav.malwarelib is not available.
Nz;imav.malwarelib not available, returning empty cleaned hits) _MalwareHitloggerdebug
cleaned_since)r1 s V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/wordpress.py_get_cleaned_malware_hitsr9 _ s? I
$ $%6 7 77 c e Zd Zej Zd Zd Zd Zd Z d Z
d Z d Z d Z
d ej fd
Zd%d efd
Zd Z eedee d Z eeddee d Z eedde d Z d Z d Z d Z d Z d Z!d Z" e#e$j% d Z& e#e$j' d Z( e#e$j' d Z) eedde* d Z+d Z, e#e$j' d! Z- e#e.j/ d" Z0 e#e.j1 d# Z2d$S )&ImunifySecurityPluginc d | _ d | _ t d }| d | _ | d }||n t
j | _ t j | _
t j | _ i | _
t j | _ t j | _ d | _ d | _ d | _ d | _ t- | _ t1 | _ t5 | _ t9 | _ d | _ d | _ d | _ d S )Nr< installedenabled)!_loop_sinkr getinstallation_completedr
SECURITY_PLUGIN_ENABLEDlast_config_valuer _get_global_waf_enabled_last_waf_enabled_get_waf_default_last_waf_default_last_user_waf_enabled _get_global_ai_bot_protection_last_ai_bot_protection$_get_global_ai_bot_protection_preset _last_ai_bot_protection_preset_last_license_typeinstallation_task
deleting_taskinstall_and_update_tasksetfreshly_installed_sitesr) incident_collectorr* incident_senderr( changelog_processor_site_processing_task _stats_task_license_reconverge_task)selfstatepersisted_enableds r8 __init__z ImunifySecurityPlugin.__init__p s/
233&+ii &<&<# "IIi 0 0 !,
2
"(!?!A!A !'!8!:!: >@# (.'K'M'M$ 7 9 9
+
#' 6: 26<@$47EE$ #4"5"5 - / / #5#7#7 :>"04=A%%%r: c
K d S N )r[ loops r8 create_sinkz!ImunifySecurityPlugin.create_sink s r: c \ K || _ || _ | j | | _ | j | | _ | j | | _ | j | | _
t r| d {V nt d | d {V d S )NT)
missing_ok)r@ rA create_taskrefresh_auth_files_update_auth_taskprocess_wordpress_sitesrX
send_statsrY reconverge_license_typerZ r _apply_first_install_configFIRST_INSTALL_FLAGunlink _recover_installation_on_startup)r[ rb sinks r8
create_sourcez#ImunifySecurityPlugin.create_source s'
!%!7!7 # # % %"
"
&*Z%;%; ( ( * *&
&
" :11$//2C2CDD(,
(>(> ( ( * *)
)
% 72244 4 4 4 4 4 4 4 4 % % % 6 6 63355555555555r: c , K | j s t j sdS t d d| _ | t j | j d{V | j
!| j
| j dS dS )a
Self-heal when the installation state was lost.
If the feature is enabled but installation_completed is falsy (state
file missing, earlier install interrupted, etc.), manage_plugin_installation
can never recover: its True == True guard always returns early.
Trigger install_everywhere once per restart to repopulate the
wordpress_site table and flip the flag.
NzXInstallation state is missing while feature is enabled; triggering startup self-recoveryTrp )
rC r
rD r5 inforE process_installationr install_everywhererA rP add_done_callback_mark_installation_doner[ s r8 ro z6ImunifySecurityPlugin._recover_installation_on_startup s
' 4
F
/
"& '' %4: 6 6 6
! - " 4 4,
. -r: c f K t sd S t j d {V dk rKt
t }t
d t
d S )N i ) rm existsr HostingPanel users_countFIRST_INSTALL_CONFIG_PATH
write_textFIRST_INSTALL_CONFIG_FILE read_textchmodrn )r[ _s r8 rl z1ImunifySecurityPlugin._apply_first_install_config s !((** F +--99;; ; ; ; ; ; ;q @ @)44)3355 A
& + +E 2 2 2!!#####r: c h K | j | j d {V | j r&| j | j d {V | j r&| j | j d {V | j r(| j | j d {V d S d S r` )rh cancelrX rY rZ ry s r8 shutdownz ImunifySecurityPlugin.shutdown s %%'''$$$$$$$$ % - & - - / / /, , , , , , , , # # # % % %" " " " " " " " ( 0 ) 0 0 2 2 2/ / / / / / / / / / 0 0r: c t | | s t d| dS t | | }|d uo)| o| S )NzUnknown task '%s'F)hasattrr5 errorgetattrdone cancelled)r[ task_attr_nametasks r8 _task_in_progressz'ImunifySecurityPlugin._task_in_progress si t^,, LL,n = = =5t^,,4 L OLDNN<L<L8LLr: c @ t d| j | j d d S )Nr< )r> r? )r rC rE ry s r8 _save_installation_statez.ImunifySecurityPlugin._save_installation_state s7 # ! 8 1
r: r c H | r t d d S | }| t d| d S | j s t d d S d| _ | d S )Nz Installation task was cancelledz Installation task failed: %sz>Feature was disabled during installation, skipping flag updateT)r r5 rt exceptionr rE rC r )r[ r excs r8 rx z-ImunifySecurityPlugin._mark_installation_done s >> KK9 : : : Fnn ? LL7 = = = F% KK'
F&*# %%'''''r: Fcoroc K | d r\|r| d S | j r=| j | j d {V n# t j $ r Y nw xY w| d r0t d | d S t j | | _ d S )NrQ rP z Installation is already running)
r closerQ r asyncioCancelledErrorr5 warningrf rP )r[ r
for_new_sitess r8 ru z*ImunifySecurityPlugin.process_installation s ! !/ 2 2
!
"))+++ ,,,,,,,,, - D ! !"5 6 6 NN< = = = JJLLL F!(!4T!:!: s
A A10A1c P K | d rD| j r=| j | j d {V n# t j $ r Y nw xY w| d r t
d d S t j | | _ d S )NrP rQ zDeleting is already running) r rP r r r r5 r rf rQ )r[ r s r8 process_deletingz&ImunifySecurityPlugin.process_deleting$ s ! !"5 6 6 %
&--/// 000000000 - D ! !/ 2 2 NN8 9 9 9 F $ 0 6 6s
A AAT)check_period_firstcheck_lock_period lock_filec K t rt d {V t j | j d {V d S Nrs )r& r' r update_auth_everywhererA ry s r8 rg z(ImunifySecurityPlugin.refresh_auth_files3 s` " // ! ! ! ! ! ! !+<<<<<<<<<<<<r: )r jitterr r c K t j sdS | j dt d{V }d }| j d| d{V }d}d}dddd}i }|D ]}t j | d{V } | dz }
|
dz } | j d| j d{V r|dz
}|j |vr | j dt j
|j d{V } | j dt | j d{V ||j < nE# t $ r8}
t d|j |
d d
d ||j < Y d}
~
nd}
~
ww xY w||j }| j dt |j |
|j t% | d | d
d
d{V \ }}|r|dz
}||v r||xx dz
cc< t) h d d{V }| d pd}| d pd}| d pd}| d pd}t+ j ||||t/ | |t1 t3 j t1 t3 j dt1 | t1 | t1 |d
t1 |d t1 |d d }| j dt8 j d{V |d< | j | d{V dS )z8Send WP plugin adoption stats to the correlation server.Nc 4 t t j 5 t j d d d n # 1 swxY w Y t j t j d S )NF)
r r OverridingResetresetr" selectwheremanually_deleted_atis_nullcountra r: r8 _count_manually_removedzAImunifySecurityPlugin.send_stats.<locals>._count_manually_removedL s )344
"
"!!!
"
"
"
"
"
"
"
"
"
"
"
"
"
"
" $&&}8@@GGHH
s
:>>r )balancedstrictmonitorzimunify-securityz rules.phpr{ zOCould not load AI bot protection config for uid %s, counting it as disabled: %sFr )ai_bot_protectionpresetr r > imunify-coreimunify-antivirusimunify-wp-securityimunify360-firewallr r r r ) waf_enabledr r r )waf_enabled_sites ai_bot_protection_enabled_sites!ai_bot_protection_preset_balanced ai_bot_protection_preset_strict ai_bot_protection_preset_monitor) core_version
av_versionfirewall_version
wp_versioninstalled_sitesmanually_removed_sites
server_configstatsiaid) r
rD r@ run_in_executorr% wp_cliget_content_dirr| uidpwdgetpwuidr pw_name Exceptionr5 rt r docrootboolrB r r
WpSecurityPluginStatslenstrr rF rK r get_iaidrA process_message)r[ sitesr manually_removedr ai_bot_enabled_sites
preset_countsuser_ai_configsite content_dirdata_dir rules_php pw_recordr
hoster_cfg
ai_enabledr pkgsr r r r msgs r8 rj z ImunifySecurityPlugin.send_stats> s 0 Fj007JKKKKKKKK "&!;!; )"
"
%&!BB
*, , / , /D & 6t < <<<<<<<K"%77H ;.IZ//i6FGGGGGGGG
'!Q&!x~--&*j&@&@ clDH' ' ! ! ! ! ! !I
#j 8 8 0!) # !
KK; .3",0 0N48,,,,,,
(1J'+z'A'A) Z^^$78899x44( ( " " " " " " J
/$)$]**!&)))Q.))))
XX 1228b
88$9::@bxx//52 XX 344:
/%! -! JJ#3 "6#A#C#C D D%(8::& & &)):%;%;367K3L3L58!*-6 6 47!(+4 4 58!),5 5
6 !J 6 6 '0
F j((-----------s A%D++
E-5.E((E-< c K t d | d{V n2# t $ r%}t d| Y d}~nd}~ww xY w | j | j d{V dS # t $ r&}t d| Y d}~dS d}~ww xY w)a
Periodic task for WordPress site file processing.
Runs every minute to:
1. Process changelog.php files written by the WordPress plugin (rule disable/enable from WP admin)
2. Collect incident files written by the WordPress plugin
zTProcessing rule disable changelogs and collecting WordPress CVE protection incidentsNz&Error in WordPress site processing: %sz-Error sending pending WordPress incidents: %s)r5 r6 _process_installed_sitesr r rV send_pending_incidentsrA )r[ es r8 ri z-ImunifySecurityPlugin.process_wordpress_sites s
A
F//11 1 1 1 1 1 1 1 1 F F F
LLA1 E E E E E E E E F M &==djII I I I I I I I I I M M M LLH! L L L L L L L L L Ms- 9
A(A##A(,%B
C B>>Cc b K t }|s t d d S | j || j d {V }|r&t
d |D | j d {V | j |d d {V t d d S )Nz0No WordPress sites found for periodic processingc g | ] }|j
S ra )domain).0ss r8
<listcomp>zBImunifySecurityPlugin._process_installed_sites.<locals>.<listcomp> s :::a:::r: )domainsrp T)delete_after_processing )days)
r% r5 r6 rW process_changelogs_for_sitesrA r+ rU collect_incidents_for_sitesr, )r[ r affected_sitess r8 r z.ImunifySecurityPlugin._process_installed_sites s( #%% LLK L L L F *GGtz
0::>:::Z
%AA $( B
'B//////r: c K j fd} | d d{V dS )z&Install plugin on new WordPress sites.c K t j j d {V } | rj | | S r )r rv rA rT update)r r[ s r8 install_and_trackzFImunifySecurityPlugin._install_on_new_sites.<locals>.install_and_track sT $*$=4:$N$N$N N N N N N NO
E,33ODDD" "r: T)r N)rT clearru )r[ r s ` r8 _install_on_new_sitesz+ImunifySecurityPlugin._install_on_new_sites s
$**,,, # # # # # '' (
r: c \ K t j | j | j d{V t j | j d{V t
j sW| t j | j d{V d| _ d| _
| dS dS )zCTidy up sites from which the WordPress plugin was deleted manually.)rp rT Nrs F) r tidy_up_manually_deletedrA rT $fix_data_file_permissions_everywherer
rD r remove_all_installedrC rE r ry s r8 _tidy_upz ImunifySecurityPlugin._tidy_up s -$($@
9tzJJJJJJJJJJ0 ,''+<<<
+0D '%*D " ) ) + + + + +
, ,r: c K t j | j d{V }|r | j | dS dS )zFAdopt sites where plugin is installed but not tracked in our database.rs N)r adopt_found_sitesrA rT r )r[
adopted_sitess r8 _adopt_found_sitesz(ImunifySecurityPlugin._adopt_found_sites s^ $ 6DJ G G GGGGGGG
? ( / /
> > > > > ? ?r: c J K t j | j d{V dS )z1Update plugin on all sites where it is installed.rs N)r update_everywhererA ry s r8 _update_existingz&ImunifySecurityPlugin._update_existing s4 &DJ777777777777r: c K | d{V | j r
| j d{V | d{V | d{V | d{V dS )z
Combined operation: install on new sites, adopt found sites, tidy up,
and update existing plugins.
This runs all operations sequentially to avoid race conditions.
N)r rP r r r ry s r8 _run_install_and_updatez-ImunifySecurityPlugin._run_install_and_update" s ((********* ! )( ( ( ( ( ( ( ( %%''''''''' mmoo ##%%%%%%%%%%%r: c R K t d|j |j | d r"t d|j d S |j dk r%| j sd S | d {V d S | d r"t d|j d S | d r"t d|j d S |j d k r | d {V d S |j d
k r | d {V d S |j d k rP| j s t d d S t j | | _
d S d S )
Nz<ImunifySecurityPlugin received message action: %s method: %srR z7Install-and-update is still running, skipping action %sinstall_on_new_sitesrP z1Installation is still running, skipping action %srQ z5Uninstallation is already running, skipping action %supdate_existingtidy_upinstall_and_updatez>Installation is not completed yet, skipping install_and_update)r5 rt actionmethodr r rC r r r r rf r rR )r[ messages r8 manage_plugin_actionz*ImunifySecurityPlugin.manage_plugin_action5 s J N N
! !"; < < NNI
F > 3 3 3.
,,.. . . . . . . . F ! !"5 6 6 NNC
F ! !/ 2 2 NNG
F > . . .'')) ) ) ) ) ) ) ) F >Y & &--// ! ! ! ! ! ! ! F > 1 1 1.
*
,3+>,,.., ,D ( ( ( 2 1r: c K t |d t sd S t j }|| j k rd S || _ |r| j s| d pi di }d|vrX t dddii d| _ nB# t $ r t d Y n w xY wt j
| _ d|vrp t dddii d| _ t j | _ nZ# t $ r t d Y n4w xY wt j | _ t j | _ | t j | j
d {V | j !| j | j d S d S |sl| j s| d rR| t j | j
d {V d| _ | d S d S d S ) Nconf submitted WORDPRESSr Tz9waf_enabled config reset skipped, field not in schema yetr Fz?ai_bot_protection config reset skipped, field not in schema yetrs rP )
isinstancer r
rD rE rC rB dict_to_configrG r r5 r6 r rF rL rM rN rK ru rv rA rP rw rx r r r r )r[ r current_config_value submitted_wps r8 manage_plugin_installationz0ImunifySecurityPlugin.manage_plugin_installations s" '&/<88 F ( @ 4#9 9 9 F "6 @ ,(C @ , $KK 4 4 :??R L L00 NN11$}d&;< .2D**, LL3 *0)G)I)I&",66 NN11$':E&BC 49D0 CEE 77 - LL3 8:: , ?AA 3 ++)tz:::
%1&880 21
& , ' ,%%&9:: , ''+<<<
+0D ' ) ) + + + + + , , , ,s% ;,B( ($CC/AD4 4$EEc K t |d t sdS t j sdS | j sdS t j }t j }|| j k r
|| j k rdS | j
dt d{V }|s|| _ || _ dS t j
| d{V }|t | k r|| _ || _ dS dS )a
Propagate admin toggles of WORDPRESS.ai_bot_protection and
WORDPRESS.ai_bot_protection_preset to every managed WP install's
plugin_config.php immediately, so the WP plugin picks up the
change at the next request rather than waiting for a scan cycle.
Phase 2 per-account support extends *this* handler with a
UserConfig branch (mirroring manage_waf_config); do not add a
sibling handler.
r N)r r r
rD rC r rK rM rL rN r@ r r% update_plugin_config_on_sitesr )r[ r current_enabledcurrent_presetr writtens r8 manage_ai_bot_protection_configz5ImunifySecurityPlugin.manage_ai_bot_protection_config s '&/<88 F0
F*
F >@@ DFF t ; ; ; $"EEE Fj007JKKKKKKKK +:D (2@D / F <UCCCCCCCC c%jj +:D (2@D / / / ! r: c > K | d{V dS )zPoll for license-edition changes and reconverge plugin_config.php.
Edition changes reach only the external hook framework, never the
message bus, so a poll is the propagation trigger.
N) _reconverge_license_type_oncery s r8 rk z-ImunifySecurityPlugin.reconverge_license_type s2 0022222222222r: c F K t j sd S | j sd S t j }|| j k rd S | j d t d {V }|s || _ d S t j
| d {V }|t | k r || _ d S d S r` ) r
rD rC r get_license_typerO r@ r r% r r r )r[ currentr r" s r8 r% z3ImunifySecurityPlugin._reconverge_license_type_once s 0 F* F -// d- - - Fj007JKKKKKKKK &-D # F <UCCCCCCCC c%jj &-D # # # ! r: c K t j sdS |d }| }| di d }t |t
r|| j |j d }|dS t j
|j d{V }|s"|r t j |j d{V n#|r!|s t j |j d{V dS || j |j k rdS || j |j < |rt j
s!t j |j d{V dS t j |j d{V dS t |t r t j }|| j k r<|| _ |st j d{V n*t j d{V n# t& $ r Y nw xY w t j }|| j k r"|| _ t j d{V dS dS # t& $ r Y dS w xY wdS )u\ Caches are dispatch markers, not apply receipts — apply failures propagate, no auto-retry.Nr r r )r
rD config_to_dictrB r r rJ popusernamer is_waf_enabled_for_userredeploy_waf_for_userremove_waf_rules_for_userrF r WAF_ENABLEDrG remove_waf_rules_for_all_sitesredeploy_waf_for_all_sitesKeyError WAF_DEFAULTrI apply_waf_default_change) r[ r r config_dict waf_valueprev
new_effectiver( current_defaults r8 manage_waf_configz'ImunifySecurityPlugin.manage_waf_config s 0 Fv))++ OOK4488 GG dJ ' ' ( < 266t}dKK<F&,&DM' ' ! ! ! ! ! !
J
J 6t}EEEEEEEEEE J- J :4=IIIIIIIIID 7 ; ;DM J JJJ9BD '
6
BF$B$D$D
B 6t}EEEEEEEEEEE 24=AAAAAAAAAAA
l
+
+ <
B#/ d 444-4D*" B $ C E EEEEEEEEE $ ? A AAAAAAAA
<"+"7 #d&<<<-<D* 9;;;;;;;;;;; =<
< <s$ G/ /
G<;G< H; ;
I I c K | j sdS | d dk s| d sdS t |d }t }|D ]}|j dk r} t j |j }t | }|r|j nd}|D ]5}|j
| r| ||f n6z# t $ r Y w xY w|s t d dS t dt# | d |D } t% j | j | d{V t d t# | dS )
a
INFO [2025-02-24 12:00:20,384] imav.plugins.wordpress: Malware cleanup finished:
HookEvent.MalwareCleanupFinished(
{
'cleanup_id': 'fa4fe7e48dbf45588f53b24366cd8893',
'started': 1740398411.786418,
'error': None,
'total_files': 3,
'total_cleaned': 3,
'status': 'ok'
}
)
Nstatusokstartedfilez3Cleanup finished => no sites found for cleaned hitsz1Cleanup finished => %s site(s) need to be updatedc 8 g | ]\ }}t |d | S )r )r r r )r! )r site_pathr s r8 r zIImunifySecurityPlugin.handle_malware_cleanup_finished.<locals>.<listcomp>u s;
3
9RS 9 9 9
r: z"%s site(s) updated after a cleanup)rE rB r9 rS
resource_typer getpwnamuserr$ pw_uid orig_file
startswithaddr3 r5 r6 rt r r update_data_on_sitesrA )
r[ r hits
site_pathshit user_info
user_sitesr rB wordpress_sitess
r8 handle_malware_cleanup_finishedz5ImunifySecurityPlugin.handle_malware_cleanup_finished= s % F ;;x D ( ( I0F0F ( F ));<<UU
C F** # SX 6 6I!3I!>!>J,5? ((4 &0 " " =33I>> " &NNIs+; < < < !E" D + LLN O O O F ?
OO
",
)$*oFFFFFFFFF 8#o:N:NOOOOOs /A+C
C('C(c K | j sdS | d dk s*| d r| d sdS |d }t | }|s t d| dS t dt
| t j | j | d{V t dt
| dS ) a
INFO [2025-02-24 11:57:17,968] imav.plugins.wordpress: Malware scan finished:
HookEvent.MalwareScanningFinished(
{
'scan_id': 'b9bd136aff0a4d87a248c859cfe41c47',
'scan_type': 'user',
'path': '/home/user1'
}
)
INFO [2025-02-24 12:00:10,740] imav.plugins.wordpress: Malware scan finished:
HookEvent.MalwareScanningFinished(
{
'scan_id': 'a74271d2cdd04e0c9bd49ef6de23e0d8',
'scan_type': 'user',
'path': '/home/user4',
'started': 1740398383,
'total_files': 39229,
'total_malicious': 3,
'error': None,
'status': 'ok',
'scan_params': {'intensity_cpu': 2, 'intensity_io': 2, 'intensity_ram': 2048, 'initiator': None, 'file_patterns': None, 'exclude_patterns': None, 'follow_symlinks': False, 'detect_elf': True},
'stats': {'scan_time': 27, 'mem_peak': 28217344, 'smart_time_hs': 0.004, 'scan_time_hs': 1.1751, 'smart_time_preg': 0, 'scan_time_preg': 2.7391, 'finder_time': 13.5896, 'cas_time': 0.7562, 'deobfuscate_time': 0.8998, 'total_files': 39229}
}
)
Nr= r> pathr z+Scan finished => no sites found for path=%sz.Scan finished => %s site(s) need to be updatedz %s site(s) updated after a scan)
rE rB r# r5 r6 rt r r rJ rA )r[ r rS r s r8 handle_malware_scan_finishedz2ImunifySecurityPlugin.handle_malware_scan_finished~ s 8 % F
KK ! !T ) );;v&&
*;;w''
*
F v!$'' LLF M M M F <c%jj
)$*e<<<<<<<<< 5s5zzBBBBBr: N)F)3__name__
__module__ __qualname__r AV_IM360SCOPEr^ rc rq ro rl r r r r Taskrx r ru r r r r LOCK_FILErg SEND_WP_PLUGIN_STATS_LOCK_FILErj SITE_PROCESSING_LOCK_FILEri r r r r r r r r
WordpressPluginActionr ConfigUpdater r# LICENSE_RECONVERGE_LOCK_FILErk r% r; r MalwareCleanupFinishedrQ MalwareScanningFinishedrT ra r: r8 r< r< m sO NE$B $B $BL
6 6 6, @$ $ $0 0 0$M M M
(GL ( ( ( ((; ;y ; ; ; ;(
7
7
7 _ = =
=
_ 0 q. q. q.f _ + M M
M<0 0 04
, , , ? ? ?8 8 8& & && VK -..; ; /.;z VK $%%K, K, &%K,Z VK $%%)A )A &%)AV _ . 3 3
3. . . VK $%%/< /< &%/<b VI ,-->P >P .->P@ VI -..4C 4C /.4C 4C 4Cr: r< )Wr loggingr
contextlibr pathlibr typingr defence360agent.contracts.configr r r r r
%defence360agent.contracts.hook_eventsr !defence360agent.contracts.licenser "defence360agent.contracts.messagesr
!defence360agent.contracts.pluginsr r r defence360agent.subsys.panelsr 'defence360agent.subsys.persistent_stater r r defence360agent.utilsr r r r defence360agent.utils.check_lockr defence360agent.internals.iaidr defence360agent.utils.commonr defence360agent.wordpressr r r defence360agent.wordpress.utilsr (defence360agent.wordpress.bot_protectionr defence360agent.modelr defence360agent.model.wordpressr! r" )defence360agent.wordpress.site_repositoryr# r$ r% $defence360agent.wordpress.proxy_authr& r' r( r) r* defence360agent.wordpress.pluginr+ (defence360agent.model.wordpress_incidentr, getLoggerrU r5 rX r[ r] r\ r`
CONFIG_DIRr r rm rB r4 floatlistr9 r< ra r: r8 <module>r sE
< ; ; ; ; ; 8 8 8 8 8 8 : : : : : :
8 7 7 7 7 7
8 7 7 7 7 7 @ @ @ @ @ @ , , , , , , 3 3 3 3 3 3 , , , , , , D D D D D D , + + + + + A A A A A A A A
L K K K K K
8 $ $ }en = = . .u~ "4!3u~" " 2 1U^ TA
B
B
DL ')K K "CC hl " t
8 84 8 8 8 8 F
C F
C F
C F
C F
CK F
C F
C F
C F
C F
Cr: defence360agent/plugins/__pycache__/wordpress.cpython-311.pyc 0000644 0000000 0000000 00000122446 00000000000 021202 0 ustar
r_j d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m
Z
m Z m Z m
Z
mZ d dlmZ d dlmZ d dlmZ d d lmZmZmZ d d
lmZ d d lm Z m Z m Z d d l m Z m!Z!m"Z"m#Z# d d
l$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z, d dl*m-Z- d dl.m/Z/ d dl0m1Z1 d dl2m3Z3 d dl4m5Z5m6Z6 d dl7m8Z8m9Z9m:Z: d dl;m<Z<m=Z= d dl*m>Z>m?Z?m@Z@ d dlAmBZB d dlCmDZD ejE eF ZG e de jH ZI e d e jH ZJ e d e jH ZK e d e jH ZL ed ZM ed ZNeMd!z ZOeMd"z ZP e!jQ d#d$d% ZRd&eSd'eTfd(ZU G d) d*ee ZVdS )+ N)suppress)Path) Coroutine)ANTIVIRUS_MODEConfigValidationError SystemConfig
UserConfig Wordpress) HookEvent)
LicenseCLN) MessageType) MessageSink
MessageSourceexpect)
hosting_panel)
load_stateregister_lock_file
save_state)Scopeimporterrecurring_checksystem_packages_info)
check_lock)IndependentAgentIDAPI)DAY)cli)plugin)_prepare_ai_bot_settings)resolve_ai_bot_protection) tls_check)WPSite
WordpressSite)get_sites_by_pathget_sites_for_userget_installed_sites)is_secret_expired
rotate_secret)ChangelogProcessorIncidentCollectorIncidentSender) update_disabled_rules_on_sites) delete_old_wordpress_incidentsz wp-gen-authzwp-site-processzwp-plugin-statszwp-license-reconvergez-/etc/sysconfig/imunify360/imunify360.config.dzF/opt/imunify360/venv/share/imunify360/11_on_first_install_wp_av.configz 11_on_first_install_wp_av.configz .11_on_first_install_wp_av.flagzimav.malwarelib.model
MalwareHit)modulenamedefaultstarted_timestampreturnc | t t d g S t | S )z
Get malware hits cleaned since the given timestamp with lazy import fallback.
Returns empty list if imav.malwarelib is not available.
Nz;imav.malwarelib not available, returning empty cleaned hits) _MalwareHitloggerdebug
cleaned_since)r1 s V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/wordpress.py_get_cleaned_malware_hitsr9 _ s? I
$ $%6 7 77 c e Zd Zej Zd Zd Zd Zd Z d Z
d Z d Z d Z
d ej fd
Zd%d efd
Zd Z eedee d Z eeddee d Z eedde d Z d Z d Z d Z d Z d Z!d Z" e#e$j% d Z& e#e$j' d Z( e#e$j' d Z) eedde* d Z+d Z, e#e$j' d! Z- e#e.j/ d" Z0 e#e.j1 d# Z2d$S )&ImunifySecurityPluginc d | _ d | _ t d }| d | _ | d }||n t
j | _ t j | _
t j | _ i | _
t j | _ t j | _ d | _ d | _ d | _ d | _ t- | _ t1 | _ t5 | _ t9 | _ d | _ d | _ d | _ d S )Nr< installedenabled)!_loop_sinkr getinstallation_completedr
SECURITY_PLUGIN_ENABLEDlast_config_valuer _get_global_waf_enabled_last_waf_enabled_get_waf_default_last_waf_default_last_user_waf_enabled _get_global_ai_bot_protection_last_ai_bot_protection$_get_global_ai_bot_protection_preset _last_ai_bot_protection_preset_last_license_typeinstallation_task
deleting_taskinstall_and_update_tasksetfreshly_installed_sitesr) incident_collectorr* incident_senderr( changelog_processor_site_processing_task _stats_task_license_reconverge_task)selfstatepersisted_enableds r8 __init__z ImunifySecurityPlugin.__init__p s/
233&+ii &<&<# "IIi 0 0 !,
2
"(!?!A!A !'!8!:!: >@# (.'K'M'M$ 7 9 9
+
#' 6: 26<@$47EE$ #4"5"5 - / / #5#7#7 :>"04=A%%%r: c
K d S N )r[ loops r8 create_sinkz!ImunifySecurityPlugin.create_sink s r: c \ K || _ || _ | j | | _ | j | | _ | j | | _ | j | | _
t r| d {V nt d | d {V d S )NT)
missing_ok)r@ rA create_taskrefresh_auth_files_update_auth_taskprocess_wordpress_sitesrX
send_statsrY reconverge_license_typerZ r _apply_first_install_configFIRST_INSTALL_FLAGunlink _recover_installation_on_startup)r[ rb sinks r8
create_sourcez#ImunifySecurityPlugin.create_source s'
!%!7!7 # # % %"
"
&*Z%;%; ( ( * *&
&
" :11$//2C2CDD(,
(>(> ( ( * *)
)
% 72244 4 4 4 4 4 4 4 4 % % % 6 6 63355555555555r: c , K | j s t j sdS t d d| _ | t j | j d{V | j
!| j
| j dS dS )a
Self-heal when the installation state was lost.
If the feature is enabled but installation_completed is falsy (state
file missing, earlier install interrupted, etc.), manage_plugin_installation
can never recover: its True == True guard always returns early.
Trigger install_everywhere once per restart to repopulate the
wordpress_site table and flip the flag.
NzXInstallation state is missing while feature is enabled; triggering startup self-recoveryTrp )
rC r
rD r5 inforE process_installationr install_everywhererA rP add_done_callback_mark_installation_doner[ s r8 ro z6ImunifySecurityPlugin._recover_installation_on_startup s
' 4
F
/
"& '' %4: 6 6 6
! - " 4 4,
. -r: c f K t sd S t j d {V dk rKt
t }t
d t
d S )N i ) rm existsr HostingPanel users_countFIRST_INSTALL_CONFIG_PATH
write_textFIRST_INSTALL_CONFIG_FILE read_textchmodrn )r[ _s r8 rl z1ImunifySecurityPlugin._apply_first_install_config s !((** F +--99;; ; ; ; ; ; ;q @ @)44)3355 A
& + +E 2 2 2!!#####r: c h K | j | j d {V | j r&| j | j d {V | j r&| j | j d {V | j r(| j | j d {V d S d S r` )rh cancelrX rY rZ ry s r8 shutdownz ImunifySecurityPlugin.shutdown s %%'''$$$$$$$$ % - & - - / / /, , , , , , , , # # # % % %" " " " " " " " ( 0 ) 0 0 2 2 2/ / / / / / / / / / 0 0r: c t | | s t d| dS t | | }|d uo)| o| S )NzUnknown task '%s'F)hasattrr5 errorgetattrdone cancelled)r[ task_attr_nametasks r8 _task_in_progressz'ImunifySecurityPlugin._task_in_progress si t^,, LL,n = = =5t^,,4 L OLDNN<L<L8LLr: c @ t d| j | j d d S )Nr< )r> r? )r rC rE ry s r8 _save_installation_statez.ImunifySecurityPlugin._save_installation_state s7 # ! 8 1
r: r c H | r t d d S | }| t d| d S | j s t d d S d| _ | d S )Nz Installation task was cancelledz Installation task failed: %sz>Feature was disabled during installation, skipping flag updateT)r r5 rt exceptionr rE rC r )r[ r excs r8 rx z-ImunifySecurityPlugin._mark_installation_done s >> KK9 : : : Fnn ? LL7 = = = F% KK'
F&*# %%'''''r: Fcoroc K | d r\|r| d S | j r=| j | j d {V n# t j $ r Y nw xY w| d r0t d | d S t j | | _ d S )NrQ rP z Installation is already running)
r closerQ r asyncioCancelledErrorr5 warningrf rP )r[ r
for_new_sitess r8 ru z*ImunifySecurityPlugin.process_installation s ! !/ 2 2
!
"))+++ ,,,,,,,,, - D ! !"5 6 6 NN< = = = JJLLL F!(!4T!:!: s
A A10A1c P K | d rD| j r=| j | j d {V n# t j $ r Y nw xY w| d r t
d d S t j | | _ d S )NrP rQ zDeleting is already running) r rP r r r r5 r rf rQ )r[ r s r8 process_deletingz&ImunifySecurityPlugin.process_deleting$ s ! !"5 6 6 %
&--/// 000000000 - D ! !/ 2 2 NN8 9 9 9 F $ 0 6 6s
A AAT)check_period_firstcheck_lock_period lock_filec K t rt d {V t j | j d {V d S Nrs )r& r' r update_auth_everywhererA ry s r8 rg z(ImunifySecurityPlugin.refresh_auth_files3 s` " // ! ! ! ! ! ! !+<<<<<<<<<<<<r: )r jitterr r c K t j sdS | j dt d{V }d }| j d| d{V }d}d}dddd}i }|D ]}t j | d{V } | dz }
|
dz } | j d| j d{V r|dz
}|j |vr | j dt j
|j d{V } | j dt | j d{V ||j < nE# t $ r8}
t d|j |
d d
d ||j < Y d}
~
nd}
~
ww xY w||j }| j dt |j |
|j t% | d | d
d
d{V \ }}|r|dz
}||v r||xx dz
cc< t) h d d{V }| d pd}| d pd}| d pd}| d pd}t+ j ||||t/ | |t1 t3 j t1 t3 j dt1 | t1 | t1 |d
t1 |d t1 |d d }| j dt8 j d{V |d< | j | d{V dS )z8Send WP plugin adoption stats to the correlation server.Nc 4 t t j 5 t j d d d n # 1 swxY w Y t j t j d S )NF)
r r OverridingResetresetr" selectwheremanually_deleted_atis_nullcountra r: r8 _count_manually_removedzAImunifySecurityPlugin.send_stats.<locals>._count_manually_removedL s )344
"
"!!!
"
"
"
"
"
"
"
"
"
"
"
"
"
"
" $&&}8@@GGHH
s
:>>r )balancedstrictmonitorzimunify-securityz rules.phpr{ zOCould not load AI bot protection config for uid %s, counting it as disabled: %sFr )ai_bot_protectionpresetr r > imunify-coreimunify-antivirusimunify-wp-securityimunify360-firewallr r r r ) waf_enabledr r r )waf_enabled_sites ai_bot_protection_enabled_sites!ai_bot_protection_preset_balanced ai_bot_protection_preset_strict ai_bot_protection_preset_monitor) core_version
av_versionfirewall_version
wp_versioninstalled_sitesmanually_removed_sites
server_configstatsiaid) r
rD r@ run_in_executorr% wp_cliget_content_dirr| uidpwdgetpwuidr pw_name Exceptionr5 rt r docrootboolrB r r
WpSecurityPluginStatslenstrr rF rK r get_iaidrA process_message)r[ sitesr manually_removedr ai_bot_enabled_sites
preset_countsuser_ai_configsite content_dirdata_dir rules_php pw_recordr
hoster_cfg
ai_enabledr pkgsr r r r msgs r8 rj z ImunifySecurityPlugin.send_stats> s 0 Fj007JKKKKKKKK "&!;!; )"
"
%&!BB
*, , / , /D & 6t < <<<<<<<K"%77H ;.IZ//i6FGGGGGGGG
'!Q&!x~--&*j&@&@ clDH' ' ! ! ! ! ! !I
#j 8 8 0!) # !
KK; .3",0 0N48,,,,,,
(1J'+z'A'A) Z^^$78899x44( ( " " " " " " J
/$)$]**!&)))Q.))))
XX 1228b
88$9::@bxx//52 XX 344:
/%! -! JJ#3 "6#A#C#C D D%(8::& & &)):%;%;367K3L3L58!*-6 6 47!(+4 4 58!),5 5
6 !J 6 6 '0
F j((-----------s A%D++
E-5.E((E-< c K t d | d{V n2# t $ r%}t d| Y d}~nd}~ww xY w | j | j d{V dS # t $ r&}t d| Y d}~dS d}~ww xY w)a
Periodic task for WordPress site file processing.
Runs every minute to:
1. Process changelog.php files written by the WordPress plugin (rule disable/enable from WP admin)
2. Collect incident files written by the WordPress plugin
zTProcessing rule disable changelogs and collecting WordPress CVE protection incidentsNz&Error in WordPress site processing: %sz-Error sending pending WordPress incidents: %s)r5 r6 _process_installed_sitesr r rV send_pending_incidentsrA )r[ es r8 ri z-ImunifySecurityPlugin.process_wordpress_sites s
A
F//11 1 1 1 1 1 1 1 1 F F F
LLA1 E E E E E E E E F M &==djII I I I I I I I I I M M M LLH! L L L L L L L L L Ms- 9
A(A##A(,%B
C B>>Cc b K t }|s t d d S | j || j d {V }|r&t
d |D | j d {V | j |d d {V t d d S )Nz0No WordPress sites found for periodic processingc g | ] }|j
S ra )domain).0ss r8
<listcomp>zBImunifySecurityPlugin._process_installed_sites.<locals>.<listcomp> s :::a:::r: )domainsrp T)delete_after_processing )days)
r% r5 r6 rW process_changelogs_for_sitesrA r+ rU collect_incidents_for_sitesr, )r[ r affected_sitess r8 r z.ImunifySecurityPlugin._process_installed_sites s( #%% LLK L L L F *GGtz
0::>:::Z
%AA $( B
'B//////r: c K j fd} | d d{V dS )z&Install plugin on new WordPress sites.c K t j j d {V } | rj | | S r )r rv rA rT update)r r[ s r8 install_and_trackzFImunifySecurityPlugin._install_on_new_sites.<locals>.install_and_track sT $*$=4:$N$N$N N N N N N NO
E,33ODDD" "r: T)r N)rT clearru )r[ r s ` r8 _install_on_new_sitesz+ImunifySecurityPlugin._install_on_new_sites s
$**,,, # # # # # '' (
r: c \ K t j | j | j d{V t j | j d{V t
j sW| t j | j d{V d| _ d| _
| dS dS )zCTidy up sites from which the WordPress plugin was deleted manually.)rp rT Nrs F) r tidy_up_manually_deletedrA rT $fix_data_file_permissions_everywherer
rD r remove_all_installedrC rE r ry s r8 _tidy_upz ImunifySecurityPlugin._tidy_up s -$($@
9tzJJJJJJJJJJ0 ,''+<<<
+0D '%*D " ) ) + + + + +
, ,r: c K t j | j d{V }|r | j | dS dS )zFAdopt sites where plugin is installed but not tracked in our database.rs N)r adopt_found_sitesrA rT r )r[
adopted_sitess r8 _adopt_found_sitesz(ImunifySecurityPlugin._adopt_found_sites s^ $ 6DJ G G GGGGGGG
? ( / /
> > > > > ? ?r: c J K t j | j d{V dS )z1Update plugin on all sites where it is installed.rs N)r update_everywhererA ry s r8 _update_existingz&ImunifySecurityPlugin._update_existing s4 &DJ777777777777r: c K | d{V | j r
| j d{V | d{V | d{V | d{V dS )z
Combined operation: install on new sites, adopt found sites, tidy up,
and update existing plugins.
This runs all operations sequentially to avoid race conditions.
N)r rP r r r ry s r8 _run_install_and_updatez-ImunifySecurityPlugin._run_install_and_update" s ((********* ! )( ( ( ( ( ( ( ( %%''''''''' mmoo ##%%%%%%%%%%%r: c R K t d|j |j | d r"t d|j d S |j dk r%| j sd S | d {V d S | d r"t d|j d S | d r"t d|j d S |j d k r | d {V d S |j d
k r | d {V d S |j d k rP| j s t d d S t j | | _
d S d S )
Nz<ImunifySecurityPlugin received message action: %s method: %srR z7Install-and-update is still running, skipping action %sinstall_on_new_sitesrP z1Installation is still running, skipping action %srQ z5Uninstallation is already running, skipping action %supdate_existingtidy_upinstall_and_updatez>Installation is not completed yet, skipping install_and_update)r5 rt actionmethodr r rC r r r r rf r rR )r[ messages r8 manage_plugin_actionz*ImunifySecurityPlugin.manage_plugin_action5 s J N N
! !"; < < NNI
F > 3 3 3.
,,.. . . . . . . . F ! !"5 6 6 NNC
F ! !/ 2 2 NNG
F > . . .'')) ) ) ) ) ) ) ) F >Y & &--// ! ! ! ! ! ! ! F > 1 1 1.
*
,3+>,,.., ,D ( ( ( 2 1r: c K t |d t sd S t j }|| j k rd S || _ |r| j s| d pi di }d|vrX t dddii d| _ nB# t $ r t d Y n w xY wt j
| _ d|vrp t dddii d| _ t j | _ nZ# t $ r t d Y n4w xY wt j | _ t j | _ | t j | j
d {V | j !| j | j d S d S |sl| j s| d rR| t j | j
d {V d| _ | d S d S d S ) Nconf submitted WORDPRESSr Tz9waf_enabled config reset skipped, field not in schema yetr Fz?ai_bot_protection config reset skipped, field not in schema yetrs rP )
isinstancer r
rD rE rC rB dict_to_configrG r r5 r6 r rF rL rM rN rK ru rv rA rP rw rx r r r r )r[ r current_config_value submitted_wps r8 manage_plugin_installationz0ImunifySecurityPlugin.manage_plugin_installations s" '&/<88 F ( @ 4#9 9 9 F "6 @ ,(C @ , $KK 4 4 :??R L L00 NN11$}d&;< .2D**, LL3 *0)G)I)I&",66 NN11$':E&BC 49D0 CEE 77 - LL3 8:: , ?AA 3 ++)tz:::
%1&880 21
& , ' ,%%&9:: , ''+<<<
+0D ' ) ) + + + + + , , , ,s% ;,B( ($CC/AD4 4$EEc K t |d t sdS t j sdS | j sdS t j }t j }|| j k r
|| j k rdS | j
dt d{V }|s|| _ || _ dS t j
| d{V }|t | k r|| _ || _ dS dS )a
Propagate admin toggles of WORDPRESS.ai_bot_protection and
WORDPRESS.ai_bot_protection_preset to every managed WP install's
plugin_config.php immediately, so the WP plugin picks up the
change at the next request rather than waiting for a scan cycle.
Phase 2 per-account support extends *this* handler with a
UserConfig branch (mirroring manage_waf_config); do not add a
sibling handler.
r N)r r r
rD rC r rK rM rL rN r@ r r% update_plugin_config_on_sitesr )r[ r current_enabledcurrent_presetr writtens r8 manage_ai_bot_protection_configz5ImunifySecurityPlugin.manage_ai_bot_protection_config s '&/<88 F0
F*
F >@@ DFF t ; ; ; $"EEE Fj007JKKKKKKKK +:D (2@D / F <UCCCCCCCC c%jj +:D (2@D / / / ! r: c > K | d{V dS )zPoll for license-edition changes and reconverge plugin_config.php.
Edition changes reach only the external hook framework, never the
message bus, so a poll is the propagation trigger.
N) _reconverge_license_type_oncery s r8 rk z-ImunifySecurityPlugin.reconverge_license_type s2 0022222222222r: c F K t j sd S | j sd S t j }|| j k rd S | j d t d {V }|s || _ d S t j
| d {V }|t | k r || _ d S d S r` ) r
rD rC r get_license_typerO r@ r r% r r r )r[ currentr r" s r8 r% z3ImunifySecurityPlugin._reconverge_license_type_once s 0 F* F -// d- - - Fj007JKKKKKKKK &-D # F <UCCCCCCCC c%jj &-D # # # ! r: c K t j sdS |d }| }| di d }t |t
r|| j |j d }|dS t j
|j d{V }|s"|r t j |j d{V n#|r!|s t j |j d{V dS || j |j k rdS || j |j < |rt j
s!t j |j d{V dS t j |j d{V dS t |t r t j }|| j k r<|| _ |st j d{V n*t j d{V n# t& $ r Y nw xY w t j }|| j k r"|| _ t j d{V dS dS # t& $ r Y dS w xY wdS )u\ Caches are dispatch markers, not apply receipts — apply failures propagate, no auto-retry.Nr r r )r
rD config_to_dictrB r r rJ popusernamer is_waf_enabled_for_userredeploy_waf_for_userremove_waf_rules_for_userrF r WAF_ENABLEDrG remove_waf_rules_for_all_sitesredeploy_waf_for_all_sitesKeyError WAF_DEFAULTrI apply_waf_default_change) r[ r r config_dict waf_valueprev
new_effectiver( current_defaults r8 manage_waf_configz'ImunifySecurityPlugin.manage_waf_config s 0 Fv))++ OOK4488 GG dJ ' ' ( < 266t}dKK<F&,&DM' ' ! ! ! ! ! !
J
J 6t}EEEEEEEEEE J- J :4=IIIIIIIIID 7 ; ;DM J JJJ9BD '
6
BF$B$D$D
B 6t}EEEEEEEEEEE 24=AAAAAAAAAAA
l
+
+ <
B#/ d 444-4D*" B $ C E EEEEEEEEE $ ? A AAAAAAAA
<"+"7 #d&<<<-<D* 9;;;;;;;;;;; =<
< <s$ G/ /
G<;G< H; ;
I I c K | j sdS | d dk s| d sdS t |d }t }|D ]}|j dk r} t j |j }t | }|r|j nd}|D ]5}|j
| r| ||f n6z# t $ r Y w xY w|s t d dS t dt# | d |D } t% j | j | d{V t d t# | dS )
a
INFO [2025-02-24 12:00:20,384] imav.plugins.wordpress: Malware cleanup finished:
HookEvent.MalwareCleanupFinished(
{
'cleanup_id': 'fa4fe7e48dbf45588f53b24366cd8893',
'started': 1740398411.786418,
'error': None,
'total_files': 3,
'total_cleaned': 3,
'status': 'ok'
}
)
Nstatusokstartedfilez3Cleanup finished => no sites found for cleaned hitsz1Cleanup finished => %s site(s) need to be updatedc 8 g | ]\ }}t |d | S )r )r r r )r! )r site_pathr s r8 r zIImunifySecurityPlugin.handle_malware_cleanup_finished.<locals>.<listcomp>u s;
3
9RS 9 9 9
r: z"%s site(s) updated after a cleanup)rE rB r9 rS
resource_typer getpwnamuserr$ pw_uid orig_file
startswithaddr3 r5 r6 rt r r update_data_on_sitesrA )
r[ r hits
site_pathshit user_info
user_sitesr rB wordpress_sitess
r8 handle_malware_cleanup_finishedz5ImunifySecurityPlugin.handle_malware_cleanup_finished= s % F ;;x D ( ( I0F0F ( F ));<<UU
C F** # SX 6 6I!3I!>!>J,5? ((4 &0 " " =33I>> " &NNIs+; < < < !E" D + LLN O O O F ?
OO
",
)$*oFFFFFFFFF 8#o:N:NOOOOOs /A+C
C('C(c K | j sdS | d dk s*| d r| d sdS |d }t | }|s t d| dS t dt
| t j | j | d{V t dt
| dS ) a
INFO [2025-02-24 11:57:17,968] imav.plugins.wordpress: Malware scan finished:
HookEvent.MalwareScanningFinished(
{
'scan_id': 'b9bd136aff0a4d87a248c859cfe41c47',
'scan_type': 'user',
'path': '/home/user1'
}
)
INFO [2025-02-24 12:00:10,740] imav.plugins.wordpress: Malware scan finished:
HookEvent.MalwareScanningFinished(
{
'scan_id': 'a74271d2cdd04e0c9bd49ef6de23e0d8',
'scan_type': 'user',
'path': '/home/user4',
'started': 1740398383,
'total_files': 39229,
'total_malicious': 3,
'error': None,
'status': 'ok',
'scan_params': {'intensity_cpu': 2, 'intensity_io': 2, 'intensity_ram': 2048, 'initiator': None, 'file_patterns': None, 'exclude_patterns': None, 'follow_symlinks': False, 'detect_elf': True},
'stats': {'scan_time': 27, 'mem_peak': 28217344, 'smart_time_hs': 0.004, 'scan_time_hs': 1.1751, 'smart_time_preg': 0, 'scan_time_preg': 2.7391, 'finder_time': 13.5896, 'cas_time': 0.7562, 'deobfuscate_time': 0.8998, 'total_files': 39229}
}
)
Nr= r> pathr z+Scan finished => no sites found for path=%sz.Scan finished => %s site(s) need to be updatedz %s site(s) updated after a scan)
rE rB r# r5 r6 rt r r rJ rA )r[ r rS r s r8 handle_malware_scan_finishedz2ImunifySecurityPlugin.handle_malware_scan_finished~ s 8 % F
KK ! !T ) );;v&&
*;;w''
*
F v!$'' LLF M M M F <c%jj
)$*e<<<<<<<<< 5s5zzBBBBBr: N)F)3__name__
__module__ __qualname__r AV_IM360SCOPEr^ rc rq ro rl r r r r Taskrx r ru r r r r LOCK_FILErg SEND_WP_PLUGIN_STATS_LOCK_FILErj SITE_PROCESSING_LOCK_FILEri r r r r r r r r
WordpressPluginActionr ConfigUpdater r# LICENSE_RECONVERGE_LOCK_FILErk r% r; r MalwareCleanupFinishedrQ MalwareScanningFinishedrT ra r: r8 r< r< m sO NE$B $B $BL
6 6 6, @$ $ $0 0 0$M M M
(GL ( ( ( ((; ;y ; ; ; ;(
7
7
7 _ = =
=
_ 0 q. q. q.f _ + M M
M<0 0 04
, , , ? ? ?8 8 8& & && VK -..; ; /.;z VK $%%K, K, &%K,Z VK $%%)A )A &%)AV _ . 3 3
3. . . VK $%%/< /< &%/<b VI ,-->P >P .->P@ VI -..4C 4C /.4C 4C 4Cr: r< )Wr loggingr
contextlibr pathlibr typingr defence360agent.contracts.configr r r r r
%defence360agent.contracts.hook_eventsr !defence360agent.contracts.licenser "defence360agent.contracts.messagesr
!defence360agent.contracts.pluginsr r r defence360agent.subsys.panelsr 'defence360agent.subsys.persistent_stater r r defence360agent.utilsr r r r defence360agent.utils.check_lockr defence360agent.internals.iaidr defence360agent.utils.commonr defence360agent.wordpressr r r defence360agent.wordpress.utilsr (defence360agent.wordpress.bot_protectionr defence360agent.modelr defence360agent.model.wordpressr! r" )defence360agent.wordpress.site_repositoryr# r$ r% $defence360agent.wordpress.proxy_authr& r' r( r) r* defence360agent.wordpress.pluginr+ (defence360agent.model.wordpress_incidentr, getLoggerrU r5 rX r[ r] r\ r`
CONFIG_DIRr r rm rB r4 floatlistr9 r< ra r: r8 <module>r sE
< ; ; ; ; ; 8 8 8 8 8 8 : : : : : :
8 7 7 7 7 7
8 7 7 7 7 7 @ @ @ @ @ @ , , , , , , 3 3 3 3 3 3 , , , , , , D D D D D D , + + + + + A A A A A A A A
L K K K K K
8 $ $ }en = = . .u~ "4!3u~" " 2 1U^ TA
B
B
DL ')K K "CC hl " t
8 84 8 8 8 8 F
C F
C F
C F
C F
CK F
C F
C F
C F
C F
Cr: defence360agent/plugins/accumulate.py 0000644 0000000 0000000 00000007017 00000000000 014731 0 ustar import asyncio
import collections
import os
from logging import getLogger
from defence360agent.api import inactivity
from defence360agent.contracts.messages import (
Accumulatable,
MessageType,
Splittable,
)
from defence360agent.contracts.plugins import (
MessageSink,
MessageSource,
expect,
)
from defence360agent.utils import recurring_check, safe_cancel_task
logger = getLogger(__name__)
class Accumulate(MessageSink, MessageSource):
PROCESSING_ORDER = MessageSink.ProcessingOrder.POST_PROCESS_MESSAGE
SHUTDOWN_PRIORITY = (
200 # Shutdown after regular plugins (100), before SendToServer
)
DEFAULT_AGGREGATE_TIMEOUT = int(
os.environ.get("IMUNIFY360_AGGREGATE_MESSAGES_TIMEOUT", 60)
)
SHUTDOWN_SEND_TIMEOUT = int(
os.environ.get("IMUNIFY360_AGGREGATE_SHUTDOWN_SEND_TIMEOUT", 50)
)
def __init__(
self,
period=DEFAULT_AGGREGATE_TIMEOUT,
shutdown_timeout=SHUTDOWN_SEND_TIMEOUT,
**kwargs,
):
super().__init__(**kwargs)
self._period = period
self._shutdown_timeout = shutdown_timeout
self._data = collections.defaultdict(list)
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
self._task = (
None
if self._period == 0
else loop.create_task(recurring_check(self._period)(self._flush)())
)
async def create_sink(self, loop):
self._loop = loop
async def shutdown(self):
try:
await asyncio.wait_for(self.stop(), self._shutdown_timeout)
except asyncio.TimeoutError:
# Used logger.error to notify sentry
logger.error(
"Timeout (%ss) sending messages to server on shutdown.",
self._shutdown_timeout,
)
if self._task is not None:
await safe_cancel_task(self._task)
async def stop(self):
logger.info("Accumulate.stop cancel _task")
if self._task is not None:
await safe_cancel_task(self._task)
logger.info("Accumulate.stop wait lock")
# send pending messages
await self._flush()
@expect(MessageType.Accumulatable)
async def collect(self, message: Accumulatable):
list_types = (
message.LIST_CLASS
if isinstance(message.LIST_CLASS, tuple)
else (message.LIST_CLASS,)
)
if message.do_accumulate():
with inactivity.track.task("accumulate"):
for list_type in list_types:
self._data[list_type].append(message)
async def _flush(self):
copy_data = self._data
self._data = collections.defaultdict(list)
for list_type, messages in copy_data.items():
batched = (
list_type.batched(messages)
if issubclass(list_type, Splittable)
else (messages,)
)
for batch in batched:
logger.info(
f"Prepare {list_type.__name__}(<items={len(batch)}>) "
"for further processing"
)
try:
# FIXME: remove this try..except block after
# we have forbidden to create Accumulatable class
# without LIST_CLASS.
await self._sink.process_message(list_type(items=batch))
except TypeError:
logger.error("%s, %s", list_type, batch)
raise
defence360agent/plugins/analyst_cleanup_update.py 0000644 0000000 0000000 00000013036 00000000000 017330 0 ustar import logging
import asyncio
from datetime import datetime
from collections import namedtuple
from peewee import OperationalError
from defence360agent.contracts.plugins import MessageSource
from defence360agent.subsys.persistent_state import register_lock_file, Scope
from defence360agent.model.analyst_cleanup import AnalystCleanupRequest
from defence360agent.utils import recurring_check
from defence360agent.utils.common import DAY
from defence360agent.utils.check_lock import check_lock
from defence360agent.api.server.analyst_cleanup import AnalystCleanupAPI
from defence360agent.utils.sshutil import remove_pub_key
from defence360agent.internals.iaid import IAIDTokenError
logger = logging.getLogger(__name__)
LOCK_FILE = register_lock_file("analyst-cleanup-update", Scope.IM360)
UpdateStatusRow = namedtuple(
"UpdateStatusRow", ["zendesk_id", "new_status", "updated_at"]
)
class AnalystCleanupUpdate(MessageSource):
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
self._task = loop.create_task(
recurring_check(
check_lock,
check_period_first=True,
check_lock_period=DAY / 2,
lock_file=LOCK_FILE,
)(self._update_task)()
)
async def shutdown(self):
self._task.cancel()
# CancelledError is handled by @recurring_check():
await self._task
@staticmethod
async def _process(
old_request, new_tickets_map, semaphore
) -> UpdateStatusRow | None:
async with semaphore:
zendesk_id = old_request.zendesk_id
# Skip if the ticket wasn't found in the Zendesk response
if zendesk_id not in new_tickets_map:
logger.warning(
f"Ticket {zendesk_id} not found in Zendesk API response"
)
return
ticket = new_tickets_map[zendesk_id]
ticket_status = ticket["status"]
updated_at = datetime.fromisoformat(
ticket["updated_at"].replace("Z", "+00:00")
)
# Determine new local status based on Zendesk ticket status
new_status = {
"new": "pending",
"solved": "completed",
"closed": "completed",
}.get(ticket_status, "in_progress")
# Update local status if it has changed
if new_status and new_status != old_request.status:
logger.info(
f"Updating ticket {zendesk_id} status from"
f" '{old_request.status}' to '{new_status}'"
)
# If transitioning to completed, remove the SSH key
if new_status == "completed":
logger.info(
f"Removing SSH key for user '{old_request.username}'"
)
await asyncio.to_thread(
remove_pub_key, old_request.username
)
return UpdateStatusRow(zendesk_id, new_status, updated_at)
@staticmethod
def _update_db_statuses(rows: [UpdateStatusRow | None]):
for ticket in rows:
if not ticket:
continue
AnalystCleanupRequest.update_status(
ticket.zendesk_id, ticket.new_status, ticket.updated_at
)
async def _update_task(self):
"""
Gets all active and recently closed requests (for case if reopened).
And asks all the requests status from zendesk API.
Updates the state of the tickets in the database if changed.
If any completed tickets, removes public key from relevant user.
"""
try:
current_requests = (
AnalystCleanupRequest.get_all_relevant_requests()
)
# Skip if there are no requests to check
if not current_requests:
logger.info(
"No relevant analyst cleanup requests found to update"
)
return
except OperationalError as e:
if "no such table" in str(e):
logger.info("Database hasn't been updated yet")
else:
logger.error(
f"Can't get data from analyst cleanup table: {e}"
)
return
# Extract Zendesk IDs from the requests
zendesk_ids = [request.zendesk_id for request in current_requests]
try:
# Get ticket status updates from Zendesk API
new_tickets = await AnalystCleanupAPI.get_tickets(zendesk_ids)
if not new_tickets:
logger.warning(
"Didn't get tickets info from imunifyAPI but expected"
)
return
# Map from zendesk_id to ticket for easier lookup
new_tickets_map = {
str(ticket["id"]): ticket for ticket in new_tickets
}
# Process each request
semaphore = asyncio.Semaphore(5)
tasks = [
self._process(old_request, new_tickets_map, semaphore)
for old_request in current_requests
]
results = await asyncio.gather(*tasks)
# Update the ticket status in the database
await asyncio.to_thread(self._update_db_statuses, results)
except IAIDTokenError as e:
logger.error(f"IAIDTokenError: {e}")
except Exception as e:
logger.error(f"Error updating analyst cleanup requests: {e}")
defence360agent/plugins/backup_info_sender.py 0000644 0000000 0000000 00000005754 00000000000 016434 0 ustar import asyncio
import time
from datetime import timedelta
from logging import getLogger
from typing import Union
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import MessageSource
from defence360agent.subsys.backup_systems import (
get_current_backend,
get_last_backup_timestamp,
)
from defence360agent.subsys.persistent_state import load_state, save_state
from defence360agent.utils import Scope, recurring_check, safe_cancel_task
logger = getLogger(__name__)
SEND_INTERVAL = int(timedelta(hours=24).total_seconds())
RECURRING_CHECK_INTERVAL = 5
class BackupInfoSender(MessageSource):
"""Send user backup statistics to CH periodically"""
SCOPE = Scope.IM360
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
self._send_event = asyncio.Event()
self._last_send_timestamp = self.load_last_send_timestamp()
self._check_task = self._loop.create_task(
self._recurring_check_data_to_send()
)
self._send_stat_task = self._loop.create_task(
self._recurring_send_stat()
)
async def shutdown(self):
for task in [self._check_task, self._send_stat_task]:
await safe_cancel_task(task)
self.save_last_send_timestamp()
@staticmethod
def is_valid_timestamp(timestamp: Union[int, float]) -> bool:
return isinstance(timestamp, (int, float)) and timestamp > 0
def save_last_send_timestamp(self, ts: Union[int, float] = None):
timestamp = self._last_send_timestamp if ts is None else ts
if not self.is_valid_timestamp(timestamp):
logger.warning("Invalid timestamp: %s", timestamp)
return
save_state("BackupInfoSender", {"last_send_timestamp": timestamp})
def load_last_send_timestamp(self):
timestamp = load_state("BackupInfoSender").get("last_send_timestamp")
if not self.is_valid_timestamp(timestamp):
logger.warning("Invalid timestamp loaded, resetting to 0")
timestamp = 0
return timestamp
@recurring_check(RECURRING_CHECK_INTERVAL)
async def _recurring_check_data_to_send(self):
if time.time() - self._last_send_timestamp >= SEND_INTERVAL:
self._send_event.set()
@recurring_check(0)
async def _recurring_send_stat(self):
await self._send_event.wait()
try:
await self._send_server_config()
except Exception as e:
logger.exception("Failed to collect backup info: %s", e)
finally:
# Ensure backup info is not sent too frequently, even after an error
self._last_send_timestamp = time.time()
self._send_event.clear()
async def _send_server_config(self):
confg_msg = MessageType.BackupInfo(
backup_provider_type=get_current_backend(),
last_backup_timestamp=await get_last_backup_timestamp(),
)
await self._sink.process_message(confg_msg)
defence360agent/plugins/cagefs.py 0000644 0000000 0000000 00000012433 00000000000 014034 0 ustar """
Goal: Invoke
/usr/sbin/cagefsctl --update-etc
/usr/sbin/cagefsctl --force-update-etc
asynchronously. As far production scale `cagefsctl --force-update-etc`
tends last for too long, e.g. -
# time cagefsctl --force-update-etc
Updating users ...
Updating user user523 ...
Updating user user804 ...
...
Updating user user269 ...
Updating user user116 ...
Updating user user121 ...
Updating user user117 ...
real 2m44.454s
user 0m26.233s
sys 0m19.972s
"""
import asyncio
import logging
import os
import subprocess
import time
from typing import Optional
from defence360agent.api import inactivity
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import MessageSink, expect
from defence360agent.subsys.persistent_state import load_state, save_state
from defence360agent.utils import timefun
_CAGEFSCTL_TOOL = "/usr/sbin/cagefsctl"
_WAIT_LOCK = "--wait-lock"
logger = logging.getLogger(__name__)
class CageFS(MessageSink):
async def create_sink(self, loop: asyncio.AbstractEventLoop):
self._loop = loop
self._queue = asyncio.Queue()
self._last_force_update_ts = load_state("CageFS").get(
"last_force_update_ts", 0
)
self._consumer_task = self._loop.create_task(self._consumer())
async def shutdown(self):
self._consumer_task.cancel()
await self._consumer_task
if self._queue.qsize():
logger.warning("%d item(s) were not consumed", self._queue.qsize())
save_state(
"CageFS", {"last_force_update_ts": self._last_force_update_ts}
)
@expect(MessageType.ConfigUpdate)
async def put_to_queue(self, message):
config = message["conf"]
username = getattr(config, "username", None)
# not all ConfigUpdate messages mean the merged config file changed on disk
# --force-update-etc is expensive so we wanna make sure the SystemConfig
# actually changed on disk
# OR it is a UserConfig change, in which case we process anyways
if username is not None or config.modified_since(
self._last_force_update_ts
):
self._queue.put_nowait(username)
async def _consumer(self):
"""
:raise never:
"""
while True:
try:
commitconfig_username = await self._queue.get()
# that check is here because CageFS may be installed
# just after Imunify agent installation/startup
if not os.path.exists(_CAGEFSCTL_TOOL):
continue
# purge queue and eliminate duplicates
uniq = {commitconfig_username}
try:
while True:
uniq.add(self._queue.get_nowait())
except asyncio.QueueEmpty:
pass
with inactivity.track.task("cagefs"):
for username in uniq:
await self._commitconfig(username)
except asyncio.CancelledError:
# We are done
return
except Exception:
logger.exception("Something went wrong")
# Never. Stop.
continue
@timefun(log=logger.info)
async def _commitconfig(self, username: Optional[str]):
"""
:raise asyncio.CancelledError:
:raise Exception:
"""
if username:
cmd = [_CAGEFSCTL_TOOL, _WAIT_LOCK, "--update-etc", username]
else:
cmd = [_CAGEFSCTL_TOOL, _WAIT_LOCK, "--force-update-etc"]
# a config written while cagefsctl runs must still re-trigger a commit
started_at = time.time()
try:
proc = await asyncio.create_subprocess_exec(
*cmd,
stdin=subprocess.DEVNULL,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
# must not survive on agent stop/restart because of
# stdout, stderr pipes
start_new_session=False,
)
future1 = self._passthru_log(cmd, logging.DEBUG, proc.stdout)
future2 = self._passthru_log(cmd, logging.WARN, proc.stderr)
await asyncio.gather(future1, future2)
out, err = await proc.communicate()
rc = await proc.wait()
except asyncio.CancelledError:
logger.warning("%r is terminated by CancelledError", cmd)
raise
else:
if rc is None:
logger.error("logic error: process has not terminated yet")
elif rc:
logger.error(
"%r failed with rc [%s], stdout=%s, stderr=%s",
cmd,
rc,
out,
err,
)
else:
logger.info("%r succeeded with rc [%s]", cmd, rc)
if username is None:
self._last_force_update_ts = started_at
@staticmethod
async def _passthru_log(cmd, loglevel, streamreader):
while True:
line = await streamreader.readline()
if not line: # EOF
break
logger.log(loglevel, "%r: %r", cmd, line)
defence360agent/plugins/checkpoint.py 0000644 0000000 0000000 00000002351 00000000000 014731 0 ustar from defence360agent.contracts.plugins import MessageSink
from defence360agent.model.instance import db
from defence360agent.utils import recurring_check
class Checkpoint(MessageSink):
"""
Checkpoint imunify360.db periodically to limit unexpected WAL file growing.
"""
ONE_DAY = 24 * 60 * 60
def __init__(self, *, checkpoint_period=ONE_DAY, db=db):
self._checkpoint_period = checkpoint_period
self._db = db
self._task = None
async def create_sink(self, loop):
self._loop = loop
self._task = self._loop.create_task(
recurring_check(self._checkpoint_period)(self._checkpoint)()
)
async def shutdown(self):
task, self._task = self._task, None # avoid cancelling twice
if task is None or task.cancelled():
return
task.cancel()
# CancelledError is handled by @recurring_check():
await task
async def _checkpoint(self):
# 1. may not shrink database wal file in case of this command will be
# during external read process took place
# 2. returning immediately without result if database
# has concurrent transaction
self._db.execute_sql("PRAGMA wal_checkpoint(TRUNCATE)")
defence360agent/plugins/client.py 0000644 0000000 0000000 00000046121 00000000000 014063 0 ustar import asyncio
import concurrent.futures
import contextlib
import json
import logging
import os
import time
import uuid
from typing import Generator
from defence360agent.api.server import (
APIError,
APIErrorTooManyRequests,
APITokenError,
send_message,
)
from defence360agent.contracts import license
from defence360agent.contracts.config import Core
from defence360agent.contracts.messages import (
GeneralMetrics,
Message,
MessageList,
MessageType,
)
from defence360agent.contracts.plugins import MessageSink, expect
from defence360agent.internals import delivery_ack, feature_flags
from defence360agent.internals.feature_flags import (
MESSAGE_LOSS_OBSERVABILITY_FLAG,
is_enabled,
)
from defence360agent.internals.message_status_publisher import Gen, publisher
from defence360agent.internals.persistent_message import (
PersistentMessagesQueue,
)
from defence360agent.utils import (
log_future_errors,
recurring_check,
safe_cancel_task,
Scope,
)
from defence360agent.utils.json import ServerJSONEncoder
logger = logging.getLogger(__name__)
_reporter_gen_queued = Gen()
_reporter_gen_sending = Gen()
_reporter_gen_sent = Gen()
class SendToServerClient:
"""Send messages to server.
* process Reportable messages;
* add them to a pending messages list;
* send all pending messages to server when list is full (contains
_PENDING_MESSAGES_LIMIT items or more) or when the oldest pending
message has waited the max send delay (0 unless batching is
enabled via the feature flag);
* send all pending messages on plugin shutdown."""
_PENDING_MESSAGES_LIMIT = int(
os.environ.get("IMUNIFYAV_MESSAGES_COUNT_TO_SEND", 20)
)
_MAX_SEND_DELAY = 0.0
_BATCHING_FLAG = "message_send_batching"
# paces retries of messages re-queued after failed sends
_SEND_MESSAGE_RECURRING_TIME = 60
_METRICS_REPORT_INTERVAL = 60 * 5
# 50 second because it should be less than DefaultTimeoutStopSec
_SHUTDOWN_SEND_TIMEOUT = 50
_METRICS_FLUSH_TIMEOUT = 5
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
self._unsent_metrics = {}
async def create_sink(self, loop: asyncio.AbstractEventLoop):
self._loop = loop
self._pending = PersistentMessagesQueue()
self._try_send = asyncio.Event()
self._lock = asyncio.Lock()
self._shutting_down = asyncio.Event()
self._flush_deadline = None
self._metrics_task = loop.create_task(self._report_metrics())
self._sender_task = loop.create_task(self._send())
self._invoke_send_message_task = loop.create_task(
self._invoke_send_message()
)
@recurring_check(_METRICS_REPORT_INTERVAL)
async def _report_metrics(self):
await self._emit_metrics()
def _collect_metrics(self) -> dict:
return {
"agent.persistent_queue.evicted": self._pending.pop_evicted(),
"agent.msg_status.dropped": publisher.pop_dropped(),
"agent.send.method_missing_dropped": (
send_message.pop_method_missing_dropped()
),
}
def _collect_gauges(self) -> dict:
return {
"agent.persistent_queue.size": self._pending.qsize(),
"agent.persistent_queue.storage_size": self._pending.storage_size,
"agent.msg_status.queue_size": publisher.queue_depth(),
}
async def _emit_metrics(self):
# Deliver outside the persistent send-queue: a loss report routed
# through it could be evicted by the very loss it reports. On failed
# delivery the deltas roll into the next interval's report instead.
metrics = self._unsent_metrics
self._unsent_metrics = {}
collected = self._collect_metrics()
# Flag off: drain and discard so the first report after enabling
# reflects only post-enable activity, not a backlog.
if not is_enabled(MESSAGE_LOSS_OBSERVABILITY_FLAG):
return
for name, value in collected.items():
if value:
metrics[name] = metrics.get(name, 0) + value
sent = False
try:
# Gauge sampling can hit the DB, so it stays inside the guarded
# region: any failure past this point must restore the popped
# deltas rather than count toward recurring_check's error limit.
# Gauges are point-in-time samples: taken fresh each interval and
# never carried over — a stale depth is worse than a missing one.
payload = {**metrics, **self._collect_gauges()}
message = GeneralMetrics(
[
{"name": name, "value": value}
for name, value in payload.items()
]
)
message["timestamp"] = time.time()
message["message_id"] = uuid.uuid4().hex
# Serialize with _send_pending_messages: the NATS sink shares one
# gateway connection between both paths, and reconnecting closes it
# and consumes the reconnect slot, so an unlocked metrics report
# can break a batch that is in flight.
async with self._lock:
sent = await self._send_metrics_direct(message)
except asyncio.CancelledError:
# CancelledError is not an Exception: without this branch a
# cancellation landing mid-send would eat the popped deltas.
self._unsent_metrics = metrics
raise
except Exception as exc:
logger.warning("Failed to deliver loss metrics: %r", exc)
if not sent:
self._unsent_metrics = metrics
async def _send_metrics_direct(self, message: Message) -> bool:
with self._get_api() as api:
await api.send_messages(
[(time.time(), self._encode_data_to_put_in_queue(message))]
)
return True
async def shutdown(self) -> None:
"""
When shutdown begins it signals any in-flight HTTP sends to
abort immediately (via _shutting_down event), then gives 50
seconds to finish the stop() sequence. If stop() isn't done
in 50 seconds it force-cancels the sender task.
Finally, any messages still in the buffer are flushed to
persistent storage so nothing is lost.
"""
# Signal shutdown — aborts in-flight HTTP requests from the
# _send task via the asyncio.wait race in _send_pending_messages.
# This lets stop() acquire the lock quickly instead of waiting
# for a slow HTTP response. The event is cleared in stop()
# before the final _send_pending_messages() flush so that
# remaining messages are actually delivered during shutdown.
self._shutting_down.set()
try:
await asyncio.wait_for(self.stop(), self._SHUTDOWN_SEND_TIMEOUT)
except asyncio.TimeoutError:
# Used logger.error to notify sentry
logger.error(
"Timeout (%ds) sending messages to server on shutdown.",
self._SHUTDOWN_SEND_TIMEOUT,
)
if not self._sender_task.cancelled():
await safe_cancel_task(self._sender_task)
if self._pending.buffer_size > 0:
logger.warning(
"Save %s messages to persistent storage",
self._pending.buffer_size,
)
self._pending.push_buffer_to_storage()
logger.warning("Stored queue %r", self._pending.qsize())
async def stop(self):
"""
Stop sending.
1. wait for the lock being available
i.e., while _sender_task finishes the current round
of sending message (if it takes too long, then
the timeout in shutdown() is triggered
2. once the sending round complete (we got the lock),
cancel the next iteration of the _sender_task (it exits)
3. send _pending messages (again, if it takes too long,
the timeout in shutdown() is triggered
and the coroutine is cancelled
That method makes sure that the coroutine
that was started in it has ended.
It excludes a situation when:
-> The result of a coroutine that started
BEFORE shutdown() is started.
-> And the process of sending messages
from _pending is interrupted because of it
"""
# The _lock allows you to be sure that the _send_pending_messages
# coroutine is not running and _pending is not being used
logger.info("SendToServer.stop cancel _invoke_send_message_task")
await safe_cancel_task(self._invoke_send_message_task)
if self._metrics_task is not None:
await safe_cancel_task(self._metrics_task)
logger.info("SendToServer.stop wait lock")
async with self._lock:
# Cancel _sender_task. The lock ensures that the coroutine
# is not in its critical part
logger.info("SendToServer.stop lock acquired, cancel _sender_task")
await safe_cancel_task(self._sender_task)
# Clear the shutdown signal so the final flush actually
# delivers messages instead of re-queuing them.
self._shutting_down.clear()
# send messages that are in _pending at the time of agent shutdown
await self._send_pending_messages()
if self._metrics_task is not None:
# Final metrics flush: after the real messages so it cannot eat
# their shutdown budget, time-bounded for the same reason, and
# only once the task is cancelled so it cannot race this emit.
with contextlib.suppress(asyncio.TimeoutError):
await asyncio.wait_for(
self._emit_metrics(), self._METRICS_FLUSH_TIMEOUT
)
@staticmethod
def _set_api_attrs(api):
api.set_product_name(license.LicenseCLN.get_product_name())
api.set_server_id(license.LicenseCLN.get_server_id())
api.set_license(license.LicenseCLN.get_token())
return api
@contextlib.contextmanager
def _get_api(self) -> Generator[send_message.SendMessageAPI, None, None]:
base_url = os.environ.get("IMUNIFYAV_API_BASE")
# we send messages sequentially, so max_workers=1
with concurrent.futures.ThreadPoolExecutor(max_workers=2) as executor:
api = send_message.SendMessageAPI(
Core.VERSION, base_url, executor=executor
)
yield self._set_api_attrs(api)
@expect(MessageType.Reportable)
async def send_to_server(self, message: Message) -> None:
# add message handling time if it does not exist, so that
# the server does not depend on the time it was received
if "timestamp" not in message:
message["timestamp"] = time.time()
if "message_id" not in message:
message["message_id"] = uuid.uuid4().hex
self._pending.put(self._encode_data_to_put_in_queue(message))
self._try_send.set()
publisher.report(message, _reporter_gen_queued, stage="agent-queued")
@recurring_check(_SEND_MESSAGE_RECURRING_TIME)
async def _invoke_send_message(self):
self._try_send.set()
def _max_send_delay(self) -> float:
if feature_flags.is_enabled(self._BATCHING_FLAG):
for value in feature_flags.get_params(self._BATCHING_FLAG):
try:
return float(value)
except ValueError:
pass
return self._MAX_SEND_DELAY
@recurring_check(0)
async def _send(self):
if self._flush_deadline is None:
await self._try_send.wait()
else:
timeout = max(0, self._flush_deadline - self._loop.time())
with contextlib.suppress(asyncio.TimeoutError):
await asyncio.wait_for(self._try_send.wait(), timeout)
self._try_send.clear()
qsize = self._pending.qsize()
if qsize == 0:
self._flush_deadline = None
return
if self._flush_deadline is None:
self._flush_deadline = self._loop.time() + self._max_send_delay()
if (
qsize < self._PENDING_MESSAGES_LIMIT
and self._loop.time() < self._flush_deadline
):
return
self._flush_deadline = None
# The _lock protects critical part of _send method
logger.info("SendToServer._send wait lock")
need_to_cancel = None
async with self._lock:
logger.info("SendToServer._send lock acquired")
try:
await self._send_pending_messages()
except asyncio.CancelledError as e:
logger.info("SendToServer._send cancelled unlocking")
need_to_cancel = e
logger.info("SendToServer._send lock released")
if need_to_cancel:
raise need_to_cancel
def _encode_data_to_put_in_queue(self, data: Message) -> bytes:
msg = json.dumps(data, cls=ServerJSONEncoder) + "\n"
return msg.encode()
def _decode_message(self, message: bytes) -> Message:
data = json.loads(message)
if data.get("list"):
msg = MessageList(data["list"])
msg.update({k: v for k, v in data.items() if k != "list"})
return msg
return Message(data)
def _persist_failed(self, message_id, timestamp, message):
message["api_retries_count"] = message.get("api_retries_count", 0) + 1
encoded = self._encode_data_to_put_in_queue(message)
if message_id is None:
# never stored yet: make it durable now, not on the next flush
self._pending.put(encoded, timestamp=timestamp)
self._pending.push_buffer_to_storage()
else:
self._pending.update_message(message_id, encoded)
async def _send_one_message(self, api, message):
"""Race the HTTP send against the shutdown signal.
Returns True on success, raises on API error,
or returns False if shutdown interrupted the send.
"""
send_task = asyncio.ensure_future(api.send_message(message))
# Consume errors of an abandoned send; the handled path warns.
send_task.add_done_callback(
lambda task: log_future_errors(task, logger.debug)
)
shutdown_task = asyncio.ensure_future(self._shutting_down.wait())
try:
done, pending_tasks = await asyncio.wait(
{send_task, shutdown_task},
return_when=asyncio.FIRST_COMPLETED,
)
except asyncio.CancelledError:
send_task.cancel()
shutdown_task.cancel()
raise
for task in pending_tasks:
await safe_cancel_task(task)
if send_task in done:
# Prefer send completion when both tasks finish in one loop turn.
send_task.result()
return True
# Shutdown won the race
return False
async def _try_send_one(self, api, message_id, timestamp, message_bytes):
"""Deliver one message and return (stop, failed); message_id is None
for a fresh memory-only message, set for a stored row."""
if self._shutting_down.is_set():
logger.warning(
"Shutdown signal received, keeping remaining messages"
)
return True, False
message = self._decode_message(message_bytes)
msg_info = {
"method": message.get("method"),
"message_id": message.get("message_id"),
}
try:
publisher.report(
message, _reporter_gen_sending, stage="agent-sending"
)
sent = await self._send_one_message(api, message)
if not sent:
logger.warning(
"Shutdown signal received during send,"
" keeping remaining messages"
)
return True, False
# Dropped, not delivered; the agent-sending report above stays,
# so the loss surfaces as a stage gap rather than a delivery.
if msg_info["method"]:
publisher.report(
message, _reporter_gen_sent, stage="agent-sent"
)
logger.info("message sent %s", msg_info)
delivery_ack.registry.confirm(message.get("message_id"))
if message_id is not None:
self._pending.delete([message_id])
return False, False
except (APIErrorTooManyRequests, APITokenError) as exc:
logger.warning(
"Failed to send message %s to server: %s", msg_info, exc
)
self._persist_failed(message_id, timestamp, message)
return True, True
except APIError as exc:
logger.warning(
"Failed to send message %s to server: %s", msg_info, exc
)
self._persist_failed(message_id, timestamp, message)
return False, True
async def _send_pending_messages(self) -> None:
with self._get_api() as api:
if api.server_id is None:
return
# stored backlog (older, not deleted) first, then fresh buffer
batch = list(self._pending.peek_stored()) + [
(None, timestamp, message_bytes)
for timestamp, message_bytes in self._pending.drain_buffer()
]
logger.info("Sending %s messages", len(batch))
failure_count = 0
processed = 0
try:
for message_id, timestamp, message_bytes in batch:
stop, failed = await self._try_send_one(
api, message_id, timestamp, message_bytes
)
if stop and not failed:
# shutdown aborted this message before any attempt;
# leave it in the un-attempted tail so it is persisted
break
processed += 1
if failed:
failure_count += 1
if stop:
# server-level stop: the rest won't send either
failure_count += len(batch) - processed
break
finally:
# un-attempted fresh messages are memory-only; stored are not
unattempted_fresh = [
(ts, mb)
for mid, ts, mb in batch[processed:]
if mid is None
]
if unattempted_fresh:
self._pending.put_many(unattempted_fresh)
self._pending.push_buffer_to_storage()
logger.info("Unsuccessful to send %s messages", failure_count)
class SendToServer(SendToServerClient, MessageSink):
SCOPE = Scope.AV
SHUTDOWN_PRIORITY = 900 # Shutdown late, after Accumulate has flushed
async def _send_metrics_direct(self, message: Message) -> bool:
with self._get_api() as api:
if api.server_id is None:
return False
await api.send_message(message)
return True
defence360agent/plugins/config_merger.py 0000644 0000000 0000000 00000001474 00000000000 015415 0 ustar import logging
from defence360agent.contracts.config import ConfigValidationError, Merger
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import MessageSink, expect
logger = logging.getLogger(__name__)
class ConfigMerger(MessageSink):
PROCESSING_ORDER = MessageSink.ProcessingOrder.PRE_PROCESS_MESSAGE
def __init__(self):
self.loop = None
async def create_sink(self, loop):
self.loop = loop
@expect(MessageType.ConfigUpdate)
async def update_merged_config(self, message):
try:
Merger.update_merged_config()
except ConfigValidationError as err:
logger.error("Config is invalid. Will not update: %s", err)
finally:
if event := message.get("event"):
event.set()
defence360agent/plugins/config_watcher.py 0000644 0000000 0000000 00000003616 00000000000 015571 0 ustar import time
from defence360agent.contracts import config
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import (
MessageSink,
MessageSource,
expect,
)
from defence360agent.utils import recurring_check, Scope
POLLING_INTERVAL = config.int_from_envvar("READ_CONFIG_POLLING_INTERVAL", 30)
class ConfigWatcher(MessageSink, MessageSource):
"""Send ConfigUpdate message on [root's] config update.
The config update is detected by polling config file's
modification time.
"""
SCOPE = Scope.AV
def __init__(self):
self._config = config.ConfigFile()
self._last_notify_time = 0
self._sink = None
self._task = None
async def create_sink(self, loop):
"plugins.MessageSink method"
@expect(MessageType.ConfigUpdate)
async def on_config_update_message(self, message):
# update the time, to avoid sending duplicate ConfigUpdate
# messages after the "config update" command
self._last_notify_time = message["timestamp"]
async def create_source(self, loop, sink):
self._sink = sink
self._task = loop.create_task(self._check_config())
async def shutdown(self):
if self._task is not None:
t, self._task = self._task, None
t.cancel()
await t
self._sink = None
@recurring_check(POLLING_INTERVAL)
async def _check_config(self):
if config.any_layer_modified_since(self._last_notify_time):
# notify about the update
message = MessageType.ConfigUpdate(
conf=self._config, timestamp=time.time()
)
await self._sink.process_message(message)
# update the time here, in case ConfigUpdate might stuck
# in the queue for longer than the polling interval
self._last_notify_time = message["timestamp"]
defence360agent/plugins/event_hook_executor.py 0000644 0000000 0000000 00000001411 00000000000 016655 0 ustar from defence360agent.contracts.hook_events import HookEvent
from defence360agent.contracts.plugins import (
MessageSink,
MessageSource,
expect,
)
from defence360agent.hooks.execute import execute_hooks
EVENTS = (
HookEvent.AgentStarted,
HookEvent.AgentMisconfig,
HookEvent.LicenseExpired,
HookEvent.LicenseExpiring,
HookEvent.LicenseRenewed,
)
class EventHookExecutor(MessageSink, MessageSource):
PROCESSING_ORDER = MessageSink.ProcessingOrder.EVENT_HOOK
async def create_sink(self, loop):
self._loop = loop
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
@expect(*EVENTS)
async def receive_event(self, event):
self._loop.create_task(execute_hooks(event))
defence360agent/plugins/event_monitor.py 0000644 0000000 0000000 00000006352 00000000000 015477 0 ustar import json
from abc import ABC
from logging import getLogger
from pathlib import Path
from typing import Dict, List, Optional
from defence360agent.contracts.config import Core
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import MessageSource
from defence360agent.feature_management.plugins.native import (
NativeFeatureManagementSettingsChange,
)
from defence360agent.plugins.event_monitor_message_processor import (
EventProcessorBase,
UserConfigProcessor,
)
from defence360agent.utils import recurring_check, safe_cancel_task
logger = getLogger(__name__)
class EventMonitor(MessageSource, ABC):
EVENT_DIR = Core.INBOX_HOOKS_DIR
PATTERN = "*.*.*.*.json"
def __init__(self):
self._loop = None
self._sink = None
self._processors: List[EventProcessorBase] = []
self._processing_task = None
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
self._processors.append(NativeFeatureManagementSettingsChange(loop))
self._processors.append(UserConfigProcessor(loop))
self._processing_task = self._loop.create_task(
self._check_inbox_folder_generate_events()
)
async def shutdown(self):
await safe_cancel_task(self._processing_task)
@staticmethod
def _rmfile(file: Path): # pragma: no cover
try:
file.unlink()
except FileNotFoundError:
pass # do nothing if we cannot remove it, just skip it
except Exception as e:
logger.warning("Couldn't remove file %s %s", file, e)
@staticmethod
def _from_json(file: Path) -> Dict:
return json.loads(file.read_text())
def _event_to_message(self, file) -> Optional[MessageType.cPanelEvent]:
try:
username, hook, ts1, ts2, *_ = file.name.split(".")
ts = float(ts1 + "." + ts2)
except ValueError:
logger.warning("hook-event-file detected with wrong name %s", file)
return None
try:
return MessageType.cPanelEvent.from_hook_event(
username=username,
hook=hook,
ts=ts,
fields=self._from_json(file),
)
except FileNotFoundError: # pragma: no cover
# already deleted
logger.warning("hook file disappeared %s", file)
except json.JSONDecodeError:
# wrong format or broken json
logger.warning("hook file have broken json %s", file)
return None
@recurring_check(30)
async def _check_inbox_folder_generate_events(self):
for file in Path(self.EVENT_DIR).glob("*.*.*.json"):
try:
message = self._event_to_message(file)
if message is not None:
for processor in self._processors:
if await processor.is_enabled():
processor.add_message(message)
except Exception as exc: # pragma: no cover
logger.error("Failed to process %s hook event", exc)
finally:
self._rmfile(file)
for processor in self._processors:
await processor.process_messages()
defence360agent/plugins/event_monitor_message_processor.py 0000644 0000000 0000000 00000015557 00000000000 021311 0 ustar import asyncio
import logging
import os
from abc import ABC, abstractmethod
from collections import defaultdict
from heapq import heappop, heappush
from typing import Dict
from defence360agent.contracts.config import Core
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import BaseMessageProcessor, expect
from defence360agent.utils import is_safe_subdir_name, rmtree
logger = logging.getLogger()
class EventProcessorBase(BaseMessageProcessor, ABC):
def __init__(self, loop):
# note: empty list is a heap (no need for heapify here)
self._msg_buf = defaultdict(list)
self._loop = loop
def add_message(self, message):
heappush(
self._msg_buf[message["username"]], (message["timestamp"], message)
)
async def process_messages(self):
await asyncio.gather(
*(
self.process_user_messages(user_messages)
for user_messages in self._msg_buf.values()
)
)
@expect(MessageType.cPanelEvent)
async def process_event(self, message):
if not self._message_is_relatable(message): # pragma: no cover
return
if message.hook == "Modify":
await self._process_modify(message)
elif message.hook == "Create":
await self._process_create(message)
elif message.hook == "change_package":
await self._process_change_package(message)
elif message.hook == "Remove":
await self._process_account_removed(message)
async def process_user_messages(self, messages):
for _ in range(len(messages)):
await self.process_message(heappop(messages)[1])
@abstractmethod
async def _process_modify(self, message):
"""Modify hook"""
@abstractmethod
async def _process_create(self, message):
"""Create hook"""
@abstractmethod
async def _process_change_package(self, message):
"""change_package hook"""
@abstractmethod
async def _process_account_removed(self, message):
"""Remove hook"""
@abstractmethod
def _message_is_relatable(self, message):
"""Whether the message should be processed"""
@abstractmethod
async def is_enabled(self):
"""Whether messages should be processed"""
class SettingsChangeBase(EventProcessorBase, ABC):
"""Process hook event messages from cPanel"""
async def _process_modify(self, message):
package_field = "plan" if "plan" in message.data else "exclude"
await self._get_settings_and_update(message, package_field)
async def _process_create(self, message):
await self._get_settings_and_update(message, "plan", True)
async def _process_change_package(self, message):
await self._get_settings_and_update(message, "new_pkg", True)
async def _process_account_removed(self, message):
pass
async def _get_settings_and_update(
self,
message,
package_field: str,
add_to_package: bool = False,
) -> None:
logger.info("Get settings from %s", message)
settings = await self._get_settings_from_message(message)
await self._apply_settings(
message, package_field, add_to_package, settings
)
async def _apply_settings(
self, message, package_field, add_to_package, settings
):
logger.info("Step 1 %s ", settings)
# Do nothing if there are no values for Imunify360 features
# in the message for Modify hook
if (
message.get("plan") is None
and message["hook"] == "Modify"
and all(value is None for value in settings.values())
):
return
if not all(settings.values()):
try:
package_name = message.data[package_field]
except KeyError:
logger.warning("No information about package in message")
fallback_settings = self._default_settings()
else:
fallback_settings = await self._get_package_settings(
package_name, add_to_package
)
for feature, value in settings.items():
if value is None:
settings[feature] = fallback_settings[feature]
logger.info(
"Settings specified in hook message %s for %s",
settings,
message["username"],
)
for feature, value in settings.items():
await self.on_settings_change(message["username"], feature, value)
@abstractmethod
def _message_is_relatable(self, message):
"""Whether the message should be processed"""
@abstractmethod
async def on_settings_change(self, user, feature, value):
"""What to do after settings were changed (e.g. sync the DB)"""
@staticmethod
@abstractmethod
def _default_settings() -> Dict[str, str]:
"""Get default package settings"""
@abstractmethod
async def _get_settings_from_message(self, message):
"""Retrieve settings from the message"""
@classmethod
@abstractmethod
async def _get_package_settings(
cls, package_name: str, add_to_package: bool
) -> Dict[str, str]:
"""Get current package settings"""
@abstractmethod
async def is_enabled(self):
"""Whether messages should be processed"""
class UserConfigProcessor(EventProcessorBase):
def _message_is_relatable(self, message):
return True
async def is_enabled(self):
return True
async def _process_account_removed(self, message):
user = message.get("user") or message.get("username")
if not is_safe_subdir_name(user):
return
target = os.path.join(Core.USER_CONFDIR, user)
try:
rmtree(target)
except FileNotFoundError:
pass
except OSError as e:
logger.warning(
"Failed to remove user_config dir %s: %s", target, e
)
async def _process_modify(self, message):
old_username = message.data.get("old_username")
new_username = message.username
if not (
old_username
and is_safe_subdir_name(old_username)
and is_safe_subdir_name(new_username)
):
return
try:
os.rename(
os.path.join(Core.USER_CONFDIR, old_username),
os.path.join(Core.USER_CONFDIR, new_username),
)
except FileNotFoundError:
pass
except OSError as e:
logger.warning(
"Failed to rename user_config %s -> %s: %s",
old_username,
new_username,
e,
)
async def _process_create(self, message):
"""Create hook"""
async def _process_change_package(self, message):
"""change_package hook"""
defence360agent/plugins/feature_flags.py 0000644 0000000 0000000 00000021370 00000000000 015413 0 ustar """
Feature flags synchronisation plugin (AV mode only).
In IM360 mode the Go resident-agent handles feature-flag sync.
In AV mode there is no resident-agent, so this plugin takes over.
Periodically POSTs the local file checksum to the API and writes
back any updated flags to ``/var/imunify360/feature_flags.json`` (legacy map
``{flag: true}`` on disk) and ``/var/imunify360/feature_flags`` (plain names,
one per line). The POSTed checksum is over the canonical JSON **array** of
enabled names, matching the correlation sync API—not over the on-disk map bytes.
"""
import asyncio
import json
import logging
import os
import urllib.error
import urllib.request
from defence360agent.contracts.config import Core
from defence360agent.contracts.plugins import MessageSource
from defence360agent.internals.feature_flags import (
FLAGS_PATH,
FLAGS_PLAIN_PATH,
enabled_flag_names_sorted,
plain_text_payload_for_enabled_flags,
serialize_feature_flags_file_payload,
sync_checksum_hex_from_flags_file,
sync_response_file_bytes,
)
from defence360agent.internals.iaid import (
IAIDTokenError,
IndependentAgentIDAPI,
)
from defence360agent.utils import Scope, atomic_rewrite
logger = logging.getLogger(__name__)
_SYNC_URL = "/api/sync/v1/feature-flags"
def _env_int(name: str, default: int) -> int:
"""Read an int env var tolerantly.
A non-numeric value (empty string, typo, etc.) must NOT raise at
import time — the plugin lives in the AV agent entry point and a
bad env var would otherwise kill the whole agent.
"""
raw = os.environ.get(name)
if not raw:
return default
try:
return int(raw)
except ValueError:
logger.warning(
"feature-flags: %s=%r is not an int, using default %d",
name,
raw,
default,
)
return default
_TRUE_VALUES = frozenset({"1", "true", "yes", "on"})
_FALSE_VALUES = frozenset({"0", "false", "no", "off"})
def _env_bool(name: str, default: bool) -> bool:
raw = os.environ.get(name)
if not raw:
return default
normalized = raw.strip().lower()
if normalized in _TRUE_VALUES:
return True
if normalized in _FALSE_VALUES:
return False
logger.warning(
"feature-flags: %s=%r is not a bool, using default %s",
name,
raw,
default,
)
return default
_SYNC_INTERVAL = _env_int("I360_FEATURE_FLAGS_SYNC_INTERVAL", 3600)
_INITIAL_DELAY = _env_int("I360_FEATURE_FLAGS_INIT_DELAY", 10)
_UNREGISTERED_DELAY = _env_int("I360_FEATURE_FLAGS_UNREG_DELAY", 30)
_USE_SERVER_DELAY = _env_bool("I360_FEATURE_FLAGS_USE_SERVER_DELAY", True)
_HTTP_TIMEOUT = 30
def _next_delay(server_delay: int) -> int:
if _USE_SERVER_DELAY and server_delay > 0:
return server_delay
return _SYNC_INTERVAL
class FeatureFlagsSync(MessageSource):
SCOPE = Scope.AV
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
self._task = loop.create_task(self._sync_loop())
async def shutdown(self):
if self._task is not None:
self._task.cancel()
try:
await self._task
except asyncio.CancelledError:
pass
def _local_checksum(self) -> str:
return sync_checksum_hex_from_flags_file(FLAGS_PATH)
async def _sync_loop(self):
await asyncio.sleep(_INITIAL_DELAY)
while True:
delay = _SYNC_INTERVAL
try:
if not IndependentAgentIDAPI.is_registered():
delay = _UNREGISTERED_DELAY
else:
delay = _next_delay(await self._do_sync())
except asyncio.CancelledError:
raise
except Exception:
logger.warning("feature flags sync failed", exc_info=True)
await asyncio.sleep(delay)
async def _do_sync(self) -> int:
try:
token = await IndependentAgentIDAPI.get_token()
except IAIDTokenError:
logger.warning("no IAID token, skipping feature flags sync")
return 0
loop = asyncio.get_event_loop()
checksum = await loop.run_in_executor(None, self._local_checksum)
payload = json.dumps({"checksum": checksum}).encode()
base_url = os.getenv("I360_FEATURE_FLAGS_API_URL", Core.API_BASE_URL)
url = base_url.rstrip("/") + _SYNC_URL
req = urllib.request.Request(
url,
data=payload,
headers={
"Content-Type": "application/json",
"X-Auth": token,
},
method="POST",
)
try:
resp_body = await loop.run_in_executor(
None, self._blocking_request, req
)
except urllib.error.HTTPError as e:
# Non-5xx (404/403/4xx) is usually a server-side routing or
# auth state, not an agent bug — keep it a one-line WARNING.
# 5xx means the server actually misbehaved; keep the traceback.
if 500 <= e.code < 600:
logger.error(
"feature flags sync HTTP %s on %s: %s",
e.code,
url,
e.reason,
)
else:
logger.warning(
"feature flags sync HTTP %s on %s: %s",
e.code,
url,
e.reason,
)
return 0
except (urllib.error.URLError, TimeoutError) as e:
# DNS, connection refused, TLS, timeout — transient network
# conditions, not bugs. One-line WARNING so logs stay readable.
# A timeout during resp.read() escapes urlopen as a bare
# TimeoutError, not wrapped in URLError.
logger.warning(
"feature flags sync connection failed on %s: %s",
url,
getattr(e, "reason", e),
)
return 0
except Exception:
logger.error(
"feature flags sync request failed on %s",
url,
exc_info=True,
)
return 0
try:
result = json.loads(resp_body)
except json.JSONDecodeError:
logger.error("failed to parse feature flags response")
return 0
server_delay = result.get("delay", 0)
if result.get("changed") is False:
logger.debug("feature flags unchanged, skipping write")
return server_delay
flags = result.get("flags")
params = result.get("params") or {}
if flags is not None:
await loop.run_in_executor(None, self._write_flags, flags, params)
return server_delay
@staticmethod
def _blocking_request(req: urllib.request.Request) -> bytes:
with urllib.request.urlopen(req, timeout=_HTTP_TIMEOUT) as resp:
return resp.read()
@staticmethod
def _write_flags(flags, params=None) -> None:
"""Persist flags + params on disk in the canonical sync-response
shape so the next sync's checksum matches what the server returned.
Falls back to the legacy ``{name: true}`` map when ``flags`` is not
a list (response shape we don't recognise) — keeps the long-standing
on-disk contract from older code paths.
"""
params = params or {}
try:
if isinstance(flags, list):
names = [n for n in flags if isinstance(n, str)]
cleaned = {
name: [v for v in vals if isinstance(v, str)]
for name, vals in params.items()
if isinstance(name, str) and isinstance(vals, list)
}
data = sync_response_file_bytes(names, cleaned)
else:
data = serialize_feature_flags_file_payload(flags)
except TypeError:
logger.warning(
"feature flags sync: unexpected flags type %r, skipping write",
type(flags).__name__,
)
return
n_active = len(enabled_flag_names_sorted(flags))
try:
os.makedirs(os.path.dirname(FLAGS_PATH), exist_ok=True)
# Atomic write-to-temp + rename so a crash mid-write can't
# leave the flags file truncated/corrupt — otherwise readers
# would fall back to defaults until the next sync.
atomic_rewrite(FLAGS_PATH, data, backup=False)
plain = plain_text_payload_for_enabled_flags(flags)
atomic_rewrite(FLAGS_PLAIN_PATH, plain, backup=False)
logger.info("feature flags synced: %d flags active", n_active)
except OSError:
logger.error("failed to write flags file", exc_info=True)
defence360agent/plugins/files_recurring_update.py 0000644 0000000 0000000 00000002141 00000000000 017323 0 ustar import logging
from defence360agent import files
from defence360agent.contracts import config, messages
from defence360agent.contracts.plugins import MessageSource
from defence360agent.utils import recurring_check
logger = logging.getLogger(__name__)
class FilesRecurringUpdateTask(MessageSource):
async def _on_files_update(
self, index: files.Index, is_updated: bool
) -> None:
if is_updated:
message = messages.MessageType.FilesUpdated(index.type, index)
await self._sink.process_message(message)
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
self._task = loop.create_task(self._update_task())
# subscribe to file updates
for type_ in files.Index.types():
files.Index.add_hook(type_, self._on_files_update)
async def shutdown(self):
self._task.cancel()
# CancelledError is handled by @recurring_check():
await self._task
@recurring_check(config.FilesUpdate.PERIOD)
async def _update_task(self):
await files.update_and_log_error()
defence360agent/plugins/icontact_sender.py 0000644 0000000 0000000 00000010661 00000000000 015751 0 ustar import asyncio
import logging
import time
from pathlib import Path
from defence360agent.internals.iaid import IAIDTokenError
from defence360agent.api.server import APIError
from defence360agent.api.server.events import EventsAPI
from defence360agent.contracts.config import (
Core,
IContactMessageType,
)
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import (
MessageSink,
MessageSource,
)
from defence360agent.internals.the_sink import TheSink
from defence360agent.model.icontact import IContactThrottle
from defence360agent.subsys.panels.cpanel import cPanel
from defence360agent.subsys.panels.plesk import Plesk
from defence360agent.subsys.panels.hosting_panel import HostingPanel
from defence360agent.utils import (
await_for,
create_task_and_log_exceptions,
recurring_check,
retry_on,
Scope,
)
from defence360agent.utils.common import DAY
logger = logging.getLogger(__name__)
async def async_log_on_error(e, i):
logger.warning(
"Can't get recommendations for the dashboard due to "
"iaid token error, reason: %s. Attempt %s",
e,
i,
)
await_for(seconds=100)
class IContactSender(MessageSink, MessageSource):
PROCESSING_ORDER = MessageSink.ProcessingOrder.ICONTACT_SENT
SCOPE = Scope.AV_IM360
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
self._tasks = []
self._notification_flag_path = (
Path(Core.TMPDIR) / "icontact_generic_notifications"
)
async def create_sink(self, loop):
pass
async def _send_icontact_message(
self,
*,
message_type,
params,
period_limit,
user=None,
):
if message_type is None:
return
if not IContactThrottle.may_be_notified(
message_type,
period_limit,
user=user,
):
return
template_args = await self._panel.notify(
message_type=IContactMessageType.GENERIC,
params=params,
user=user,
)
if template_args:
IContactThrottle.refresh(message_type, user=user)
sent_message = MessageType.IContactSent(
message_type=message_type,
timestamp=int(time.time()),
template_args=template_args,
)
await self._sink.process_message(sent_message)
async def create_source(self, loop, sink: TheSink):
self._sink = sink
self._panel = HostingPanel()
if self._panel.NAME in [cPanel.NAME, Plesk.NAME]:
self._tasks = [
create_task_and_log_exceptions(
loop, self.generic_notifications
)
]
async def shutdown(self):
for task in self._tasks:
task.cancel()
await asyncio.gather(*self._tasks, return_exceptions=True)
@retry_on(
APIError,
on_error=await_for(seconds=10),
max_tries=3,
silent=True,
log=logger,
)
@retry_on(
IAIDTokenError,
on_error=async_log_on_error,
max_tries=3,
silent=True,
log=logger,
)
async def get_notifications(self) -> list:
notifications = []
if (
not self._notification_flag_path.exists()
or (self._notification_flag_path.stat().st_mtime + DAY)
< time.time()
): # send notification request no more than once a day
notifications = await EventsAPI.notification()
# update flag modify time
self._notification_flag_path.touch(mode=0o644, exist_ok=True)
return notifications
@recurring_check(DAY)
async def generic_notifications(self):
if notifications := await self.get_notifications():
logger.info(
"Sending %s generic icontact notifications", len(notifications)
)
for notification in notifications:
await self._send_icontact_message(
message_type=notification["type"],
params={
"subject": notification["notification_subject"],
"body_html": notification["notification_body_html"],
},
period_limit=notification["notification_period_limit"],
user=notification.get("notification_user"),
)
defence360agent/plugins/idle_time_out.py 0000644 0000000 0000000 00000002327 00000000000 015427 0 ustar from logging import getLogger
from defence360agent.api import inactivity
from defence360agent.contracts.config import SimpleRpc
from defence360agent.contracts.plugins import MessageSink
from defence360agent.utils import clip, fail_agent_service, recurring_check
logger = getLogger(__name__)
class IdleTimeOutCheck(MessageSink):
async def create_sink(self, loop):
self._loop = loop
if SimpleRpc.SOCKET_ACTIVATION:
inactivity.track.reset_timer()
self._task = loop.create_task(
recurring_check(
period=clip(
SimpleRpc.INACTIVITY_TIMEOUT // 5, low=1, high=60
),
)(
self._check_timeout,
)()
)
else:
self._task = None
async def shutdown(self):
if self._task:
self._task.cancel()
# CancelledError is handled by @recurring_check():
await self._task
async def _check_timeout(self):
logger.info("Periodical check %s ", inactivity.track)
if inactivity.track.is_timeout():
logger.warning("Shutting down due to inactivity.")
fail_agent_service()
defence360agent/plugins/lve_utils_install.py 0000644 0000000 0000000 00000003431 00000000000 016336 0 ustar from defence360agent.contracts.plugins import MessageSink
from defence360agent.utils import (
check_run_outside_sandbox,
recurring_check,
RecurringCheckStop,
)
from defence360agent.utils.resource_limits import is_lve_active, has_lvectl
class LveUtilsAutoInstaller(MessageSink):
"""
Install lve-utils package on CL with LVE automatically
(according to DEF-11452) to provide tools to limit CPU/IO.
Used tools:
/usr/sbin/lvectl - provided by lve-utils package
/bin/lve_suwrapper - provided by lve-wrappers package
(which is a dependency of lve-utils)
lve-utils package is installed by default on CL,
but for some reason may not exist.
"""
def __init__(self, *, check_period=3600):
self._check_period = check_period
self._task = None
async def create_sink(self, loop):
self._loop = loop
self._task = self._loop.create_task(
recurring_check(self._check_period)(
self._install_lve_utils_if_needed
)()
)
async def shutdown(self):
if self._task is not None:
self._task.cancel()
await self._task
self._task = None
async def _install_lve_utils_if_needed(self):
if not is_lve_active(): # kernel doesn't support lve or it is disabled
# no point trying to install lve-utils
raise RecurringCheckStop()
# suppose that lve should be actived on CL only
if not has_lvectl(): # utilities might have been removed
# DEF-41613: yum install triggers RPM scriptlets whose LSM
# transition on exec is blocked by the agent unit's NNP.
await check_run_outside_sandbox(
["yum", "-y", "install", "lve-utils"]
)
defence360agent/plugins/myimunify.py 0000644 0000000 0000000 00000003751 00000000000 014635 0 ustar import logging
from defence360agent.contracts.config import MyImunifyConfig
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import (
MessageSink,
MessageSource,
expect,
)
from defence360agent.myimunify.model import update_users_protection
from defence360agent.subsys.panels import hosting_panel
from defence360agent.subsys.persistent_state import load_state, save_state
logger = logging.getLogger(__name__)
class MyImunifyPlugin(MessageSink, MessageSource):
def __init__(self):
self._previous_myimunify_status = (
load_state("MyImunifyPlugin").get("myimunify_enabled")
or MyImunifyConfig.ENABLED
)
self._loop = None
self._sink = None
async def shutdown(self):
save_state(
"MyImunifyPlugin",
{"myimunify_enabled": self._previous_myimunify_status},
)
async def create_sink(self, loop):
pass
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
async def _update_myimunify_users(self):
existing_users = await hosting_panel.HostingPanel().get_users()
await update_users_protection(
self._sink, existing_users, False, force_config_update=True
)
@expect(MessageType.ConfigUpdate)
async def on_config_update(self, message: MessageType.ConfigUpdate):
myimunify_enabled = MyImunifyConfig.ENABLED
previous_status = self._previous_myimunify_status
# We're also triggering additional MessageType.ConfigUpdate messages
# so we must update previous_status before triggering new one
self._previous_myimunify_status = myimunify_enabled
if myimunify_enabled and not previous_status:
await self._update_myimunify_users()
if myimunify_enabled != previous_status:
await hosting_panel.HostingPanel().switch_ui_config(
myimunify_enabled=myimunify_enabled
)
defence360agent/plugins/ping.py 0000644 0000000 0000000 00000001030 00000000000 013530 0 ustar from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import (
MessageSink,
MessageSource,
expect,
)
class SendPing(MessageSource, MessageSink):
async def create_sink(self, loop):
self._loop = loop
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
@expect(MessageType.ServerConnected, MessageType.ServerReconnected)
async def send_ping(self, _):
await self._sink.process_message(MessageType.Ping())
defence360agent/plugins/send_domain_list.py 0000644 0000000 0000000 00000006005 00000000000 016115 0 ustar import datetime
import logging
import pwd
import time
from typing import AsyncIterator
from defence360agent.contracts.config import (
int_from_envvar,
)
from defence360agent.contracts.messages import DomainList
from defence360agent.contracts.myimunify_id import get_myimunify_users
from defence360agent.contracts.plugins import (
MessageSink,
MessageSource,
)
from defence360agent.subsys.panels.base import PanelException
from defence360agent.subsys.panels.hosting_panel import HostingPanel
from defence360agent.utils import (
Scope,
recurring_check,
split_for_chunk,
)
logger = logging.getLogger(__name__)
class SendDomainList(MessageSink, MessageSource):
SCOPE = Scope.AV_IM360
def __init__(self, period=None):
self._task = None
if period:
self._period = period
else:
self._period = int_from_envvar(
"IMUNIFY360_SEND_DOMAIN_PERIOD",
int(datetime.timedelta(days=1).total_seconds()),
)
async def create_sink(self, loop):
"""MessageSink method"""
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
self._task = self._loop.create_task(
recurring_check(self._period)(self._send_domain_list)()
)
async def shutdown(self):
if self._task is not None:
self._task, t = None, self._task
t.cancel()
await t
def _panel_domain_type_to_imunify(self, panel_type: str) -> str:
return {
"main": "primary",
"parked": "alias",
}.get(panel_type, panel_type)
async def _create_domain_list_msg(self) -> AsyncIterator[DomainList]:
hp = HostingPanel()
logger.info("HostingsPanel: %s", hp.NAME)
domains = []
myimunify_users = await get_myimunify_users()
for user in myimunify_users:
username = user["username"]
user_pwd = pwd.getpwnam(username)
for domain_data in await hp.get_user_domains_details(username):
domains.append(
{
"username": username,
"docroot": domain_data.docroot,
"name": domain_data.domain,
"securesite_user_id": user["myimunify_id"],
"uid": user_pwd.pw_uid,
"type": self._panel_domain_type_to_imunify(
domain_data.type
),
}
)
timestamp = time.time()
for chunk in split_for_chunk(domains, chunk_size=3000):
msg = DomainList()
msg["timestamp"] = timestamp
msg["domains"] = chunk
yield msg
async def _send_domain_list(self):
try:
async for msg in self._create_domain_list_msg():
await self._sink.process_message(msg)
except PanelException as e:
logger.warning("Domain list report skipped: %s", e)
defence360agent/plugins/send_server_config.py 0000644 0000000 0000000 00000026367 00000000000 016463 0 ustar import binascii
import datetime
import hashlib
import os
import re
import uuid
from functools import lru_cache
from logging import getLogger
from pathlib import Path
from typing import Dict, List
from defence360agent.contracts import sentry
from defence360agent.contracts.config import (
ConfigFile,
Core,
CustomBillingConfig,
Malware,
MalwareSignatures,
SystemConfig,
int_from_envvar,
FREEMIUM_FEATURE_FLAG,
)
from defence360agent.contracts.license import LicenseCLN
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import (
MessageSink,
MessageSource,
expect,
)
from defence360agent.contracts.myimunify_id import get_myimunify_users
from defence360agent.feature_management.control import (
is_native_feature_management_enabled,
is_native_feature_management_supported,
)
from defence360agent.internals.iaid import IndependentAgentIDAPI
from defence360agent.subsys.panels.hosting_panel import HostingPanel
from defence360agent.subsys.panels.cpanel import cPanel
from defence360agent.utils import (
log_error_and_ignore,
recurring_check,
safe_cancel_task,
Scope,
stub_unexpected_error,
safe_run,
system_packages_info,
)
from defence360agent.subsys.persistent_state import load_state, save_state
from defence360agent.utils.whmcs import WhmcsConf
#: info about these paths is sent to server in SERVER_CONFIG
CH_PATHS = (
"/var/imunify360/imunify360.db",
"/var/imunify360/imunify360.db-shm",
"/var/imunify360/imunify360.db-wal",
"/var/imunify360/gw.dir/",
)
logger = getLogger(__name__)
# Components which version sends to CH
PACKAGES_TO_REPORT = {
"imunify360-firewall",
"imunify-antivirus",
"ai-bolit",
"app-version-detector",
"imunify360-php-i360",
"imunify360-webshield-bundle",
"imunify-realtime-av",
"imunify-realtime-av-imrt2",
"imunify-auditd-log-reader",
"imunify360-pam",
"imunify-notifier",
"imunify360-unified-access-logger",
"imunify360-ossec-server",
"imunify360-ossec",
"imunify-core",
"imunify-ui",
"imunify360-venv",
"imunify-patchman",
"imunify-wp-security",
"rustbolit",
"imunify-release",
"imunify-common",
"alt-common-release",
"alt-php-hyperscan",
"alt-php-internal",
"cloudlinux-backup-utils",
"minidaemon",
}
def read_cpu_info():
with open("/proc/cpuinfo") as f:
return f.read()
@lru_cache(maxsize=1)
def get_cpu_info():
text = read_cpu_info()
tuples = re.findall("^(.*?)[ \t]*:[ \t]*(.*)$", text, flags=re.M)
res: List[dict] = []
current = {}
for key, value in tuples:
if key == "processor":
if current and "processor" in current:
res.append(current)
current = {}
current[key] = value
res.append(current)
return res
@stub_unexpected_error
def get_cpu_cores():
physical_ids = {}
for processor in get_cpu_info():
if (
physical_id := processor.get("physical id", processor["processor"])
) not in physical_ids:
physical_ids[physical_id] = int(processor.get("cpu cores", 1))
return sum(physical_ids.values())
@stub_unexpected_error
def get_cpu_model_and_flags():
processor = get_cpu_info()[0]
return "{} {}".format(
processor.get("model name") or processor["Processor"],
processor.get("flags") or processor["Features"],
)
@stub_unexpected_error
async def get_hosting_panel_version(hp):
return await hp.version()
@stub_unexpected_error
async def get_users_amount(hp):
return await hp.users_count()
@stub_unexpected_error
async def get_domains_amount(hp):
return len(await hp.get_domain_to_owner())
@stub_unexpected_error
def get_malware_db_update_time():
if os.path.exists(MalwareSignatures.AI_BOLIT_HOSTER):
return int(os.path.getmtime(MalwareSignatures.AI_BOLIT_HOSTER))
@stub_unexpected_error
async def get_nfm_state():
if await is_native_feature_management_supported():
return await is_native_feature_management_enabled()
def get_sha256_machine_id():
machine_id = Path("/etc/machine-id")
if machine_id.exists():
return hashlib.sha256(machine_id.read_bytes()).hexdigest()
return None
@stub_unexpected_error
def get_myimunify_whmcs_activation_state():
"""
True only if active in whmcs config
otherwise False
"""
activation_state = WhmcsConf().read().get("status")
return activation_state == "active"
async def get_additional_info(hp):
return {
"cpu_cores": get_cpu_cores(),
"cpuinfo": get_cpu_model_and_flags(),
"hosting_panel_version": await get_hosting_panel_version(hp),
"users_amount": await get_users_amount(hp),
"domains_amount": await get_domains_amount(hp),
"trim_malicious": Malware.CLEANUP_TRIM,
"days_to_keep_backup": Malware.CLEANUP_KEEP,
"malware_db_update_time": get_malware_db_update_time(),
"native_feature_management_enabled": await get_nfm_state(),
"machine_id": get_sha256_machine_id(),
"myimunify_freemium_flag_exists": os.path.exists(
FREEMIUM_FEATURE_FLAG
),
"myimunify_whmcs_activated": get_myimunify_whmcs_activation_state(),
}
async def get_users_configs(hp) -> Dict:
"""
Return dict that includes users config values that are explicitly
set in the corresponding config files.
"""
result = dict()
try:
current_users = frozenset(await hp.get_users())
except Exception:
logger.exception("Failed to get the list of panel's users.")
current_users = frozenset()
users_conf = os.path.join("*", Core.USER_CONFIG_FILE_NAME)
for userconf_file in Path(Core.USER_CONFDIR).glob(users_conf):
if userconf_file.parent.name in current_users:
result[userconf_file.parent.name] = ConfigFile(
username=userconf_file.parent.name
).config_to_dict(normalize=False)
return result
class SendServerConfig(MessageSink, MessageSource):
"""
This plugin is to provide central server with
different server metrics. Message is sent on plugin creation,
and then every :period: seconds
"""
SCOPE = Scope.AV
def __init__(self, period=None):
self._task = None
# timestamp of the last ConfigUpdate sent to the server
self._last_send_time = None # avoid duplicate on startup
if period:
self._period = period
else:
self._period = int_from_envvar(
"IMUNIFY360_SEND_SERVER_CONFIG_PERIOD",
int(datetime.timedelta(days=1).total_seconds() / 3),
)
async def create_sink(self, loop):
"""MessageSink method"""
@expect(MessageType.ConfigUpdate)
@log_error_and_ignore()
async def on_config_update_message(self, message):
if self._last_send_time is None: # 1st ConfigUpdate
# enable sending config on 2nd+ ConfigUpdate
self._last_send_time = 0
return
if not isinstance(message["conf"], SystemConfig):
# ignore user configs, we do not need to send them on each change
# all user configs will be send in
# recurring_check(self._period)(self._send_server_config)()
return
if message["conf"].modified_since(self._last_send_time):
self._last_send_time = message["timestamp"]
self._loop.create_task(self._send_server_config())
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
self._task = self._loop.create_task(
recurring_check(self._period)(self._send_server_config)()
)
async def shutdown(self):
if self._task is not None:
self._task, t = None, self._task
await safe_cancel_task(t)
async def _create_server_config_msg(self):
msg = MessageType.ServerConfig(uname=_uname_info())
diskstat = _diskstat()
if diskstat:
msg["diskstats"] = diskstat
hp = HostingPanel()
license_info = LicenseCLN.license_info()
msg.update(sentry.tags())
msg.update(await get_additional_info(hp))
if hp.NAME == cPanel.NAME:
msg["users"] = await get_myimunify_users()
msg["iaid"] = IndependentAgentIDAPI.get_iaid()
msg["status_license"] = LicenseCLN.is_valid()
msg["system_info"] = {
"uptime_since": await _uptime(),
"devices": await _blkid(),
"mac": await _mac_address(),
}
msg["agent_global_config"] = (
ConfigFile().config_to_dict()
| CustomBillingConfig().config_to_dict()
)
msg["agent_users_configs"] = await get_users_configs(hp)
msg["paths"] = await _get_path_sizes(CH_PATHS)
msg["components_versions"] = await system_packages_info(
PACKAGES_TO_REPORT
)
msg["agent_global_config"][
"CUSTOM_BILLING.effective_upgrade_url"
] = license_info.get("upgrade_url")
msg["agent_global_config"][
"CUSTOM_BILLING.effective_upgrade_url_360"
] = license_info.get("upgrade_url_360")
msg["agent_global_config"]["CORE.doctor_report"] = load_state(
"doctor_key"
).get("doctor_key")
save_state("doctor_key", {"doctor_key": None})
return msg
async def _send_server_config(self):
await self._sink.process_message(
await self._create_server_config_msg()
)
async def _get_path_sizes(paths) -> Dict[str, int]:
"""Return path->size mapping for *paths*.
Send -errno on error.
"""
sizes = {}
for path in map(os.fspath, paths):
try:
if os.path.isdir(path):
size = _compute_dir_size(path)
else:
size = os.path.getsize(path)
except OSError as e:
logger.warning("Can't get size for %s, reason: %s", path, e)
sizes[path] = -e.errno
else:
sizes[path] = size
return sizes
def _compute_dir_size(directory_path: str) -> int:
total_size = 0
def _onerror(err: OSError):
raise err
for root, _dirs, files in os.walk(
directory_path, onerror=_onerror, followlinks=False
):
for file_name in files:
file_path = os.path.join(root, file_name)
try:
total_size += os.path.getsize(file_path)
except OSError as e:
raise e
return total_size
def _diskstat():
try:
with open("/proc/diskstats") as f:
return f.read()
except OSError as e: # pragma: no cover
logger.warning("Can't get diskstat: %s", str(e))
def _uname_info() -> dict:
return dict(
zip(
("sysname", "nodename", "release", "version", "machine"),
os.uname(),
)
)
async def _uptime() -> str:
"""System up since"""
return await safe_run(["uptime", "--since"])
async def _blkid() -> str:
"""Executes utility to locate/print block device attributes"""
return await safe_run(["blkid"])
async def _mac_address() -> str:
"""MAC address in formatted way, like it specifies in
/sys/class/net/*/address"""
return binascii.hexlify(uuid.getnode().to_bytes(6, "big"), ":").decode()
defence360agent/plugins/service_manager.py 0000644 0000000 0000000 00000004177 00000000000 015744 0 ustar """Base service manager plugin.
Provides the shared start/stop/enable/disable logic that product-specific
service managers (imav, im360) inherit from.
"""
import asyncio
import logging
from defence360agent import utils
from defence360agent.contracts import messages, plugins
logger = logging.getLogger(__name__)
class BaseServiceManager(plugins.MessageSink):
"""Base service manager: start/stop services based on config changes.
Subclasses populate ``_services`` (list of async check callables)
and ``_units`` (dict of name → unitctl) in their ``__init__``.
"""
def __init__(self):
self._lock = asyncio.Lock()
self._services = []
self._units = {}
async def _ensure_consistent_services_state(self):
for service in self._services:
await service()
@plugins.expect(messages.MessageType.ConfigUpdate)
async def on_config_update(
self, message_ignored: messages.MessageType.ConfigUpdate
):
async with self._lock:
await self._ensure_consistent_services_state()
@utils.log_error_and_ignore()
async def _ensure_service_status(
self, unitctl, service_name, should_be_running, reload=False
):
is_running = await unitctl.is_active()
if is_running is not should_be_running:
if should_be_running:
logger.info(
"%s is enabled in the config but it is not"
" running. Enabling it...",
service_name,
)
await unitctl.enable(now=True)
logger.info("Enabled %s", service_name)
else:
logger.info(
"%s is not enabled in the config but it is"
" running. Disabling it...",
service_name,
)
await unitctl.disable(now=True)
logger.info("Disabled %s", service_name)
else:
if is_running and reload:
await unitctl.reload()
logger.info(
"Reloading %s after config update...", service_name
)
defence360agent/plugins/wordpress.py 0000644 0000000 0000000 00000106673 00000000000 014646 0 ustar import asyncio
import logging
import pwd
from contextlib import suppress
from pathlib import Path
from typing import Coroutine
from defence360agent.contracts.config import (
ANTIVIRUS_MODE,
ConfigValidationError,
SystemConfig,
UserConfig,
Wordpress,
)
from defence360agent.contracts.hook_events import HookEvent
from defence360agent.contracts.license import LicenseCLN
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import (
MessageSink,
MessageSource,
expect,
)
from defence360agent.subsys.panels import hosting_panel
from defence360agent.subsys.persistent_state import (
load_state,
register_lock_file,
save_state,
)
from defence360agent.utils import (
Scope,
importer,
recurring_check,
system_packages_info,
)
from defence360agent.utils.check_lock import check_lock
from defence360agent.internals.iaid import IndependentAgentIDAPI
from defence360agent.utils.common import DAY
from defence360agent.wordpress import cli as wp_cli
from defence360agent.wordpress import plugin
from defence360agent.wordpress.utils import _prepare_ai_bot_settings
from defence360agent.wordpress.bot_protection import (
resolve_ai_bot_protection,
)
from defence360agent.model import tls_check
from defence360agent.model.wordpress import WPSite, WordpressSite
from defence360agent.wordpress.site_repository import (
get_sites_by_path,
get_sites_for_user,
get_installed_sites,
)
from defence360agent.wordpress.proxy_auth import (
is_secret_expired,
rotate_secret,
)
from defence360agent.wordpress import (
ChangelogProcessor,
IncidentCollector,
IncidentSender,
)
from defence360agent.wordpress.plugin import update_disabled_rules_on_sites
from defence360agent.model.wordpress_incident import (
delete_old_wordpress_incidents,
)
logger = logging.getLogger(__name__)
LOCK_FILE = register_lock_file("wp-gen-auth", Scope.AV_IM360)
SITE_PROCESSING_LOCK_FILE = register_lock_file(
"wp-site-process", Scope.AV_IM360
)
SEND_WP_PLUGIN_STATS_LOCK_FILE = register_lock_file(
"wp-plugin-stats", Scope.AV_IM360
)
LICENSE_RECONVERGE_LOCK_FILE = register_lock_file(
"wp-license-reconverge", Scope.AV_IM360
)
CONFIG_DIR = Path("/etc/sysconfig/imunify360/imunify360.config.d")
FIRST_INSTALL_CONFIG_FILE = Path(
"/opt/imunify360/venv/share/imunify360/11_on_first_install_wp_av.config"
)
FIRST_INSTALL_CONFIG_PATH = CONFIG_DIR / "11_on_first_install_wp_av.config"
FIRST_INSTALL_FLAG = CONFIG_DIR / ".11_on_first_install_wp_av.flag"
_MalwareHit = importer.get(
module="imav.malwarelib.model", name="MalwareHit", default=None
)
def _get_cleaned_malware_hits(started_timestamp: float) -> list:
"""
Get malware hits cleaned since the given timestamp with lazy import fallback.
Returns empty list if imav.malwarelib is not available.
"""
if _MalwareHit is None:
logger.debug(
"imav.malwarelib not available, returning empty cleaned hits"
)
return []
return _MalwareHit.cleaned_since(started_timestamp)
class ImunifySecurityPlugin(MessageSink, MessageSource):
SCOPE = Scope.AV_IM360
def __init__(self):
self._loop = None
self._sink = None
state = load_state("ImunifySecurityPlugin")
self.installation_completed = state.get("installed")
# Explicit None check: a persisted False must win over the live
# config value. Plain `or` would flip False → True via short-circuit.
persisted_enabled = state.get("enabled")
self.last_config_value = (
persisted_enabled
if persisted_enabled is not None
else Wordpress.SECURITY_PLUGIN_ENABLED
)
self._last_waf_enabled = plugin._get_global_waf_enabled()
self._last_waf_default = plugin._get_waf_default()
self._last_user_waf_enabled: dict[str, bool | None] = {}
# Seed with the current value so the first ConfigUpdate after startup
# only triggers a propagation when the admin has actually toggled it.
self._last_ai_bot_protection = plugin._get_global_ai_bot_protection()
self._last_ai_bot_protection_preset = (
plugin._get_global_ai_bot_protection_preset()
)
# Seeded None (not a live read) to keep license-file I/O out of the
# constructor; the poll reconverges on the first tick if it differs.
self._last_license_type = None
self.installation_task: asyncio.Task | None = None
self.deleting_task: asyncio.Task | None = None
self.install_and_update_task: asyncio.Task | None = None
self.freshly_installed_sites: set[WPSite] = set()
# Incident collection and changelog processing components
self.incident_collector = IncidentCollector()
self.incident_sender = IncidentSender()
self.changelog_processor = ChangelogProcessor()
self._site_processing_task: asyncio.Task | None = None
self._stats_task: asyncio.Task | None = None
self._license_reconverge_task: asyncio.Task | None = None
async def create_sink(self, loop):
pass
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
self._update_auth_task = self._loop.create_task(
self.refresh_auth_files()
)
self._site_processing_task = self._loop.create_task(
self.process_wordpress_sites()
)
self._stats_task = self._loop.create_task(self.send_stats())
self._license_reconverge_task = self._loop.create_task(
self.reconverge_license_type()
)
if ANTIVIRUS_MODE:
await self._apply_first_install_config()
else:
FIRST_INSTALL_FLAG.unlink(missing_ok=True)
await self._recover_installation_on_startup()
async def _recover_installation_on_startup(self):
"""
Self-heal when the installation state was lost.
If the feature is enabled but installation_completed is falsy (state
file missing, earlier install interrupted, etc.), manage_plugin_installation
can never recover: its True == True guard always returns early.
Trigger install_everywhere once per restart to repopulate the
wordpress_site table and flip the flag.
"""
if (
self.installation_completed
or not Wordpress.SECURITY_PLUGIN_ENABLED
):
return
logger.info(
"Installation state is missing while feature is enabled; "
"triggering startup self-recovery"
)
# Sync last_config_value to the live config. If the persisted state
# held a stale `enabled: False`, _mark_installation_done would bail
# on `if not self.last_config_value` and installation_completed would
# never flip — recovery would re-run on every restart.
self.last_config_value = True
await self.process_installation(
plugin.install_everywhere(sink=self._sink)
)
if self.installation_task is not None:
self.installation_task.add_done_callback(
self._mark_installation_done
)
async def _apply_first_install_config(self):
if not FIRST_INSTALL_FLAG.exists():
return
if await hosting_panel.HostingPanel().users_count() == 1:
_ = FIRST_INSTALL_CONFIG_PATH.write_text(
FIRST_INSTALL_CONFIG_FILE.read_text()
)
FIRST_INSTALL_CONFIG_PATH.chmod(0o600)
FIRST_INSTALL_FLAG.unlink()
async def shutdown(self):
self._update_auth_task.cancel()
# CancelledError is handled by @recurring_check():
await self._update_auth_task
# Cancel site processing (changelogs + incidents) task
if self._site_processing_task:
self._site_processing_task.cancel()
await self._site_processing_task
if self._stats_task:
self._stats_task.cancel()
await self._stats_task
if self._license_reconverge_task:
self._license_reconverge_task.cancel()
await self._license_reconverge_task
def _task_in_progress(self, task_attr_name):
if not hasattr(self, task_attr_name):
logger.error("Unknown task '%s'", task_attr_name)
return False
task = getattr(self, task_attr_name)
return task is not None and not task.done() and not task.cancelled()
def _save_installation_state(self):
save_state(
"ImunifySecurityPlugin",
{
"installed": self.installation_completed,
"enabled": self.last_config_value,
},
)
def _mark_installation_done(self, task: asyncio.Task):
if task.cancelled():
logger.info("Installation task was cancelled")
return
exc = task.exception()
if exc is not None:
logger.error("Installation task failed: %s", exc)
return
if not self.last_config_value:
logger.info(
"Feature was disabled during installation, "
"skipping flag update"
)
return
self.installation_completed = True
self._save_installation_state()
async def process_installation(self, coro: Coroutine, for_new_sites=False):
if self._task_in_progress("deleting_task"):
if for_new_sites:
coro.close()
return
if self.deleting_task:
self.deleting_task.cancel()
try:
await self.deleting_task
except asyncio.CancelledError:
pass
if self._task_in_progress("installation_task"):
logger.warning("Installation is already running")
coro.close()
return
self.installation_task = asyncio.create_task(coro)
async def process_deleting(self, coro):
if self._task_in_progress("installation_task"):
if self.installation_task:
self.installation_task.cancel()
try:
await self.installation_task
except asyncio.CancelledError:
pass
if self._task_in_progress("deleting_task"):
logger.warning("Deleting is already running")
return
self.deleting_task = asyncio.create_task(coro)
@recurring_check(
check_lock,
check_period_first=True,
check_lock_period=DAY,
lock_file=LOCK_FILE,
)
async def refresh_auth_files(self):
if is_secret_expired():
await rotate_secret()
await plugin.update_auth_everywhere(sink=self._sink)
@recurring_check(
check_lock,
check_period_first=True,
jitter=True,
check_lock_period=DAY,
lock_file=SEND_WP_PLUGIN_STATS_LOCK_FILE,
)
async def send_stats(self):
"""Send WP plugin adoption stats to the correlation server."""
if not Wordpress.SECURITY_PLUGIN_ENABLED:
return
sites = await self._loop.run_in_executor(None, get_installed_sites)
def _count_manually_removed():
with suppress(tls_check.OverridingReset):
tls_check.reset()
return (
WordpressSite.select()
.where(WordpressSite.manually_deleted_at.is_null(False))
.count()
)
manually_removed = await self._loop.run_in_executor(
None, _count_manually_removed
)
waf_enabled_sites = 0
ai_bot_enabled_sites = 0
preset_counts = {"balanced": 0, "strict": 0, "monitor": 0}
user_ai_config: dict[int, dict] = {}
for site in sites:
content_dir = await wp_cli.get_content_dir(site)
data_dir = content_dir / "imunify-security"
rules_php = data_dir / "rules.php"
if await self._loop.run_in_executor(None, rules_php.exists):
waf_enabled_sites += 1
if site.uid not in user_ai_config:
try:
pw_record = await self._loop.run_in_executor(
None, pwd.getpwuid, site.uid
)
user_ai_config[
site.uid
] = await self._loop.run_in_executor(
None,
_prepare_ai_bot_settings,
pw_record.pw_name,
)
except Exception as exc:
logger.info(
"Could not load AI bot protection config for uid"
" %s, counting it as disabled: %s",
site.uid,
exc,
)
user_ai_config[site.uid] = {
"ai_bot_protection": False,
"preset": "balanced",
}
hoster_cfg = user_ai_config[site.uid]
ai_enabled, preset = await self._loop.run_in_executor(
None,
resolve_ai_bot_protection,
site.docroot,
data_dir,
site.uid,
bool(hoster_cfg.get("ai_bot_protection")),
hoster_cfg.get("preset", "balanced"),
)
if ai_enabled:
ai_bot_enabled_sites += 1
if preset in preset_counts:
preset_counts[preset] += 1
pkgs = await system_packages_info(
{
"imunify360-firewall",
"imunify-antivirus",
"imunify-core",
"imunify-wp-security",
}
)
av_version = pkgs.get("imunify-antivirus") or ""
firewall_version = pkgs.get("imunify360-firewall") or ""
core_version = pkgs.get("imunify-core") or ""
wp_version = pkgs.get("imunify-wp-security") or ""
msg = MessageType.WpSecurityPluginStats(
core_version=core_version,
av_version=av_version,
firewall_version=firewall_version,
wp_version=wp_version,
installed_sites=len(sites),
manually_removed_sites=manually_removed,
server_config={
"waf_enabled": str(plugin._get_global_waf_enabled()),
"ai_bot_protection": str(
plugin._get_global_ai_bot_protection()
),
},
stats={
"waf_enabled_sites": str(waf_enabled_sites),
"ai_bot_protection_enabled_sites": str(ai_bot_enabled_sites),
"ai_bot_protection_preset_balanced": str(
preset_counts["balanced"]
),
"ai_bot_protection_preset_strict": str(
preset_counts["strict"]
),
"ai_bot_protection_preset_monitor": str(
preset_counts["monitor"]
),
},
)
msg["iaid"] = await self._loop.run_in_executor(
None, IndependentAgentIDAPI.get_iaid
)
await self._sink.process_message(msg)
@recurring_check(
check_lock,
check_period_first=True,
check_lock_period=1 * 60, # Run every 1 minute
lock_file=SITE_PROCESSING_LOCK_FILE,
)
async def process_wordpress_sites(self):
"""
Periodic task for WordPress site file processing.
Runs every minute to:
1. Process changelog.php files written by the WordPress plugin (rule disable/enable from WP admin)
2. Collect incident files written by the WordPress plugin
"""
logger.debug(
"Processing rule disable changelogs"
" and collecting WordPress CVE protection incidents"
)
try:
await self._process_installed_sites()
except Exception as e:
# deliberately not fatal to the pass below: that pass is the
# repair path for incidents an earlier cycle failed to deliver,
# and a collection that keeps failing must not strand them
logger.error("Error in WordPress site processing: %s", e)
try:
# sends the freshly collected incidents together with any whose
# earlier message the transport never acknowledged. Reads the
# database, not the filesystem, so it must run even with no sites
# left: otherwise removing the last site strands whatever the
# transport had not yet confirmed.
await self.incident_sender.send_pending_incidents(self._sink)
except Exception as e:
logger.error("Error sending pending WordPress incidents: %s", e)
async def _process_installed_sites(self):
sites = get_installed_sites()
if not sites:
logger.debug("No WordPress sites found for periodic processing")
return
# Process changelogs (rule disable/enable from WordPress admin)
affected_sites = (
await self.changelog_processor.process_changelogs_for_sites(
sites, self._sink
)
)
if affected_sites:
await update_disabled_rules_on_sites(
domains=[s.domain for s in affected_sites],
sink=self._sink,
)
# Collect incidents
await self.incident_collector.collect_incidents_for_sites(
sites,
delete_after_processing=True,
)
delete_old_wordpress_incidents(days=30)
async def _install_on_new_sites(self):
"""Install plugin on new WordPress sites."""
# Clear any previously tracked sites
self.freshly_installed_sites.clear()
async def install_and_track():
installed_sites = await plugin.install_everywhere(sink=self._sink)
if installed_sites:
self.freshly_installed_sites.update(installed_sites)
return installed_sites
await self.process_installation(
install_and_track(),
for_new_sites=True,
)
async def _tidy_up(self):
"""Tidy up sites from which the WordPress plugin was deleted manually."""
await plugin.tidy_up_manually_deleted(
sink=self._sink,
freshly_installed_sites=self.freshly_installed_sites,
)
await plugin.fix_data_file_permissions_everywhere(sink=self._sink)
if not Wordpress.SECURITY_PLUGIN_ENABLED:
await self.process_deleting(
plugin.remove_all_installed(sink=self._sink)
)
self.installation_completed = False
self.last_config_value = False
self._save_installation_state()
async def _adopt_found_sites(self):
"""Adopt sites where plugin is installed but not tracked in our database."""
adopted_sites = await plugin.adopt_found_sites(sink=self._sink)
# Add adopted sites to freshly_installed_sites to prevent them from being
# marked as manually deleted by tidy_up (AVD database may not be updated yet)
if adopted_sites:
self.freshly_installed_sites.update(adopted_sites)
async def _update_existing(self):
"""Update plugin on all sites where it is installed."""
await plugin.update_everywhere(sink=self._sink)
async def _run_install_and_update(self):
"""
Combined operation: install on new sites, adopt found sites, tidy up,
and update existing plugins.
This runs all operations sequentially to avoid race conditions.
"""
# Install plugin on new sites.
await self._install_on_new_sites()
# Wait for installation to complete before proceeding.
if self.installation_task:
await self.installation_task
# Adopt sites where plugin is installed but not in our database.
await self._adopt_found_sites()
# Tidy up and update.
await self._tidy_up()
await self._update_existing()
@expect(MessageType.WordpressPluginAction)
async def manage_plugin_action(self, message):
logger.info(
"ImunifySecurityPlugin received message action: %s method: %s",
message.action,
message.method,
)
# Check if install_and_update is running - it blocks all other actions
if self._task_in_progress("install_and_update_task"):
logger.warning(
"Install-and-update is still running, skipping action %s",
message.action,
)
return
if message.action == "install_on_new_sites":
if not self.installation_completed:
# The installation is not completed yet. We cannot know reliably which sites are new.
return
await self._install_on_new_sites()
return
if self._task_in_progress("installation_task"):
logger.warning(
"Installation is still running, skipping action %s",
message.action,
)
return
if self._task_in_progress("deleting_task"):
logger.warning(
"Uninstallation is already running, skipping action %s",
message.action,
)
return
if message.action == "update_existing":
await self._update_existing()
return
if message.action == "tidy_up":
await self._tidy_up()
return
if message.action == "install_and_update":
if not self.installation_completed:
# The installation is not completed yet. We cannot know reliably which sites are new.
logger.warning(
"Installation is not completed yet, skipping"
" install_and_update"
)
return
# Run install_and_update as a background task to prevent blocking.
# Note: No need to check if already running - the check at the top of this function
# (line 182) already handles that case.
self.install_and_update_task = asyncio.create_task(
self._run_install_and_update()
)
@expect(MessageType.ConfigUpdate)
async def manage_plugin_installation(self, message):
if not isinstance(message["conf"], SystemConfig):
return
current_config_value = Wordpress.SECURITY_PLUGIN_ENABLED
if current_config_value == self.last_config_value:
return
# Update last config value immediately to prevent multiple installations
self.last_config_value = current_config_value
if current_config_value and not self.installation_completed:
# On re-enable, force waf_enabled back on and ai_bot_protection
# back off so a value that went stale while the plugin was off
# cannot take effect silently. Skip a key the operator set in this
# same update — overwriting it here would discard their explicit
# choice with no warning. The file-poll path (config_watcher)
# carries no delta, so it still resets both.
submitted_wp = (message.get("submitted") or {}).get(
"WORDPRESS", {}
)
if "waf_enabled" not in submitted_wp:
try:
SystemConfig().dict_to_config(
{"WORDPRESS": {"waf_enabled": True}}
)
self._last_waf_enabled = True
except ConfigValidationError:
logger.debug(
"waf_enabled config reset skipped,"
" field not in schema yet"
)
else:
# Record the operator's value so manage_waf_config, which runs
# next on this same message, sees no change and does not start
# an all-sites WAF removal/redeploy that races the installer
# started below.
self._last_waf_enabled = plugin._get_global_waf_enabled()
if "ai_bot_protection" not in submitted_wp:
try:
SystemConfig().dict_to_config(
{"WORDPRESS": {"ai_bot_protection": False}}
)
self._last_ai_bot_protection = False
self._last_ai_bot_protection_preset = (
plugin._get_global_ai_bot_protection_preset()
)
except ConfigValidationError:
logger.debug(
"ai_bot_protection config reset skipped,"
" field not in schema yet"
)
else:
self._last_ai_bot_protection = (
plugin._get_global_ai_bot_protection()
)
self._last_ai_bot_protection_preset = (
plugin._get_global_ai_bot_protection_preset()
)
await self.process_installation(
plugin.install_everywhere(sink=self._sink)
)
if self.installation_task is not None:
self.installation_task.add_done_callback(
self._mark_installation_done
)
elif not current_config_value and (
self.installation_completed
or self._task_in_progress("installation_task")
):
await self.process_deleting(
plugin.remove_all_installed(sink=self._sink)
)
self.installation_completed = False
self._save_installation_state()
@expect(MessageType.ConfigUpdate)
async def manage_ai_bot_protection_config(self, message):
"""
Propagate admin toggles of WORDPRESS.ai_bot_protection and
WORDPRESS.ai_bot_protection_preset to every managed WP install's
plugin_config.php immediately, so the WP plugin picks up the
change at the next request rather than waiting for a scan cycle.
Phase 2 per-account support extends *this* handler with a
UserConfig branch (mirroring manage_waf_config); do not add a
sibling handler.
"""
if not isinstance(message["conf"], SystemConfig):
return
if not Wordpress.SECURITY_PLUGIN_ENABLED:
# manage_plugin_installation clears any stale value on the
# next plugin re-enable, so nothing to write here.
return
if not self.installation_completed:
# Plugin is being (re-)installed. manage_plugin_installation has
# already settled ai_bot_protection (reset to False, or left as
# the operator submitted it) and the install flow writes
# plugin_config.php for every site, so propagating here would race
# with it and leave stale values on sites the installer skips
# (e.g. DB rows surviving a crash during a prior disable).
return
current_enabled = plugin._get_global_ai_bot_protection()
current_preset = plugin._get_global_ai_bot_protection_preset()
if (
current_enabled == self._last_ai_bot_protection
and current_preset == self._last_ai_bot_protection_preset
):
return
sites = await self._loop.run_in_executor(None, get_installed_sites)
if not sites:
self._last_ai_bot_protection = current_enabled
self._last_ai_bot_protection_preset = current_preset
return
written = await plugin.update_plugin_config_on_sites(sites)
if written == len(sites):
self._last_ai_bot_protection = current_enabled
self._last_ai_bot_protection_preset = current_preset
@recurring_check(
check_lock,
check_period_first=True,
check_lock_period=1 * 60,
lock_file=LICENSE_RECONVERGE_LOCK_FILE,
)
async def reconverge_license_type(self):
"""Poll for license-edition changes and reconverge plugin_config.php.
Edition changes reach only the external hook framework, never the
message bus, so a poll is the propagation trigger.
"""
await self._reconverge_license_type_once()
async def _reconverge_license_type_once(self):
if not Wordpress.SECURITY_PLUGIN_ENABLED:
return
if not self.installation_completed:
return
current = LicenseCLN.get_license_type()
if current == self._last_license_type:
return
sites = await self._loop.run_in_executor(None, get_installed_sites)
if not sites:
self._last_license_type = current
return
written = await plugin.update_plugin_config_on_sites(sites)
if written == len(sites):
self._last_license_type = current
@expect(MessageType.ConfigUpdate)
async def manage_waf_config(self, message):
"""Caches are dispatch markers, not apply receipts — apply failures propagate, no auto-retry."""
if not Wordpress.SECURITY_PLUGIN_ENABLED:
return
conf = message["conf"]
config_dict = conf.config_to_dict()
waf_value = config_dict.get("WORDPRESS", {}).get("waf_enabled")
if isinstance(conf, UserConfig):
if waf_value is None:
prev = self._last_user_waf_enabled.pop(conf.username, None)
if prev is None:
return
new_effective = await plugin.is_waf_enabled_for_user(
conf.username
)
if not prev and new_effective:
await plugin.redeploy_waf_for_user(conf.username)
elif prev and not new_effective:
await plugin.remove_waf_rules_for_user(conf.username)
return
if waf_value == self._last_user_waf_enabled.get(conf.username):
return
self._last_user_waf_enabled[conf.username] = waf_value
if not waf_value or not plugin._get_global_waf_enabled():
await plugin.remove_waf_rules_for_user(conf.username)
else:
await plugin.redeploy_waf_for_user(conf.username)
elif isinstance(conf, SystemConfig):
try:
current = Wordpress.WAF_ENABLED
except KeyError:
pass
else:
if current != self._last_waf_enabled:
self._last_waf_enabled = current
if not current:
await plugin.remove_waf_rules_for_all_sites()
else:
await plugin.redeploy_waf_for_all_sites()
try:
current_default = Wordpress.WAF_DEFAULT
except KeyError:
pass
else:
if current_default != self._last_waf_default:
self._last_waf_default = current_default
await plugin.apply_waf_default_change()
@expect(HookEvent.MalwareCleanupFinished)
async def handle_malware_cleanup_finished(self, message):
"""
INFO [2025-02-24 12:00:20,384] imav.plugins.wordpress: Malware cleanup finished:
HookEvent.MalwareCleanupFinished(
{
'cleanup_id': 'fa4fe7e48dbf45588f53b24366cd8893',
'started': 1740398411.786418,
'error': None,
'total_files': 3,
'total_cleaned': 3,
'status': 'ok'
}
)
"""
# Skip if plugin is disabled
if not self.last_config_value:
return
# Leave early if status is not ok or the started time is missing.
if message.get("status") != "ok" or not message.get("started"):
return
# load all malware hits cleaned since the cleanup started
hits = _get_cleaned_malware_hits(message["started"])
site_paths = set()
# Collect all site paths that need to be updated.
for hit in hits:
if hit.resource_type == "file":
try:
user_info = pwd.getpwnam(hit.user)
user_sites = get_sites_for_user(user_info)
uid = ( # In None cases there also no user_sites, so it wouldn't be used
user_info.pw_uid if user_info else None
)
for site_path in user_sites:
if hit.orig_file.startswith(site_path):
site_paths.add((site_path, uid))
break
except KeyError:
pass
if not site_paths:
logger.debug("Cleanup finished => no sites found for cleaned hits")
return
logger.info(
"Cleanup finished => %s site(s) need to be updated",
len(site_paths),
)
# Convert paths to WPSite objects with empty domain and update data on the sites that need to be updated.
# We need to work with paths here because sometimes the domain is not set, see https://cloudlinux.atlassian.net/browse/DEF-32238.
wordpress_sites = [
WPSite(docroot=site_path, domain="", uid=uid)
for site_path, uid in site_paths
]
await plugin.update_data_on_sites(self._sink, wordpress_sites)
logger.info("%s site(s) updated after a cleanup", len(wordpress_sites))
@expect(HookEvent.MalwareScanningFinished)
async def handle_malware_scan_finished(self, message):
"""
INFO [2025-02-24 11:57:17,968] imav.plugins.wordpress: Malware scan finished:
HookEvent.MalwareScanningFinished(
{
'scan_id': 'b9bd136aff0a4d87a248c859cfe41c47',
'scan_type': 'user',
'path': '/home/user1'
}
)
INFO [2025-02-24 12:00:10,740] imav.plugins.wordpress: Malware scan finished:
HookEvent.MalwareScanningFinished(
{
'scan_id': 'a74271d2cdd04e0c9bd49ef6de23e0d8',
'scan_type': 'user',
'path': '/home/user4',
'started': 1740398383,
'total_files': 39229,
'total_malicious': 3,
'error': None,
'status': 'ok',
'scan_params': {'intensity_cpu': 2, 'intensity_io': 2, 'intensity_ram': 2048, 'initiator': None, 'file_patterns': None, 'exclude_patterns': None, 'follow_symlinks': False, 'detect_elf': True},
'stats': {'scan_time': 27, 'mem_peak': 28217344, 'smart_time_hs': 0.004, 'scan_time_hs': 1.1751, 'smart_time_preg': 0, 'scan_time_preg': 2.7391, 'finder_time': 13.5896, 'cas_time': 0.7562, 'deobfuscate_time': 0.8998, 'total_files': 39229}
}
)
"""
# Skip if plugin is disabled
if not self.last_config_value:
return
# Leave early if status is not ok or path or stats are missing.
if (
message.get("status") != "ok"
or not message.get("path")
or not message.get("stats")
):
return
# Malware scan is finished, figure out what sites need to be updated based on the path.
path = message["path"]
sites = get_sites_by_path(path)
if not sites:
logger.debug("Scan finished => no sites found for path=%s", path)
return
# Update data on the sites that need to be updated.
logger.info(
"Scan finished => %s site(s) need to be updated", len(sites)
)
await plugin.update_data_on_sites(self._sink, sites)
logger.info("%s site(s) updated after a scan", len(sites))
defence360agent/router.py 0000644 0000000 0000000 00000003226 00000000000 012443 0 ustar """Provide Router for db migrations."""
import os
from contextlib import suppress
from peewee_migrate import Router as PeeweeRouter
from peewee_migrate.router import void
__all__ = ["Router"]
class Router(PeeweeRouter):
"""Like peewee_migrate.Router but supports multiple migrations dirs."""
# this is a slightly edited version from peewee_migrate.router.Router
def __init__(self, database, migrations_dirs, **kwargs):
super().__init__(database, migrate_dir=migrations_dirs[0], **kwargs)
self.migrations_dirs = migrations_dirs
@property
def todo(self):
"""Scan migrations in file system."""
for migrate_dir in self.migrations_dirs:
if not os.path.exists(migrate_dir):
self.logger.warn(
"Migration directory: %s does not exist.", migrate_dir
)
os.makedirs(migrate_dir)
migration_names = []
for migrate_dir in self.migrations_dirs:
migration_names += sorted(
f[: -len(".py")]
for f in os.listdir(migrate_dir)
if self.filemask.match(f)
)
return migration_names
def read(self, name):
"""Read migration from file."""
scope = {}
for migrate_dir in self.migrations_dirs:
with suppress(FileNotFoundError):
with open(os.path.join(migrate_dir, name + ".py")) as f:
code = compile(
f.read(), "<string>", "exec", dont_inherit=True
)
exec(code, scope)
return scope.get("migrate", void), scope.get("rollback", void)
defence360agent/rpc_tools/ 0000755 0000000 0000000 00000000000 00000000000 012552 5 ustar defence360agent/rpc_tools/__init__.py 0000644 0000000 0000000 00000001460 00000000000 014664 0 ustar """
RPC building blocks. Use the utils provided by this package whenever you
need to extend the RPC client/server functionality (i.e. add a new endpoint).
However, new endpoints should not be put in this package to avoid undesirable
interdependencies.
"""
from contextvars import ContextVar
from defence360agent.utils.cli import ERROR, SUCCESS, WARNING
from .exceptions import ResponseError, ServiceStateError, SocketError
from .lookup import Endpoints, UserType
from .utils import is_running
from .validate import ValidationError
caller_uid_var: ContextVar[int] = ContextVar("rpc_caller_uid")
__all__ = [
"ERROR",
"SUCCESS",
"WARNING",
"caller_uid_var",
"ResponseError",
"ServiceStateError",
"SocketError",
"Endpoints",
"UserType",
"is_running",
"ValidationError",
]
defence360agent/rpc_tools/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 014762 5 ustar defence360agent/rpc_tools/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002275 00000000000 022170 0 ustar
r_j0 U d Z ddlmZ ddlmZmZmZ ddlmZm Z m
Z
ddl m Z m
Z
ddlmZ ddlmZ ed Zee ed
< g d Zd S )
z
RPC building blocks. Use the utils provided by this package whenever you
need to extend the RPC client/server functionality (i.e. add a new endpoint).
However, new endpoints should not be put in this package to avoid undesirable
interdependencies.
)
ContextVar)ERRORSUCCESSWARNING )
ResponseErrorServiceStateError SocketError) EndpointsUserType)
is_running)ValidationErrorrpc_caller_uidcaller_uid_var) r r r r r r r
r r r
r N)__doc__ contextvarsr defence360agent.utils.clir r r
exceptionsr r r
lookupr r utilsr
validater r int__annotations____all__ W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/__init__.py<module>r s # " " " " " = = = = = = = = = = E E E E E E E E E E ' ' ' ' ' ' ' ' % % % % % %",*-=">">
3 > > > r defence360agent/rpc_tools/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000002275 00000000000 021231 0 ustar
r_j0 U d Z ddlmZ ddlmZmZmZ ddlmZm Z m
Z
ddl m Z m
Z
ddlmZ ddlmZ ed Zee ed
< g d Zd S )
z
RPC building blocks. Use the utils provided by this package whenever you
need to extend the RPC client/server functionality (i.e. add a new endpoint).
However, new endpoints should not be put in this package to avoid undesirable
interdependencies.
)
ContextVar)ERRORSUCCESSWARNING )
ResponseErrorServiceStateError SocketError) EndpointsUserType)
is_running)ValidationErrorrpc_caller_uidcaller_uid_var) r r r r r r r
r r r
r N)__doc__ contextvarsr defence360agent.utils.clir r r
exceptionsr r r
lookupr r utilsr
validater r int__annotations____all__ W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/__init__.py<module>r s # " " " " " = = = = = = = = = = E E E E E E E E E E ' ' ' ' ' ' ' ' % % % % % %",*-=">">
3 > > > r defence360agent/rpc_tools/__pycache__/exceptions.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003351 00000000000 022606 0 ustar
r_j d dl mZ G d de Z G d de Z G d de Z G d d e Z G d
d e Zd S )
)configc e Zd ZdS )RpcErrorN__name__
__module__ __qualname__ Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/exceptions.pyr r Dr r c e Zd ZdS )
ResponseErrorNr r
r r r r r
r r c e Zd ZdS ) SocketErrorNr r
r r r r r
r r c e Zd Zd fd Z xZS )ServiceStateErrorstoppedc t d t j j | d S )Nz{} service is {}.)super__init__formatr CorePRODUCT)selfstate __class__s r r zServiceStateError.__init__ sA
& &v{':E B B
r )r )r r r r
__classcell__)r s @r r r s=
r r c e Zd ZdS )NonRootValidationErrorNr r
r r r r r
r r N)defence360agent.contractsr RuntimeErrorr r r r r r
r r <module>r# s , , , , , , | H (
X r defence360agent/rpc_tools/__pycache__/exceptions.cpython-311.pyc 0000644 0000000 0000000 00000003351 00000000000 021647 0 ustar
r_j d dl mZ G d de Z G d de Z G d de Z G d d e Z G d
d e Zd S )
)configc e Zd ZdS )RpcErrorN__name__
__module__ __qualname__ Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/exceptions.pyr r Dr r c e Zd ZdS )
ResponseErrorNr r
r r r r r
r r c e Zd ZdS ) SocketErrorNr r
r r r r r
r r c e Zd Zd fd Z xZS )ServiceStateErrorstoppedc t d t j j | d S )Nz{} service is {}.)super__init__formatr CorePRODUCT)selfstate __class__s r r zServiceStateError.__init__ sA
& &v{':E B B
r )r )r r r r
__classcell__)r s @r r r s=
r r c e Zd ZdS )NonRootValidationErrorNr r
r r r r r
r r N)defence360agent.contractsr RuntimeErrorr r r r r r
r r <module>r# s , , , , , , | H (
X r defence360agent/rpc_tools/__pycache__/lookup.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000016373 00000000000 021746 0 ustar
r_j " d dl Z d dlZd dlmZ d dlmZ d dlmZ ddlm Z dZ
G d d e Z G d
d e Z
G d d
Z G d de Z G d de Z G d de Ze j e
fz Zee j fdZd ZdS ) N)Any)UserType)Scope )RpcError
__rpc_commandc e Zd ZdS )DuplicateHandlerErrorN__name__
__module__ __qualname__ U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/lookup.pyr
r
Dr r
c e Zd ZdS )NotCoroutineErrorNr r r r r r r r r c e Zd ZdZej Z e Ze j
i e j i iZ g Z
fdZed Zd Zee j
fdefd Zed
d Zed Z xZS ) Endpointsz\Endpoints class implements registration and lookup for functions
implementing RPC calls.c n t j di | | j | d S )Nr )super__init_subclass__ _subclassesappend)clskwargs __class__s r r zEndpoints.__init_subclass__! s< !!++F+++ s#####r c x g }| j D ]/}t j |d }|r| | 0|S )Nc . t | t d S N)getattr _RPC_MARK)items r <lambda>z0Endpoints.get_active_endpoints.<locals>.<lambda>+ s WT9d%C%C r )r inspect
getmembersr )r active_endpointssubcls rpc_handlerss r get_active_endpointsz Endpoints.get_active_endpoints% s[ o 0 0F"-CC L
0 ''/// r c || _ d S r! )_sink)selfsinks r __init__zEndpoints.__init__1 s
r returnc . K |d }t | }|| j | vr+t dd |d z | j | | \ }}t || | } |di |d d{V S )a: Find appropriate class and function within that class that
implements processing for request based on supplied 'command' within.
Call that (async) function and return its result.
If target class/function for given request['command'] is not found then
RpcError exception is raised.commandz&Endpoint not found for RPC method "%s" paramsNr )tuple_Endpoints__COMMAND_MAPr joinr" ) r requestr/ userr3 key cls_handler handler_namehandlers r route_to_endpointzEndpoints.route_to_endpoint4 s )$Gnn c'- - -8((79-../
%($5d$;C$@! \++d++\:: W11wx 0111111111r Nc t | D ]}| d rt | | }t |t d }|At j | st
d | j D ][}|| j | v r8d ||| j | | | }t | | |f| j | |< \dS )z{Registers RPC handlers for all functions within a class.
Functions should be decorated with @bind('command', ...)._NzMust be a coroutinez1Duplicate handlers for command {} ({}): {} and {}) dir
startswithr" r# r& iscoroutinefunctionr APPLICABLE_USER_TYPESr7 formatr
)r nameattrr3 user_typemsgs r register_rpc_handlersz Endpoints.register_rpc_handlersH s
HH D DDs##
3%%D dIt44G.t44
?'(=>>> 6
D
D c / :::K # % -i 8 A 04449<d !),W55
D D Dr c P t j t j hD ] }i | j |<
dS )z)Clears all previously made registrations.N)r NON_ROOTROOTr7 )r rI s r reset_rpc_handlersz Endpoints.reset_rpc_handlersd s7 #+X]; . .I+-C i ( ( . .r )r1 N)r r
r __doc__r AV_IM360SCOPEsetrE r rN rM r7 r r classmethodr+ r0 r r? rK rO
__classcell__)r s @r r r s
NE CEE
r2M K$ $ $ $ $ [ 9A 2 23 2 2 2 [2& D D D [D6 . . [. . . . .r r c . e Zd ZdZej ej hZdS )CommonEndpointsz5Endpoints available both for root and non root users.N)r r
r rP r rM rN rE r r r rW rW k s& ?? % .
>r rW c " e Zd ZdZej hZdS )
RootEndpointsz'Endpoints available only for root user.N)r r
r rP r rN rE r r r rY rY q s 11 %]Or rY c " e Zd ZdZej hZdS )UserOnlyEndpointsz,Endpoints available only for non root users.N)r r
r rP r rM rE r r r r[ r[ w s" 66 % . /r r[ c F t j t j | || S )z4Decorator replacing functools.wraps for rpc handlerswrappedassignedupdated) functoolspartialupdate_wrapperr] s r wrapsrd s- r c fd}|S )z4Mark a function as processing RPC calls for command.c 4 t | t | S r! )setattrr# )funcr3 s r decoratorzbind.<locals>.decorator s i))) r r )r3 ri s ` r bindrj s$ r )ra r& typingr defence360agent.contracts.configr defence360agent.utilsr
exceptionsr r# Exceptionr
r r rW rY r[ WRAPPER_ASSIGNMENTSLOOKUP_ASSIGNMENTSWRAPPER_UPDATESrd rj r r r <module>rs s 5 5 5 5 5 5 ' ' ' ' ' ' I S. S. S. S. S. S. S. S.l? ? ? ? ?i ? ? ? , , , , ,I , , , 0 0 0 0 0 0 0 0 2i\A ))2K r defence360agent/rpc_tools/__pycache__/lookup.cpython-311.pyc 0000644 0000000 0000000 00000016373 00000000000 021007 0 ustar
r_j " d dl Z d dlZd dlmZ d dlmZ d dlmZ ddlm Z dZ
G d d e Z G d
d e Z
G d d
Z G d de Z G d de Z G d de Ze j e
fz Zee j fdZd ZdS ) N)Any)UserType)Scope )RpcError
__rpc_commandc e Zd ZdS )DuplicateHandlerErrorN__name__
__module__ __qualname__ U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/lookup.pyr
r
Dr r
c e Zd ZdS )NotCoroutineErrorNr r r r r r r r r c e Zd ZdZej Z e Ze j
i e j i iZ g Z
fdZed Zd Zee j
fdefd Zed
d Zed Z xZS ) Endpointsz\Endpoints class implements registration and lookup for functions
implementing RPC calls.c n t j di | | j | d S )Nr )super__init_subclass__ _subclassesappend)clskwargs __class__s r r zEndpoints.__init_subclass__! s< !!++F+++ s#####r c x g }| j D ]/}t j |d }|r| | 0|S )Nc . t | t d S N)getattr _RPC_MARK)items r <lambda>z0Endpoints.get_active_endpoints.<locals>.<lambda>+ s WT9d%C%C r )r inspect
getmembersr )r active_endpointssubcls rpc_handlerss r get_active_endpointsz Endpoints.get_active_endpoints% s[ o 0 0F"-CC L
0 ''/// r c || _ d S r! )_sink)selfsinks r __init__zEndpoints.__init__1 s
r returnc . K |d }t | }|| j | vr+t dd |d z | j | | \ }}t || | } |di |d d{V S )a: Find appropriate class and function within that class that
implements processing for request based on supplied 'command' within.
Call that (async) function and return its result.
If target class/function for given request['command'] is not found then
RpcError exception is raised.commandz&Endpoint not found for RPC method "%s" paramsNr )tuple_Endpoints__COMMAND_MAPr joinr" ) r requestr/ userr3 key cls_handler handler_namehandlers r route_to_endpointzEndpoints.route_to_endpoint4 s )$Gnn c'- - -8((79-../
%($5d$;C$@! \++d++\:: W11wx 0111111111r Nc t | D ]}| d rt | | }t |t d }|At j | st
d | j D ][}|| j | v r8d ||| j | | | }t | | |f| j | |< \dS )z{Registers RPC handlers for all functions within a class.
Functions should be decorated with @bind('command', ...)._NzMust be a coroutinez1Duplicate handlers for command {} ({}): {} and {}) dir
startswithr" r# r& iscoroutinefunctionr APPLICABLE_USER_TYPESr7 formatr
)r nameattrr3 user_typemsgs r register_rpc_handlersz Endpoints.register_rpc_handlersH s
HH D DDs##
3%%D dIt44G.t44
?'(=>>> 6
D
D c / :::K # % -i 8 A 04449<d !),W55
D D Dr c P t j t j hD ] }i | j |<
dS )z)Clears all previously made registrations.N)r NON_ROOTROOTr7 )r rI s r reset_rpc_handlersz Endpoints.reset_rpc_handlersd s7 #+X]; . .I+-C i ( ( . .r )r1 N)r r
r __doc__r AV_IM360SCOPEsetrE r rN rM r7 r r classmethodr+ r0 r r? rK rO
__classcell__)r s @r r r s
NE CEE
r2M K$ $ $ $ $ [ 9A 2 23 2 2 2 [2& D D D [D6 . . [. . . . .r r c . e Zd ZdZej ej hZdS )CommonEndpointsz5Endpoints available both for root and non root users.N)r r
r rP r rM rN rE r r r rW rW k s& ?? % .
>r rW c " e Zd ZdZej hZdS )
RootEndpointsz'Endpoints available only for root user.N)r r
r rP r rN rE r r r rY rY q s 11 %]Or rY c " e Zd ZdZej hZdS )UserOnlyEndpointsz,Endpoints available only for non root users.N)r r
r rP r rM rE r r r r[ r[ w s" 66 % . /r r[ c F t j t j | || S )z4Decorator replacing functools.wraps for rpc handlerswrappedassignedupdated) functoolspartialupdate_wrapperr] s r wrapsrd s- r c fd}|S )z4Mark a function as processing RPC calls for command.c 4 t | t | S r! )setattrr# )funcr3 s r decoratorzbind.<locals>.decorator s i))) r r )r3 ri s ` r bindrj s$ r )ra r& typingr defence360agent.contracts.configr defence360agent.utilsr
exceptionsr r# Exceptionr
r r rW rY r[ WRAPPER_ASSIGNMENTSLOOKUP_ASSIGNMENTSWRAPPER_UPDATESrd rj r r r <module>rs s 5 5 5 5 5 5 ' ' ' ' ' ' I S. S. S. S. S. S. S. S.l? ? ? ? ?i ? ? ? , , , , ,I , , , 0 0 0 0 0 0 0 0 2i\A ))2K r defence360agent/rpc_tools/__pycache__/middleware.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000030427 00000000000 022546 0 ustar
r_j! J d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m
Z
m Z m Z d dl
mZ d dlmZ d dlmZ d d lmZ d d
lmZ d d lmZ e j e Zd Z e ed
de fd Z d Z d Z d Z!d Z"d Z#d Z$d Z%d Z&d Z'd Z(d Z)dS ) N) timedeltawraps)eula)CoreUserType caller_type)
LicenseCLN) MessageType)caller_uid_var)
hosting_panel) timed_cache) to_threadc < t fd }|S )Nc ( K t | dk r|d n | dt j }t j | } | g|R i | d {V t j | S # t j | w xY w)N user)lengetr ROOTr setreset)requestargskwargsr tokenfs Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/middleware.pywrapperz(set_caller_type_context.<locals>.wrapper s
d))a--tAwwVZZ
-N-N%% %74T444V44444444 4 e $ $ $ $K e $ $ $ $s A; ;Br r r s ` r set_caller_type_contextr! s3
1XX % % % % X % N < )seconds)
expirationreturnc v K t t j d {V S )N) frozensetr
HostingPanel get_users r" r _panel_usersr, # s; =577AACCCCCCCC D DDr" c < t fd }|S )Nc X K | d }t |t r| d nd }t j d }|r|r t j | j |k rkt d {V }|rU||vrQt t j d {V D ]1}|j
|k r$|j |v r|j |d< d|v r |j g|d< n2n3# t $ r&}t
d|| Y d }~nd }~ww xY w | g|R i | d {V S )Nparamsr usersz,Failed to resolve panel login for uid %s: %s)r
isinstancedictr pwdgetpwuidpw_namer, r getpwallpw_uid Exceptionloggerwarning)
r r r r/ nameuid panel_userspwer s
r r z+resolve_caller_panel_login.<locals>.wrapper, s X&&%/%=%=Gvzz&!!!4 && C
<$$,44(4"6"6"6"6"6"6K" &t;'>'>(1#,(?(?"?"?"?"?"?"? & &B !yC / /BJ+4M4M13v#*f#4#479zlF7O %
BC
Qw0000000000000s BC' '
D1 DDr r s ` r resolve_caller_panel_loginr@ ( s5 1XX1 1 1 1 X12 Nr" c < t fd }|S )Nc K | i | d {V }t |t s
J d|z t j |d< |S )N Result should be a dictionary %slicense)r1 r2 r
license_infor r resultr s r r z add_license.<locals>.wrapperJ ss q$)&))))))))&$''
. 7
'
' 3 5 5y
r" r r s ` r add_licenserH I s3
1XX X Nr" c < t fd }|S )Nc K | i | d {V }t |t s
J d|z t j }|d | d | d d|d< |S )NrC status license_typeeligible_for_imunify_patch)rK rL rM rD )r1 r2 r
rE r )r r rG rD r s r r z!add_license_user.<locals>.wrapperY s q$)&))))))))&$''
. 7
'
)++ h' #KK 7 7*1++,+ +
y
r" r r s ` r add_license_userrN X s3
1XX X" Nr" c < t fd }|S )Nc K | i | d {V }t |t s
J d|z d }t j rt j st j d {V sx t j t j t j d}n=# t $ r0}dd t | dd}Y d }~nd }~ww xY w||d< |S )NrC )messagetextupdatedzFailed to read EULAzFailed to read EULA: {} r )
r1 r2 r
is_validis_freer is_acceptedrQ rR rS OSErrorformatstr)r r rG eula_dictr? r s r r zadd_eula.<locals>.wrappero s6 q$)&))))))))&$''
. 7
'
**<*>*>
)++++++++
#'<>> $ #'<>>! !II
#8 9 @ @Q H H#%! !IIIIII #v
s 69B0 0
C*:&C%%C*r r s ` r add_eular\ n s3
1XX X0 Nr" c < t fd }|S )Nc K | i | d {V }t |t s
J d|z t j |d< |S )NrC version)r1 r2 r VERSIONrF s r r z add_version.<locals>.wrapper sl q$)&))))))))&$''
. 7
' !Ly
r" r r s ` r add_versionra s3
1XX X Nr" c < t fd }|S )Nc 4 K | i | d {V \ }}||dS )N) max_countitemsr+ )r r countre r s r r zmax_count.<locals>.wrapper s? Q / / /////// u "U333r" r r s ` r rd rd s3
1XX4 4 4 4 X4 Nr" c < t fd }|S )Nc 8 K | i | d {V \ }}}|||dS )N)rd countsre r+ )r r rd ri re r s r r zcounts.<locals>.wrapper sD )*D);F););#;#;#;#;#;#; 65 &&5IIIr" r r s ` r ri ri s8
1XXJ J J J XJ Nr" c < t fd }|S )Nc K t j dt t j d 5 } | i | d {V }d |D |d< |cd d d S # 1 swxY w Y d S )NalwaysT)recordc L g | ]!}d |j j "S ) )joinrQ r ).0ws r
<listcomp>z5collect_warnings.<locals>.wrapper.<locals>.<listcomp> s( !J!J!Jq#((19>":":!J!J!Jr" warnings)rt simplefilterDeprecationWarningcatch_warnings)r r warnsrG r s r r z!collect_warnings.<locals>.wrapper s h(:;;;
$D
1
1
1 U 1d-f--------F!J!JE!J!J!JF: s A A#&A#r r s ` r collect_warningsry s3
1XX X Nr" c < t fd }|S )Nc Z K | i | d {V }t |t sd|i}|S )Nre )r1 r2 rF s r r z!default_to_items.<locals>.wrapper sN q$)&))))))))&$'' ' v&F
r" r r s ` r default_to_itemsr| s3
1XX X Nr" c < t fd }|S )a
This middleware copies 'remote_addr' to 'client_addr'.
This is needed because send_command_invoke middleware may remove
remote_addr parameter from request.
Used for endpoints that need remote_addr in their logic.
:param f:
:return:
c l K | d d }|| d< | g|R i | d {V S )Nr/ remote_addr client_addr)r )r r r r r s r r z%preserve_remote_addr.<locals>.wrapper s[ h'++M:: !,
Qw0000000000000r" r r s ` r preserve_remote_addrr s5 1XX1 1 1 1 X1 Nr" c < t fd }|S )Nc K d }|r |d }n d|v r|d }|t | d }d|vr?d }t | dk r |d }n d|v r|d }|t j k rd|d< d|v rd|d< t j | d || d
d }| | d {V | d d d | g|R i | d {V S )
Nr sinkr/ r r Tpasswordz***commandcalling_process)r r/ r r )r2 r r NON_ROOTr
CommandInvokepopprocess_message)r r r r r/ user_typemsgcoros r r z,send_command_invoke_message.<locals>.wrapper sb "7DD
v
&>D '(+,,FV## t99q== $QIIv%% &vI 111%)F6N V##%*z" + * ' ,=t D D C &&s++ + + + + + + + H ! !- 6 6 6T'3D333F333333333r" r )r r s ` r send_command_invoke_messager s4
4[[$4 $4 $4 $4 [$4L Nr" )*loggingr3 rt datetimer functoolsr defence360agent.contractsr defence360agent.contracts.configr r r !defence360agent.contracts.licenser
"defence360agent.contracts.messagesr defence360agent.rpc_toolsr defence360agent.subsys.panelsr
defence360agent.utilsr defence360agent.utils.threadsr getLogger__name__r9 r! r( r, r@ rH rN r\ ra rd ri ry r| r r r+ r" r <module>r s
* * * * * * H H H H H H H H H H 8 8 8 8 8 8 : : : : : : 4 4 4 4 4 4 7 7 7 7 7 7 - - - - - - 3 3 3 3 3 3 8 $ $
"---...EI E E E /.E B , : *( ( ( ( (r" defence360agent/rpc_tools/__pycache__/middleware.cpython-311.pyc 0000644 0000000 0000000 00000030427 00000000000 021607 0 ustar
r_j! J d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m
Z
m Z m Z d dl
mZ d dlmZ d dlmZ d d lmZ d d
lmZ d d lmZ e j e Zd Z e ed
de fd Z d Z d Z d Z!d Z"d Z#d Z$d Z%d Z&d Z'd Z(d Z)dS ) N) timedeltawraps)eula)CoreUserType caller_type)
LicenseCLN) MessageType)caller_uid_var)
hosting_panel) timed_cache) to_threadc < t fd }|S )Nc ( K t | dk r|d n | dt j }t j | } | g|R i | d {V t j | S # t j | w xY w)N user)lengetr ROOTr setreset)requestargskwargsr tokenfs Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/middleware.pywrapperz(set_caller_type_context.<locals>.wrapper s
d))a--tAwwVZZ
-N-N%% %74T444V44444444 4 e $ $ $ $K e $ $ $ $s A; ;Br r r s ` r set_caller_type_contextr! s3
1XX % % % % X % N < )seconds)
expirationreturnc v K t t j d {V S )N) frozensetr
HostingPanel get_users r" r _panel_usersr, # s; =577AACCCCCCCC D DDr" c < t fd }|S )Nc X K | d }t |t r| d nd }t j d }|r|r t j | j |k rkt d {V }|rU||vrQt t j d {V D ]1}|j
|k r$|j |v r|j |d< d|v r |j g|d< n2n3# t $ r&}t
d|| Y d }~nd }~ww xY w | g|R i | d {V S )Nparamsr usersz,Failed to resolve panel login for uid %s: %s)r
isinstancedictr pwdgetpwuidpw_namer, r getpwallpw_uid Exceptionloggerwarning)
r r r r/ nameuid panel_userspwer s
r r z+resolve_caller_panel_login.<locals>.wrapper, s X&&%/%=%=Gvzz&!!!4 && C
<$$,44(4"6"6"6"6"6"6K" &t;'>'>(1#,(?(?"?"?"?"?"?"? & &B !yC / /BJ+4M4M13v#*f#4#479zlF7O %
BC
Qw0000000000000s BC' '
D1 DDr r s ` r resolve_caller_panel_loginr@ ( s5 1XX1 1 1 1 X12 Nr" c < t fd }|S )Nc K | i | d {V }t |t s
J d|z t j |d< |S )N Result should be a dictionary %slicense)r1 r2 r
license_infor r resultr s r r z add_license.<locals>.wrapperJ ss q$)&))))))))&$''
. 7
'
' 3 5 5y
r" r r s ` r add_licenserH I s3
1XX X Nr" c < t fd }|S )Nc K | i | d {V }t |t s
J d|z t j }|d | d | d d|d< |S )NrC status license_typeeligible_for_imunify_patch)rK rL rM rD )r1 r2 r
rE r )r r rG rD r s r r z!add_license_user.<locals>.wrapperY s q$)&))))))))&$''
. 7
'
)++ h' #KK 7 7*1++,+ +
y
r" r r s ` r add_license_userrN X s3
1XX X" Nr" c < t fd }|S )Nc K | i | d {V }t |t s
J d|z d }t j rt j st j d {V sx t j t j t j d}n=# t $ r0}dd t | dd}Y d }~nd }~ww xY w||d< |S )NrC )messagetextupdatedzFailed to read EULAzFailed to read EULA: {} r )
r1 r2 r
is_validis_freer is_acceptedrQ rR rS OSErrorformatstr)r r rG eula_dictr? r s r r zadd_eula.<locals>.wrappero s6 q$)&))))))))&$''
. 7
'
**<*>*>
)++++++++
#'<>> $ #'<>>! !II
#8 9 @ @Q H H#%! !IIIIII #v
s 69B0 0
C*:&C%%C*r r s ` r add_eular\ n s3
1XX X0 Nr" c < t fd }|S )Nc K | i | d {V }t |t s
J d|z t j |d< |S )NrC version)r1 r2 r VERSIONrF s r r z add_version.<locals>.wrapper sl q$)&))))))))&$''
. 7
' !Ly
r" r r s ` r add_versionra s3
1XX X Nr" c < t fd }|S )Nc 4 K | i | d {V \ }}||dS )N) max_countitemsr+ )r r countre r s r r zmax_count.<locals>.wrapper s? Q / / /////// u "U333r" r r s ` r rd rd s3
1XX4 4 4 4 X4 Nr" c < t fd }|S )Nc 8 K | i | d {V \ }}}|||dS )N)rd countsre r+ )r r rd ri re r s r r zcounts.<locals>.wrapper sD )*D);F););#;#;#;#;#;#; 65 &&5IIIr" r r s ` r ri ri s8
1XXJ J J J XJ Nr" c < t fd }|S )Nc K t j dt t j d 5 } | i | d {V }d |D |d< |cd d d S # 1 swxY w Y d S )NalwaysT)recordc L g | ]!}d |j j "S ) )joinrQ r ).0ws r
<listcomp>z5collect_warnings.<locals>.wrapper.<locals>.<listcomp> s( !J!J!Jq#((19>":":!J!J!Jr" warnings)rt simplefilterDeprecationWarningcatch_warnings)r r warnsrG r s r r z!collect_warnings.<locals>.wrapper s h(:;;;
$D
1
1
1 U 1d-f--------F!J!JE!J!J!JF: s A A#&A#r r s ` r collect_warningsry s3
1XX X Nr" c < t fd }|S )Nc Z K | i | d {V }t |t sd|i}|S )Nre )r1 r2 rF s r r z!default_to_items.<locals>.wrapper sN q$)&))))))))&$'' ' v&F
r" r r s ` r default_to_itemsr| s3
1XX X Nr" c < t fd }|S )a
This middleware copies 'remote_addr' to 'client_addr'.
This is needed because send_command_invoke middleware may remove
remote_addr parameter from request.
Used for endpoints that need remote_addr in their logic.
:param f:
:return:
c l K | d d }|| d< | g|R i | d {V S )Nr/ remote_addr client_addr)r )r r r r r s r r z%preserve_remote_addr.<locals>.wrapper s[ h'++M:: !,
Qw0000000000000r" r r s ` r preserve_remote_addrr s5 1XX1 1 1 1 X1 Nr" c < t fd }|S )Nc K d }|r |d }n d|v r|d }|t | d }d|vr?d }t | dk r |d }n d|v r|d }|t j k rd|d< d|v rd|d< t j | d || d
d }| | d {V | d d d | g|R i | d {V S )
Nr sinkr/ r r Tpasswordz***commandcalling_process)r r/ r r )r2 r r NON_ROOTr
CommandInvokepopprocess_message)r r r r r/ user_typemsgcoros r r z,send_command_invoke_message.<locals>.wrapper sb "7DD
v
&>D '(+,,FV## t99q== $QIIv%% &vI 111%)F6N V##%*z" + * ' ,=t D D C &&s++ + + + + + + + H ! !- 6 6 6T'3D333F333333333r" r )r r s ` r send_command_invoke_messager s4
4[[$4 $4 $4 $4 [$4L Nr" )*loggingr3 rt datetimer functoolsr defence360agent.contractsr defence360agent.contracts.configr r r !defence360agent.contracts.licenser
"defence360agent.contracts.messagesr defence360agent.rpc_toolsr defence360agent.subsys.panelsr
defence360agent.utilsr defence360agent.utils.threadsr getLogger__name__r9 r! r( r, r@ rH rN r\ ra rd ri ry r| r r r+ r" r <module>r s
* * * * * * H H H H H H H H H H 8 8 8 8 8 8 : : : : : : 4 4 4 4 4 4 7 7 7 7 7 7 - - - - - - 3 3 3 3 3 3 8 $ $
"---...EI E E E /.E B , : *( ( ( ( (r" defence360agent/rpc_tools/__pycache__/utils.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000016323 00000000000 021570 0 ustar
r_j1 F d dl Z d dlZd dlZd dlmZ d dlmZmZ d dlm Z d dl
m Z d dl m
Z
mZmZ d dlZd dlZd dlmZ d dlmZ d d lmZ d d
lmZmZm Z m Z d Z d Z ddZ ddee ddf fdZ!dde
ee fdZ" ed d Z#d Z$ ddZ%dS ) N)suppress) lru_cachewraps)chain)Path)OptionalTuple Generator) SimpleRpc)run_in_executor)ValidationError) AV_PID_PATHIM360_NON_RESIDENT_PID_PATHIM360_RESIDENT_PID_PATHantivirus_modec V t j rt nt } | rzt j }t t 5 t |
}||k ot j | cddd S # 1 swxY w Y dS )z/Check if non-resident agent instance is runningNF)
r enabledr r existsosgetpidr Exceptionint read_textpsutil
pid_exists)rpc_process_pid_path current_pidpids T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/utils.pyrpc_is_runningr s
&-N 3N ""$$ Aikk
i
A A*446677C+%@&*;C*@*@ A A A A A A A A A A A A A A A A 5s ;B B"%B"c t j rt S t j rMt j } t t j }|| k ot j
| S dS )z&Check if the agent instance is runningF) ConfigSOCKET_ACTIVATIONr r r r r r r r r )r r s r
is_runningr$ ' sl
%'' =ikk )35566k!<f&7&<&<< 5 schemac # K t | | D ]}| d x} r't j | }n&t
j | }| D ]+\ }}t | d |fV ,d S )Nz.pickle ) find_schema_files with_suffixr pickleloads
read_bytesyaml safe_loadr itemstuplesplit)base
schema_dirpathpdocumentkvs r _find_schemar: 3 s !$
33 ) )!!),, ,A 4 4 6 6 8 |ALLNN33HH~dnn&6&677H NN$$ ) )DAq %%q( ( ( ( ( )
) )r% returnc # z K | |z }g | d | d D ]}|V d S )Nz*.yamlz*.yml)rglob)r3 r4 r6 r5 s r r) r) ? sX
zA7!''(##7aggg&6&67
r% pathsc | rt | d d ng }t t j j dz }| ||j dz dz g |S )N
simple_rpcfeature_managementrpc)listr __file__parentextend)r> resultr5 s r get_schema_pathsrH G si $
,T%[[^^"F >> ', 6D
MM K. . 6
Mr% c g }t | D ]$}| t | %t t | S N)rH appendr: dictr )r> r& base_paths r prepare_schemarO S sM
F%e,, / /
l9--.... v r% c < t fd }|S )Nc d K t t j fd d {V S )Nc i S rK )argsfkwargss r <lambda>z<run_in_executor_decorator.<locals>.wrapper.<locals>.<lambda>_ s aa.@.@.@ r% )r asyncioget_event_loop)rT rV rU s ``r wrapperz*run_in_executor_decorator.<locals>.wrapper\ sW $ " $ $&@&@&@&@&@&@
r% )r )rU rZ s ` r run_in_executor_decoratorr[ [ s3
1XX
X
Nr% c g }|D ]w}|d | d| }
} |
r,|r*| | | |
N| | | | xt | } t | } | dk r/| | k r)| | | | |rt | i S )aP
:param list affected: IPs that were changed during operation
:param list of tuples || list of str not_affected: IPs & it's listnames
that weren't changed during operation
:param list all_list: list of all IPs that take place in operation
:param str success_warning: msg if IP was changed
:param str failure_warning: msg if IPs wasn't changed and it's absent
in any other lists
:param str in_another_list_warning: msg if IPs wasn't changed , however
it present in another list
:return list of st warnings: msg to be printed
reclistnamerI )getrL formatlenr
)
affected not_affected
dest_listnameall_listsuccess_warningfailure_warningin_another_list_warningwarningsitemrecordr^ num_deleted total_nums
r generate_warningsrn e s * H K K ;](K(K K/ K OO 3 : :68 L L M M M M OOO 2 26= I I J J J Jh--KH
I1}}k11..{IFFGGG ( h'''
Ir% )Nr& rK )&r+ rX r
contextlibr functoolsr r itertoolsr pathlibr typingr r r
r. r defence360agent.contracts.configr r" $defence360agent.model.simplificationr "defence360agent.rpc_tools.validater
defence360agent.utilsr r r r r r$ r: r) rH rO r[ rn rS r% r <module>rx s
& & & & & & & & - - - - - - - - - -
@ @ @ @ @ @ @ @ @ @ @ @ > > > > > > ) ) ) ) # tT4 HU4[ 1 1 " !& & & & & &r% defence360agent/rpc_tools/__pycache__/utils.cpython-311.pyc 0000644 0000000 0000000 00000016323 00000000000 020631 0 ustar
r_j1 F d dl Z d dlZd dlZd dlmZ d dlmZmZ d dlm Z d dl
m Z d dl m
Z
mZmZ d dlZd dlZd dlmZ d dlmZ d d lmZ d d
lmZmZm Z m Z d Z d Z ddZ ddee ddf fdZ!dde
ee fdZ" ed d Z#d Z$ ddZ%dS ) N)suppress) lru_cachewraps)chain)Path)OptionalTuple Generator) SimpleRpc)run_in_executor)ValidationError) AV_PID_PATHIM360_NON_RESIDENT_PID_PATHIM360_RESIDENT_PID_PATHantivirus_modec V t j rt nt } | rzt j }t t 5 t |
}||k ot j | cddd S # 1 swxY w Y dS )z/Check if non-resident agent instance is runningNF)
r enabledr r existsosgetpidr Exceptionint read_textpsutil
pid_exists)rpc_process_pid_path current_pidpids T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/utils.pyrpc_is_runningr s
&-N 3N ""$$ Aikk
i
A A*446677C+%@&*;C*@*@ A A A A A A A A A A A A A A A A 5s ;B B"%B"c t j rt S t j rMt j } t t j }|| k ot j
| S dS )z&Check if the agent instance is runningF) ConfigSOCKET_ACTIVATIONr r r r r r r r r )r r s r
is_runningr$ ' sl
%'' =ikk )35566k!<f&7&<&<< 5 schemac # K t | | D ]}| d x} r't j | }n&t
j | }| D ]+\ }}t | d |fV ,d S )Nz.pickle ) find_schema_files with_suffixr pickleloads
read_bytesyaml safe_loadr itemstuplesplit)base
schema_dirpathpdocumentkvs r _find_schemar: 3 s !$
33 ) )!!),, ,A 4 4 6 6 8 |ALLNN33HH~dnn&6&677H NN$$ ) )DAq %%q( ( ( ( ( )
) )r% returnc # z K | |z }g | d | d D ]}|V d S )Nz*.yamlz*.yml)rglob)r3 r4 r6 r5 s r r) r) ? sX
zA7!''(##7aggg&6&67
r% pathsc | rt | d d ng }t t j j dz }| ||j dz dz g |S )N
simple_rpcfeature_managementrpc)listr __file__parentextend)r> resultr5 s r get_schema_pathsrH G si $
,T%[[^^"F >> ', 6D
MM K. . 6
Mr% c g }t | D ]$}| t | %t t | S N)rH appendr: dictr )r> r& base_paths r prepare_schemarO S sM
F%e,, / /
l9--.... v r% c < t fd }|S )Nc d K t t j fd d {V S )Nc i S rK )argsfkwargss r <lambda>z<run_in_executor_decorator.<locals>.wrapper.<locals>.<lambda>_ s aa.@.@.@ r% )r asyncioget_event_loop)rT rV rU s ``r wrapperz*run_in_executor_decorator.<locals>.wrapper\ sW $ " $ $&@&@&@&@&@&@
r% )r )rU rZ s ` r run_in_executor_decoratorr[ [ s3
1XX
X
Nr% c g }|D ]w}|d | d| }
} |
r,|r*| | | |
N| | | | xt | } t | } | dk r/| | k r)| | | | |rt | i S )aP
:param list affected: IPs that were changed during operation
:param list of tuples || list of str not_affected: IPs & it's listnames
that weren't changed during operation
:param list all_list: list of all IPs that take place in operation
:param str success_warning: msg if IP was changed
:param str failure_warning: msg if IPs wasn't changed and it's absent
in any other lists
:param str in_another_list_warning: msg if IPs wasn't changed , however
it present in another list
:return list of st warnings: msg to be printed
reclistnamerI )getrL formatlenr
)
affected not_affected
dest_listnameall_listsuccess_warningfailure_warningin_another_list_warningwarningsitemrecordr^ num_deleted total_nums
r generate_warningsrn e s * H K K ;](K(K K/ K OO 3 : :68 L L M M M M OOO 2 26= I I J J J Jh--KH
I1}}k11..{IFFGGG ( h'''
Ir% )Nr& rK )&r+ rX r
contextlibr functoolsr r itertoolsr pathlibr typingr r r
r. r defence360agent.contracts.configr r" $defence360agent.model.simplificationr "defence360agent.rpc_tools.validater
defence360agent.utilsr r r r r r$ r: r) rH rO r[ rn rS r% r <module>rx s
& & & & & & & & - - - - - - - - - -
@ @ @ @ @ @ @ @ @ @ @ @ > > > > > > ) ) ) ) # tT4 HU4[ 1 1 " !& & & & & &r% defence360agent/rpc_tools/__pycache__/validate.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000031450 00000000000 022217 0 ustar
r_j' D d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZmZ ej e Z ej d Z G d d
e Z ed d d
g Z G d de Z G d de
Z d Z d Z d Z dS ) N)
namedtuplewraps) Validator)ANTIVIRUS_MODE
BackupRestoreMalware)
LicenseCLN) BackupSystem get_backendz^[A-Fa-f0-9]{64}$c e Zd ZddZdS )ValidationErrorNc b t |t r |g| _ n|| _ |pi | _ d S N)
isinstancestrerrors
extra_data)selfr r s W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/validate.py__init__zValidationError.__init__ s6 fc " " !!(DKK DK$* r )__name__
__module__ __qualname__r r r r r s( + + + + + +r r OrderByBase column_namedescc 4 e Zd Z fdZed Z xZS )OrderByc J t | || S r )super__new__)clsr r __class__s r r$ zOrderBy.__new__$ s wwsK666r c t j d | dd \ }} | ||dk S # t $ r5}t d t | | d}~ww xY w)zP
:param ob_string: for example: 'user+', 'id-'
:return:
z ^(.+)([+|-]) -z Incorrect order_by: ({}): {}N)recompilesplit
ValueErrorformatr )r% ob_stringcol_namesignes r
fromstringzOrderBy.fromstring' s Z 7 7 = =i H H2 NNHd3x-- - .55c!ffiHH
s AA
B0A>>B)r r r r$ classmethodr4
__classcell__r& s @r r! r! # sS 7 7 7 7 7 [ r r! c e Zd ZdZ fdZd Zd Zd Zd Zde fdZ
d Z d
Z d Z
d efd
Zd Zd Zd Zd Zd Zd Zd Zde fdZd Zd Zde ded dfdZ xZS )SchemaValidatorz%Y-%m-%dc H t j |i | i | _ d S r )r# r r )r argskwargsr& s r r zSchemaValidator.__init__9 s* $)&))) r c d t |t r|S t | S r )r r! r4 r values r _normalize_coerce_order_byz*SchemaValidator._normalize_coerce_order_by= s- eW % % L!!%(((r c h t | S r )r striplowerr> s r _normalize_coerce_sha256hashz,SchemaValidator._normalize_coerce_sha256hashB s& 5zz !!'')))r c 4 t rdS | t j S |S )NF)r r DATABASE_SCAN_ENABLEDr> s r _normalize_coerce_scan_dbz)SchemaValidator._normalize_coerce_scan_dbE s" 5 =0 0 r c 4 t |t rdS dS )NTF)r r! r> s r _validate_type_order_byz'SchemaValidator._validate_type_order_byL s eW % % 4ur r? c t t t | S r )
SHA256_REGEXPmatchr rB r> s r _validate_type_sha256hashz)SchemaValidator._validate_type_sha256hashQ s( ""3u::#3#3#5#5666r c |rJt j | s-| |d | dS dS dS )z#{'type': 'boolean', 'empty': False}zPath {} should be absoluteN)ospathisabs_errorr/ )r is_absolute_pathfieldr? s r _validate_is_absolute_pathz*SchemaValidator._validate_is_absolute_pathT sc O7==''
O E#?#F#Fu#M#MNNNNN O O
O
Or c |r? | d dS # t $ r | |d Y dS w xY wdS )z{'type': 'boolean'}asciiz Must only contain ascii symbolsN)encodeUnicodeEncodeErrorrR )r isasciirT r? s r _validate_isasciiz!SchemaValidator._validate_isasciiZ sr F
F W%%%%%%
F
F
F E#DEEEEEE
F F Fs ??c t | S r )intr> s r _normalize_coerce_intz%SchemaValidator._normalize_coerce_intb s 5zzr returnc t j t j S r )mathceildatetimenow timestamp)r documents r _normalize_default_setter_nowz-SchemaValidator._normalize_default_setter_nowe s- y*..00::<<===r c dS )a; {'type': 'dict', 'empty': False, 'schema': {
'users': {'type': 'list', 'allowed': ['non-root', 'root'],
'empty': False},
'require_rpc': {'type': 'string', 'empty': True, 'default': 'running',
'allowed': ['running', 'stopped', 'any', 'direct']}
}}
Nr r r; r< s r
_validate_cliz SchemaValidator._validate_clii r c dS )z"{'type': 'string', 'empty': False}Nr ri s r _validate_helpz SchemaValidator._validate_helps rk r c dS )z4{'type': 'boolean', 'empty': True, 'default': False}Nr ri s r _validate_positionalz$SchemaValidator._validate_positionalw rk r c dS )z!{'type': 'string', 'empty': True}Nr ri s r _validate_return_typez%SchemaValidator._validate_return_type{ rk r c dS )z5{'type': 'boolean', 'empty': False, 'default': False}Nr ri s r _validate_cli_onlyz"SchemaValidator._validate_cli_only~ rk r c dS )z
Parameter can be passed via the specified environment variable.
The value specified via a CLI argument takes precedence.
The rule's arguments are validated against this schema:
{'type': 'string', 'empty': False}
Nr ri s r _validate_envvarz SchemaValidator._validate_envvar rk r c dS )a
Parameter will only be accepted if provided via environment
variable specified by `envvar`. It will be rejected if passed as
a CLI argument.
The rule's arguments are validated against this schema:
{'type': 'boolean', 'default': False}
Nr ri s r _validate_envvar_onlyz%SchemaValidator._validate_envvar_only rk r c H |r t j | S |S r )rO rP abspathr> s r _normalize_coerce_pathz&SchemaValidator._normalize_coerce_path s# *7??5)) ) r c N t |t r|S t | S r )r r r r> s r _normalize_coerce_backup_systemz/SchemaValidator._normalize_coerce_backup_system s' e\ * * L5!!!r c t t j rt j s| |d d S d S )NzBackup is not enabled!)r ENABLED
backup_systemrR )r rT r? s r _validator_backup_is_enabledz,SchemaValidator._validator_backup_is_enabled sB % 9-*E*G*G 9 KK 7 8 8 8 8 8 9 9r rT Nc
t j | d S # t $ r5}| |d| dt | d Y d }~d S d }~ww xY w)NzIncorrect timestamp: z ())rc
fromtimestampr. rR r )r rT r? r3 s r _validator_timestampz$SchemaValidator._validator_timestamp s K + +E 2 2 2 2 2 K K K KK Iu I IA I I I J J J J J J J J J Ks #
A"*A A") r r r _DATE_FORMATr r@ rD rG rI r rM rU r[ r^ r] rg rj rm ro rq rs ru rw rz r| r r r6 r7 s @r r9 r9 6 s L ) ) )
* * *
7s 7 7 7 7O O O F F F > > > > > 1 1 1C C C0 0 0D D D C " " " 9 9 9K# Kc Kd K K K K K K K Kr r9 c $ | ||id }| ||| i sNt d ||| j t
| j | j | j | S )NT)always_return_documentz6Validation error with command {}, params {}, errors {})
normalizedvalidateloggerwarningr/ r r r rf ) validatorhashableparamsvaluess r r r s
!
! 64 " F x)9 : ; ; F D K K&)"2
i . 0DEEE h ''r c fd}|S )Nc @ t fd }|S )Nc K t | d }t || d | d< | g|R i | d {V }|S )Ncommandr )tupler )requestr; r< r resultfr s r wrapperz5validate_middleware.<locals>.wrapped.<locals>.wrapper sq WY /00H (8WX%6! !GH 1W6t666v66666666FMr r )r r r s ` r wrappedz$validate_middleware.<locals>.wrapped s9 q
r r )r r s ` r validate_middlewarer s#
Nr c p t d t fd }t r|S S )zz
Decorator for CLI commands methods that ensures that the AV+ license
is valid.
:raises ValidationError:
zImunifyAV+ license requiredc N K t j r | i | d {V S r )r
is_valid_av_plus)r; r< exceptionfuncs r
async_wrapperz/validate_av_plus_license.<locals>.async_wrapper sD & ( ( / t.v........ .r )r r r )r r r s ` @r validate_av_plus_licenser sW =>>I
4[[ [
Kr )!rc loggingra rO r+ collectionsr functoolsr cerberus.validatorr defence360agent.contracts.configr r r !defence360agent.contracts.licenser
%defence360agent.subsys.backup_systemsr r getLoggerr r r, rK Exceptionr r r! r9 r r r r r r <module>r s " " " " " " ( ( ( ( ( (
9 8 8 8 8 8 K K K K K K K K 8 $ $
.//
+ + + + +i + + + j (?@@ k &rK rK rK rK rKi rK rK rKj ( ( (
r defence360agent/rpc_tools/__pycache__/validate.cpython-311.pyc 0000644 0000000 0000000 00000031450 00000000000 021260 0 ustar
r_j' D d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZmZ ej e Z ej d Z G d d
e Z ed d d
g Z G d de Z G d de
Z d Z d Z d Z dS ) N)
namedtuplewraps) Validator)ANTIVIRUS_MODE
BackupRestoreMalware)
LicenseCLN) BackupSystem get_backendz^[A-Fa-f0-9]{64}$c e Zd ZddZdS )ValidationErrorNc b t |t r |g| _ n|| _ |pi | _ d S N)
isinstancestrerrors
extra_data)selfr r s W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/rpc_tools/validate.py__init__zValidationError.__init__ s6 fc " " !!(DKK DK$* r )__name__
__module__ __qualname__r r r r r s( + + + + + +r r OrderByBase column_namedescc 4 e Zd Z fdZed Z xZS )OrderByc J t | || S r )super__new__)clsr r __class__s r r$ zOrderBy.__new__$ s wwsK666r c t j d | dd \ }} | ||dk S # t $ r5}t d t | | d}~ww xY w)zP
:param ob_string: for example: 'user+', 'id-'
:return:
z ^(.+)([+|-]) -z Incorrect order_by: ({}): {}N)recompilesplit
ValueErrorformatr )r% ob_stringcol_namesignes r
fromstringzOrderBy.fromstring' s Z 7 7 = =i H H2 NNHd3x-- - .55c!ffiHH
s AA
B0A>>B)r r r r$ classmethodr4
__classcell__r& s @r r! r! # sS 7 7 7 7 7 [ r r! c e Zd ZdZ fdZd Zd Zd Zd Zde fdZ
d Z d
Z d Z
d efd
Zd Zd Zd Zd Zd Zd Zd Zde fdZd Zd Zde ded dfdZ xZS )SchemaValidatorz%Y-%m-%dc H t j |i | i | _ d S r )r# r r )r argskwargsr& s r r zSchemaValidator.__init__9 s* $)&))) r c d t |t r|S t | S r )r r! r4 r values r _normalize_coerce_order_byz*SchemaValidator._normalize_coerce_order_by= s- eW % % L!!%(((r c h t | S r )r striplowerr> s r _normalize_coerce_sha256hashz,SchemaValidator._normalize_coerce_sha256hashB s& 5zz !!'')))r c 4 t rdS | t j S |S )NF)r r DATABASE_SCAN_ENABLEDr> s r _normalize_coerce_scan_dbz)SchemaValidator._normalize_coerce_scan_dbE s" 5 =0 0 r c 4 t |t rdS dS )NTF)r r! r> s r _validate_type_order_byz'SchemaValidator._validate_type_order_byL s eW % % 4ur r? c t t t | S r )
SHA256_REGEXPmatchr rB r> s r _validate_type_sha256hashz)SchemaValidator._validate_type_sha256hashQ s( ""3u::#3#3#5#5666r c |rJt j | s-| |d | dS dS dS )z#{'type': 'boolean', 'empty': False}zPath {} should be absoluteN)ospathisabs_errorr/ )r is_absolute_pathfieldr? s r _validate_is_absolute_pathz*SchemaValidator._validate_is_absolute_pathT sc O7==''
O E#?#F#Fu#M#MNNNNN O O
O
Or c |r? | d dS # t $ r | |d Y dS w xY wdS )z{'type': 'boolean'}asciiz Must only contain ascii symbolsN)encodeUnicodeEncodeErrorrR )r isasciirT r? s r _validate_isasciiz!SchemaValidator._validate_isasciiZ sr F
F W%%%%%%
F
F
F E#DEEEEEE
F F Fs ??c t | S r )intr> s r _normalize_coerce_intz%SchemaValidator._normalize_coerce_intb s 5zzr returnc t j t j S r )mathceildatetimenow timestamp)r documents r _normalize_default_setter_nowz-SchemaValidator._normalize_default_setter_nowe s- y*..00::<<===r c dS )a; {'type': 'dict', 'empty': False, 'schema': {
'users': {'type': 'list', 'allowed': ['non-root', 'root'],
'empty': False},
'require_rpc': {'type': 'string', 'empty': True, 'default': 'running',
'allowed': ['running', 'stopped', 'any', 'direct']}
}}
Nr r r; r< s r
_validate_cliz SchemaValidator._validate_clii r c dS )z"{'type': 'string', 'empty': False}Nr ri s r _validate_helpz SchemaValidator._validate_helps rk r c dS )z4{'type': 'boolean', 'empty': True, 'default': False}Nr ri s r _validate_positionalz$SchemaValidator._validate_positionalw rk r c dS )z!{'type': 'string', 'empty': True}Nr ri s r _validate_return_typez%SchemaValidator._validate_return_type{ rk r c dS )z5{'type': 'boolean', 'empty': False, 'default': False}Nr ri s r _validate_cli_onlyz"SchemaValidator._validate_cli_only~ rk r c dS )z
Parameter can be passed via the specified environment variable.
The value specified via a CLI argument takes precedence.
The rule's arguments are validated against this schema:
{'type': 'string', 'empty': False}
Nr ri s r _validate_envvarz SchemaValidator._validate_envvar rk r c dS )a
Parameter will only be accepted if provided via environment
variable specified by `envvar`. It will be rejected if passed as
a CLI argument.
The rule's arguments are validated against this schema:
{'type': 'boolean', 'default': False}
Nr ri s r _validate_envvar_onlyz%SchemaValidator._validate_envvar_only rk r c H |r t j | S |S r )rO rP abspathr> s r _normalize_coerce_pathz&SchemaValidator._normalize_coerce_path s# *7??5)) ) r c N t |t r|S t | S r )r r r r> s r _normalize_coerce_backup_systemz/SchemaValidator._normalize_coerce_backup_system s' e\ * * L5!!!r c t t j rt j s| |d d S d S )NzBackup is not enabled!)r ENABLED
backup_systemrR )r rT r? s r _validator_backup_is_enabledz,SchemaValidator._validator_backup_is_enabled sB % 9-*E*G*G 9 KK 7 8 8 8 8 8 9 9r rT Nc
t j | d S # t $ r5}| |d| dt | d Y d }~d S d }~ww xY w)NzIncorrect timestamp: z ())rc
fromtimestampr. rR r )r rT r? r3 s r _validator_timestampz$SchemaValidator._validator_timestamp s K + +E 2 2 2 2 2 K K K KK Iu I IA I I I J J J J J J J J J Ks #
A"*A A") r r r _DATE_FORMATr r@ rD rG rI r rM rU r[ r^ r] rg rj rm ro rq rs ru rw rz r| r r r6 r7 s @r r9 r9 6 s L ) ) )
* * *
7s 7 7 7 7O O O F F F > > > > > 1 1 1C C C0 0 0D D D C " " " 9 9 9K# Kc Kd K K K K K K K Kr r9 c $ | ||id }| ||| i sNt d ||| j t
| j | j | j | S )NT)always_return_documentz6Validation error with command {}, params {}, errors {})
normalizedvalidateloggerwarningr/ r r r rf ) validatorhashableparamsvaluess r r r s
!
! 64 " F x)9 : ; ; F D K K&)"2
i . 0DEEE h ''r c fd}|S )Nc @ t fd }|S )Nc K t | d }t || d | d< | g|R i | d {V }|S )Ncommandr )tupler )requestr; r< r resultfr s r wrapperz5validate_middleware.<locals>.wrapped.<locals>.wrapper sq WY /00H (8WX%6! !GH 1W6t666v66666666FMr r )r r r s ` r wrappedz$validate_middleware.<locals>.wrapped s9 q
r r )r r s ` r validate_middlewarer s#
Nr c p t d t fd }t r|S S )zz
Decorator for CLI commands methods that ensures that the AV+ license
is valid.
:raises ValidationError:
zImunifyAV+ license requiredc N K t j r | i | d {V S r )r
is_valid_av_plus)r; r< exceptionfuncs r
async_wrapperz/validate_av_plus_license.<locals>.async_wrapper sD & ( ( / t.v........ .r )r r r )r r r s ` @r validate_av_plus_licenser sW =>>I
4[[ [
Kr )!rc loggingra rO r+ collectionsr functoolsr cerberus.validatorr defence360agent.contracts.configr r r !defence360agent.contracts.licenser
%defence360agent.subsys.backup_systemsr r getLoggerr r r, rK Exceptionr r r! r9 r r r r r r <module>r s " " " " " " ( ( ( ( ( (
9 8 8 8 8 8 K K K K K K K K 8 $ $
.//
+ + + + +i + + + j (?@@ k &rK rK rK rK rKi rK rK rKj ( ( (
r defence360agent/rpc_tools/exceptions.py 0000644 0000000 0000000 00000000623 00000000000 015306 0 ustar from defence360agent.contracts import config
class RpcError(RuntimeError):
pass
class ResponseError(RpcError):
pass
class SocketError(RpcError):
pass
class ServiceStateError(SocketError):
def __init__(self, state="stopped"):
super().__init__(
"{} service is {}.".format(config.Core.PRODUCT, state)
)
class NonRootValidationError(RpcError):
pass
defence360agent/rpc_tools/lookup.py 0000644 0000000 0000000 00000010615 00000000000 014440 0 ustar import functools
import inspect
from typing import Any
from defence360agent.contracts.config import UserType
from defence360agent.utils import Scope
from .exceptions import RpcError
_RPC_MARK = "__rpc_command"
class DuplicateHandlerError(Exception):
pass
class NotCoroutineError(Exception):
pass
class Endpoints:
"""Endpoints class implements registration and lookup for functions
implementing RPC calls."""
SCOPE = Scope.AV_IM360
APPLICABLE_USER_TYPES = set() # type: Set[str]
__COMMAND_MAP = {
UserType.ROOT: {},
UserType.NON_ROOT: {},
} # type: Dict[str, Dict]
_subclasses = []
def __init_subclass__(cls, **kwargs):
super().__init_subclass__(**kwargs)
cls._subclasses.append(cls)
@classmethod
def get_active_endpoints(cls):
# consider endpoint as active if it has at least one RPC call handler
active_endpoints = []
for subcls in cls._subclasses:
rpc_handlers = inspect.getmembers(
subcls, lambda item: getattr(item, _RPC_MARK, None)
)
if rpc_handlers:
active_endpoints.append(subcls)
return active_endpoints
def __init__(self, sink):
self._sink = sink
@classmethod
async def route_to_endpoint(cls, request, sink, user=UserType.ROOT) -> Any:
"""Find appropriate class and function within that class that
implements processing for request based on supplied 'command' within.
Call that (async) function and return its result.
If target class/function for given request['command'] is not found then
RpcError exception is raised."""
command = request["command"]
key = tuple(command)
if key not in cls.__COMMAND_MAP[user]:
raise RpcError(
'Endpoint not found for RPC method "%s"'
% " ".join(request["command"])
)
cls_handler, handler_name = cls.__COMMAND_MAP[user][key]
handler = getattr(cls_handler(sink), handler_name)
return await handler(**request["params"])
@classmethod
def register_rpc_handlers(cls) -> None:
"""Registers RPC handlers for all functions within a class.
Functions should be decorated with @bind('command', ...)."""
for name in dir(cls):
if name.startswith("_"):
continue
attr = getattr(cls, name)
command = getattr(attr, _RPC_MARK, None)
if command is None:
continue
if not inspect.iscoroutinefunction(attr):
raise NotCoroutineError("Must be a coroutine")
for user_type in cls.APPLICABLE_USER_TYPES:
if command in cls.__COMMAND_MAP[user_type]:
msg = (
"Duplicate handlers for command {} ({}): {} and {}"
.format(
command,
user_type,
cls.__COMMAND_MAP[user_type][command],
attr,
)
)
raise DuplicateHandlerError(msg)
cls.__COMMAND_MAP[user_type][command] = (cls, name)
@classmethod
def reset_rpc_handlers(cls):
"""Clears all previously made registrations."""
for user_type in {UserType.NON_ROOT, UserType.ROOT}:
cls.__COMMAND_MAP[user_type] = {}
class CommonEndpoints(Endpoints):
"""Endpoints available both for root and non root users."""
APPLICABLE_USER_TYPES = {UserType.NON_ROOT, UserType.ROOT}
class RootEndpoints(Endpoints):
"""Endpoints available only for root user."""
APPLICABLE_USER_TYPES = {UserType.ROOT}
class UserOnlyEndpoints(Endpoints):
"""Endpoints available only for non root users."""
APPLICABLE_USER_TYPES = {UserType.NON_ROOT}
LOOKUP_ASSIGNMENTS = functools.WRAPPER_ASSIGNMENTS + (_RPC_MARK,)
def wraps(
wrapped, assigned=LOOKUP_ASSIGNMENTS, updated=functools.WRAPPER_UPDATES
):
"""Decorator replacing functools.wraps for rpc handlers"""
return functools.partial(
functools.update_wrapper,
wrapped=wrapped,
assigned=assigned,
updated=updated,
)
def bind(*command):
"""Mark a function as processing RPC calls for command."""
def decorator(func):
setattr(func, _RPC_MARK, command)
return func
return decorator
defence360agent/rpc_tools/middleware.py 0000644 0000000 0000000 00000020706 00000000000 015246 0 ustar import logging
import pwd
import warnings
from datetime import timedelta
from functools import wraps
from defence360agent.contracts import eula
from defence360agent.contracts.config import Core, UserType, caller_type
from defence360agent.contracts.license import LicenseCLN
from defence360agent.contracts.messages import MessageType
from defence360agent.rpc_tools import caller_uid_var
from defence360agent.subsys.panels import hosting_panel
from defence360agent.utils import timed_cache
from defence360agent.utils.threads import to_thread
logger = logging.getLogger(__name__)
def set_caller_type_context(f):
@wraps(f)
async def wrapper(request, *args, **kwargs):
# Match how send_command_invoke_message extracts the caller: the
# positional user from the RPC dispatch (cb(request, sink, user)),
# else kwargs, else ROOT for the direct-CLI path (cb(request, sink)).
user = args[1] if len(args) > 1 else kwargs.get("user", UserType.ROOT)
token = caller_type.set(user)
try:
return await f(request, *args, **kwargs)
finally:
caller_type.reset(token)
return wrapper
@timed_cache(expiration=timedelta(seconds=60))
async def _panel_users() -> frozenset:
return frozenset(await hosting_panel.HostingPanel().get_users())
def resolve_caller_panel_login(f):
# Plesk additional web/FTP users share the subscription sysuser's UID,
# so the getpwuid()-derived caller name may be a non-panel entry; prefer
# the same-UID panel login, matching scan-side owner attribution.
@wraps(f)
async def wrapper(request, *args, **kwargs):
params = request.get("params")
name = params.get("user") if isinstance(params, dict) else None
uid = caller_uid_var.get(None)
if name and uid:
try:
# only re-resolve names that came from getpwuid(); a name
# that differs was authenticated another way (e.g. a PAM
# user in a generic-panel JWT, with the UI process running
# under an unrelated UID) and must be kept as is
if pwd.getpwuid(uid).pw_name == name:
panel_users = await _panel_users()
if panel_users and name not in panel_users:
for pw in await to_thread(pwd.getpwall):
if pw.pw_uid == uid and pw.pw_name in panel_users:
params["user"] = pw.pw_name
if "users" in params:
params["users"] = [pw.pw_name]
break
except Exception as e:
logger.warning(
"Failed to resolve panel login for uid %s: %s", uid, e
)
return await f(request, *args, **kwargs)
return wrapper
def add_license(f):
@wraps(f)
async def wrapper(*args, **kwargs):
result = await f(*args, **kwargs)
assert isinstance(result, dict), (
"Result should be a dictionary %s" % result
)
# license_info() includes eligible_for_imunify_patch for schema compatibility
# see https://gerrit.cloudlinux.com/c/defence360/+/195229/comment/c1b1c514_1462b41c/
result["license"] = LicenseCLN.license_info()
return result
return wrapper
def add_license_user(f):
@wraps(f)
async def wrapper(*args, **kwargs):
result = await f(*args, **kwargs)
assert isinstance(result, dict), (
"Result should be a dictionary %s" % result
)
# license_info() includes eligible_for_imunify_patch for schema compatibility
# see https://gerrit.cloudlinux.com/c/defence360/+/195229/comment/c1b1c514_1462b41c/
license = LicenseCLN.license_info()
result["license"] = {
"status": license["status"],
"license_type": license.get("license_type"),
"eligible_for_imunify_patch": license.get(
"eligible_for_imunify_patch"
),
}
return result
return wrapper
def add_eula(f):
@wraps(f)
async def wrapper(*args, **kwargs):
result = await f(*args, **kwargs)
assert isinstance(result, dict), (
"Result should be a dictionary %s" % result
)
eula_dict = None
# do not show eula if not registered or using free AV version
if LicenseCLN.is_valid() and (not LicenseCLN.is_free()):
if not await eula.is_accepted():
try:
eula_dict = {
"message": eula.message(),
"text": eula.text(),
"updated": eula.updated(),
}
except OSError as e:
eula_dict = {
"message": "Failed to read EULA",
"text": "Failed to read EULA: {}".format(str(e)),
"updated": "",
}
result["eula"] = eula_dict
return result
return wrapper
def add_version(f):
@wraps(f)
async def wrapper(*args, **kwargs):
result = await f(*args, **kwargs)
assert isinstance(result, dict), (
"Result should be a dictionary %s" % result
)
result["version"] = Core.VERSION
return result
return wrapper
def max_count(f):
@wraps(f)
async def wrapper(*args, **kwargs):
count, items = await f(*args, **kwargs)
return {"max_count": count, "items": items}
return wrapper
def counts(f):
@wraps(f)
async def wrapper(*args, **kwargs):
max_count, counts, items = await f(*args, **kwargs)
return {"max_count": max_count, "counts": counts, "items": items}
return wrapper
def collect_warnings(f):
@wraps(f)
async def wrapper(*args, **kwargs):
warnings.simplefilter("always", DeprecationWarning)
with warnings.catch_warnings(record=True) as warns:
result = await f(*args, **kwargs)
result["warnings"] = [" ".join(w.message.args) for w in warns]
return result
return wrapper
# Need only for backward compatibility
def default_to_items(f):
@wraps(f)
async def wrapper(*args, **kwargs):
result = await f(*args, **kwargs)
if not isinstance(result, dict):
result = {"items": result}
return result
return wrapper
def preserve_remote_addr(f):
"""
This middleware copies 'remote_addr' to 'client_addr'.
This is needed because send_command_invoke middleware may remove
remote_addr parameter from request.
Used for endpoints that need remote_addr in their logic.
:param f:
:return:
"""
@wraps(f)
async def wrapper(request, *args, **kwargs):
remote_addr = request["params"].get("remote_addr")
request["client_addr"] = remote_addr
return await f(request, *args, **kwargs)
return wrapper
def send_command_invoke_message(coro):
@wraps(coro)
async def wrapper(request, *args, **kwargs):
# get the sink to send CommandInvoke message
sink = None
if args:
sink = args[0]
elif "sink" in kwargs:
sink = kwargs["sink"]
if sink is not None:
params = dict(request["params"])
if "user" not in params:
# find user type (root/non-root) to determine access rights
user_type = None
if len(args) > 1:
user_type = args[1]
elif "user" in kwargs:
user_type = kwargs["user"]
if user_type == UserType.NON_ROOT:
params["user"] = True
# don't send passwords
if "password" in params:
params["password"] = "***"
msg = MessageType.CommandInvoke(
command=request["command"],
params=params,
calling_process=request.pop("calling_process", None),
)
# MQTT tracing enrichment lives at the
# SendToServerClient.send_to_server chokepoint and is gated by
# the server-driven mqtt_tracked_methods list, so adding or
# removing tracked types is server-side config without an
# agent rollout. CommandInvoke is no longer enriched here.
await sink.process_message(msg)
request["params"].pop("remote_addr", None)
return await coro(request, *args, **kwargs)
return wrapper
defence360agent/rpc_tools/utils.py 0000644 0000000 0000000 00000010061 00000000000 014262 0 ustar import pickle
import asyncio
import os
from contextlib import suppress
from functools import lru_cache, wraps
from itertools import chain
from pathlib import Path
from typing import Optional, Tuple, Generator
import yaml
import psutil
from defence360agent.contracts.config import SimpleRpc as Config
from defence360agent.model.simplification import run_in_executor
from defence360agent.rpc_tools.validate import ValidationError
from defence360agent.utils import (
AV_PID_PATH,
IM360_NON_RESIDENT_PID_PATH,
IM360_RESIDENT_PID_PATH,
antivirus_mode,
)
def rpc_is_running():
"""Check if non-resident agent instance is running"""
# we use socket activation, so we could not use socket for this purpose
# check process instead
rpc_process_pid_path = (
AV_PID_PATH if antivirus_mode.enabled else IM360_NON_RESIDENT_PID_PATH
)
if rpc_process_pid_path.exists():
current_pid = os.getpid()
with suppress(Exception):
pid = int(rpc_process_pid_path.read_text())
return pid != current_pid and psutil.pid_exists(pid)
return False
def is_running():
"""Check if the agent instance is running"""
if Config.SOCKET_ACTIVATION:
return rpc_is_running()
if IM360_RESIDENT_PID_PATH.exists():
current_pid = os.getpid()
pid = int(IM360_RESIDENT_PID_PATH.read_text())
return pid != current_pid and psutil.pid_exists(pid)
return False
def _find_schema(base=None, schema_dir="schema"):
for path in find_schema_files(base, schema_dir):
if (p := path.with_suffix(".pickle")).exists():
document = pickle.loads(p.read_bytes())
else:
document = yaml.safe_load(path.read_text())
for k, v in document.items():
# converting keys - from strings to tuples
yield tuple(k.split(" ")), v
def find_schema_files(
base=None, schema_dir="schema"
) -> Generator[Path, None, None]:
p = base / schema_dir
for path in [*p.rglob("*.yaml"), *p.rglob("*.yml")]:
yield path
def get_schema_paths(paths: Optional[Tuple[Path]] = None):
result = list(paths)[:] if paths else []
path = Path(__file__).parent.parent / "simple_rpc"
result.extend(
[
path,
path.parent / "feature_management" / "rpc",
]
)
return result
@lru_cache(1)
def prepare_schema(paths):
schema = []
for base_path in get_schema_paths(paths):
schema.append(_find_schema(base_path))
return dict(chain(*schema))
def run_in_executor_decorator(f):
@wraps(f)
async def wrapper(*args, **kwargs):
return await run_in_executor(
asyncio.get_event_loop(), lambda: f(*args, **kwargs)
)
return wrapper
def generate_warnings(
affected,
not_affected,
dest_listname,
all_list,
success_warning,
failure_warning,
in_another_list_warning=None,
):
"""
:param list affected: IPs that were changed during operation
:param list of tuples || list of str not_affected: IPs & it's listnames
that weren't changed during operation
:param list all_list: list of all IPs that take place in operation
:param str success_warning: msg if IP was changed
:param str failure_warning: msg if IPs wasn't changed and it's absent
in any other lists
:param str in_another_list_warning: msg if IPs wasn't changed , however
it present in another list
:return list of st warnings: msg to be printed
"""
warnings = []
for item in not_affected:
record, listname = item["rec"], item.get("listname", dest_listname)
if listname and in_another_list_warning:
warnings.append(in_another_list_warning.format(record, listname))
else:
warnings.append(failure_warning.format(record, dest_listname))
num_deleted = len(affected)
total_num = len(all_list)
if total_num > 1 and total_num != num_deleted:
warnings.append(success_warning.format(num_deleted, total_num))
if warnings:
raise ValidationError(warnings)
return {}
defence360agent/rpc_tools/validate.py 0000644 0000000 0000000 00000015047 00000000000 014724 0 ustar import datetime
import logging
import math
import os
import re
from collections import namedtuple
from functools import wraps
from cerberus.validator import Validator
from defence360agent.contracts.config import (
ANTIVIRUS_MODE,
BackupRestore,
Malware,
)
from defence360agent.contracts.license import LicenseCLN
from defence360agent.subsys.backup_systems import BackupSystem, get_backend
logger = logging.getLogger(__name__)
SHA256_REGEXP = re.compile("^[A-Fa-f0-9]{64}$")
class ValidationError(Exception):
def __init__(self, errors, extra_data=None):
if isinstance(errors, str):
self.errors = [errors]
else:
self.errors = errors
self.extra_data = extra_data or {}
OrderByBase = namedtuple("OrderByBase", ["column_name", "desc"])
class OrderBy(OrderByBase):
def __new__(cls, column_name, desc):
return super().__new__(cls, column_name, desc)
@classmethod
def fromstring(cls, ob_string):
"""
:param ob_string: for example: 'user+', 'id-'
:return:
"""
try:
col_name, sign = re.compile("^(.+)([+|-])").split(ob_string)[1:-1]
return cls(col_name, sign == "-")
except ValueError as e:
raise ValueError(
"Incorrect order_by: ({}): {}".format(str(e), ob_string)
)
class SchemaValidator(Validator):
_DATE_FORMAT = "%Y-%m-%d"
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
self.extra_data = {}
def _normalize_coerce_order_by(self, value):
if isinstance(value, OrderBy):
return value
return OrderBy.fromstring(value)
def _normalize_coerce_sha256hash(self, value):
return str(value).strip().lower()
def _normalize_coerce_scan_db(self, value):
if ANTIVIRUS_MODE:
return False
if value is None:
return Malware.DATABASE_SCAN_ENABLED
return value
def _validate_type_order_by(self, value):
if isinstance(value, OrderBy):
return True
return False
def _validate_type_sha256hash(self, value: str):
return SHA256_REGEXP.match(str(value).strip())
def _validate_is_absolute_path(self, is_absolute_path, field, value):
"""{'type': 'boolean', 'empty': False}"""
if is_absolute_path:
if not os.path.isabs(value):
self._error(field, "Path {} should be absolute".format(value))
def _validate_isascii(self, isascii, field, value):
"""{'type': 'boolean'}"""
if isascii:
try:
value.encode("ascii")
except UnicodeEncodeError:
self._error(field, "Must only contain ascii symbols")
def _normalize_coerce_int(self, value):
return int(value)
def _normalize_default_setter_now(self, document) -> int:
return math.ceil(datetime.datetime.now().timestamp())
# for argparser support
def _validate_cli(self, *args, **kwargs):
"""{'type': 'dict', 'empty': False, 'schema': {
'users': {'type': 'list', 'allowed': ['non-root', 'root'],
'empty': False},
'require_rpc': {'type': 'string', 'empty': True, 'default': 'running',
'allowed': ['running', 'stopped', 'any', 'direct']}
}}
"""
# for argparser support
def _validate_help(self, *args, **kwargs):
"""{'type': 'string', 'empty': False}"""
# for argparser support
def _validate_positional(self, *args, **kwargs):
"""{'type': 'boolean', 'empty': True, 'default': False}"""
# metadata for response validation
def _validate_return_type(self, *args, **kwargs):
"""{'type': 'string', 'empty': True}"""
def _validate_cli_only(self, *args, **kwargs):
"""{'type': 'boolean', 'empty': False, 'default': False}"""
def _validate_envvar(self, *args, **kwargs):
"""
Parameter can be passed via the specified environment variable.
The value specified via a CLI argument takes precedence.
The rule's arguments are validated against this schema:
{'type': 'string', 'empty': False}
"""
def _validate_envvar_only(self, *args, **kwargs):
"""
Parameter will only be accepted if provided via environment
variable specified by `envvar`. It will be rejected if passed as
a CLI argument.
The rule's arguments are validated against this schema:
{'type': 'boolean', 'default': False}
"""
def _normalize_coerce_path(self, value: str):
if value:
return os.path.abspath(value)
return value
def _normalize_coerce_backup_system(self, value):
if isinstance(value, BackupSystem):
return value
return get_backend(value)
def _validator_backup_is_enabled(self, field, value):
if not (BackupRestore.ENABLED and BackupRestore.backup_system()):
self._error(field, "Backup is not enabled!")
def _validator_timestamp(self, field: str, value: int) -> None:
try:
datetime.datetime.fromtimestamp(value)
except ValueError as e:
self._error(field, f"Incorrect timestamp: {value} ({str(e)})")
def validate(validator, hashable, params):
values = validator.normalized(
{hashable: params}, always_return_document=True
)
if not validator.validate({hashable: values[hashable]}):
logger.warning(
"Validation error with command {}, params {}, errors {}".format(
hashable, params, validator.errors
)
)
raise ValidationError(validator.errors, validator.extra_data)
return validator.document[hashable]
def validate_middleware(validator):
def wrapped(f):
@wraps(f)
async def wrapper(request, *args, **kwargs):
hashable = tuple(request["command"])
request["params"] = validate(
validator, hashable, request["params"]
)
result = await f(request, *args, **kwargs)
return result
return wrapper
return wrapped
def validate_av_plus_license(func):
"""
Decorator for CLI commands methods that ensures that the AV+ license
is valid.
:raises ValidationError:
"""
exception = ValidationError("ImunifyAV+ license required")
@wraps(func)
async def async_wrapper(*args, **kwargs):
if LicenseCLN.is_valid_av_plus():
return await func(*args, **kwargs)
raise exception
if ANTIVIRUS_MODE:
return async_wrapper
return func
defence360agent/run.py 0000644 0000000 0000000 00000000155 00000000000 011725 0 ustar CORE_PLUGINS_PACKAGES = (
"defence360agent.plugins",
"defence360agent.feature_management.plugins",
)
defence360agent/sentry.py 0000644 0000000 0000000 00000012011 00000000000 012437 0 ustar """Helper for integrate sentry in stand-alone scripts"""
import json
import os
import subprocess
from contextlib import suppress
from pathlib import Path
from typing import List, Optional, Literal
import distro
import sentry_sdk
from defence360agent.application import tags
from defence360agent.contracts import sentry
IMUNIFY360 = "imunify360"
IMUNIFYAV = "imunify-antivirus"
IMUNIFY360_PKG = "imunify360-firewall"
LICENSE = "/var/imunify360/license.json"
LICENSE_FREE = "/var/imunify360/license-free.json"
FREE_ID = "IMUNIFYAV"
UNKNOWN_ID = "UNKNOWN"
SENTRY_DSN_PATH = Path("/opt/imunify360/venv/share/imunify360/sentry")
SENTRY_DSN_DEFAULT = "https://6de77a2763bd40c58fc9e3a89285aaa8@im360.sentry.cloudlinux.com/3?timeout=20" # noqa: E501
def get_sentry_dsn() -> str:
"""Return dsn from the file or the default one."""
try:
return SENTRY_DSN_PATH.read_text(encoding="ascii").strip()
except (OSError, UnicodeDecodeError):
return SENTRY_DSN_DEFAULT
def get_server_id() -> str:
with suppress(Exception):
for filename in [LICENSE, LICENSE_FREE]:
with suppress(FileNotFoundError), open(filename) as file:
return json.load(file)["id"]
return UNKNOWN_ID
def collect_output(cmd: List[str]) -> str:
try:
cp = subprocess.run(
cmd,
stdin=subprocess.DEVNULL,
stdout=subprocess.PIPE,
stderr=subprocess.DEVNULL,
)
except OSError:
return ""
if cp.returncode != 0:
return ""
return os.fsdecode(cp.stdout)
def get_rpm_version(pkg: str) -> str:
cmd = ["rpm", "-q", "--queryformat=%{VERSION}-%{RELEASE}", pkg]
return collect_output(cmd)
def get_dpkg_version(pkg: str) -> str:
cmd = ["dpkg-query", "--showformat=${Version}", "--show", pkg]
return collect_output(cmd)
def get_current_os():
platform_os = distro.linux_distribution()[0]
return platform_os.lower()
def get_package_name():
platform_os = get_current_os()
service_name = IMUNIFY360_PKG
if platform_os != "ubuntu" and get_rpm_version(IMUNIFYAV):
service_name = IMUNIFYAV
else:
service_name = IMUNIFY360
return service_name
def get_service_version(service_name) -> str:
platform_os = get_current_os()
if platform_os != "ubuntu":
version = get_rpm_version(service_name)
else:
version = get_dpkg_version(service_name)
return version
def configure_sentry():
# using LoggingIntegration (contained in default Integrations)
# logging event with *error* level will be reported to Sentry automatically
sentry_sdk.init(dsn=get_sentry_dsn())
with sentry_sdk.configure_scope() as scope:
package = get_package_name()
scope.user = {"id": get_server_id()}
scope.set_tag("name", package)
scope.set_tag("version", get_service_version(package))
tags.cached_fill()
for tag, value in sentry.tags().items():
scope.set_tag(tag, value)
def flush_sentry():
client = sentry_sdk.Hub.current.client
if client is not None:
client.flush(timeout=2.0)
def log_message(
message: str,
format_args: Optional[dict] = None,
level: Literal[
"fatal", "critical", "error", "warning", "info", "debug"
] = "warning",
fingerprint: Optional[str] = None,
component: Optional[str] = None,
**kwargs
):
"""
Helper function to log messages to Sentry with optional fingerprinting.
This is useful when you need to log messages to Sentry without relying on error handling.
Args:
message: The message to log
format_args: Dictionary of arguments to format the message with (optional)
level: Log level (default: "warning")
fingerprint: String for Sentry fingerprinting (optional)
component: Component name to tag the message with (optional)
**kwargs: Additional keyword arguments passed to sentry_sdk.capture_message()
Common options include:
- extra: dict of extra data to include
- tags: dict of additional tags
- contexts: dict of additional contexts
"""
if format_args is None:
format_args = {}
# Only format the message if format_args is not empty
if format_args:
try:
formatted_message = message.format(**format_args)
except KeyError:
# If formatting fails due to missing keys, use the original message
formatted_message = message
else:
formatted_message = message
# Remove 'level' from kwargs if present to avoid conflicts
kwargs.pop("level", None)
if fingerprint or component:
with sentry_sdk.push_scope() as scope:
if fingerprint:
scope.fingerprint = [fingerprint]
if component:
scope.set_tag("component", component)
sentry_sdk.capture_message(
formatted_message, level=level, **kwargs
)
else:
sentry_sdk.capture_message(formatted_message, level=level, **kwargs)
defence360agent/simple_rpc/ 0000755 0000000 0000000 00000000000 00000000000 012703 5 ustar defence360agent/simple_rpc/__init__.py 0000644 0000000 0000000 00000054425 00000000000 015026 0 ustar """
Simple unix socket RPC server implementation
"""
import asyncio
import functools
import inspect
import io
import json
import os
import select
import socket
import struct
import sys
import time
from contextlib import suppress
from logging import getLogger
from typing import Sequence
from psutil import Process
import sentry_sdk
from defence360agent.api import inactivity
from defence360agent.application import app
from defence360agent.contracts.config import Core, SimpleRpc as Config
from defence360agent.feature_management.exceptions import (
FeatureManagementError,
)
from defence360agent.internals.auth_protocol import UnixSocketAuthProtocol
from defence360agent.model import tls_check
from defence360agent.model.simplification import run_in_executor
from defence360agent.utils import is_root_user, run_coro
from defence360agent.utils.buffer import LineBuffer, LineBufferOverflow
from defence360agent.subsys.panels import hosting_panel
from defence360agent.subsys.panels.base import InvalidTokenException
from defence360agent.subsys import svcctl
from defence360agent.rpc_tools.exceptions import (
ResponseError,
ServiceStateError,
SocketError,
)
from defence360agent.rpc_tools.lookup import Endpoints, UserType
from defence360agent.rpc_tools.utils import (
is_running, # noqa: F401
rpc_is_running,
)
from defence360agent.rpc_tools.validate import ValidationError
# caller_uid_var is re-exported for existing importers; it lives in
# rpc_tools so lower layers never import from simple_rpc.
from defence360agent.rpc_tools import (
ERROR,
SUCCESS,
WARNING,
caller_uid_var,
)
logger = getLogger(__name__)
_SENSITIVE_PARAM_KEYS = frozenset({"jwt", "token", "password"})
def _redact_for_log(decoded):
safe = dict(decoded)
params = safe.get("params")
if isinstance(params, dict):
safe_params = dict(params)
for key in _SENSITIVE_PARAM_KEYS:
if key in safe_params:
safe_params[key] = "***"
safe["params"] = safe_params
return safe
def _safe_log_payload(raw):
try:
decoded = json.loads(raw)
except Exception:
return "<unparseable, {} chars>".format(len(raw))
if not isinstance(decoded, dict):
return repr(decoded)
return repr(_redact_for_log(decoded))
class RpcServiceState:
# If need DB and agent should be running
# e.g. on-demand scan
RUNNING = "running"
# Agent should be stopped
STOPPED = "stopped"
# It doesn't matter for operation running or stopping the agent
# if agent is running - using socket, instead of direct communication
ANY = "any"
# No need DB and UI interaction
# preferable for use direct instead any for execution external process
# e.g. enable/disable plugins/features
DIRECT = "direct"
async def _execute_request(coro, method):
try:
result = await coro
except ValidationError as e:
result = {
"result": WARNING,
"messages": e.errors,
}
result.update(e.extra_data)
return result
except (PermissionError, FeatureManagementError) as e:
msg, *args = e.args
logger.error(msg, *args)
return {
"result": ERROR,
"messages": [msg % tuple(args)],
}
except Exception as e:
sentry_sdk.capture_exception(e)
logger.error(
"Something went wrong while processing %s (%s)", method, str(e)
)
return {"result": ERROR, "messages": str(e)}
else:
return {"result": SUCCESS, "messages": [], "data": result}
def _apply_middleware(method, user):
cb = Endpoints.route_to_endpoint
if isinstance(method, (list, tuple)):
hashable = tuple(method)
common = app.MIDDLEWARE.get(None, [])
specific = app.MIDDLEWARE.get(hashable, [])
excluded = app.MIDDLEWARE_EXCLUDE.get(hashable, [])
for mw, users in reversed(common + specific):
if (user in users) and (mw not in excluded):
logger.debug("Applying middleware %s", mw.__name__)
cb = mw(cb)
return cb
def _find_uds_inodes(socket_path: str) -> Sequence[str]:
"""Find inodes corresponding to the unix domain socket path."""
with open(
"/proc/net/unix",
encoding=sys.getfilesystemencoding(),
errors=sys.getfilesystemencodeerrors(),
) as file:
return [line.split()[-2] for line in file if socket_path in line]
def _protocol_supports_guard(protocol_cls):
"""True if cls.__init__ accepts the guard kwargs; legacy *_ signatures TypeError when passed limiter=."""
try:
sig = inspect.signature(protocol_cls.__init__)
except (TypeError, ValueError):
return False
params = sig.parameters
return "limiter" in params and "read_timeout" in params
class ConnectionLimiter:
def __init__(self, max_connections):
self.max_connections = max_connections
self._count = 0
self.saturation_logged = False
def acquire(self):
if self._count >= self.max_connections:
return False
self._count += 1
return True
def release(self):
if self._count > 0:
self._count -= 1
self.saturation_logged = False
@property
def count(self):
return self._count
class ConnectionGuard:
def __init__(self, loop, *, limiter=None, read_timeout=None, name):
self._loop = loop
self._limiter = limiter
self._read_timeout = read_timeout
self._name = name
self._transport = None
self._timeout_handle = None
self._slot_acquired = False
self._peer_pid = None
self._peer_uid = None
def try_admit(self, transport):
if self._limiter is not None and not self._limiter.acquire():
if not self._limiter.saturation_logged:
logger.warning(
"%s connection limit (%d) reached; rejecting new client",
self._name,
self._limiter.max_connections,
)
self._limiter.saturation_logged = True
return False
self._slot_acquired = self._limiter is not None
self._transport = transport
self._schedule_timeout()
return True
def note_peer(self, pid, uid):
self._peer_pid = pid
self._peer_uid = uid
def on_data(self):
self._schedule_timeout()
def on_lost(self):
self._cancel_timeout()
if self._slot_acquired and self._limiter is not None:
self._limiter.release()
self._slot_acquired = False
self._transport = None
def _schedule_timeout(self):
if self._read_timeout is None:
return
if self._timeout_handle is not None:
self._timeout_handle.cancel()
self._timeout_handle = self._loop.call_later(
self._read_timeout, self._on_timeout
)
def _cancel_timeout(self):
if self._timeout_handle is not None:
self._timeout_handle.cancel()
self._timeout_handle = None
def _on_timeout(self):
self._timeout_handle = None
if self._transport is None:
return
logger.warning(
"Closing idle %s connection (pid=%s uid=%s, no data for %ds)",
self._name,
self._peer_pid,
self._peer_uid,
self._read_timeout,
)
transport, self._transport = self._transport, None
transport.close()
self.on_lost()
class _RpcServerProtocol(UnixSocketAuthProtocol):
def __init__(self, loop, sink, user, *, limiter=None, read_timeout=None):
self._loop = loop
self._sink = sink
self.user = user
self._transport = None
self._buf = LineBuffer()
self._guard = ConnectionGuard(
loop, limiter=limiter, read_timeout=read_timeout, name="RPC"
)
def connection_made(self, transport):
if not self._guard.try_admit(transport):
transport.close()
return
try:
super().connection_made(transport)
except (OSError, AttributeError, struct.error) as exc:
logger.warning(
"Rejected RPC connection: SO_PEERCRED unavailable (%s)",
exc,
)
transport.close()
self._transport = None
self._guard.on_lost()
return
self._guard.note_peer(self._pid, self._uid)
def preprocess_data(self, data: str):
decoded = json.loads(data)
user_type, user_name = hosting_panel.HostingPanel().authenticate(
self, decoded
)
self.user = user_type
if user_name is not None:
decoded["params"]["user"] = user_name
# Prevent multi-user bypass: non-root callers may only operate on
# their own username even when 'users' (plural) is supplied.
if "users" in decoded["params"]:
decoded["params"]["users"] = [user_name]
# add calling process
try:
calling_process = Process(self._pid).cmdline()
except Exception as e:
calling_process = [str(e)]
decoded["calling_process"] = calling_process
return decoded
def data_received(self, data):
if self._transport is None:
return
self._guard.on_data()
try:
self._buf.append(data.decode())
except LineBufferOverflow as e:
logger.warning(
"Closing RPC connection (pid=%s uid=%s): %s",
self._pid,
self._uid,
e,
)
self._transport.close()
self._transport = None
self._guard.on_lost()
return
for msg in self._buf:
try:
result = self.preprocess_data(msg)
method = result["command"]
params = result["params"]
logger.debug("Data received: command=%s", method)
cb = _apply_middleware(method, self.user)
# Scope caller_uid_var to the create_task call so the new
# task captures it via copy_context, but the parent
# protocol context is left untouched -- preventing leakage
# into subsequent reads (tests, repeated requests, etc.).
token = caller_uid_var.set(self._uid)
try:
# TODO: fix that there is no json flag in params
self._loop.create_task(
self._dispatch(
method, params, cb(result, self._sink, self.user)
)
)
finally:
caller_uid_var.reset(token)
except InvalidTokenException as e:
# without events in Sentry
logger.warning("Incorrect token provided")
self._write_response({"result": ERROR, "messages": str(e)})
except Exception as e:
logger.exception(
"Something went wrong before processing %s",
_safe_log_payload(msg),
)
self._write_response({"result": ERROR, "messages": str(e)})
async def _dispatch(self, method, params, coro):
with inactivity.track.task("rpc_{}".format(method)):
# route and save result to 'result'
response = await _execute_request(coro, method)
logger.info(
"Response: method - {}, data - {}".format(method, response)
)
self._write_response(response)
def connection_lost(self, transport):
self._guard.on_lost()
self._transport = None
def _write_response(self, data):
if self._transport is None:
logger.warning("Cannot send RPC response: connection lost.")
return
else:
try:
self._transport.write((json.dumps(data) + "\n").encode())
except Exception as e:
logger.exception(e) # TODO: need to own message error
def _check_socket_folder_permissions(socket_path):
dir_name = os.path.dirname(socket_path)
os.makedirs(dir_name, exist_ok=True)
os.chmod(dir_name, 0o755)
class RpcServer:
SOCKET_PATH = Config.SOCKET_PATH
USER = UserType.ROOT
SOCKET_MODE = 0o700
@classmethod
async def create(cls, loop, sink):
_check_socket_folder_permissions(cls.SOCKET_PATH)
with suppress(FileNotFoundError):
os.unlink(cls.SOCKET_PATH)
limiter = ConnectionLimiter(Config.MAX_CONCURRENT_CONNECTIONS)
server = await loop.create_unix_server(
lambda: _RpcServerProtocol(
loop,
sink,
cls.USER,
limiter=limiter,
read_timeout=Config.READ_TIMEOUT,
),
cls.SOCKET_PATH,
)
os.chmod(cls.SOCKET_PATH, cls.SOCKET_MODE)
return server
class RpcServerAV:
USER = UserType.ROOT
SOCKET_PATH = Config.SOCKET_PATH
PROTOCOL_CLASS = _RpcServerProtocol
@classmethod
async def create(cls, loop, sink):
"""Looking for socket in /proc/net/unix and check which descriptor
corresponded to it by comparing inode
$ ls -l /proc/[pid]/fd
lrwx------ 1 root root 64 Apr 11 07:20 4 -> socket:[2866765]
$ cat /proc/net/unix
Num RefCount Protocol Flags Type St Inode Path
ffff880054c0a4c0: 00000002 00000000 00010000 0001 01 2866765 /var/run/defence360agent/simple_rpc.sock # noqa
"""
def safe_readlink(*args, **kwargs):
"""Return empty path on error."""
with suppress(OSError):
return os.readlink(*args, **kwargs)
return ""
# find inodes for the SOCKET_PATH
_socket_path = cls.SOCKET_PATH
_check_socket_folder_permissions(_socket_path)
if _socket_path.startswith("/var/run"):
# remove /var prefix, see DEF-16201
_socket_path = _socket_path[len("/var") :]
inodes = _find_uds_inodes(_socket_path)
# find socket fds corresponding to the inodes
last_error = None
for inode in inodes:
try:
with os.scandir("/proc/self/fd") as it:
for fd in it:
if safe_readlink(fd.path) == "socket:[{}]".format(
inode
):
socket_fd = int(fd.name)
break # found fd
else: # no break, not found fd for given inode
continue # try another inode
break # found fd
except OSError as e:
last_error = e
else: # no break, not found
raise SocketError(
"[{}] Socket {!r} for {} not found.".format(
"inode" * (not inodes), cls.SOCKET_PATH, cls.USER
)
) from last_error
_socket = socket.fromfd(
socket_fd,
socket.AF_UNIX,
socket.SOCK_STREAM | socket.SOCK_NONBLOCK,
)
if _protocol_supports_guard(cls.PROTOCOL_CLASS):
limiter = ConnectionLimiter(Config.MAX_CONCURRENT_CONNECTIONS)
factory = lambda: cls.PROTOCOL_CLASS( # noqa: E731
loop,
sink,
cls.USER,
limiter=limiter,
read_timeout=Config.READ_TIMEOUT,
)
else:
factory = lambda: cls.PROTOCOL_CLASS( # noqa: E731
loop, sink, cls.USER
)
server = await loop.create_unix_server(factory, sock=_socket)
return server
class NonRootRpcServerAV(RpcServerAV):
USER = UserType.NON_ROOT
SOCKET_PATH = Config.NON_ROOT_SOCKET_PATH
class NonRootRpcServer(RpcServer):
SOCKET_PATH = Config.NON_ROOT_SOCKET_PATH
USER = UserType.NON_ROOT
# Match the systemd .socket unit (SocketMode=0666). UNIX domain sockets
# don't use the execute bit, so granting it (the previous 0o777) only
# widened the attack surface without enabling any client.
SOCKET_MODE = 0o666
class _RpcClientImpl:
def __init__(self, socket_path):
try:
self._sock = socket.socket(
socket.AF_UNIX, socket.SOCK_STREAM | socket.SOCK_NONBLOCK
)
self._sock.connect(socket_path)
except (ConnectionRefusedError, FileNotFoundError, BlockingIOError):
raise ServiceStateError()
def dispatch(self, method, params):
try:
self._sock.sendall(
(
json.dumps({"command": method, "params": params}) + "\n"
).encode()
)
except BrokenPipeError as e:
raise SocketError(f"communication interrupted, {e}")
try:
data = self._sock_recv_until(terminator_byte=b"\n")
except ConnectionResetError as e:
raise ResponseError(f"Connection reset: {e}") from e
try:
response = json.loads(data.decode())
except Exception as e:
raise ResponseError(
"Error parsing RPC response {!r}".format(data)
) from e
return response
def _sock_recv_until(self, terminator_byte):
assert not self._sock.getblocking()
chunks = []
while (not chunks) or (terminator_byte not in chunks[-1]):
fdread_list = [self._sock.fileno()]
rwx_fdlist = select.select(
fdread_list,
[],
[],
# naive timeout for one-shot response
# scenario
Config.CLIENT_TIMEOUT,
)
fdready_list = rwx_fdlist[0]
if self._sock.fileno() not in fdready_list:
if any(rwx_fdlist):
raise SocketError(
"select() = {!r} resulted in error".format(rwx_fdlist)
)
else:
raise SocketError("request timeout")
chunk = self._sock.recv(io.DEFAULT_BUFFER_SIZE)
if len(chunk) == 0:
raise SocketError("Empty response from socket.recv()")
chunks.append(chunk)
return b"".join(chunks)
class _NoRpcImpl:
def __init__(self, sink=None):
self._sink = sink
# suppress is for doing those things idempotent way
# PSSST! simplification.run_in_executor() is main thread now! :-X
# with suppress(tls_check.OverridingReset):
# tls_check.reset("main CLI thread for stopped agent")
with suppress(tls_check.OverridingReset):
loop = asyncio.get_event_loop()
loop.run_until_complete(run_in_executor(loop, tls_check.reset))
def dispatch(self, method, params):
loop = asyncio.get_event_loop()
logger.info("Executing {}, params: {}".format(method, params))
request = {"command": method, "params": params}
token = caller_uid_var.set(os.getuid())
try:
cb = _apply_middleware(method, user=UserType.ROOT)
return loop.run_until_complete(
_execute_request(cb(request, self._sink), method)
)
finally:
caller_uid_var.reset(token)
class RpcClient:
"""
One RpcClient instance is suitable to use for multiple ipc calls
:param RpcServiceState require_svc_is_running: whether to provide direct
endpoints binding if the service is stopped.
:param int reconnect_with_timeout: timeout in sec for reconnect retries
:param int num_retries: number of reconnect retries
"""
def __init__(
self,
*,
require_svc_is_running=RpcServiceState.RUNNING,
reconnect_with_timeout=None,
num_retries=1,
):
self._impl = None
self._socket_path = (
Config.SOCKET_PATH
if is_root_user()
else Config.NON_ROOT_SOCKET_PATH
)
if (
require_svc_is_running == RpcServiceState.STOPPED
and rpc_is_running()
):
raise ServiceStateError(RpcServiceState.RUNNING)
elif require_svc_is_running == RpcServiceState.RUNNING:
# ensure that socket is active
run_coro(svcctl.activate_socket_service(Core.SVC_NAME))
if require_svc_is_running in (
RpcServiceState.ANY,
RpcServiceState.RUNNING,
):
try:
if reconnect_with_timeout:
self._impl = self._reconnect_with_timeout(
reconnect_with_timeout, num_retries
)
else:
self._impl = _RpcClientImpl(self._socket_path)
return
except ServiceStateError:
if require_svc_is_running == RpcServiceState.RUNNING:
raise
if self._impl is None:
# In other cases (ANY, STOPPED, DIRECT) need to use _NoRpcImpl
assert (
is_root_user()
), "_NoRpcImpl is not available for non root user"
self._impl = _NoRpcImpl()
def __getattr__(self, method):
return functools.partial(self._dispatch, method)
def cmd(self, *command):
return functools.partial(self._dispatch, command)
def _dispatch(self, method, **params):
response = self._impl.dispatch(method, params)
if isinstance(method, (list, tuple)):
if response["result"] in (ERROR, WARNING):
return response["result"], response["messages"]
else:
assert response["result"] == SUCCESS
return response["result"], response["data"]
else:
if response["result"] in (ERROR, WARNING):
raise ResponseError(response["messages"])
return response["data"]
def _reconnect_with_timeout(self, timeout, num_retries):
while True:
try:
return _RpcClientImpl(self._socket_path)
except ServiceStateError:
if num_retries:
logger.info(
"Waiting %d second(s) before retry...", timeout
)
time.sleep(timeout)
num_retries -= 1
else:
raise
defence360agent/simple_rpc/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 015113 5 ustar defence360agent/simple_rpc/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000105502 00000000000 022316 0 ustar
r_jY " d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl m
Z
ddlmZ ddlmZ ddlmZ ddlZddlmZ ddlmZ dd lmZmZ dd
l m Z dd l m Z dd l!m"Z" dd
l#m$Z$ ddl%m&Z&m'Z' ddl(m)Z)m*Z* ddl+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2m3Z3m4Z4 ddl5m6Z6m7Z7 ddl8m9Z9m:Z: ddl;m<Z< ddl=m>Z>m?Z?m@Z@mAZA eeB ZC eDh d ZEd ZFd ZG G d d ZHd ZId ZJd eKd eeK fd!ZLd" ZM G d# d$ ZN G d% d& ZO G d' d(e ZPd) ZQ G d* d+ ZR G d, d- ZS G d. d/eS ZT G d0 d1eR ZU G d2 d3 ZV G d4 d5 ZW G d6 d7 ZXdS )8z.
Simple unix socket RPC server implementation
N)suppress) getLogger)Sequence)Process)
inactivity)app)Core SimpleRpc)FeatureManagementError)UnixSocketAuthProtocol) tls_check)run_in_executor) is_root_userrun_coro)
LineBufferLineBufferOverflow)
hosting_panel)InvalidTokenException)svcctl)
ResponseErrorServiceStateError SocketError) EndpointsUserType)
is_runningrpc_is_running)ValidationError)ERRORSUCCESSWARNINGcaller_uid_var> jwttokenpasswordc t | }| d }t |t r't | }t D ] }||v rd||< ||d< |S )Nparamsz***)dictget
isinstance_SENSITIVE_PARAM_KEYS)decodedsafer& safe_paramskeys X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/__init__.py_redact_for_logr0 @ sn ==D
XXh
F&$ %6ll ( ) )Ck!!#( C $X K c t j | }n2# t $ r% d t | cY S w xY wt |t st | S t t | S )Nz<unparseable, {} chars>) jsonloads Exceptionformatlenr) r' reprr0 )rawr+ s r/ _safe_log_payloadr: L s :*S// : : :(//C99999: gt $ $ G}} (( ) ))s ,AAc e Zd ZdZdZdZdZdS )RpcServiceStaterunningstoppedanydirectN)__name__
__module__ __qualname__RUNNINGSTOPPEDANYDIRECT r1 r/ r< r< V s* G G C
FFFr1 r< c K | d {V }t g |dS # t $ r5}t |j d}| |j |cY d }~S d }~wt t f$ r@}|j ^}}t j
|g|R t |t | z gdcY d }~S d }~wt $ r^}t j | t
d|t! | t t! | dcY d }~S d }~ww xY w)N)resultmessagesdatarJ rK z-Something went wrong while processing %s (%s))r r r errorsupdate
extra_dataPermissionErrorr argsloggererrorr tupler5
sentry_sdkcapture_exceptionstr)coromethodrJ emsgrR s r/ _execute_requestr] h su C. "r6BBB-
al###
3 4
V
d S 4 uT{{*+
5 5 5$Q''' ;VSVV
SVV44444444
5s?
D *A D D %5B D
D -AD D D c t j }t | t t f rt | }t
j d g }t
j |g }t
j |g }t ||z D ]8\ }}||v r/||vr+t d|j || }9|S )NzApplying middleware %s)
r route_to_endpointr) listrU r
MIDDLEWAREr( MIDDLEWARE_EXCLUDEreversedrS debugrA ) rZ usercbhashablecommonspecificexcludedmwuserss r/ _apply_middlewarerm s $B&4-(( == ##D"-->%%h33)--h;;!&8"344 IB
Bh$6$6 5r{CCCRVV
Ir1 socket_pathreturnc t dt j t j 5 } fd|D cddd S # 1 swxY w Y dS )z9Find inodes corresponding to the unix domain socket path.z/proc/net/unix)encodingrN c L g | ] }|v | d !S ))split).0linern s r/
<listcomp>z$_find_uds_inodes.<locals>.<listcomp> s0 IIIT[D5H5H
R 5H5H5Hr1 N)opensysgetfilesystemencodinggetfilesystemencodeerrors)rn files ` r/ _find_uds_inodesr} s
*,,,..
J
IIIITIII J J J J J J J J J J J J J J J J J Js AAAc t j | j }n# t t f$ r Y dS w xY w|j }d|v od|v S )zcTrue if cls.__init__ accepts the guard kwargs; legacy *_ signatures TypeError when passed limiter=.Flimiter read_timeout)inspect signature__init__ TypeError
ValueError
parameters) protocol_clssigr& s r/ _protocol_supports_guardr s_ 566 z " uu
^F ;>V#;;s 11c 6 e Zd Zd Zd Zd Zed ZdS )ConnectionLimiterc 0 || _ d| _ d| _ d S )Nr F)max_connections_countsaturation_logged)selfr s r/ r zConnectionLimiter.__init__ s . !& r1 c J | j | j k rdS | xj dz
c_ dS )NF T)r r r s r/ acquirezConnectionLimiter.acquire s, ;$. . .5 q tr1 c N | j dk r| xj dz c_ d| _ d S d S )Nr r F)r r r s r/ releasezConnectionLimiter.release s2 ;?? KK1 KK%*D " " " ?r1 c | j S N)r r s r/ countzConnectionLimiter.count s
{r1 N)rA rB rC r r r propertyr rH r1 r/ r r s\ ' ' '
+ + +
X r1 r c F e Zd ZddddZd Zd Zd Zd Zd Zd Z d
Z
dS ) ConnectionGuardNr r c || _ || _ || _ || _ d | _ d | _ d| _ d | _ d | _ d S NF) _loop_limiter
_read_timeout_name
_transport_timeout_handle_slot_acquired _peer_pid _peer_uid)r loopr r names r/ r zConnectionGuard.__init__ sH
)
# # r1 c " | j ^| j sE| j j s7t d| j | j j d| j _ dS | j d u| _ || _ | dS )Nz6%s connection limit (%d) reached; rejecting new clientTF)
r r r rS warningr r r r _schedule_timeoutr transports r/ try_admitzConnectionGuard.try_admit s = $T]-B-B-D-D $=2
7LJM1
37
/5 "m4 7# tr1 c " || _ || _ d S r )r r )r piduids r/ note_peerzConnectionGuard.note_peer s r1 c . | d S r )r r s r/ on_datazConnectionGuard.on_data s r1 c | | j r'| j | j d| _ d | _ d S r )_cancel_timeoutr r r r r s r/ on_lostzConnectionGuard.on_lost sM (4=#< M ! ! # # #"'D r1 c | j d S | j | j | j | j | j | _ d S r )r r cancelr
call_later _on_timeoutr s r/ r z!ConnectionGuard._schedule_timeout sY % F + ' ' ) ) ) #z 4 4 0
r1 c X | j "| j d | _ d S d S r )r r r s r/ r z ConnectionGuard._cancel_timeout s6 + ' ' ) ) )#'D , +r1 c d | _ | j d S t d| j | j | j | j | j d c}| _ | | d S )Nz;Closing idle %s connection (pid=%s uid=%s, no data for %ds))
r r rS r r r r r closer r s r/ r zConnectionGuard._on_timeout sx # ? " F I J N N
&*_d" 4? r1 ) rA rB rC r r r r r r r r rH r1 r/ r r s (,4
! ! !
( ( (
r1 r c P e Zd ZddddZ fdZdefdZd Zd Zd Z d
Z
xZ S ) _RpcServerProtocolNr c || _ || _ || _ d | _ t | _ t
|||d | _ d S )NRPC)r r r )r _sinkre r r _bufr _guard)r r sinkre r r s r/ r z_RpcServerProtocol.__init__ sL
LL % ' 5
r1 c | j | s| d S t | ny# t
t t j f$ rZ}t
d| | d | _ | j Y d }~d S d }~ww xY w| j
| j | j d S )Nz5Rejected RPC connection: SO_PEERCRED unavailable (%s))r r r superconnection_madeOSErrorAttributeErrorstructrT rS r r r r _pid_uid)r r exc __class__s r/ r z"_RpcServerProtocol.connection_made s {$$Y// OO F
GG # #I . . . . 6 NNG
OO "DO K ! ! ! FFFFF
di33333s !A C 1ACC rL c ~ t j | }t j | | \ }}|| _ |!||d d< d|d v r |g|d d< t
| j }n'# t $ r}t | g}Y d }~nd }~ww xY w||d< |S )Nr& re rl calling_process) r3 r4 r HostingPanel authenticatere r r cmdliner5 rX )r rL r+ user_type user_namer r[ s r/ preprocess_dataz"_RpcServerProtocol.preprocess_data s *T"" , 9 ; ; H H '
9 (1GH f % '(+++.7[!'* ' %di 0 0 8 8 : :OO ' ' ' "1vvhOOOOOO '%4!"s *&B
B5B00B5c | j d S | j | j | nx# t $ rk}t d| j | j
| | j d | _ | j Y d }~d S d }~ww xY w| j D ]} |
| }|d }|d }t d| t || j }t# j | j
} | j | || ||| j | j t# j | n# t# j | w xY w# t0 $ rO}t d | t4 t7 | d Y d }~:d }~wt8 $ r]}t dt= | | t4 t7 | d Y d }~d }~ww xY wd S )Nz*Closing RPC connection (pid=%s uid=%s): %scommandr& zData received: command=%szIncorrect token providedrM z)Something went wrong before processing %s) r r r r appenddecoder rS r r r r r r rd rm re r! setr create_task _dispatchr resetr _write_responser rX r5 exceptionr: ) r rL r[ r\ rJ rZ r& rf r# s r/
data_receivedz _RpcServerProtocol.data_received4 s ? " F I T[[]] + + + +!
NN<
O ! ! # # # "DO K ! ! ! FFFFF
9 $ L $ LC#
L --c22 * ) 8&AAA&vty99 '*49550J** "FBBvtz49,M,M #(////N(/////(
L
L
L 9:::$$3q66%J%JKKKKKKKK
L
L
L ?%c**
$$3q66%J%JKKKKKKKK
L=$ L $ LsX ,A
CA CCA.F6AF F6 F22F66
I4 AH
I4AI//I4c R K t j d | 5 t || d {V }t
d || | | d d d d S # 1 swxY w Y d S )Nzrpc_{}z Response: method - {}, data - {})r tracktaskr6 r] rS infor )r rZ r& rY responses r/ r z _RpcServerProtocol._dispatchk s
"
"8??6#:#:
;
; + + -dF ; ;;;;;;;H KK299&(KK
* * *
+ + + + + + + + + + + + + + + + + +s AB B #B c F | j d | _ d S r )r r r r s r/ connection_lostz"_RpcServerProtocol.connection_lostt s! r1 c 4 | j t d d S | j t j | dz d S # t $ r%}t | Y d }~d S d }~ww xY w)Nz*Cannot send RPC response: connection lost.
) r rS r writer3 dumpsencoder5 r )r rL r[ s r/ r z"_RpcServerProtocol._write_responsex s ? " NNG H H H F
$%%tz$'7'7$'>&F&F&H&HIIIII
$
$
$ #########
$s AA( (
B2BB) rA rB rC r r rX r r r r r
__classcell__)r s @r/ r r s 48t
4 4 4 4 4"C *5L 5L 5Ln+ + + $ $ $ $ $ $ $r1 r c t j | }t j |d t j |d d S )NT)exist_oki )ospathdirnamemakedirschmod)rn dir_names r/ _check_socket_folder_permissionsr sB w{++HK4((((HXu r1 c D e Zd Zej Zej ZdZe d Z
dS ) RpcServeri c K t j t t 5 t j j d d d n # 1 swxY w Y t
t j fd j d {V }t j
j j |S )Nc J t j t j S Nr )r USERConfig READ_TIMEOUTclsr r r s r/ <lambda>z"RpcServer.create.<locals>.<lambda> s+ & # 0 r1 ) r SOCKET_PATHr FileNotFoundErrorr unlinkr r MAX_CONCURRENT_CONNECTIONScreate_unix_serverr SOCKET_MODE)r r r serverr s ``` @r/ createzRpcServer.create s ( 999
'
(
( ' ' Ico & & & ' ' ' ' ' ' ' ' ' ' ' ' ' ' '#F$EFF..
O
#/222
s AA AN) rA rB rC r r r ROOTr r classmethodr rH r1 r/ r r sA $K =DK [ r1 r c D e Zd Zej Zej ZeZ e
d Z dS ) RpcServerAVc ~ K d } j }t | | d r|t d d }t | }d}|D ]} t j d 5 }|D ]?} || j d | k rt | j
}
n@ ddd g ddd nX# 1 swxY w Y # t $ r } | }Y d} ~ d} ~ ww xY wt d d| z j j
|t j |
t j t j t j z } t' j r"t+ t, j fd }
n fd
}
|
| d{V }|S ) a Looking for socket in /proc/net/unix and check which descriptor
corresponded to it by comparing inode
$ ls -l /proc/[pid]/fd
lrwx------ 1 root root 64 Apr 11 07:20 4 -> socket:[2866765]
$ cat /proc/net/unix
Num RefCount Protocol Flags Type St Inode Path
ffff880054c0a4c0: 00000002 00000000 00010000 0001 01 2866765 /var/run/defence360agent/simple_rpc.sock # noqa
c t t 5 t j | i |cddd S # 1 swxY w Y dS )zReturn empty path on error.N )r r r readlink)rR kwargss r/
safe_readlinkz)RpcServerAV.create.<locals>.safe_readlink s '""
4
4{D3F33
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
42s 377z/var/runz/varNz
/proc/self/fdz socket:[{}]z"[{}] Socket {!r} for {} not found.inodec V j t j S r )PROTOCOL_CLASSr r r r s r/ r z$RpcServerAV.create.<locals>.<lambda> s0 c 0 0 # 0 1 r1 c < j S r )r r )r r r s r/ r z$RpcServerAV.create.<locals>.<lambda> s c 0 0dCH r1 )sock)r r
startswithr7 r} r scandirr r6 intr r r r socketfromfdAF_UNIX SOCK_STREAM
SOCK_NONBLOCKr r r r r
r )r r r r _socket_pathinodes
last_errorr itfd socket_fdr[ _socketfactoryr
r s ``` @r/ r zRpcServerAV.create s ( 666 " ": . . 7'F
6L!,//
E
Z00 B ! !(=11]5I5I !6 6 ),BG I !E !
4;;6z*COSX
- N !5 5
$C$6 7 7 '(IJJG GG G ..wW.EEEEEEEE
sI "C 6AC: C C C C C C C
C6*C11C6N) rA rB rC r r r r r r r r r rH r1 r/ r r sF =D$K'NC C [C C Cr1 r c * e Zd Zej Zej ZdS )NonRootRpcServerAVN) rA rB rC r NON_ROOTr r NON_ROOT_SOCKET_PATHr rH r1 r/ r/ r/ s D-KKKr1 r/ c . e Zd Zej Zej ZdZ dS )NonRootRpcServeri N)
rA rB rC r r1 r r r0 r r rH r1 r/ r3 r3 s% -K D KKKr1 r3 c e Zd Zd Zd Zd ZdS )_RpcClientImplc t j t j t j t j z | _ | j | d S # t t t f$ r t w xY wr )
r! r# r$ r% _sockconnectConnectionRefusedErrorr BlockingIOErrorr )r rn s r/ r z_RpcClientImpl.__init__ sy & 2V5I I DJ
J { + + + + +&(9?K & & &#%% % &s AA &A?c | j t j ||d dz n$# t
$ r}t
d| d }~ww xY w | d }n%# t $ r}t d| |d }~ww xY w t j
| }n5# t $ r(}t d
| |d }~ww xY w|S )Nr r& r zcommunication interrupted,
)terminator_bytezConnection reset: z Error parsing RPC response {!r})r7 sendallr3 r r BrokenPipeErrorr _sock_recv_untilConnectionResetErrorr r4 r r5 r6 )r rZ r& r[ rL r s r/ dispatchz_RpcClientImpl.dispatch sJ A J J6V D DEEL&((
A A A ?A ? ?@@ @ A A(((??DD# A A A 8Q 8 899q @ A z$++--00HH 188>>
sH AA
A(A##A(,B
B%
B B%)&C
D#C==Dc | j rJ g }|r ||d vr| j g}t j |g g t j }|d }| j |vr@t
| r"t d | t d | j t j }t | dk rt d |
| |||d vd | S )Nr z!select() = {!r} resulted in errorzrequest timeoutz!Empty response from socket.recv()r1 )r7 getblockingfilenoselectr CLIENT_TIMEOUTr? r r6 recvioDEFAULT_BUFFER_SIZEr7 r join)r r> chunks fdread_list
rwx_fdlist fdready_listchunks r/ rA z _RpcClientImpl._sock_recv_until sG :))+++++ !fRj @ @ :,,../K %
J &a=Lz "",66z?? 9%;BB:NN &&7888JOOB$:;;E5zzQ!"EFFF MM% / !fRj @ @2 xx r1 N)rA rB rC r rC rA rH r1 r/ r5 r5 sA & & & . r1 r5 c e Zd ZddZd ZdS )
_NoRpcImplNc || _ t t j 5 t j }| t |t j d d d d S # 1 swxY w Y d S r ) r r r
OverridingResetasyncioget_event_looprun_until_completer r )r r r s r/ r z_NoRpcImpl.__init__> s
i/
0
0 L L)++D # #OD)/$J$J K K K L L L L L L L L L L L L L L L L L Ls AA//A36A3c t j }t d || ||d}t j t j } t |t j }| t ||| j | t j | S # t j | w xY w)NzExecuting {}, params: {}r< )re )rW rX rS r r6 r! r r getuidrm r r rY r] r r )r rZ r& r requestr# rf s r/ rC z_NoRpcImpl.dispatchJ s %'' .55ffEEFFF $77 "29;;// ("6
>>>B** GTZ!8!8&AA
' ' ' 'N ' ' ' 's
-A C C$r )rA rB rC r rC rH r1 r/ rT rT = s;
L
L
L
L ( ( ( ( (r1 rT c D e Zd ZdZej ddddZd Zd Zd Z d Z
dS )
RpcClientaR
One RpcClient instance is suitable to use for multiple ipc calls
:param RpcServiceState require_svc_is_running: whether to provide direct
endpoints binding if the service is stopped.
:param int reconnect_with_timeout: timeout in sec for reconnect retries
:param int num_retries: number of reconnect retries
Nr )require_svc_is_runningreconnect_with_timeout num_retriesc d | _ t r t j n t j | _ |t j k r't rt t j
|t j
k r+t t j
t j |t j t j
fv r[ |r | || | _ nt% | j | _ d S # t $ r |t j
k r Y nw xY w| j -t s
J d t' | _ d S d S )Nz-_NoRpcImpl is not available for non root user)_implr r r r1 r& r< rE r r rD r r activate_socket_servicer SVC_NAMErF _reconnect_with_timeoutr5 rT )r r_ r` ra s r/ r zRpcClient.__init__c se
~~
-F ,
#o&= = =
> $O$;<< <
#'>
>
> V3DMBB C C C ! #&
) C!%!=!=. " "DJJ "00A!B!BDJ$
)_-DDD ED
:
?
?>
?
? # DJJJ s 7C9 9DDc 6 t j | j | S r functoolspartialr )r rZ s r/ __getattr__zRpcClient.__getattr__ s 888r1 c 6 t j | j | S r rh )r r s r/ cmdz
RpcClient.cmd s 999r1 c h | j || }t |t t f rI|d t
t fv r|d |d fS |d t k sJ |d |d fS |d t
t fv rt |d |d S )NrJ rK rL ) rc rC r) r` rU r r r r )r rZ r& r s r/ r zRpcClient._dispatch s :&&vv66 ftUm , ,
$!eW%555 )8J+??? )W4444 )8F+;;;!eW%555#HZ$8999F# #r1 c t | j S # t $ r; |r5t d| t j | |dz }n Y nw xY w^)NTz$Waiting %d second(s) before retry...r )r5 r& r rS r timesleep)r timeoutra s r/ rf z!RpcClient._reconnect_with_timeout s
%d&7888$
KK> Jw''' 1$KK K
s AA A ) rA rB rC __doc__r< rD r rk rm r rf rH r1 r/ r^ r^ X s / 6 # ,& ,& ,& ,& ,&\9 9 9: : :
$
$
$ r1 r^ )Yrs rW ri r rK r3 r rH r! r ry rp
contextlibr loggingr typingr psutilr rV defence360agent.apir defence360agent.applicationr defence360agent.contracts.configr r
r -defence360agent.feature_management.exceptionsr 'defence360agent.internals.auth_protocolr defence360agent.modelr
$defence360agent.model.simplificationr defence360agent.utilsr r defence360agent.utils.bufferr r defence360agent.subsys.panelsr "defence360agent.subsys.panels.baser defence360agent.subsysr $defence360agent.rpc_tools.exceptionsr r r defence360agent.rpc_tools.lookupr r defence360agent.rpc_tools.utilsr r "defence360agent.rpc_tools.validater defence360agent.rpc_toolsr r r r! rA rS frozensetr* r0 r: r< r] rm rX r} r r r r r r r r/ r3 r5 rT r^ rH r1 r/ <module>r s+
* * * * * * + + + + + + F F F F F F F F K J J J J J + + + + + + @ @ @ @ @ @ 8 8 8 8 8 8 8 8 G G G G G G G G 7 7 7 7 7 7 D D D D D D ) ) ) ) ) )
A @ @ @ @ @ @ @ ? > > > > >
8 " ">">">?? * * * $C C C8 J# J(3- J J J J< < < ,D D D D D D D DN}$ }$ }$ }$ }$/ }$ }$ }$@ 2I I I I I I I IX. . . . . . . .
y > > > > > > > > B( ( ( ( ( ( ( (6Z Z Z Z Z Z Z Z Z Zr1 defence360agent/simple_rpc/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000105502 00000000000 021357 0 ustar
r_jY " d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl m
Z
ddlmZ ddlmZ ddlmZ ddlZddlmZ ddlmZ dd lmZmZ dd
l m Z dd l m Z dd l!m"Z" dd
l#m$Z$ ddl%m&Z&m'Z' ddl(m)Z)m*Z* ddl+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2m3Z3m4Z4 ddl5m6Z6m7Z7 ddl8m9Z9m:Z: ddl;m<Z< ddl=m>Z>m?Z?m@Z@mAZA eeB ZC eDh d ZEd ZFd ZG G d d ZHd ZId ZJd eKd eeK fd!ZLd" ZM G d# d$ ZN G d% d& ZO G d' d(e ZPd) ZQ G d* d+ ZR G d, d- ZS G d. d/eS ZT G d0 d1eR ZU G d2 d3 ZV G d4 d5 ZW G d6 d7 ZXdS )8z.
Simple unix socket RPC server implementation
N)suppress) getLogger)Sequence)Process)
inactivity)app)Core SimpleRpc)FeatureManagementError)UnixSocketAuthProtocol) tls_check)run_in_executor) is_root_userrun_coro)
LineBufferLineBufferOverflow)
hosting_panel)InvalidTokenException)svcctl)
ResponseErrorServiceStateError SocketError) EndpointsUserType)
is_runningrpc_is_running)ValidationError)ERRORSUCCESSWARNINGcaller_uid_var> jwttokenpasswordc t | }| d }t |t r't | }t D ] }||v rd||< ||d< |S )Nparamsz***)dictget
isinstance_SENSITIVE_PARAM_KEYS)decodedsafer& safe_paramskeys X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/__init__.py_redact_for_logr0 @ sn ==D
XXh
F&$ %6ll ( ) )Ck!!#( C $X K c t j | }n2# t $ r% d t | cY S w xY wt |t st | S t t | S )Nz<unparseable, {} chars>) jsonloads Exceptionformatlenr) r' reprr0 )rawr+ s r/ _safe_log_payloadr: L s :*S// : : :(//C99999: gt $ $ G}} (( ) ))s ,AAc e Zd ZdZdZdZdZdS )RpcServiceStaterunningstoppedanydirectN)__name__
__module__ __qualname__RUNNINGSTOPPEDANYDIRECT r1 r/ r< r< V s* G G C
FFFr1 r< c K | d {V }t g |dS # t $ r5}t |j d}| |j |cY d }~S d }~wt t f$ r@}|j ^}}t j
|g|R t |t | z gdcY d }~S d }~wt $ r^}t j | t
d|t! | t t! | dcY d }~S d }~ww xY w)N)resultmessagesdatarJ rK z-Something went wrong while processing %s (%s))r r r errorsupdate
extra_dataPermissionErrorr argsloggererrorr tupler5
sentry_sdkcapture_exceptionstr)coromethodrJ emsgrR s r/ _execute_requestr] h su C. "r6BBB-
al###
3 4
V
d S 4 uT{{*+
5 5 5$Q''' ;VSVV
SVV44444444
5s?
D *A D D %5B D
D -AD D D c t j }t | t t f rt | }t
j d g }t
j |g }t
j |g }t ||z D ]8\ }}||v r/||vr+t d|j || }9|S )NzApplying middleware %s)
r route_to_endpointr) listrU r
MIDDLEWAREr( MIDDLEWARE_EXCLUDEreversedrS debugrA ) rZ usercbhashablecommonspecificexcludedmwuserss r/ _apply_middlewarerm s $B&4-(( == ##D"-->%%h33)--h;;!&8"344 IB
Bh$6$6 5r{CCCRVV
Ir1 socket_pathreturnc t dt j t j 5 } fd|D cddd S # 1 swxY w Y dS )z9Find inodes corresponding to the unix domain socket path.z/proc/net/unix)encodingrN c L g | ] }|v | d !S ))split).0linern s r/
<listcomp>z$_find_uds_inodes.<locals>.<listcomp> s0 IIIT[D5H5H
R 5H5H5Hr1 N)opensysgetfilesystemencodinggetfilesystemencodeerrors)rn files ` r/ _find_uds_inodesr} s
*,,,..
J
IIIITIII J J J J J J J J J J J J J J J J J Js AAAc t j | j }n# t t f$ r Y dS w xY w|j }d|v od|v S )zcTrue if cls.__init__ accepts the guard kwargs; legacy *_ signatures TypeError when passed limiter=.Flimiter read_timeout)inspect signature__init__ TypeError
ValueError
parameters) protocol_clssigr& s r/ _protocol_supports_guardr s_ 566 z " uu
^F ;>V#;;s 11c 6 e Zd Zd Zd Zd Zed ZdS )ConnectionLimiterc 0 || _ d| _ d| _ d S )Nr F)max_connections_countsaturation_logged)selfr s r/ r zConnectionLimiter.__init__ s . !& r1 c J | j | j k rdS | xj dz
c_ dS )NF T)r r r s r/ acquirezConnectionLimiter.acquire s, ;$. . .5 q tr1 c N | j dk r| xj dz c_ d| _ d S d S )Nr r F)r r r s r/ releasezConnectionLimiter.release s2 ;?? KK1 KK%*D " " " ?r1 c | j S N)r r s r/ countzConnectionLimiter.count s
{r1 N)rA rB rC r r r propertyr rH r1 r/ r r s\ ' ' '
+ + +
X r1 r c F e Zd ZddddZd Zd Zd Zd Zd Zd Z d
Z
dS ) ConnectionGuardNr r c || _ || _ || _ || _ d | _ d | _ d| _ d | _ d | _ d S NF) _loop_limiter
_read_timeout_name
_transport_timeout_handle_slot_acquired _peer_pid _peer_uid)r loopr r names r/ r zConnectionGuard.__init__ sH
)
# # r1 c " | j ^| j sE| j j s7t d| j | j j d| j _ dS | j d u| _ || _ | dS )Nz6%s connection limit (%d) reached; rejecting new clientTF)
r r r rS warningr r r r _schedule_timeoutr transports r/ try_admitzConnectionGuard.try_admit s = $T]-B-B-D-D $=2
7LJM1
37
/5 "m4 7# tr1 c " || _ || _ d S r )r r )r piduids r/ note_peerzConnectionGuard.note_peer s r1 c . | d S r )r r s r/ on_datazConnectionGuard.on_data s r1 c | | j r'| j | j d| _ d | _ d S r )_cancel_timeoutr r r r r s r/ on_lostzConnectionGuard.on_lost sM (4=#< M ! ! # # #"'D r1 c | j d S | j | j | j | j | j | _ d S r )r r cancelr
call_later _on_timeoutr s r/ r z!ConnectionGuard._schedule_timeout sY % F + ' ' ) ) ) #z 4 4 0
r1 c X | j "| j d | _ d S d S r )r r r s r/ r z ConnectionGuard._cancel_timeout s6 + ' ' ) ) )#'D , +r1 c d | _ | j d S t d| j | j | j | j | j d c}| _ | | d S )Nz;Closing idle %s connection (pid=%s uid=%s, no data for %ds))
r r rS r r r r r closer r s r/ r zConnectionGuard._on_timeout sx # ? " F I J N N
&*_d" 4? r1 ) rA rB rC r r r r r r r r rH r1 r/ r r s (,4
! ! !
( ( (
r1 r c P e Zd ZddddZ fdZdefdZd Zd Zd Z d
Z
xZ S ) _RpcServerProtocolNr c || _ || _ || _ d | _ t | _ t
|||d | _ d S )NRPC)r r r )r _sinkre r r _bufr _guard)r r sinkre r r s r/ r z_RpcServerProtocol.__init__ sL
LL % ' 5
r1 c | j | s| d S t | ny# t
t t j f$ rZ}t
d| | d | _ | j Y d }~d S d }~ww xY w| j
| j | j d S )Nz5Rejected RPC connection: SO_PEERCRED unavailable (%s))r r r superconnection_madeOSErrorAttributeErrorstructrT rS r r r r _pid_uid)r r exc __class__s r/ r z"_RpcServerProtocol.connection_made s {$$Y// OO F
GG # #I . . . . 6 NNG
OO "DO K ! ! ! FFFFF
di33333s !A C 1ACC rL c ~ t j | }t j | | \ }}|| _ |!||d d< d|d v r |g|d d< t
| j }n'# t $ r}t | g}Y d }~nd }~ww xY w||d< |S )Nr& re rl calling_process) r3 r4 r HostingPanel authenticatere r r cmdliner5 rX )r rL r+ user_type user_namer r[ s r/ preprocess_dataz"_RpcServerProtocol.preprocess_data s *T"" , 9 ; ; H H '
9 (1GH f % '(+++.7[!'* ' %di 0 0 8 8 : :OO ' ' ' "1vvhOOOOOO '%4!"s *&B
B5B00B5c | j d S | j | j | nx# t $ rk}t d| j | j
| | j d | _ | j Y d }~d S d }~ww xY w| j D ]} |
| }|d }|d }t d| t || j }t# j | j
} | j | || ||| j | j t# j | n# t# j | w xY w# t0 $ rO}t d | t4 t7 | d Y d }~:d }~wt8 $ r]}t dt= | | t4 t7 | d Y d }~d }~ww xY wd S )Nz*Closing RPC connection (pid=%s uid=%s): %scommandr& zData received: command=%szIncorrect token providedrM z)Something went wrong before processing %s) r r r r appenddecoder rS r r r r r r rd rm re r! setr create_task _dispatchr resetr _write_responser rX r5 exceptionr: ) r rL r[ r\ rJ rZ r& rf r# s r/
data_receivedz _RpcServerProtocol.data_received4 s ? " F I T[[]] + + + +!
NN<
O ! ! # # # "DO K ! ! ! FFFFF
9 $ L $ LC#
L --c22 * ) 8&AAA&vty99 '*49550J** "FBBvtz49,M,M #(////N(/////(
L
L
L 9:::$$3q66%J%JKKKKKKKK
L
L
L ?%c**
$$3q66%J%JKKKKKKKK
L=$ L $ LsX ,A
CA CCA.F6AF F6 F22F66
I4 AH
I4AI//I4c R K t j d | 5 t || d {V }t
d || | | d d d d S # 1 swxY w Y d S )Nzrpc_{}z Response: method - {}, data - {})r tracktaskr6 r] rS infor )r rZ r& rY responses r/ r z _RpcServerProtocol._dispatchk s
"
"8??6#:#:
;
; + + -dF ; ;;;;;;;H KK299&(KK
* * *
+ + + + + + + + + + + + + + + + + +s AB B #B c F | j d | _ d S r )r r r r s r/ connection_lostz"_RpcServerProtocol.connection_lostt s! r1 c 4 | j t d d S | j t j | dz d S # t $ r%}t | Y d }~d S d }~ww xY w)Nz*Cannot send RPC response: connection lost.
) r rS r writer3 dumpsencoder5 r )r rL r[ s r/ r z"_RpcServerProtocol._write_responsex s ? " NNG H H H F
$%%tz$'7'7$'>&F&F&H&HIIIII
$
$
$ #########
$s AA( (
B2BB) rA rB rC r r rX r r r r r
__classcell__)r s @r/ r r s 48t
4 4 4 4 4"C *5L 5L 5Ln+ + + $ $ $ $ $ $ $r1 r c t j | }t j |d t j |d d S )NT)exist_oki )ospathdirnamemakedirschmod)rn dir_names r/ _check_socket_folder_permissionsr sB w{++HK4((((HXu r1 c D e Zd Zej Zej ZdZe d Z
dS ) RpcServeri c K t j t t 5 t j j d d d n # 1 swxY w Y t
t j fd j d {V }t j
j j |S )Nc J t j t j S Nr )r USERConfig READ_TIMEOUTclsr r r s r/ <lambda>z"RpcServer.create.<locals>.<lambda> s+ & # 0 r1 ) r SOCKET_PATHr FileNotFoundErrorr unlinkr r MAX_CONCURRENT_CONNECTIONScreate_unix_serverr SOCKET_MODE)r r r serverr s ``` @r/ createzRpcServer.create s ( 999
'
(
( ' ' Ico & & & ' ' ' ' ' ' ' ' ' ' ' ' ' ' '#F$EFF..
O
#/222
s AA AN) rA rB rC r r r ROOTr r classmethodr rH r1 r/ r r sA $K =DK [ r1 r c D e Zd Zej Zej ZeZ e
d Z dS ) RpcServerAVc ~ K d } j }t | | d r|t d d }t | }d}|D ]} t j d 5 }|D ]?} || j d | k rt | j
}
n@ ddd g ddd nX# 1 swxY w Y # t $ r } | }Y d} ~ d} ~ ww xY wt d d| z j j
|t j |
t j t j t j z } t' j r"t+ t, j fd }
n fd
}
|
| d{V }|S ) a Looking for socket in /proc/net/unix and check which descriptor
corresponded to it by comparing inode
$ ls -l /proc/[pid]/fd
lrwx------ 1 root root 64 Apr 11 07:20 4 -> socket:[2866765]
$ cat /proc/net/unix
Num RefCount Protocol Flags Type St Inode Path
ffff880054c0a4c0: 00000002 00000000 00010000 0001 01 2866765 /var/run/defence360agent/simple_rpc.sock # noqa
c t t 5 t j | i |cddd S # 1 swxY w Y dS )zReturn empty path on error.N )r r r readlink)rR kwargss r/
safe_readlinkz)RpcServerAV.create.<locals>.safe_readlink s '""
4
4{D3F33
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
42s 377z/var/runz/varNz
/proc/self/fdz socket:[{}]z"[{}] Socket {!r} for {} not found.inodec V j t j S r )PROTOCOL_CLASSr r r r s r/ r z$RpcServerAV.create.<locals>.<lambda> s0 c 0 0 # 0 1 r1 c < j S r )r r )r r r s r/ r z$RpcServerAV.create.<locals>.<lambda> s c 0 0dCH r1 )sock)r r
startswithr7 r} r scandirr r6 intr r r r socketfromfdAF_UNIX SOCK_STREAM
SOCK_NONBLOCKr r r r r
r )r r r r _socket_pathinodes
last_errorr itfd socket_fdr[ _socketfactoryr
r s ``` @r/ r zRpcServerAV.create s ( 666 " ": . . 7'F
6L!,//
E
Z00 B ! !(=11]5I5I !6 6 ),BG I !E !
4;;6z*COSX
- N !5 5
$C$6 7 7 '(IJJG GG G ..wW.EEEEEEEE
sI "C 6AC: C C C C C C C
C6*C11C6N) rA rB rC r r r r r r r r r rH r1 r/ r r sF =D$K'NC C [C C Cr1 r c * e Zd Zej Zej ZdS )NonRootRpcServerAVN) rA rB rC r NON_ROOTr r NON_ROOT_SOCKET_PATHr rH r1 r/ r/ r/ s D-KKKr1 r/ c . e Zd Zej Zej ZdZ dS )NonRootRpcServeri N)
rA rB rC r r1 r r r0 r r rH r1 r/ r3 r3 s% -K D KKKr1 r3 c e Zd Zd Zd Zd ZdS )_RpcClientImplc t j t j t j t j z | _ | j | d S # t t t f$ r t w xY wr )
r! r# r$ r% _sockconnectConnectionRefusedErrorr BlockingIOErrorr )r rn s r/ r z_RpcClientImpl.__init__ sy & 2V5I I DJ
J { + + + + +&(9?K & & &#%% % &s AA &A?c | j t j ||d dz n$# t
$ r}t
d| d }~ww xY w | d }n%# t $ r}t d| |d }~ww xY w t j
| }n5# t $ r(}t d
| |d }~ww xY w|S )Nr r& r zcommunication interrupted,
)terminator_bytezConnection reset: z Error parsing RPC response {!r})r7 sendallr3 r r BrokenPipeErrorr _sock_recv_untilConnectionResetErrorr r4 r r5 r6 )r rZ r& r[ rL r s r/ dispatchz_RpcClientImpl.dispatch sJ A J J6V D DEEL&((
A A A ?A ? ?@@ @ A A(((??DD# A A A 8Q 8 899q @ A z$++--00HH 188>>
sH AA
A(A##A(,B
B%
B B%)&C
D#C==Dc | j rJ g }|r ||d vr| j g}t j |g g t j }|d }| j |vr@t
| r"t d | t d | j t j }t | dk rt d |
| |||d vd | S )Nr z!select() = {!r} resulted in errorzrequest timeoutz!Empty response from socket.recv()r1 )r7 getblockingfilenoselectr CLIENT_TIMEOUTr? r r6 recvioDEFAULT_BUFFER_SIZEr7 r join)r r> chunks fdread_list
rwx_fdlist fdready_listchunks r/ rA z _RpcClientImpl._sock_recv_until sG :))+++++ !fRj @ @ :,,../K %
J &a=Lz "",66z?? 9%;BB:NN &&7888JOOB$:;;E5zzQ!"EFFF MM% / !fRj @ @2 xx r1 N)rA rB rC r rC rA rH r1 r/ r5 r5 sA & & & . r1 r5 c e Zd ZddZd ZdS )
_NoRpcImplNc || _ t t j 5 t j }| t |t j d d d d S # 1 swxY w Y d S r ) r r r
OverridingResetasyncioget_event_looprun_until_completer r )r r r s r/ r z_NoRpcImpl.__init__> s
i/
0
0 L L)++D # #OD)/$J$J K K K L L L L L L L L L L L L L L L L L Ls AA//A36A3c t j }t d || ||d}t j t j } t |t j }| t ||| j | t j | S # t j | w xY w)NzExecuting {}, params: {}r< )re )rW rX rS r r6 r! r r getuidrm r r rY r] r r )r rZ r& r requestr# rf s r/ rC z_NoRpcImpl.dispatchJ s %'' .55ffEEFFF $77 "29;;// ("6
>>>B** GTZ!8!8&AA
' ' ' 'N ' ' ' 's
-A C C$r )rA rB rC r rC rH r1 r/ rT rT = s;
L
L
L
L ( ( ( ( (r1 rT c D e Zd ZdZej ddddZd Zd Zd Z d Z
dS )
RpcClientaR
One RpcClient instance is suitable to use for multiple ipc calls
:param RpcServiceState require_svc_is_running: whether to provide direct
endpoints binding if the service is stopped.
:param int reconnect_with_timeout: timeout in sec for reconnect retries
:param int num_retries: number of reconnect retries
Nr )require_svc_is_runningreconnect_with_timeout num_retriesc d | _ t r t j n t j | _ |t j k r't rt t j
|t j
k r+t t j
t j |t j t j
fv r[ |r | || | _ nt% | j | _ d S # t $ r |t j
k r Y nw xY w| j -t s
J d t' | _ d S d S )Nz-_NoRpcImpl is not available for non root user)_implr r r r1 r& r< rE r r rD r r activate_socket_servicer SVC_NAMErF _reconnect_with_timeoutr5 rT )r r_ r` ra s r/ r zRpcClient.__init__c se
~~
-F ,
#o&= = =
> $O$;<< <
#'>
>
> V3DMBB C C C ! #&
) C!%!=!=. " "DJJ "00A!B!BDJ$
)_-DDD ED
:
?
?>
?
? # DJJJ s 7C9 9DDc 6 t j | j | S r functoolspartialr )r rZ s r/ __getattr__zRpcClient.__getattr__ s 888r1 c 6 t j | j | S r rh )r r s r/ cmdz
RpcClient.cmd s 999r1 c h | j || }t |t t f rI|d t
t fv r|d |d fS |d t k sJ |d |d fS |d t
t fv rt |d |d S )NrJ rK rL ) rc rC r) r` rU r r r r )r rZ r& r s r/ r zRpcClient._dispatch s :&&vv66 ftUm , ,
$!eW%555 )8J+??? )W4444 )8F+;;;!eW%555#HZ$8999F# #r1 c t | j S # t $ r; |r5t d| t j | |dz }n Y nw xY w^)NTz$Waiting %d second(s) before retry...r )r5 r& r rS r timesleep)r timeoutra s r/ rf z!RpcClient._reconnect_with_timeout s
%d&7888$
KK> Jw''' 1$KK K
s AA A ) rA rB rC __doc__r< rD r rk rm r rf rH r1 r/ r^ r^ X s / 6 # ,& ,& ,& ,& ,&\9 9 9: : :
$
$
$ r1 r^ )Yrs rW ri r rK r3 r rH r! r ry rp
contextlibr loggingr typingr psutilr rV defence360agent.apir defence360agent.applicationr defence360agent.contracts.configr r
r -defence360agent.feature_management.exceptionsr 'defence360agent.internals.auth_protocolr defence360agent.modelr
$defence360agent.model.simplificationr defence360agent.utilsr r defence360agent.utils.bufferr r defence360agent.subsys.panelsr "defence360agent.subsys.panels.baser defence360agent.subsysr $defence360agent.rpc_tools.exceptionsr r r defence360agent.rpc_tools.lookupr r defence360agent.rpc_tools.utilsr r "defence360agent.rpc_tools.validater defence360agent.rpc_toolsr r r r! rA rS frozensetr* r0 r: r< r] rm rX r} r r r r r r r r/ r3 r5 rT r^ rH r1 r/ <module>r s+
* * * * * * + + + + + + F F F F F F F F K J J J J J + + + + + + @ @ @ @ @ @ 8 8 8 8 8 8 8 8 G G G G G G G G 7 7 7 7 7 7 D D D D D D ) ) ) ) ) )
A @ @ @ @ @ @ @ ? > > > > >
8 " ">">">?? * * * $C C C8 J# J(3- J J J J< < < ,D D D D D D D DN}$ }$ }$ }$ }$/ }$ }$ }$@ 2I I I I I I I IX. . . . . . . .
y > > > > > > > > B( ( ( ( ( ( ( (6Z Z Z Z Z Z Z Z Z Zr1 defence360agent/simple_rpc/__pycache__/advisor.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006254 00000000000 022232 0 ustar
r_j v d dl mZ d dlmZ d dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
G d d e Zd
S ) ) defaultdict)
ConfigFile)
RootEndpoints)
update_config)lookup) EventsAPI)config_cleanupc e Zd Z ej dd d Z ej dd d Zd Zed Z dS ) AdvisorEndpointsadvisorapplyc < K | | d {V S N)_applyselfadvicess W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/advisor.py
advisor_applyz AdvisorEndpoints.advisor_apply s* [[))))))))) z apply-allc n K t j d {V }| | d {V S r )r r r r s r apply_allzAdvisorEndpoints.apply_all sJ !)++++++++[[)))))))))r c : K t t }t }|D ]}| ||| t | j | d {V dt t iS )Nitems)r dictr config_to_dict_extract_conf_from_adviser _sinkr )r r target_conf current_confadvises r r zAdvisorEndpoints._apply s !$'' !||2244 N NF * *6< M M M MDJ 444444444
(C(C(E(EFFGGr c | d D ]3\ }}| D ]\ }}|| | |v r d S 4| d D ] \ }}|| | !d S )Nignore
config_action)r update)r! r r section_key
section_value value_keyignored_valuess r r z*AdvisorEndpoints._extract_conf_from_advise s *0*:*@*@*B*B &K -:-@-@-B-B
) > ,Y7>IIFFF J
+1 *A*G*G*I*I ; ; &K $ + +M : : : : ; ;r N)
__name__
__module__ __qualname__r bindr r r staticmethodr r r r r s V[G$$* * %$* V[K((* * )(*H H H ; ; \; ; ;r r N) collectionsr defence360agent.contracts.configr defence360agent.rpc_tools.lookupr defence360agent.utils.configr defence360agent.rpc_toolsr !defence360agent.api.server.eventsr +defence360agent.feature_management.checkersr r r/ r r <module>r7 s # # # # # # 7 7 7 7 7 7 : : : : : : 6 6 6 6 6 6 , , , , , , 7 7 7 7 7 7 F F F F F F; ; ; ; ;} ; ; ; ; ;r defence360agent/simple_rpc/__pycache__/advisor.cpython-311.pyc 0000644 0000000 0000000 00000006254 00000000000 021273 0 ustar
r_j v d dl mZ d dlmZ d dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
G d d e Zd
S ) ) defaultdict)
ConfigFile)
RootEndpoints)
update_config)lookup) EventsAPI)config_cleanupc e Zd Z ej dd d Z ej dd d Zd Zed Z dS ) AdvisorEndpointsadvisorapplyc < K | | d {V S N)_applyselfadvicess W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/advisor.py
advisor_applyz AdvisorEndpoints.advisor_apply s* [[))))))))) z apply-allc n K t j d {V }| | d {V S r )r r r r s r apply_allzAdvisorEndpoints.apply_all sJ !)++++++++[[)))))))))r c : K t t }t }|D ]}| ||| t | j | d {V dt t iS )Nitems)r dictr config_to_dict_extract_conf_from_adviser _sinkr )r r target_conf current_confadvises r r zAdvisorEndpoints._apply s !$'' !||2244 N NF * *6< M M M MDJ 444444444
(C(C(E(EFFGGr c | d D ]3\ }}| D ]\ }}|| | |v r d S 4| d D ] \ }}|| | !d S )Nignore
config_action)r update)r! r r section_key
section_value value_keyignored_valuess r r z*AdvisorEndpoints._extract_conf_from_advise s *0*:*@*@*B*B &K -:-@-@-B-B
) > ,Y7>IIFFF J
+1 *A*G*G*I*I ; ; &K $ + +M : : : : ; ;r N)
__name__
__module__ __qualname__r bindr r r staticmethodr r r r r s V[G$$* * %$* V[K((* * )(*H H H ; ; \; ; ;r r N) collectionsr defence360agent.contracts.configr defence360agent.rpc_tools.lookupr defence360agent.utils.configr defence360agent.rpc_toolsr !defence360agent.api.server.eventsr +defence360agent.feature_management.checkersr r r/ r r <module>r7 s # # # # # # 7 7 7 7 7 7 : : : : : : 6 6 6 6 6 6 , , , , , , 7 7 7 7 7 7 F F F F F F; ; ; ; ;} ; ; ; ; ;r defence360agent/simple_rpc/__pycache__/analyst_cleanup.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000024605 00000000000 023745 0 ustar
r_j# , d dl Z d dlmZ d dlmZmZ d dlmZ d dlmZm Z d dl
m c m c m
Z d dlmZmZmZ d dlmZ d dlmZmZ ee Zd Zd
Zd Z d Z d
Z de ddee ddddddde iZ e de dZ dZ! e"ddeh Z#d Z$d Z% G d d e Z&dS ) N) getLogger)datetime timedelta)ValidationError)
RootEndpointsbind) get_ssh_portcheck_ssh_connectioninstall_pub_key)AnalystCleanupRequest)NO_AGENT_TOKENAnalystCleanupAPIzhttps://cloudlinux.zendesk.com/hc/en-us/articles/6245743410460-How-to-authenticate-your-server-for-Support-Team-and-use-the-SSH-access-formz9https://cloudlinux.zendesk.com/auth/v2/login/registrationzeYou are not authorized to submit Analyst Cleanup requests. Contact sales@cloudlinux.com to get accesszxThis server could not authenticate with the Imunify360 API. Make sure the agent is registered and its license is active.zoOur support system returned an unexpected response. Check your email for a ticket confirmation before retrying.not_allowlistednot_authorizedzjThis server is not linked to a CloudLinux customer account. Make sure its license is active and try again.zendesk_unreachablezQOur support system is temporarily unreachable. Please try again in a few minutes.zendesk_upstream_errorzKOur support system rejected the request. Please try again in a few minutes.zendesk_suspendedzZOur support system did not accept the request. Please contact CloudLinux support directly.zendesk_unknown_responsezNThe cleanup request was rejected as invalid. Try again with a shorter message.) i z Failed to create support ticketc t | d t | t S )Nmessage)_TICKET_ERROR_MESSAGESget _TICKET_ERROR_MESSAGES_BY_STATUS_TICKET_ERROR_DEFAULTstatusbodys _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/analyst_cleanup.py_ticket_error_messager! S s= ! % % (,,V5JKK c f | d t v rdS | d uod| cxk odk nc S )Nr Tr i )r _CLIENT_STATE_CODESr s r _is_expected_client_stater% Z sK xx 111t 5#"5"5"5"5#"5"5"5"55r" c e Zd ZdeeffdZ edd d Z edd d
d
Z edd d ZdS )AnalystCleanupEndpointsreturnc K t j ||| d{V \ }}| d pi }|dk rj| d rU| d r@t d|d |d t |d fS t
|| r t j n t j } |d|| t t || )z
Creates a Zendesk ticket and return link and id of the ticket
On any error raises ValidationError, which would be added to RPC answer
Nticketr urlidzCreated ticket on url z2Failed to create support ticket: status=%s body=%s) r
create_ticketr loggerinfostrr% warningerrorr r! )selfemailsubjectfull_descriptionr r r* logs r _create_zendesk_ticketz.AnalystCleanupEndpoints._create_zendesk_ticketa s / <
(##)r S==VZZ . .=6::d3C3C= KK@ @@ A A A%=#fTl"3"33 3 )66
FNN
@&$OOO 3FD A ABBBr" zanalyst-cleanuprequestc K t j | x}rt d| t j d{V st t
t j | d{V }| dd s.t | dd dt d | d d rt j
d
t | d{V }t d{V }t | d{V }d } t j d | d
| }
d| d|
d| d} |s)t j
dt" | dt$ dz
} n!|s t j
dt" | dz
} | || | d{V \ } }
t j ||
| dd| iiS )z Handle analyst cleanup requestzYou already have an active request for cleaning this user. If you have additional information, you may follow the link and provide new data here: NresultFr zd Couldn't register your email in our Zendesk system. You can make it manually by following the link z( and then try sending the request again.is_newu We’ve set up a Zendesk account for you! To complete your registration, check your email and click the “Reset Password” button.zAnalyst Cleanup Request:/z
Username: z
Server Access: z
Customer Message:
z
z'Support SSH public key is not installedz]
WARNING: Not able to install analyst's public key
Please make it manually by reffering to z+
and provide credentials to zendesk ticketzSSH connection test failedze
WARNING: SSH connection test failed. Please verify SSH access and refer to the access request form.)username
zendesk_id ticket_linkitems
ticket_url)r get_active_request_linkr r check_cleanup_allowedNOT_ALLOWLISTED_MESSAGEcheck_registeredr ZENDESK_REGISTRATION_URLwarningswarnr r r
hp HostingPanel
get_server_ipWarningPREPARE_SERVER_GUIDEr8 create_request)r3 r4 r@ r
active_ticket email_status
key_installedssh_port
connection_okr5
server_accessr6 rD ticket_ids r request_cleanupz'AnalystCleanupEndpoints.request_cleanup} s 2 I
= "H8EH H
(=???????? ;!"9:: : . ? F FFFFFFF %00 ! ##Ir22 2 2*B2 2 2
He , , M'
.h 7 7777777
& '''''' 28 < <<<<<<<
, ..00 H H8 H Hh H H
0
0
0 +
0
0")
0
0
0
MCW M M M $($ $ $
M6 @ @ @ @
'+&A&A '
'
!
!
!
!
!
!
I , "
,
344r" z get-requestsN2 r c n K |t j || }nt j ||| }|rt | dk rg S t j t
d z
t d fd|D }t d| |S )z
Get status of analyst cleanup requests for all or a specific user
Completed tickets will only be visible for 2 weeks after their last update
Nr )weekszShowing requests since c g | ]}}|j d k s |j k |j |j |j t t j |j t t j |j |j d~S ) completed)r@ rD r
created_at last_updaterA ) r last_updatedr@ rB r0 r timestampr` rA ).0req
two_weeks_agos r
<listcomp>z:AnalystCleanupEndpoints.request_status.<locals>.<listcomp> s
z[((C,<},L,L L !o * !("4S^"D"D E E "8#5c6F#G#G H H !n
-M,L,Lr" zGot requests: ) r get_all_requestsget_user_requestslenr utcnowr r. r/ )r3 r@ limitoffsetrequestsfiltered_requestsrf s @r request_statusz&AnalystCleanupEndpoints.request_status s ,=eVLLHH,>% H
3x==A--I !))IA,>,>,>>
=m==>>>
8%688999 r" z
is-allowedc D K t j d {V }dd|iiS )NrC
is_allowed)r rF )r3 rr s r rr z"AnalystCleanupEndpoints.is_allowed s6 ,BDDDDDDDD
,
344r" )NrZ r ) __name__
__module__ __qualname__r0 r8 r rY rp rr r" r r' r' ` s C
s C C C C8
T
Y''M5 M5 ('M5^
T
^,,&! &! &! -,&!P
T
\**5 5 +*5 5 5r" r' )'rJ loggingr r r defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelrL defence360agent.utils.sshutilr r
r %defence360agent.model.analyst_cleanupr *defence360agent.api.server.analyst_cleanupr
r rs r. rP rI rG _NOT_AUTHENTICATED_MESSAGE_UNKNOWN_RESPONSE_MESSAGEr r r frozensetr$ r! r% r' rv r" r <module>r s ( ( ( ( ( ( ( ( 5 5 5 5 5 5 @ @ @ @ @ @ @ @ 8 8 8 8 8 8 8 8 8 8 8 8
H G G G G G
8 e ?
2 D C . : . . . 7 9' .
# -
$
$ $ : i(.9
6 6 6 Y5 Y5 Y5 Y5 Y5m Y5 Y5 Y5 Y5 Y5r" defence360agent/simple_rpc/__pycache__/analyst_cleanup.cpython-311.pyc 0000644 0000000 0000000 00000024605 00000000000 023006 0 ustar
r_j# , d dl Z d dlmZ d dlmZmZ d dlmZ d dlmZm Z d dl
m c m c m
Z d dlmZmZmZ d dlmZ d dlmZmZ ee Zd Zd
Zd Z d Z d
Z de ddee ddddddde iZ e de dZ dZ! e"ddeh Z#d Z$d Z% G d d e Z&dS ) N) getLogger)datetime timedelta)ValidationError)
RootEndpointsbind) get_ssh_portcheck_ssh_connectioninstall_pub_key)AnalystCleanupRequest)NO_AGENT_TOKENAnalystCleanupAPIzhttps://cloudlinux.zendesk.com/hc/en-us/articles/6245743410460-How-to-authenticate-your-server-for-Support-Team-and-use-the-SSH-access-formz9https://cloudlinux.zendesk.com/auth/v2/login/registrationzeYou are not authorized to submit Analyst Cleanup requests. Contact sales@cloudlinux.com to get accesszxThis server could not authenticate with the Imunify360 API. Make sure the agent is registered and its license is active.zoOur support system returned an unexpected response. Check your email for a ticket confirmation before retrying.not_allowlistednot_authorizedzjThis server is not linked to a CloudLinux customer account. Make sure its license is active and try again.zendesk_unreachablezQOur support system is temporarily unreachable. Please try again in a few minutes.zendesk_upstream_errorzKOur support system rejected the request. Please try again in a few minutes.zendesk_suspendedzZOur support system did not accept the request. Please contact CloudLinux support directly.zendesk_unknown_responsezNThe cleanup request was rejected as invalid. Try again with a shorter message.) i z Failed to create support ticketc t | d t | t S )Nmessage)_TICKET_ERROR_MESSAGESget _TICKET_ERROR_MESSAGES_BY_STATUS_TICKET_ERROR_DEFAULTstatusbodys _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/analyst_cleanup.py_ticket_error_messager! S s= ! % % (,,V5JKK c f | d t v rdS | d uod| cxk odk nc S )Nr Tr i )r _CLIENT_STATE_CODESr s r _is_expected_client_stater% Z sK xx 111t 5#"5"5"5"5#"5"5"5"55r" c e Zd ZdeeffdZ edd d Z edd d
d
Z edd d ZdS )AnalystCleanupEndpointsreturnc K t j ||| d{V \ }}| d pi }|dk rj| d rU| d r@t d|d |d t |d fS t
|| r t j n t j } |d|| t t || )z
Creates a Zendesk ticket and return link and id of the ticket
On any error raises ValidationError, which would be added to RPC answer
Nticketr urlidzCreated ticket on url z2Failed to create support ticket: status=%s body=%s) r
create_ticketr loggerinfostrr% warningerrorr r! )selfemailsubjectfull_descriptionr r r* logs r _create_zendesk_ticketz.AnalystCleanupEndpoints._create_zendesk_ticketa s / <
(##)r S==VZZ . .=6::d3C3C= KK@ @@ A A A%=#fTl"3"33 3 )66
FNN
@&$OOO 3FD A ABBBr" zanalyst-cleanuprequestc K t j | x}rt d| t j d{V st t
t j | d{V }| dd s.t | dd dt d | d d rt j
d
t | d{V }t d{V }t | d{V }d } t j d | d
| }
d| d|
d| d} |s)t j
dt" | dt$ dz
} n!|s t j
dt" | dz
} | || | d{V \ } }
t j ||
| dd| iiS )z Handle analyst cleanup requestzYou already have an active request for cleaning this user. If you have additional information, you may follow the link and provide new data here: NresultFr zd Couldn't register your email in our Zendesk system. You can make it manually by following the link z( and then try sending the request again.is_newu We’ve set up a Zendesk account for you! To complete your registration, check your email and click the “Reset Password” button.zAnalyst Cleanup Request:/z
Username: z
Server Access: z
Customer Message:
z
z'Support SSH public key is not installedz]
WARNING: Not able to install analyst's public key
Please make it manually by reffering to z+
and provide credentials to zendesk ticketzSSH connection test failedze
WARNING: SSH connection test failed. Please verify SSH access and refer to the access request form.)username
zendesk_id ticket_linkitems
ticket_url)r get_active_request_linkr r check_cleanup_allowedNOT_ALLOWLISTED_MESSAGEcheck_registeredr ZENDESK_REGISTRATION_URLwarningswarnr r r
hp HostingPanel
get_server_ipWarningPREPARE_SERVER_GUIDEr8 create_request)r3 r4 r@ r
active_ticket email_status
key_installedssh_port
connection_okr5
server_accessr6 rD ticket_ids r request_cleanupz'AnalystCleanupEndpoints.request_cleanup} s 2 I
= "H8EH H
(=???????? ;!"9:: : . ? F FFFFFFF %00 ! ##Ir22 2 2*B2 2 2
He , , M'
.h 7 7777777
& '''''' 28 < <<<<<<<
, ..00 H H8 H Hh H H
0
0
0 +
0
0")
0
0
0
MCW M M M $($ $ $
M6 @ @ @ @
'+&A&A '
'
!
!
!
!
!
!
I , "
,
344r" z get-requestsN2 r c n K |t j || }nt j ||| }|rt | dk rg S t j t
d z
t d fd|D }t d| |S )z
Get status of analyst cleanup requests for all or a specific user
Completed tickets will only be visible for 2 weeks after their last update
Nr )weekszShowing requests since c g | ]}}|j d k s |j k |j |j |j t t j |j t t j |j |j d~S ) completed)r@ rD r
created_at last_updaterA ) r last_updatedr@ rB r0 r timestampr` rA ).0req
two_weeks_agos r
<listcomp>z:AnalystCleanupEndpoints.request_status.<locals>.<listcomp> s
z[((C,<},L,L L !o * !("4S^"D"D E E "8#5c6F#G#G H H !n
-M,L,Lr" zGot requests: ) r get_all_requestsget_user_requestslenr utcnowr r. r/ )r3 r@ limitoffsetrequestsfiltered_requestsrf s @r request_statusz&AnalystCleanupEndpoints.request_status s ,=eVLLHH,>% H
3x==A--I !))IA,>,>,>>
=m==>>>
8%688999 r" z
is-allowedc D K t j d {V }dd|iiS )NrC
is_allowed)r rF )r3 rr s r rr z"AnalystCleanupEndpoints.is_allowed s6 ,BDDDDDDDD
,
344r" )NrZ r ) __name__
__module__ __qualname__r0 r8 r rY rp rr r" r r' r' ` s C
s C C C C8
T
Y''M5 M5 ('M5^
T
^,,&! &! &! -,&!P
T
\**5 5 +*5 5 5r" r' )'rJ loggingr r r defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelrL defence360agent.utils.sshutilr r
r %defence360agent.model.analyst_cleanupr *defence360agent.api.server.analyst_cleanupr
r rs r. rP rI rG _NOT_AUTHENTICATED_MESSAGE_UNKNOWN_RESPONSE_MESSAGEr r r frozensetr$ r! r% r' rv r" r <module>r s ( ( ( ( ( ( ( ( 5 5 5 5 5 5 @ @ @ @ @ @ @ @ 8 8 8 8 8 8 8 8 8 8 8 8
H G G G G G
8 e ?
2 D C . : . . . 7 9' .
# -
$
$ $ : i(.9
6 6 6 Y5 Y5 Y5 Y5 Y5m Y5 Y5 Y5 Y5 Y5r" defence360agent/simple_rpc/__pycache__/endpoints.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000062346 00000000000 022572 0 ustar
r_j: 2 U d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
m Z ddl m
Z
ddlmZ dd lmZ dd
lmZmZ dd lmZmZmZmZmZm Z m Z dd l m Z dd
l m!Z!m"Z"m#Z# ddl$m%Z%m&Z& ddl'm(Z( ddl)m*Z*m+Z+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2m3Z3m4Z4m5Z5m6Z6 ddl7m8Z8 ddl9m:Z:m;Z; ddl<m=Z= ddl>m?Z? ddl@mAZA eeB ZC G d de* ZDdZEd ZFd ZGi ZHe eIef eJd < e d d ZKd ZLd ZMi ZNe eOef eJd!< d"eId#ePd$eQfd%ZRd#ePd$dfd&ZSd"eId#ePd$dfd'ZTd"eId$dfd(ZUd)eOd#ePd$eQfd*ZVd#ePd$dfd+ZWd)eOd#ePd$dfd,ZX G d- d.e* ZY G d/ d0e+ ZZ G d1 d2e* Z[ G d3 d4e+ Z\ G d5 d6e+ Z] G d7 d8e+ Z^dS )9z"
Here you enumerate rpc endpoints
N)deque) getLogger)Dict)files) JWTIssuer)NewsFeed)PamAuth)configeula)ANTIVIRUS_MODECoreImmutableMerger LocalConfig
MutableMergereffective_user_configint_from_envvar)
LicenseCLN)CLNCLNErrorInvalidLicenseError)!collect_billing_incompatibilitiesget_license_type)ValidationError)CommonEndpoints
RootEndpointsbind)caller_uid_var)PanelException)IMUNIFY_PACKAGE_NAMES
CheckRunErrorcheck_dbgetpwnamsystem_packages_info)
update_config)ZendeskAPIError send_request)sync_billing_dataget_doctor_key)
hosting_panelc e Zd Z edd dd Z eddd d Z edd dd Z edd dd
Z edd dd Z edd
dd Z dS )ConfigEndpointsr
showNc K t j }|r&t |t j | }d|iS d| iS Nitems)r
ConfigFiler config_to_dict)selfuser full_confuser_conf_dicts Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/endpoints.py config_showzConfigEndpoints.config_show; s_ %'' 9 26,T22 N ^, ,Y 5 5 7 78 8 defaultsc K t j }dt | t d t | diS )Nr0 F) normalize)mutable_config local_configimmutable_config)r get_layer_namesconfigs_to_dictr r2 r )r3 layer_pathss r7 config_show_defaultsz$ConfigEndpoints.config_show_defaultsF su #355 "/ "<"<"L"L"N"N +
< <u < M M$3 % %!/##
r9 updatec K |r|d }t j | }t d|| t | j || d {V | | d {V S )Nr z#AUDIT config.update user=%r data=%r)jsonloadsloggerwarningr$ _sinkr8 )r3 r0 datar4 new_datas r7
config_updatez ConfigEndpoints.config_updateS s 8D:d##<dHMMM J
%%d+++++++++r9 patchc K t d|| t | j || d {V | | d {V S )Nz"AUDIT config.patch user=%r data=%r)rH rI r$ rJ r8 )r3 rK r4 s r7 config_update_uiz ConfigEndpoints.config_update_uib si ;T4HHHDJd333333333%%d+++++++++r9 z
patch-manyc K |g }t d|| |D ] }t | j || d {V i S )Nz(AUDIT config.patch-many users=%r data=%r)rH rI r$ rJ )r3 rK usersr4 s r7 config_update_many_uiz%ConfigEndpoints.config_update_many_uih sd =EA5$OOO 8 8D
D$77 7 7 7 7 7 7 7 7 r9 zget-manyc K |i S di i}t j }|D ]/}t |t j | }||d |< 0|S r/ )r
r1 r )r3 rR resultr5 r4 r6 s r7 config_get_many_uiz"ConfigEndpoints.config_get_many_uiq sm =I2 %'' 3 3D 26,T22 N %3F7OD ! !
r9 N)NNNNN)
__name__
__module__ __qualname__r r8 rC rM rP rS rV r9 r7 r, r, : s T(F9 9 9 9
T(FJ''
('
T(H , , , ,
T(G , , , ,
T(L!! "!
T(J
r9 r, g N@i' _login_pam_failuresI360_LOGIN_PAM_UID_MAXi, _login_pam_uid_failuresusernamenowreturnc t | }|dS |t z
}|r.|d |k r"| |r |d |k "|s
t | = dS t | t
k S )NTr )r^ get_LOGIN_PAM_WINDOWpopleftlen_LOGIN_PAM_MAX)ra rb historycutoffs r7 _login_pam_allowedrl s !%%h//Gt
$
$F
gaj6)) gaj6)) )t w<<. ((r9 c | t z
fdt D }|D ]
}t |= d S )Nc 2 g | ]\ }}|d k |S r\ .0uhrk s r7
<listcomp>z$_login_pam_sweep.<locals>.<listcomp> s& I I I41a!B%&..Q...r9 )rf r^ r0 )rb stalera rk s @r7 _login_pam_sweeprw sX
$
$F I I I I.4466 I I IE * * ) )* *r9 c l | t vrpt t t k rSt | t t t k r't t t t = t | t | d S rW ) r^ rh _LOGIN_PAM_MAX_TRACKEDrw nextiter
setdefaultr append)ra rb s r7 _login_pam_record_failurer~ s +++ # $ $(> > > " # #'= = =#D.A)B)B$C$CD""8UWW55<<SAAAAAr9 c < t | d d S rW )r^ pop)ra s r7 _login_pam_resetr s Hd+++++r9 uidc t dk rdS t | }|dS |t z
}|r.|d |k r"| |r |d |k "|s
t | = dS t | t k S )Nr T)_LOGIN_PAM_UID_MAXr` re _LOGIN_PAM_UID_WINDOWrg rh )r rb rj rk s r7 _login_pam_uid_allowedr s Q t%))#..Gt
(
(F
gaj6)) gaj6)) #C (t w<<, ,,r9 c | t z
fdt D }|D ]
}t |= d S )Nc 2 g | ]\ }}|d k |S ro r\ rq s r7 ru z(_login_pam_uid_sweep.<locals>.<listcomp> s& M M M41aaefnnQnnnr9 )r r` r0 )rb rv r rk s @r7 _login_pam_uid_sweepr sX
(
(F M M M M288:: M M ME ) ) #C ( () )r9 c t dk rd S | t vrpt t t k rSt | t t t k r't t t
t = t | t | d S )Nr )
r r` rh _LOGIN_PAM_UID_MAX_TRACKEDr rz r{ r| r r} )r rb s r7 _login_pam_uid_record_failurer s Q *** ' ( (,F F F S!!! & ' '+E E E'T2I-J-J(K(KL&&sEGG44;;C@@@@@r9 c 8 e Zd Z edd d ZdS )LoginEndpointsloginpamc r K t j } t j }n7# t $ r* t
d t d w xY w|dk r:t || s*t
d| t d t || s*t
d| t d t }|
|| }|sPt || |dk rt || t
d| t d t! | t
d | d
t% || | d {V iS ) Nz.AUDIT login.pam REJECTED: caller_uid_var unsetz,login.pam reached without caller_uid_var setr z#AUDIT login.pam RATE_LIMITED uid=%rz"Authentication rate limit exceededz(AUDIT login.pam RATE_LIMITED username=%rz"AUDIT login.pam FAILED username=%rzAuthentication failedz#AUDIT login.pam SUCCESS username=%rr0 )time monotonicr re LookupErrorrH error RuntimeErrorr rI r rl r authenticater~ r r infor get_token
get_user_type)r3 ra passwordrb
caller_uidpam_auth
authenticateds r7
login_via_pamz LoginEndpoints.login_via_pam s n O'+--JJ O O O LLI J J J MNN N O ??#9*c#J#J? NN@* M M M!"FGG G!(C00 H NN:H
""FGG G99 --hAA
; %h 4 4 4Q-j#>>> NN? J J J!"9:: :""" 98DDD Y[[** 6 6x @ @@@@@@@
s + 4A N)rY rZ r[ r r r\ r9 r7 r r s: T'5
r9 r c 8 e Zd Z edd d ZdS )RootLoginEndpointsr re c K t | st d dt |t | d {V iS )NzUser name not foundr0 )r" r r r r r )r3 ra s r7 login_getz RootLoginEndpoints.login_get ss !! 9!"788 8
Y[[** 7 7 A AAAAAAA
r9 N)rY rZ r[ r r r\ r9 r7 r r s: T'5
r9 r c 8 e Zd Z ed dd ZdS )PackageVersionsEndpointszget-package-versionsNc > K dt t d {V iS r/ )r# r )r3 r4 s r7 get_package_versionsz-PackageVersionsEndpoints.get_package_versions s- 34I J JJJJJJJKKr9 rW )rY rZ r[ r r r\ r9 r7 r r sD T
!!L L L "!L L Lr9 r c 6 e Zd Z ed d ZdS )
NewsEndpointszget-newsc < K dt j d {V iS r/ )r re r3 s r7 get_newszNewsEndpoints.get_news s) x|~~------..r9 N)rY rZ r[ r r r\ r9 r7 r r s8 T*/ / / / /r9 r c e Zd Zej Z ed d d Z ed d Z ed d Z ed d d
Z ed d Z
ed
d Z ed d d Z edd d Z
edd d Z ed d d Z ed d Z edd d!d ZdS )" EndpointsregisterNc
H K t j t j rrt j rt
st
d nHt dt j z | d {V t j | d {V n_# t $ r!}t
t | d }~wt $ r(}t d| t j t! j d {V d {V n# t& $ r7 t d t
t | t( $ rB}t
d t | t | d }~wt t f$ r!}t
t | d }~ww xY wY d }~nd }~ww xY wi S )NzAgent is already registeredz!Unregistering invalid license: %szUCan't register %r as imunify360 key. Trying to register it as a web panel key insteadz3Registration with web panel's key doesn't supportedz{}, {})r r cache_clear
is_registeredis_validr r rH r
unregisterr r r strr rI r* HostingPanel retrieve_keyNotImplementedErrorr format)r3 regkeyepanel_es r7 r zEndpoints.register s ((*** # % % ("$$
(% I)*GHHHI 7 *,,- oo''''''''' .,v&& & & & & & & & &" * * *!#a&&)) ) . . . NN9
.l'466CCEEEEEEEE '
.
.
.I &c!ff---!
M
M
M%hooc!ffc'll&K&KLLL 12
.
.
.%c!ff---
. .& sV 'C
H
C))H 7HAEHA H =G H1 H
HHH r c K t j st d t j rt d t j d {V i S )NzAgent is not registered yetz$Free license can not be unregistered)r r r is_freer r r s r7 r zEndpoints.unregister7 sm ')) A!"?@@ @ J!"HII In r9 zupdate-licensec 4 K t j st d t j }t j d {V t _ t j | d {V }|t d i S )Nz(Unregistered (server-id is not assigned)z*License does not exist. Agent unregistered) r r r r r* r users_countr
refresh_token)r3 token new_tokens r7 update_licensezEndpoints.update_licenseA s ')) N!"LMM M$&& ,..::<< < < < < < < +E22222222 !"NOO O r9 rstatusFc K t j t j st d |r"t j rt d | S )Nz%License is invalid for current serverz Free license)r r r r r r license_info)r3 paids r7 r zEndpoints.rstatusN st ((***"$$ K!"IJJ J 2J&(( 2!.11 1 """r9 versionc " K dt j iS r/ )
CoreConfigVERSIONr s r7 r zEndpoints.versionW s +,,r9 wakeupc
K i S )zBWake up the agent, so it can process the request, if it's sleepingr\ r s r7 r zEndpoints.wakeup[ s
r9 rD latestc K |rl|t j j v rY|r&t j | S |r.t j | || d {V S n|s|dk rt d t j || d {V d S # t j
t j f$ r Y d S w xY w)Nr z9Listing and version are not supported for this files type) r
FilesUpdateDISABLEDr Indexget_list update_tor rD asyncio TimeoutError UpdateError)r3 subjforcelistr s r7 update_fileszEndpoints.update_files` s
DF . 777
4 {4((11333
I "[ . . 8 8% H HHHHHHHH
I
w(**%O ,tU++ + + + + + + + + +$e&78 DD s B& &CCr acceptc < K t j d {V d S rW )r r r s r7 eula_acceptzEndpoints.eula_accepts s* kmmr9 r- c , K t j S rW )r textr s r7 eula_showzEndpoints.eula_showw s y{{r9 checkdbc ^ K |rt j dS t j dS )zmCheck DB consistency and repair if needed.
If recreate_schema is set recreate schema for attached DB.N)r! recreate_schemacheck_and_repair)r3 r s r7 r zEndpoints.checkdb{ s: ( $ & & & & & % ' ' ' ' 'r9 doctorc 8 K t d {V }d|z S )Nz8Please, provide this key:
%s
to Imunify360 Support Team
r( )r3 keys r7 r zEndpoints.doctor s0 "$$$$$$$$ IC O
r9 supportsendc K t d {V }n# t $ r d }Y nw xY w t |||||| d {V }n?# t $ r2}t d|j |j |j d }~ww xY wd|giS )Nz@Got error from Zendesk API. error=%s, description=%s, details=%sr0 )r) r r& r% rH r descriptiondetails) r3 emailsubjectr cln attachments
doctor_key
ticket_urlr s r7 send_to_supportzEndpoints.send_to_support s
- / ///////JJ JJJ
+w Zk JJ LL
* &&s# ((A
B-A>>BrW )F)NFFr rX )rY rZ r[ r r r r r r r r r r r r r r r r\ r9 r7 r r s *L T*# # # #J
T,
T
T)__# # # _#
T)__- - _-
T(^^ ^
T(^^:B ^$
T&(
T&&
T)__( ( ( _(
T(^^
^
T)V AE' ' ' ' ' 'r9 r c j e Zd ZdZdZ edd d Z edd d ZdS )
WhmcsEndpointz<
Describes all endpoints for interaction with WHMCS
1billingsyncc K t j | }n"# t j $ r t d w xY wt | j | d {V }d|dS )Nz Invalid JSONsuccessrU rK )rF rG JSONDecodeError
ValueErrorr' rJ )r3 rK decoded_datarU s r7 billing_synczWhmcsEndpoint.billing_sync sy - :d++LL# - - - ^,, , -(\BBBBBBBB#V444s 8z
get-configc z K t | j t t d {V }d|dS )N)r billing_licenseissuesr r )dictr r r )r3 rU s r7 billing_get_configz WhmcsEndpoint.billing_get_config sS L , . .:<<<<<<<<
$V444r9 N)rY rZ r[ __doc__r r r r r\ r9 r7 r r ss
G T)V 5 5 5
T)\""5 5 #"5 5 5r9 r )_r r rF r collectionsr loggingr typingr defence360agentr defence360agent.api.jwt_issuerr defence360agent.api.newsfeedr defence360agent.api.pam_authr defence360agent.contractsr
r defence360agent.contracts.configr r
r r r r r r !defence360agent.contracts.licenser defence360agent.internals.clnr r r !defence360agent.myimunify.billingr r defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r r defence360agent.simple_rpcr "defence360agent.subsys.panels.baser defence360agent.utilsr r r! r" r# defence360agent.utils.configr$ defence360agent.utils.supportr% r& defence360agent.utils.whmcsr' defence360agent.utils.doctorr) defence360agent.subsys.panelsr* rY rH r, ri rf ry r^ r __annotations__r r r r` intfloatboolrl rw r~ r r r r r r r r r r r\ r9 r7 <module>r" sg ! ! ! ! ! ! 4 4 4 4 4 4 1 1 1 1 1 1 0 0 0 0 0 0 2 2 2 2 2 2 2 2 9 8 8 8 8 8 L L L L L L L L L L 6 5 5 5 5 5
6 5 5 5 5 5 = = = = = = 7 6 6 6 6 6 G G G G G G G G 9 9 9 9 9 9 7 7 7 7 7 7 7 7 7 7 7 7 8 B B B B Bo B B BL (* T#u*% * * *$_%=sCC # ,. c5j) . . .
)
)5
)T
)
)
)
)*% *D * * * *B B% BD B B B B,s ,t , , , , - -% -D - - - - )e ) ) ) ) )
As
A
A4
A
A
A
A!
!
!
!
!
_ !
!
!
H
L L L L L L L L / / / / /M / / / W' W' W' W' W'
W' W' W't5 5 5 5 5M 5 5 5 5 5r9 defence360agent/simple_rpc/__pycache__/endpoints.cpython-311.pyc 0000644 0000000 0000000 00000062346 00000000000 021633 0 ustar
r_j: 2 U d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
m Z ddl m
Z
ddlmZ dd lmZ dd
lmZmZ dd lmZmZmZmZmZm Z m Z dd l m Z dd
l m!Z!m"Z"m#Z# ddl$m%Z%m&Z& ddl'm(Z( ddl)m*Z*m+Z+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2m3Z3m4Z4m5Z5m6Z6 ddl7m8Z8 ddl9m:Z:m;Z; ddl<m=Z= ddl>m?Z? ddl@mAZA eeB ZC G d de* ZDdZEd ZFd ZGi ZHe eIef eJd < e d d ZKd ZLd ZMi ZNe eOef eJd!< d"eId#ePd$eQfd%ZRd#ePd$dfd&ZSd"eId#ePd$dfd'ZTd"eId$dfd(ZUd)eOd#ePd$eQfd*ZVd#ePd$dfd+ZWd)eOd#ePd$dfd,ZX G d- d.e* ZY G d/ d0e+ ZZ G d1 d2e* Z[ G d3 d4e+ Z\ G d5 d6e+ Z] G d7 d8e+ Z^dS )9z"
Here you enumerate rpc endpoints
N)deque) getLogger)Dict)files) JWTIssuer)NewsFeed)PamAuth)configeula)ANTIVIRUS_MODECoreImmutableMerger LocalConfig
MutableMergereffective_user_configint_from_envvar)
LicenseCLN)CLNCLNErrorInvalidLicenseError)!collect_billing_incompatibilitiesget_license_type)ValidationError)CommonEndpoints
RootEndpointsbind)caller_uid_var)PanelException)IMUNIFY_PACKAGE_NAMES
CheckRunErrorcheck_dbgetpwnamsystem_packages_info)
update_config)ZendeskAPIError send_request)sync_billing_dataget_doctor_key)
hosting_panelc e Zd Z edd dd Z eddd d Z edd dd Z edd dd
Z edd dd Z edd
dd Z dS )ConfigEndpointsr
showNc K t j }|r&t |t j | }d|iS d| iS Nitems)r
ConfigFiler config_to_dict)selfuser full_confuser_conf_dicts Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/endpoints.py config_showzConfigEndpoints.config_show; s_ %'' 9 26,T22 N ^, ,Y 5 5 7 78 8 defaultsc K t j }dt | t d t | diS )Nr0 F) normalize)mutable_config local_configimmutable_config)r get_layer_namesconfigs_to_dictr r2 r )r3 layer_pathss r7 config_show_defaultsz$ConfigEndpoints.config_show_defaultsF su #355 "/ "<"<"L"L"N"N +
< <u < M M$3 % %!/##
r9 updatec K |r|d }t j | }t d|| t | j || d {V | | d {V S )Nr z#AUDIT config.update user=%r data=%r)jsonloadsloggerwarningr$ _sinkr8 )r3 r0 datar4 new_datas r7
config_updatez ConfigEndpoints.config_updateS s 8D:d##<dHMMM J
%%d+++++++++r9 patchc K t d|| t | j || d {V | | d {V S )Nz"AUDIT config.patch user=%r data=%r)rH rI r$ rJ r8 )r3 rK r4 s r7 config_update_uiz ConfigEndpoints.config_update_uib si ;T4HHHDJd333333333%%d+++++++++r9 z
patch-manyc K |g }t d|| |D ] }t | j || d {V i S )Nz(AUDIT config.patch-many users=%r data=%r)rH rI r$ rJ )r3 rK usersr4 s r7 config_update_many_uiz%ConfigEndpoints.config_update_many_uih sd =EA5$OOO 8 8D
D$77 7 7 7 7 7 7 7 7 r9 zget-manyc K |i S di i}t j }|D ]/}t |t j | }||d |< 0|S r/ )r
r1 r )r3 rR resultr5 r4 r6 s r7 config_get_many_uiz"ConfigEndpoints.config_get_many_uiq sm =I2 %'' 3 3D 26,T22 N %3F7OD ! !
r9 N)NNNNN)
__name__
__module__ __qualname__r r8 rC rM rP rS rV r9 r7 r, r, : s T(F9 9 9 9
T(FJ''
('
T(H , , , ,
T(G , , , ,
T(L!! "!
T(J
r9 r, g N@i' _login_pam_failuresI360_LOGIN_PAM_UID_MAXi, _login_pam_uid_failuresusernamenowreturnc t | }|dS |t z
}|r.|d |k r"| |r |d |k "|s
t | = dS t | t
k S )NTr )r^ get_LOGIN_PAM_WINDOWpopleftlen_LOGIN_PAM_MAX)ra rb historycutoffs r7 _login_pam_allowedrl s !%%h//Gt
$
$F
gaj6)) gaj6)) )t w<<. ((r9 c | t z
fdt D }|D ]
}t |= d S )Nc 2 g | ]\ }}|d k |S r\ .0uhrk s r7
<listcomp>z$_login_pam_sweep.<locals>.<listcomp> s& I I I41a!B%&..Q...r9 )rf r^ r0 )rb stalera rk s @r7 _login_pam_sweeprw sX
$
$F I I I I.4466 I I IE * * ) )* *r9 c l | t vrpt t t k rSt | t t t k r't t t t = t | t | d S rW ) r^ rh _LOGIN_PAM_MAX_TRACKEDrw nextiter
setdefaultr append)ra rb s r7 _login_pam_record_failurer~ s +++ # $ $(> > > " # #'= = =#D.A)B)B$C$CD""8UWW55<<SAAAAAr9 c < t | d d S rW )r^ pop)ra s r7 _login_pam_resetr s Hd+++++r9 uidc t dk rdS t | }|dS |t z
}|r.|d |k r"| |r |d |k "|s
t | = dS t | t k S )Nr T)_LOGIN_PAM_UID_MAXr` re _LOGIN_PAM_UID_WINDOWrg rh )r rb rj rk s r7 _login_pam_uid_allowedr s Q t%))#..Gt
(
(F
gaj6)) gaj6)) #C (t w<<, ,,r9 c | t z
fdt D }|D ]
}t |= d S )Nc 2 g | ]\ }}|d k |S ro r\ rq s r7 ru z(_login_pam_uid_sweep.<locals>.<listcomp> s& M M M41aaefnnQnnnr9 )r r` r0 )rb rv r rk s @r7 _login_pam_uid_sweepr sX
(
(F M M M M288:: M M ME ) ) #C ( () )r9 c t dk rd S | t vrpt t t k rSt | t t t k r't t t
t = t | t | d S )Nr )
r r` rh _LOGIN_PAM_UID_MAX_TRACKEDr rz r{ r| r r} )r rb s r7 _login_pam_uid_record_failurer s Q *** ' ( (,F F F S!!! & ' '+E E E'T2I-J-J(K(KL&&sEGG44;;C@@@@@r9 c 8 e Zd Z edd d ZdS )LoginEndpointsloginpamc r K t j } t j }n7# t $ r* t
d t d w xY w|dk r:t || s*t
d| t d t || s*t
d| t d t }|
|| }|sPt || |dk rt || t
d| t d t! | t
d | d
t% || | d {V iS ) Nz.AUDIT login.pam REJECTED: caller_uid_var unsetz,login.pam reached without caller_uid_var setr z#AUDIT login.pam RATE_LIMITED uid=%rz"Authentication rate limit exceededz(AUDIT login.pam RATE_LIMITED username=%rz"AUDIT login.pam FAILED username=%rzAuthentication failedz#AUDIT login.pam SUCCESS username=%rr0 )time monotonicr re LookupErrorrH error RuntimeErrorr rI r rl r authenticater~ r r infor get_token
get_user_type)r3 ra passwordrb
caller_uidpam_auth
authenticateds r7
login_via_pamz LoginEndpoints.login_via_pam s n O'+--JJ O O O LLI J J J MNN N O ??#9*c#J#J? NN@* M M M!"FGG G!(C00 H NN:H
""FGG G99 --hAA
; %h 4 4 4Q-j#>>> NN? J J J!"9:: :""" 98DDD Y[[** 6 6x @ @@@@@@@
s + 4A N)rY rZ r[ r r r\ r9 r7 r r s: T'5
r9 r c 8 e Zd Z edd d ZdS )RootLoginEndpointsr re c K t | st d dt |t | d {V iS )NzUser name not foundr0 )r" r r r r r )r3 ra s r7 login_getz RootLoginEndpoints.login_get ss !! 9!"788 8
Y[[** 7 7 A AAAAAAA
r9 N)rY rZ r[ r r r\ r9 r7 r r s: T'5
r9 r c 8 e Zd Z ed dd ZdS )PackageVersionsEndpointszget-package-versionsNc > K dt t d {V iS r/ )r# r )r3 r4 s r7 get_package_versionsz-PackageVersionsEndpoints.get_package_versions s- 34I J JJJJJJJKKr9 rW )rY rZ r[ r r r\ r9 r7 r r sD T
!!L L L "!L L Lr9 r c 6 e Zd Z ed d ZdS )
NewsEndpointszget-newsc < K dt j d {V iS r/ )r re r3 s r7 get_newszNewsEndpoints.get_news s) x|~~------..r9 N)rY rZ r[ r r r\ r9 r7 r r s8 T*/ / / / /r9 r c e Zd Zej Z ed d d Z ed d Z ed d Z ed d d
Z ed d Z
ed
d Z ed d d Z edd d Z
edd d Z ed d d Z ed d Z edd d!d ZdS )" EndpointsregisterNc
H K t j t j rrt j rt
st
d nHt dt j z | d {V t j | d {V n_# t $ r!}t
t | d }~wt $ r(}t d| t j t! j d {V d {V n# t& $ r7 t d t
t | t( $ rB}t
d t | t | d }~wt t f$ r!}t
t | d }~ww xY wY d }~nd }~ww xY wi S )NzAgent is already registeredz!Unregistering invalid license: %szUCan't register %r as imunify360 key. Trying to register it as a web panel key insteadz3Registration with web panel's key doesn't supportedz{}, {})r r cache_clear
is_registeredis_validr r rH r
unregisterr r r strr rI r* HostingPanel retrieve_keyNotImplementedErrorr format)r3 regkeyepanel_es r7 r zEndpoints.register s ((*** # % % ("$$
(% I)*GHHHI 7 *,,- oo''''''''' .,v&& & & & & & & & &" * * *!#a&&)) ) . . . NN9
.l'466CCEEEEEEEE '
.
.
.I &c!ff---!
M
M
M%hooc!ffc'll&K&KLLL 12
.
.
.%c!ff---
. .& sV 'C
H
C))H 7HAEHA H =G H1 H
HHH r c K t j st d t j rt d t j d {V i S )NzAgent is not registered yetz$Free license can not be unregistered)r r r is_freer r r s r7 r zEndpoints.unregister7 sm ')) A!"?@@ @ J!"HII In r9 zupdate-licensec 4 K t j st d t j }t j d {V t _ t j | d {V }|t d i S )Nz(Unregistered (server-id is not assigned)z*License does not exist. Agent unregistered) r r r r r* r users_countr
refresh_token)r3 token new_tokens r7 update_licensezEndpoints.update_licenseA s ')) N!"LMM M$&& ,..::<< < < < < < < +E22222222 !"NOO O r9 rstatusFc K t j t j st d |r"t j rt d | S )Nz%License is invalid for current serverz Free license)r r r r r r license_info)r3 paids r7 r zEndpoints.rstatusN st ((***"$$ K!"IJJ J 2J&(( 2!.11 1 """r9 versionc " K dt j iS r/ )
CoreConfigVERSIONr s r7 r zEndpoints.versionW s +,,r9 wakeupc
K i S )zBWake up the agent, so it can process the request, if it's sleepingr\ r s r7 r zEndpoints.wakeup[ s
r9 rD latestc K |rl|t j j v rY|r&t j | S |r.t j | || d {V S n|s|dk rt d t j || d {V d S # t j
t j f$ r Y d S w xY w)Nr z9Listing and version are not supported for this files type) r
FilesUpdateDISABLEDr Indexget_list update_tor rD asyncio TimeoutError UpdateError)r3 subjforcelistr s r7 update_fileszEndpoints.update_files` s
DF . 777
4 {4((11333
I "[ . . 8 8% H HHHHHHHH
I
w(**%O ,tU++ + + + + + + + + +$e&78 DD s B& &CCr acceptc < K t j d {V d S rW )r r r s r7 eula_acceptzEndpoints.eula_accepts s* kmmr9 r- c , K t j S rW )r textr s r7 eula_showzEndpoints.eula_showw s y{{r9 checkdbc ^ K |rt j dS t j dS )zmCheck DB consistency and repair if needed.
If recreate_schema is set recreate schema for attached DB.N)r! recreate_schemacheck_and_repair)r3 r s r7 r zEndpoints.checkdb{ s: ( $ & & & & & % ' ' ' ' 'r9 doctorc 8 K t d {V }d|z S )Nz8Please, provide this key:
%s
to Imunify360 Support Team
r( )r3 keys r7 r zEndpoints.doctor s0 "$$$$$$$$ IC O
r9 supportsendc K t d {V }n# t $ r d }Y nw xY w t |||||| d {V }n?# t $ r2}t d|j |j |j d }~ww xY wd|giS )Nz@Got error from Zendesk API. error=%s, description=%s, details=%sr0 )r) r r& r% rH r descriptiondetails) r3 emailsubjectr cln attachments
doctor_key
ticket_urlr s r7 send_to_supportzEndpoints.send_to_support s
- / ///////JJ JJJ
+w Zk JJ LL
* &&s# ((A
B-A>>BrW )F)NFFr rX )rY rZ r[ r r r r r r r r r r r r r r r r\ r9 r7 r r s *L T*# # # #J
T,
T
T)__# # # _#
T)__- - _-
T(^^ ^
T(^^:B ^$
T&(
T&&
T)__( ( ( _(
T(^^
^
T)V AE' ' ' ' ' 'r9 r c j e Zd ZdZdZ edd d Z edd d ZdS )
WhmcsEndpointz<
Describes all endpoints for interaction with WHMCS
1billingsyncc K t j | }n"# t j $ r t d w xY wt | j | d {V }d|dS )Nz Invalid JSONsuccessrU rK )rF rG JSONDecodeError
ValueErrorr' rJ )r3 rK decoded_datarU s r7 billing_synczWhmcsEndpoint.billing_sync sy - :d++LL# - - - ^,, , -(\BBBBBBBB#V444s 8z
get-configc z K t | j t t d {V }d|dS )N)r billing_licenseissuesr r )dictr r r )r3 rU s r7 billing_get_configz WhmcsEndpoint.billing_get_config sS L , . .:<<<<<<<<
$V444r9 N)rY rZ r[ __doc__r r r r r\ r9 r7 r r ss
G T)V 5 5 5
T)\""5 5 #"5 5 5r9 r )_r r rF r collectionsr loggingr typingr defence360agentr defence360agent.api.jwt_issuerr defence360agent.api.newsfeedr defence360agent.api.pam_authr defence360agent.contractsr
r defence360agent.contracts.configr r
r r r r r r !defence360agent.contracts.licenser defence360agent.internals.clnr r r !defence360agent.myimunify.billingr r defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r r defence360agent.simple_rpcr "defence360agent.subsys.panels.baser defence360agent.utilsr r r! r" r# defence360agent.utils.configr$ defence360agent.utils.supportr% r& defence360agent.utils.whmcsr' defence360agent.utils.doctorr) defence360agent.subsys.panelsr* rY rH r, ri rf ry r^ r __annotations__r r r r` intfloatboolrl rw r~ r r r r r r r r r r r\ r9 r7 <module>r" sg ! ! ! ! ! ! 4 4 4 4 4 4 1 1 1 1 1 1 0 0 0 0 0 0 2 2 2 2 2 2 2 2 9 8 8 8 8 8 L L L L L L L L L L 6 5 5 5 5 5
6 5 5 5 5 5 = = = = = = 7 6 6 6 6 6 G G G G G G G G 9 9 9 9 9 9 7 7 7 7 7 7 7 7 7 7 7 7 8 B B B B Bo B B BL (* T#u*% * * *$_%=sCC # ,. c5j) . . .
)
)5
)T
)
)
)
)*% *D * * * *B B% BD B B B B,s ,t , , , , - -% -D - - - - )e ) ) ) ) )
As
A
A4
A
A
A
A!
!
!
!
!
_ !
!
!
H
L L L L L L L L / / / / /M / / / W' W' W' W' W'
W' W' W't5 5 5 5 5M 5 5 5 5 5r9 defence360agent/simple_rpc/__pycache__/hooks.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000012601 00000000000 021677 0 ustar
r_jH d dl Z d dlZd dlmZ d dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZ d dlmZ ej e Z G d d
e
ZdS ) N)
HookEvents) HooksConfig)
LicenseCLN) EventHook)ValidationError)
RootEndpointsbind)notifierc @ e Zd ZddZ edd d Z edd d Z edd d Z edd
d Z ed d
d Z ed d dd Z
ed d dd Z dS )HooksEndpointsNc v |t j vr(||k r$t d | d S d S )Nz "{}" is not valid event for hook)r EVENTSr format)selfeventextras U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/hooks.py _check_eventzHooksEndpoints._check_event sG
) ) )eunn!299%@@
* )nn hookaddc K | | t j || }|s#t d || d|d< d|iS )Nr pathzUnable to add hook "{} {}"
registeredstatusitemsr r add_hookr r r r r results r hook_addzHooksEndpoints.hook_add ss % #%d;;; !,33E4@@
(x r deletec K | | t j || }|s#t d || d|d< d|iS )Nr z Unable to delete hook "{} {}" unregisteredr r )r r delete_hookr r r s r hook_deletezHooksEndpoints.hook_delete! ss % &U>>> !/66udCC
*x r listc b K | |d t j | }d|iS )Nallr )r r list_events)r r r! s r hook_listzHooksEndpoints.hook_list, s7 %'''&u-- r z
add-nativec K | | t j ||d }|s#t d || d|d< d|iS )NT)r r nativez!Unable to add native hook "{} {}"r r r r r s r hook_add_nativez HooksEndpoints.hook_add_native2 su % #%d4HHH !3::5$GG
(x r znotifications-configshowc J K dt iS )Nr )r get)r s r r0 zHooksEndpoints.show= s! **,,--r updatec . K t j rt d |r|d }t j | }t | t j d {V | d {V S )N*This action is not allowed in demo versionr )
r is_demor jsonloadsr r3 r
config_updatedr0 )r r datanew_datas r r3 zHooksEndpoints.updateA s P!"NOO O 8D:d##
X&&&%'''''''''YY[[ r patchc K t j rt d t | t j d {V | d {V S )Nr5 )r r6 r r r3 r
r9 r0 )r r: s r update_uizHooksEndpoints.update_uiL s P!"NOO O
T"""%'''''''''YY[[ r )N)NN) __name__
__module__ __qualname__r r r" r' r, r/ r0 r3 r> r r r r sM
T&%! ! !
T&(! ! !
T&&! ! !
T&, ! ! !
T
&)). . *).
T
(++! ! ! ,+!
T
'**! ! ! +*! ! !r r )r7 logging defence360agent.contracts.configr defence360agent.contracts.hooksr !defence360agent.contracts.licenser defence360agent.model.event_hookr defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r defence360agent.subsysr
getLoggerr? loggerr rB r r <module>rM s 7 7 7 7 7 7 7 7 7 7 7 7 8 8 8 8 8 8 6 6 6 6 6 6 5 5 5 5 5 5 @ @ @ @ @ @ @ @ + + + + + + 8 $ $C! C! C! C! C!] C! C! C! C! C!r defence360agent/simple_rpc/__pycache__/hooks.cpython-311.pyc 0000644 0000000 0000000 00000012601 00000000000 020740 0 ustar
r_jH d dl Z d dlZd dlmZ d dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZ d dlmZ ej e Z G d d
e
ZdS ) N)
HookEvents) HooksConfig)
LicenseCLN) EventHook)ValidationError)
RootEndpointsbind)notifierc @ e Zd ZddZ edd d Z edd d Z edd d Z edd
d Z ed d
d Z ed d dd Z
ed d dd Z dS )HooksEndpointsNc v |t j vr(||k r$t d | d S d S )Nz "{}" is not valid event for hook)r EVENTSr format)selfeventextras U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/hooks.py _check_eventzHooksEndpoints._check_event sG
) ) )eunn!299%@@
* )nn hookaddc K | | t j || }|s#t d || d|d< d|iS )Nr pathzUnable to add hook "{} {}"
registeredstatusitemsr r add_hookr r r r r results r hook_addzHooksEndpoints.hook_add ss % #%d;;; !,33E4@@
(x r deletec K | | t j || }|s#t d || d|d< d|iS )Nr z Unable to delete hook "{} {}" unregisteredr r )r r delete_hookr r r s r hook_deletezHooksEndpoints.hook_delete! ss % &U>>> !/66udCC
*x r listc b K | |d t j | }d|iS )Nallr )r r list_events)r r r! s r hook_listzHooksEndpoints.hook_list, s7 %'''&u-- r z
add-nativec K | | t j ||d }|s#t d || d|d< d|iS )NT)r r nativez!Unable to add native hook "{} {}"r r r r r s r hook_add_nativez HooksEndpoints.hook_add_native2 su % #%d4HHH !3::5$GG
(x r znotifications-configshowc J K dt iS )Nr )r get)r s r r0 zHooksEndpoints.show= s! **,,--r updatec . K t j rt d |r|d }t j | }t | t j d {V | d {V S )N*This action is not allowed in demo versionr )
r is_demor jsonloadsr r3 r
config_updatedr0 )r r datanew_datas r r3 zHooksEndpoints.updateA s P!"NOO O 8D:d##
X&&&%'''''''''YY[[ r patchc K t j rt d t | t j d {V | d {V S )Nr5 )r r6 r r r3 r
r9 r0 )r r: s r update_uizHooksEndpoints.update_uiL s P!"NOO O
T"""%'''''''''YY[[ r )N)NN) __name__
__module__ __qualname__r r r" r' r, r/ r0 r3 r> r r r r sM
T&%! ! !
T&(! ! !
T&&! ! !
T&, ! ! !
T
&)). . *).
T
(++! ! ! ,+!
T
'**! ! ! +*! ! !r r )r7 logging defence360agent.contracts.configr defence360agent.contracts.hooksr !defence360agent.contracts.licenser defence360agent.model.event_hookr defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r defence360agent.subsysr
getLoggerr? loggerr rB r r <module>rM s 7 7 7 7 7 7 7 7 7 7 7 7 8 8 8 8 8 8 6 6 6 6 6 6 5 5 5 5 5 5 @ @ @ @ @ @ @ @ + + + + + + 8 $ $C! C! C! C! C!] C! C! C! C! C!r defence360agent/simple_rpc/__pycache__/hosting_panel.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006603 00000000000 023413 0 ustar
r_j b d dl mZ d dlmZ d dlmZ d dlmZ d dlm Z m
Z
G d de Z dS ) )PanelException) DirectAdmin) HostingPanel)ValidationError)
RootEndpointsbindc e Zd Z ed d
d Z ed d
d Z ed d Z ed d Z ed
d Ze d Z
dS )HostingPanelEndpointsz
enable-pluginNc F K | j | d {V S N)
hosting_panelenable_imunify_pluginself plugin_names ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/hosting_panel.py
enable_pluginz#HostingPanelEndpoints.enable_plugin s/ '==kJJJJJJJJJ zdisable-pluginc F K | j | d {V S r )r
disable_imunify_pluginr s r disable_pluginz$HostingPanelEndpoints.disable_plugin
s/ '>>{KKKKKKKKKr z add-sudouserc K | j }t |t st d | | d {V S Nz&Feature available only for DirectAdmin)r
isinstancer r add_sudouserr userhps r r z"HostingPanelEndpoints.add_sudouser sT
"k** L!"JKK K__T*********r zdelete-sudouserc K | j }t |t st d | | d {V S r )r
r r r delete_sudouserr s r r z%HostingPanelEndpoints.delete_sudouser sV
"k** L!"JKK K''---------r z
list-docrootsc H K d| j d {V iS )Nitems)r
list_docroots)r s r get_docrootsz"HostingPanelEndpoints.get_docroots! s2 t 1 ? ? A AAAAAAABBr c | t S # t $ r!}t t | d }~ww xY wr )r r r str)r es r r
z#HostingPanelEndpoints.hosting_panel% sD * >> ! * * *!#a&&)) ) *s
; 6;r ) __name__
__module__ __qualname__r r r r r r$ propertyr
r r r
r
s T/K K K K
T
L L L L
T.+ + +
T
. . .
T/C C C * * X* * *r r
N) "defence360agent.subsys.panels.baser )defence360agent.subsys.panels.directadminr +defence360agent.subsys.panels.hosting_panelr defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r r
r, r r <module>r2 s = = = = = = A A A A A A D D D D D D 5 5 5 5 5 5 @ @ @ @ @ @ @ @"* "* "* "* "*M "* "* "* "* "*r defence360agent/simple_rpc/__pycache__/hosting_panel.cpython-311.pyc 0000644 0000000 0000000 00000006603 00000000000 022454 0 ustar
r_j b d dl mZ d dlmZ d dlmZ d dlmZ d dlm Z m
Z
G d de Z dS ) )PanelException) DirectAdmin) HostingPanel)ValidationError)
RootEndpointsbindc e Zd Z ed d
d Z ed d
d Z ed d Z ed d Z ed
d Ze d Z
dS )HostingPanelEndpointsz
enable-pluginNc F K | j | d {V S N)
hosting_panelenable_imunify_pluginself plugin_names ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/hosting_panel.py
enable_pluginz#HostingPanelEndpoints.enable_plugin s/ '==kJJJJJJJJJ zdisable-pluginc F K | j | d {V S r )r
disable_imunify_pluginr s r disable_pluginz$HostingPanelEndpoints.disable_plugin
s/ '>>{KKKKKKKKKr z add-sudouserc K | j }t |t st d | | d {V S Nz&Feature available only for DirectAdmin)r
isinstancer r add_sudouserr userhps r r z"HostingPanelEndpoints.add_sudouser sT
"k** L!"JKK K__T*********r zdelete-sudouserc K | j }t |t st d | | d {V S r )r
r r r delete_sudouserr s r r z%HostingPanelEndpoints.delete_sudouser sV
"k** L!"JKK K''---------r z
list-docrootsc H K d| j d {V iS )Nitems)r
list_docroots)r s r get_docrootsz"HostingPanelEndpoints.get_docroots! s2 t 1 ? ? A AAAAAAABBr c | t S # t $ r!}t t | d }~ww xY wr )r r r str)r es r r
z#HostingPanelEndpoints.hosting_panel% sD * >> ! * * *!#a&&)) ) *s
; 6;r ) __name__
__module__ __qualname__r r r r r r$ propertyr
r r r
r
s T/K K K K
T
L L L L
T.+ + +
T
. . .
T/C C C * * X* * *r r
N) "defence360agent.subsys.panels.baser )defence360agent.subsys.panels.directadminr +defence360agent.subsys.panels.hosting_panelr defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r r
r, r r <module>r2 s = = = = = = A A A A A A D D D D D D 5 5 5 5 5 5 @ @ @ @ @ @ @ @"* "* "* "* "*M "* "* "* "* "*r defence360agent/simple_rpc/__pycache__/myimunify.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000011115 00000000000 022601 0 ustar
r_j
d dl Zd dlmZmZ d dlmc mc mZ d dl
m Z m Z d dl
mZmZmZ d dlmZ d dlmZ G d dej Z G d d
ej ZdS ) N)ListOptional)MyImunifyConfigis_mi_freemium_license) MyImunify#set_protection_status_for_all_usersupdate_users_protection)lookup)Scopec e Zd Zej Z ej dd dee de fd Z
ej dd d Z ej dd d Z d
S ) MyImunifyEndpoints myimunifyupdateitems
protectionc J K t | j ||dk d {V i S )Nenabled)r _sink)selfr r s Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/myimunify.pyr zMyImunifyEndpoints.update sK % JzY 6
z
enable-allc @ K t | j d d {V d S )NTr r r s r
enable_allz MyImunifyEndpoints.enable_all s0 1$*dCCCCCCCCCCCr z disable-allc @ K t | j d d {V d S )NFr r s r disable_allz MyImunifyEndpoints.disable_all s0 1$*eDDDDDDDDDDDr N)
__name__
__module__ __qualname__r IM360SCOPEr
bindr strr r r r r r
r
s KEV[h''$s) (' V[l++D D ,+D V[m,,E E -,E E Er r
c t e Zd Zej Z ej dd ddee de
e fd Z dS )MyImunifyCommonEndpointsr statusNr userc
K t j }t j }||g}t j r| d {V |g }t t | d }t j dz t j
ddd||| d z }t j t j | }t j |t' d |D dS )Nz/?cloudlinux_advantage provisioning my_imunify_account_protection)mactionsuiteusernamedomain server_ipc 0 g | ]}|d |d dS )r) r )r1 r r% ).0items r
<listcomp>z3MyImunifyCommonEndpoints.status.<locals>.<listcomp>H s9 "&\l9KLL r )myimunify_enabledpurchase_page_url is_freemiumr )r PURCHASE_PAGE_URLhp HostingPanelENABLEDget_domains_per_usergetnextiterurllibparse urlencode
get_server_ipr selectwherer) in_dictsr )r r r) purchase_url
panel_manager user_domainsr2 responses r r( z MyImunifyCommonEndpoints.status( sM &8 ))
FE &
'<<>>>>>>>>#dB-- d< 0 0$77#5 l,,!7&4%D(,&,)6)D)D)F)F
#%%++IN,>,>u,E,EFFLLNN!0!8!-133 $
r )N) r r r r r! r" r
r# r r$ r r( r% r r r' r' % sc KEV[h''#
#
$s) #
8C= #
#
#
('#
#
#
r r' ) urllib.parserC typingr r +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelr< defence360agent.contracts.configr r defence360agent.myimunify.modelr r r defence360agent.rpc_toolsr
defence360agent.utilsr
RootEndpointsr
CommonEndpointsr' r% r r <module>r[ s9 ! ! ! ! ! ! ! ! 8 8 8 8 8 8 8 8 8 8 8 8
- , , , , , ' ' ' ' ' 'E E E E E- E E E&'
'
'
'
'
v 5 '
'
'
'
'
r defence360agent/simple_rpc/__pycache__/myimunify.cpython-311.pyc 0000644 0000000 0000000 00000011115 00000000000 021642 0 ustar
r_j
d dl Zd dlmZmZ d dlmc mc mZ d dl
m Z m Z d dl
mZmZmZ d dlmZ d dlmZ G d dej Z G d d
ej ZdS ) N)ListOptional)MyImunifyConfigis_mi_freemium_license) MyImunify#set_protection_status_for_all_usersupdate_users_protection)lookup)Scopec e Zd Zej Z ej dd dee de fd Z
ej dd d Z ej dd d Z d
S ) MyImunifyEndpoints myimunifyupdateitems
protectionc J K t | j ||dk d {V i S )Nenabled)r _sink)selfr r s Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/myimunify.pyr zMyImunifyEndpoints.update sK % JzY 6
z
enable-allc @ K t | j d d {V d S )NTr r r s r
enable_allz MyImunifyEndpoints.enable_all s0 1$*dCCCCCCCCCCCr z disable-allc @ K t | j d d {V d S )NFr r s r disable_allz MyImunifyEndpoints.disable_all s0 1$*eDDDDDDDDDDDr N)
__name__
__module__ __qualname__r IM360SCOPEr
bindr strr r r r r r
r
s KEV[h''$s) (' V[l++D D ,+D V[m,,E E -,E E Er r
c t e Zd Zej Z ej dd ddee de
e fd Z dS )MyImunifyCommonEndpointsr statusNr userc
K t j }t j }||g}t j r| d {V |g }t t | d }t j dz t j
ddd||| d z }t j t j | }t j |t' d |D dS )Nz/?cloudlinux_advantage provisioning my_imunify_account_protection)mactionsuiteusernamedomain server_ipc 0 g | ]}|d |d dS )r) r )r1 r r% ).0items r
<listcomp>z3MyImunifyCommonEndpoints.status.<locals>.<listcomp>H s9 "&\l9KLL r )myimunify_enabledpurchase_page_url is_freemiumr )r PURCHASE_PAGE_URLhp HostingPanelENABLEDget_domains_per_usergetnextiterurllibparse urlencode
get_server_ipr selectwherer) in_dictsr )r r r) purchase_url
panel_manager user_domainsr2 responses r r( z MyImunifyCommonEndpoints.status( sM &8 ))
FE &
'<<>>>>>>>>#dB-- d< 0 0$77#5 l,,!7&4%D(,&,)6)D)D)F)F
#%%++IN,>,>u,E,EFFLLNN!0!8!-133 $
r )N) r r r r r! r" r
r# r r$ r r( r% r r r' r' % sc KEV[h''#
#
$s) #
8C= #
#
#
('#
#
#
r r' ) urllib.parserC typingr r +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelr< defence360agent.contracts.configr r defence360agent.myimunify.modelr r r defence360agent.rpc_toolsr
defence360agent.utilsr
RootEndpointsr
CommonEndpointsr' r% r r <module>r[ s9 ! ! ! ! ! ! ! ! 8 8 8 8 8 8 8 8 8 8 8 8
- , , , , , ' ' ' ' ' 'E E E E E- E E E&'
'
'
'
'
v 5 '
'
'
'
'
r defence360agent/simple_rpc/__pycache__/permissions.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001731 00000000000 023131 0 ustar
r_j= > d dl mZ d dlmZmZ G d de ZdS ) permissions_list)CommonEndpointsbindc : e Zd Z edd dd ZdS )PermissionEndpoints permissionslistNc 4 K dt | d {V iS )Nitemsr )selfusers [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/permissions.pyr z$PermissionEndpoints.permissions_list s, / 5 555555566 )N)__name__
__module__ __qualname__r r r r r r s? T- 7 7 7 ! 7 7 7r r N)%defence360agent.contracts.permissionsr defence360agent.rpc_tools.lookupr r r r r r <module>r sc B B B B B B B B B B B B B B7 7 7 7 7/ 7 7 7 7 7r defence360agent/simple_rpc/__pycache__/permissions.cpython-311.pyc 0000644 0000000 0000000 00000001731 00000000000 022172 0 ustar
r_j= > d dl mZ d dlmZmZ G d de ZdS ) permissions_list)CommonEndpointsbindc : e Zd Z edd dd ZdS )PermissionEndpoints permissionslistNc 4 K dt | d {V iS )Nitemsr )selfusers [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/permissions.pyr z$PermissionEndpoints.permissions_list s, / 5 555555566 )N)__name__
__module__ __qualname__r r r r r r s? T- 7 7 7 ! 7 7 7r r N)%defence360agent.contracts.permissionsr defence360agent.rpc_tools.lookupr r r r r r <module>r sc B B B B B B B B B B B B B B7 7 7 7 7/ 7 7 7 7 7r defence360agent/simple_rpc/__pycache__/plesk_stats.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000016115 00000000000 023114 0 ustar
r_j5 d dl Z d dlZd dlmZ d dlmZ d dlmZmZ d dl m
Z
d dl m Z d dl
mZ d dlmZ d d lmZ d d
lmZ d d lmZ ej d d
d Z G d de ZdS ) N)suppress)
LicenseCLN)
RootEndpointsbind)run_in_executor_decorator) HostingPanel)list_docroots_domains_users)atomic_rewrite)Plesk) kernel_care)importerzimav.malwarelib.model
MalwareHit)modulenamedefaultc f e Zd ZdZ ed d Zed Zed Z dS )PleskStatsEndpointsd z plesk-statsc D K t }t |t s
J d t t t
j }t t
j |t
j
j }| t d {V d {V }d|dz |d|| d {V dt j rdndiiS )Nzonly for pleskitemsi )
last_modifiedlast_modified_strlicense r )r
isinstancer introunddatetimenow timestampstr
fromtimestamptimezoneutc_domains_statsr _get_stats_field_in_plugin_infor is_valid)selfpanelcurrent_timestampr
domains_statss [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/plesk_stats.py plesk_statsz PleskStatsEndpoints.plesk_stats sZ %''99)999' h&7&;&;&=&=&G&G&I&I J J K K + +!!%
# 1 1-// / / / / / /
!2T!9%6 ==????????
!4!6!6 =AAA
c K t j d {V si S t j d {V }d d d}t t
5 t
t j j 5 }t j | }d d d n # 1 swxY w Y d d d n # 1 swxY w Y |d dk }|d |d k r/t j
t j j
n4t j
|d t j j
}|sdn6t j
t j j
|z
j }t! t j j t j |d | d d
|d |d S )
N)effective_kernelfirst_time_update_available
updateCode1effectiveKernelr0 )tzr1 r F)backup
autoUpdate)kernel_uptodateoutdated_since_days)r
KernelCarecheck_installedget_plugin_infor FileNotFoundErroropen
KC_PROPERTIESjsonloadr r r# r$ r" daysr
dumpsr )cls plugin_infopreviousfileupdate_availabler1 r9 s r, r& z3PleskStatsEndpoints._get_stats_field_in_plugin_info/ s{ +--==???????? I ' 2 4 4 D D F FFFFFFF $+/
'
(
( + +k,:;;
+t 9T??
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + '|4; ,-:L1MMM
! !X%6%: ! ; ; ;"00679J9N $ $
AA !%%):)>%??-.
" 0 J(34E(F3N3X3X3Z3Z
+< 8#6
s6 4 C B4( C 4B8 8C ;B8 <C CCc t g ddS t t t j t }t d t t t j t D t t fd| }g }|D ]9\ }}}|D ]0\ }| | r| | n1:|d | j
t | dS )Nr )infected_siteswsites_infectedc 3 & K | ] }|d V
dS )r N ).0datas r, <genexpr>z5PleskStatsEndpoints._domains_stats.<locals>.<genexpr>i s:
G
r. c | d v S )N rM )rO infected_userss r, <lambda>z4PleskStatsEndpoints._domains_stats.<locals>.<lambda>t s T!W 6 r. )r listselect orig_filewhere is_infectedtuplessetuserdistinctfilter
startswithappendMAX_DOMAINS_COUNTlen)
r( plesk_response
file_namesinfected_plesk_responserJ docrootdomainr\ filenamerS s
@r, r% z"PleskStatsEndpoints._domains_statsZ s "$#$
j 2 3 3
U:))++
,
,
VXX
!!*/22z--//00
#' 6666
#
#
%< !GVT )
&&w// "))&111E
--Et/E-E F "> 2 2
r. N)
__name__
__module__ __qualname__ra r r- classmethodr& r r% rM r. r, r r sv T-
. (
(
[(
T (
(
(
(
(
r. r )r r@
contextlibr !defence360agent.contracts.licenser defence360agent.rpc_tools.lookupr r defence360agent.rpc_tools.utilsr +defence360agent.subsys.panels.hosting_panelr 'defence360agent.subsys.panels.plesk.apir defence360agent.utilsr
#defence360agent.subsys.panels.pleskr defence360agent.subsys.featuresr r
getr r rM r. r, <module>rw s. 8 8 8 8 8 8 @ @ @ @ @ @ @ @ E E E E E E D D D D D D O O O O O O 0 0 0 0 0 0 5 5 5 5 5 5 7 7 7 7 7 7 * * * * * *
X\ " t
o
o
o
o
o
- o
o
o
o
o
r. defence360agent/simple_rpc/__pycache__/plesk_stats.cpython-311.pyc 0000644 0000000 0000000 00000016115 00000000000 022155 0 ustar
r_j5 d dl Z d dlZd dlmZ d dlmZ d dlmZmZ d dl m
Z
d dl m Z d dl
mZ d dlmZ d d lmZ d d
lmZ d d lmZ ej d d
d Z G d de ZdS ) N)suppress)
LicenseCLN)
RootEndpointsbind)run_in_executor_decorator) HostingPanel)list_docroots_domains_users)atomic_rewrite)Plesk) kernel_care)importerzimav.malwarelib.model
MalwareHit)modulenamedefaultc f e Zd ZdZ ed d Zed Zed Z dS )PleskStatsEndpointsd z plesk-statsc D K t }t |t s
J d t t t
j }t t
j |t
j
j }| t d {V d {V }d|dz |d|| d {V dt j rdndiiS )Nzonly for pleskitemsi )
last_modifiedlast_modified_strlicense r )r
isinstancer introunddatetimenow timestampstr
fromtimestamptimezoneutc_domains_statsr _get_stats_field_in_plugin_infor is_valid)selfpanelcurrent_timestampr
domains_statss [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/plesk_stats.py plesk_statsz PleskStatsEndpoints.plesk_stats sZ %''99)999' h&7&;&;&=&=&G&G&I&I J J K K + +!!%
# 1 1-// / / / / / /
!2T!9%6 ==????????
!4!6!6 =AAA
c K t j d {V si S t j d {V }d d d}t t
5 t
t j j 5 }t j | }d d d n # 1 swxY w Y d d d n # 1 swxY w Y |d dk }|d |d k r/t j
t j j
n4t j
|d t j j
}|sdn6t j
t j j
|z
j }t! t j j t j |d | d d
|d |d S )
N)effective_kernelfirst_time_update_available
updateCode1effectiveKernelr0 )tzr1 r F)backup
autoUpdate)kernel_uptodateoutdated_since_days)r
KernelCarecheck_installedget_plugin_infor FileNotFoundErroropen
KC_PROPERTIESjsonloadr r r# r$ r" daysr
dumpsr )cls plugin_infopreviousfileupdate_availabler1 r9 s r, r& z3PleskStatsEndpoints._get_stats_field_in_plugin_info/ s{ +--==???????? I ' 2 4 4 D D F FFFFFFF $+/
'
(
( + +k,:;;
+t 9T??
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + '|4; ,-:L1MMM
! !X%6%: ! ; ; ;"00679J9N $ $
AA !%%):)>%??-.
" 0 J(34E(F3N3X3X3Z3Z
+< 8#6
s6 4 C B4( C 4B8 8C ;B8 <C CCc t g ddS t t t j t }t d t t t j t D t t fd| }g }|D ]9\ }}}|D ]0\ }| | r| | n1:|d | j
t | dS )Nr )infected_siteswsites_infectedc 3 & K | ] }|d V
dS )r N ).0datas r, <genexpr>z5PleskStatsEndpoints._domains_stats.<locals>.<genexpr>i s:
G
r. c | d v S )N rM )rO infected_userss r, <lambda>z4PleskStatsEndpoints._domains_stats.<locals>.<lambda>t s T!W 6 r. )r listselect orig_filewhere is_infectedtuplessetuserdistinctfilter
startswithappendMAX_DOMAINS_COUNTlen)
r( plesk_response
file_namesinfected_plesk_responserJ docrootdomainr\ filenamerS s
@r, r% z"PleskStatsEndpoints._domains_statsZ s "$#$
j 2 3 3
U:))++
,
,
VXX
!!*/22z--//00
#' 6666
#
#
%< !GVT )
&&w// "))&111E
--Et/E-E F "> 2 2
r. N)
__name__
__module__ __qualname__ra r r- classmethodr& r r% rM r. r, r r sv T-
. (
(
[(
T (
(
(
(
(
r. r )r r@
contextlibr !defence360agent.contracts.licenser defence360agent.rpc_tools.lookupr r defence360agent.rpc_tools.utilsr +defence360agent.subsys.panels.hosting_panelr 'defence360agent.subsys.panels.plesk.apir defence360agent.utilsr
#defence360agent.subsys.panels.pleskr defence360agent.subsys.featuresr r
getr r rM r. r, <module>rw s. 8 8 8 8 8 8 @ @ @ @ @ @ @ @ E E E E E E D D D D D D O O O O O O 0 0 0 0 0 0 5 5 5 5 5 5 7 7 7 7 7 7 * * * * * *
X\ " t
o
o
o
o
o
- o
o
o
o
o
r. defence360agent/simple_rpc/__pycache__/reputation_management.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006712 00000000000 025150 0 ustar
r_j d dl Z d dlmZ d dlmZmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
d dlmZ e j e Z G d d
ej ZdS ) N)lookup)ValidationErrorvalidate_av_plus_license)PanelException)InfectedDomainList)
hosting_panel)
ReputationAPI)run_in_executorc e Zd Z ej d ed Z ej d ed ZdS ) ReputationManagementEndpointszinfected-domainsc K t t j d {V }t j ||| \ }}||dS )N)offsetlimit)items max_count)setr HostingPanel get_usersr get_by_user)selfr r existing_usersr r s e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/reputation_management.py list_domainsz*ReputationManagementEndpoints.list_domains sv =#=#?#?#I#I#K#K K K K K K KLL-9 6
y "
z
check-domainsc K t j }| st d | d {V }n.# t
$ r!}t t
| d }~ww xY w|st d t j | d {V t j d {V t d fd d {V d S )Nz!No avaliable control panel found!zDomains not foundc . t j S )N)r refresh_domains)domain_to_userreputation_datas r <lambda>z=ReputationManagementEndpoints.check_domains.<locals>.<lambda>6 s &6 r ) r r is_installedr get_user_domainsr strr checkget_domain_to_ownerr
)r hpdomainser r s @@r
check_domainsz+ReputationManagementEndpoints.check_domains sY
'
)
) G!"EFF F * / / 1 1111111GG * * *!#a&&)) ) * 7!"566 6 - 3G < <<<<<<< ,..BBDD D D D D D D
s A
B! A==BN)__name__
__module__ __qualname__r bindr r r) r r r r sy V[#$$
%$
V[ !!
"!
r r )loggingdefence360agent.rpc_toolsr "defence360agent.rpc_tools.validater r "defence360agent.subsys.panels.baser %defence360agent.model.infected_domainr defence360agent.subsys.panelsr %defence360agent.api.server.reputationr $defence360agent.model.simplificationr
getLoggerr* logger
RootEndpointsr r. r r <module>r: s , , , , , , > = = = = = D D D D D D 7 7 7 7 7 7 ? ? ? ? ? ? @ @ @ @ @ @ 8 $ $)
)
)
)
)
F$8 )
)
)
)
)
r defence360agent/simple_rpc/__pycache__/reputation_management.cpython-311.pyc 0000644 0000000 0000000 00000006712 00000000000 024211 0 ustar
r_j d dl Z d dlmZ d dlmZmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
d dlmZ e j e Z G d d
ej ZdS ) N)lookup)ValidationErrorvalidate_av_plus_license)PanelException)InfectedDomainList)
hosting_panel)
ReputationAPI)run_in_executorc e Zd Z ej d ed Z ej d ed ZdS ) ReputationManagementEndpointszinfected-domainsc K t t j d {V }t j ||| \ }}||dS )N)offsetlimit)items max_count)setr HostingPanel get_usersr get_by_user)selfr r existing_usersr r s e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/reputation_management.py list_domainsz*ReputationManagementEndpoints.list_domains sv =#=#?#?#I#I#K#K K K K K K KLL-9 6
y "
z
check-domainsc K t j }| st d | d {V }n.# t
$ r!}t t
| d }~ww xY w|st d t j | d {V t j d {V t d fd d {V d S )Nz!No avaliable control panel found!zDomains not foundc . t j S )N)r refresh_domains)domain_to_userreputation_datas r <lambda>z=ReputationManagementEndpoints.check_domains.<locals>.<lambda>6 s &6 r ) r r is_installedr get_user_domainsr strr checkget_domain_to_ownerr
)r hpdomainser r s @@r
check_domainsz+ReputationManagementEndpoints.check_domains sY
'
)
) G!"EFF F * / / 1 1111111GG * * *!#a&&)) ) * 7!"566 6 - 3G < <<<<<<< ,..BBDD D D D D D D
s A
B! A==BN)__name__
__module__ __qualname__r bindr r r) r r r r sy V[#$$
%$
V[ !!
"!
r r )loggingdefence360agent.rpc_toolsr "defence360agent.rpc_tools.validater r "defence360agent.subsys.panels.baser %defence360agent.model.infected_domainr defence360agent.subsys.panelsr %defence360agent.api.server.reputationr $defence360agent.model.simplificationr
getLoggerr* logger
RootEndpointsr r. r r <module>r: s , , , , , , > = = = = = D D D D D D 7 7 7 7 7 7 ? ? ? ? ? ? @ @ @ @ @ @ 8 $ $)
)
)
)
)
F$8 )
)
)
)
)
r defence360agent/simple_rpc/__pycache__/schema.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000021152 00000000000 022015 0 ustar
r_j d dl mZmZ d dlmZmZ d dlmZ d dlm Z m
Z
m Z m Z m
Z
mZmZmZmZmZmZmZ d dlmZ G d de Zd Zd S )
)BaseErrorHandlerBasicErrorHandler)DefinitionSchemaUnvalidatedSchema)UserType) add_eula add_licenseadd_license_user add_versioncollect_warningscountsdefault_to_items max_countpreserve_remote_addrresolve_caller_panel_loginsend_command_invoke_messageset_caller_type_context)prepare_schemac L e Zd Zej Zd Zd ZdS ) ErrorHandlerc # * K |j r'|j D ] }| | E d {V d S d |j |j | j |j d j |j |j |j |j d V d S )Nz#field: '{}', value: '{}', error: {} )
constraintfieldvalue)
child_errorscollect_errorsformatr r messagesgetcodeinfor )selferrorerrs V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/schema.pyr zErrorHandler.collect_errors s )
4
4 ..s3333333333
4
4 8>> 8
!!%*b118Z $ / + +
c n g }|D ]/}| | D ]}| | 0|S )N)r append)r# errorsstring_representationr$ r" s r& __call__zErrorHandler.__call__* sX " 3 3E ++E22
3
3%,,T2222
3 %$r' N)__name__
__module__ __qualname__r r copyr r, r' r& r r sF )..00H "% % % % %r' r c j | t t j t | t }i d t
t j t j fft t j fft t j t j ff || t j t j fft t j fft t j fft t j fft t j t j fft t j t j fft t j t j ffg
dt" t j t j ffgdt$ t j t j ffgdt" t j t j ffgdt& t j t j ffgdt& t j t j ffgdt$ t j t j ffgdt$ t j t j ffgd t$ t j t j ffgd
t" t j t j ffgd t" t j t j ffgd t$ t j t j ffgd
t" t j t j ffgdt$ t j t j ffgdt$ t j t j ffgdt$ t j t j ffgdt$ t j t j ffgt$ t j t j ffgt$ t j t j ffgt" t j t j ffgt" t j t j ffgt& t j t j ffgt& t j t j ffgd}i dt gdt gdt gdt gdt gdt gdt gdt gdt gd t gd t gd t gd t gd t gd!t gd"t gd#t gi d$t gd%t gd&t gd't gd(t gd)t gd*t gd+t gd,t gd-t gd.t gd/t gd0t gd1t gd2t gd3t gd4t gt gt gt gt gt gt gt gt gt gt gt gt gt gt gd5}|||fS )6N)
error_handler) whitelistiplist) blacklistr5 r6 )graylistr5 r6 )r4 r5 add)r7 r5 r9 )r4 countryr6 )r7 r: r6 )r8 r: r6 )r7 )r4 )zwhitelisted-crawlersr6 )z blocked-portr6 )zblocked-port-ipr6 )rules
list-disabled)wordpress-pluginr; r< )r= z
list-sites)) proactiveignorer6 )feature-managementshow)ip-listsynced)rB localr6 )rB rD r9 )rB rD delete)z
enable-plugin)zdisable-plugin)zswitch-max-webserver)zinstall-vendors)zuninstall-vendors)z add-sudouser)zdelete-sudouser)doctor)captchazupdate-localizations)rG zcompile-localizations)update)kcarectlzdisable-auto-update)rI zenable-auto-update)rI z plugin-info)register)
unregister)rstatus)zupdate-license)3rdpartyr6 )z admin-emails)z
list-docroots)featuresr6 )rN status)rN install)rN remove)r@ nativeenable)r@ rR disable)r@ rR rO )importwblist)r; zupdate-app-specific-rules)supportsend)rM conflicts)
smtp-blockingreset)rZ sync))malwarez on-demandzcheck-detached)checkdb)zrestore-configs)patchmanusers)r_ rJ )r_ rP )r_ migrate)r_ uninstall)r_ rO )r_ rP realtime)r_ rb rc )analyst-cleanuprequest)rd z get-requests)rd z
is-allowed)r r expandr r r r ROOTNON_ROOTr r r r
r r r r r
r r )schema_validatorvalidate_middleware schema_paths
_validator _middleware_middleware_excludes r& init_validatorro 3 sH "! #N<$@$@ A A
# JW %x}h6G&H I ((*;)= >
(8=(:K*L M $#J// 12
8=* +
1 3 4
' (
8=(*;< =
x/@ A B
x/@ A B1
W6 $
hmX%67 8&
7W< $
(9: ;&
=WB #
hmX%67 8%
CWH #
!HM83D#E F%
IWN #
!HM83D#E F%
OWT )
(9: ;+
UWZ )
(9: ;+
[W` (
(9: ;*
aWf &8=(2C"DEFgWh &8=(2C"DEFiWj )
(9: ;+
kWp !
hmX%67 8#
qWv $
(9: ;&
wW| #
(9: ;%
}WB 7
(9: ;9
CWH +
(9: ;-
IWP (9: ;*
(9: ;)
"((-9J)K L M
hmX%67 8'
"HM83D#E F&
"HM83D#E F)
iW W WKr1XJ1hZ1 "H:1 xj 1
1 H:
1 xj1 hZ1 ,hZ1 -xj1 hZ1 ,hZ1 +XJ1 $hZ 1 z 1 (!1" xj#1 1$ hZ%1& xj'1( H:)1* XJ+1, xj-1.
/10 (112
314 3XJ516 4hZ718 3XJ91: xj;1< /
=1> hZ?1@ "H:A1B #XJC1D "H:E1 1F 6>J j 'j (z#+*"*"*$,:!)
.6Z08z)1
.6Z,4:a1 1 1f {$7 77r' N)cerberus.errorsr r cerberus.schemar r defence360agent.contracts.configr $defence360agent.rpc_tools.middlewarer r r
r r r
r r r r r r defence360agent.rpc_tools.utilsr r ro r1 r' r& <module>ru s0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 5 5 5 5 5 5
; : : : : :% % % % %# % % %:Z8 Z8 Z8 Z8 Z8r' defence360agent/simple_rpc/__pycache__/schema.cpython-311.pyc 0000644 0000000 0000000 00000021152 00000000000 021056 0 ustar
r_j d dl mZmZ d dlmZmZ d dlmZ d dlm Z m
Z
m Z m Z m
Z
mZmZmZmZmZmZmZ d dlmZ G d de Zd Zd S )
)BaseErrorHandlerBasicErrorHandler)DefinitionSchemaUnvalidatedSchema)UserType) add_eula add_licenseadd_license_user add_versioncollect_warningscountsdefault_to_items max_countpreserve_remote_addrresolve_caller_panel_loginsend_command_invoke_messageset_caller_type_context)prepare_schemac L e Zd Zej Zd Zd ZdS ) ErrorHandlerc # * K |j r'|j D ] }| | E d {V d S d |j |j | j |j d j |j |j |j |j d V d S )Nz#field: '{}', value: '{}', error: {} )
constraintfieldvalue)
child_errorscollect_errorsformatr r messagesgetcodeinfor )selferrorerrs V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/schema.pyr zErrorHandler.collect_errors s )
4
4 ..s3333333333
4
4 8>> 8
!!%*b118Z $ / + +
c n g }|D ]/}| | D ]}| | 0|S )N)r append)r# errorsstring_representationr$ r" s r& __call__zErrorHandler.__call__* sX " 3 3E ++E22
3
3%,,T2222
3 %$r' N)__name__
__module__ __qualname__r r copyr r, r' r& r r sF )..00H "% % % % %r' r c j | t t j t | t }i d t
t j t j fft t j fft t j t j ff || t j t j fft t j fft t j fft t j fft t j t j fft t j t j fft t j t j ffg
dt" t j t j ffgdt$ t j t j ffgdt" t j t j ffgdt& t j t j ffgdt& t j t j ffgdt$ t j t j ffgdt$ t j t j ffgd t$ t j t j ffgd
t" t j t j ffgd t" t j t j ffgd t$ t j t j ffgd
t" t j t j ffgdt$ t j t j ffgdt$ t j t j ffgdt$ t j t j ffgdt$ t j t j ffgt$ t j t j ffgt$ t j t j ffgt" t j t j ffgt" t j t j ffgt& t j t j ffgt& t j t j ffgd}i dt gdt gdt gdt gdt gdt gdt gdt gdt gd t gd t gd t gd t gd t gd!t gd"t gd#t gi d$t gd%t gd&t gd't gd(t gd)t gd*t gd+t gd,t gd-t gd.t gd/t gd0t gd1t gd2t gd3t gd4t gt gt gt gt gt gt gt gt gt gt gt gt gt gt gd5}|||fS )6N)
error_handler) whitelistiplist) blacklistr5 r6 )graylistr5 r6 )r4 r5 add)r7 r5 r9 )r4 countryr6 )r7 r: r6 )r8 r: r6 )r7 )r4 )zwhitelisted-crawlersr6 )z blocked-portr6 )zblocked-port-ipr6 )rules
list-disabled)wordpress-pluginr; r< )r= z
list-sites)) proactiveignorer6 )feature-managementshow)ip-listsynced)rB localr6 )rB rD r9 )rB rD delete)z
enable-plugin)zdisable-plugin)zswitch-max-webserver)zinstall-vendors)zuninstall-vendors)z add-sudouser)zdelete-sudouser)doctor)captchazupdate-localizations)rG zcompile-localizations)update)kcarectlzdisable-auto-update)rI zenable-auto-update)rI z plugin-info)register)
unregister)rstatus)zupdate-license)3rdpartyr6 )z admin-emails)z
list-docroots)featuresr6 )rN status)rN install)rN remove)r@ nativeenable)r@ rR disable)r@ rR rO )importwblist)r; zupdate-app-specific-rules)supportsend)rM conflicts)
smtp-blockingreset)rZ sync))malwarez on-demandzcheck-detached)checkdb)zrestore-configs)patchmanusers)r_ rJ )r_ rP )r_ migrate)r_ uninstall)r_ rO )r_ rP realtime)r_ rb rc )analyst-cleanuprequest)rd z get-requests)rd z
is-allowed)r r expandr r r r ROOTNON_ROOTr r r r
r r r r r
r r )schema_validatorvalidate_middleware schema_paths
_validator _middleware_middleware_excludes r& init_validatorro 3 sH "! #N<$@$@ A A
# JW %x}h6G&H I ((*;)= >
(8=(:K*L M $#J// 12
8=* +
1 3 4
' (
8=(*;< =
x/@ A B
x/@ A B1
W6 $
hmX%67 8&
7W< $
(9: ;&
=WB #
hmX%67 8%
CWH #
!HM83D#E F%
IWN #
!HM83D#E F%
OWT )
(9: ;+
UWZ )
(9: ;+
[W` (
(9: ;*
aWf &8=(2C"DEFgWh &8=(2C"DEFiWj )
(9: ;+
kWp !
hmX%67 8#
qWv $
(9: ;&
wW| #
(9: ;%
}WB 7
(9: ;9
CWH +
(9: ;-
IWP (9: ;*
(9: ;)
"((-9J)K L M
hmX%67 8'
"HM83D#E F&
"HM83D#E F)
iW W WKr1XJ1hZ1 "H:1 xj 1
1 H:
1 xj1 hZ1 ,hZ1 -xj1 hZ1 ,hZ1 +XJ1 $hZ 1 z 1 (!1" xj#1 1$ hZ%1& xj'1( H:)1* XJ+1, xj-1.
/10 (112
314 3XJ516 4hZ718 3XJ91: xj;1< /
=1> hZ?1@ "H:A1B #XJC1D "H:E1 1F 6>J j 'j (z#+*"*"*$,:!)
.6Z08z)1
.6Z,4:a1 1 1f {$7 77r' N)cerberus.errorsr r cerberus.schemar r defence360agent.contracts.configr $defence360agent.rpc_tools.middlewarer r r
r r r
r r r r r r defence360agent.rpc_tools.utilsr r ro r1 r' r& <module>ru s0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 5 5 5 5 5 5
; : : : : :% % % % %# % % %:Z8 Z8 Z8 Z8 Z8r' defence360agent/simple_rpc/__pycache__/wordpress_security_plugin.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000022636 00000000000 026122 0 ustar
r_j
" d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m
Z
m Z d dl m
Z
d dlmZ d dlmZ d dlmZ d d lmZ e j e Z dd
edz d edz d eedz edz f fd
Z G d de Z G d de Z dS ) N)ValidationError)CommonEndpoints
RootEndpointsbind)Scope is_root_user) MessageType)get_wordpress_incidents)$enrich_incidents_with_disabled_state) get_installed_sites_paginated)get_domain_pathsuser site_searchreturnc x t j }t rt d| d}| s t j | j }t d| | n<# t $ r/ t d| t d| d w xY w||fS ||fS )a
Determine the user_id and site_path for filtering WordPress incidents.
Three calling contexts:
1. Root user: Can query all incidents or filter by specific user
2. Non-root user: Can only query their own incidents (user/site_search ignored)
3. Proxy service: Both user and site_search must be set, restricted to that site
Args:
user: Username to filter by
site_search: Site path to filter by
Returns:
Tuple of (user_id, site_path) to filter by, or (None, None) for all
Raises:
KeyError: If the specified user doesn't exist
ValueError: If proxy service call is missing required parameters
z-Root user querying incidents, user filter: %sNz(Filtering incidents for user %s (uid=%d)zUser not found: %szUser 'z ' not found)
osgetuidr loggerdebugpwdgetpwnampw_uidKeyErrorwarning)r r current_uiduser_ids i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/wordpress_security_plugin.py get_user_id_and_site_for_queryr s , )++K~~ $ DdKKK
; ,t,,3 >g
;
;
; 3T::: 9 9 9 9:::
; ## ##s 5A8 89B1c e Zd Zej Z edd d Z edd d Z edd d Z edd d Z
d
S ) WordpressEndpointswordpress-pluginzinstall-on-new-sitesc p K | j t j d d {V d S )Ninstall_on_new_sitesaction_sinkprocess_messager WordpressPluginActionselfs r wordpress_plugin_installz+WordpressEndpoints.wordpress_plugin_installG sZ j(( -5K L L L
ztidy-upc p K | j t j d d {V d S )Ntidy_upr$ r& r* s r wordpress_plugin_tidy_upz+WordpressEndpoints.wordpress_plugin_tidy_upM sY j(( -Y ? ? ?
r- updatec p K | j t j d d {V d S )Nupdate_existingr$ r& r* s r wordpress_plugin_updatez*WordpressEndpoints.wordpress_plugin_updateS sZ j(( -5F G G G
r- zinstall-and-updatec p K | j t j d d {V d S )Ninstall_and_updater$ r& r* s r #wordpress_plugin_install_and_updatez6WordpressEndpoints.wordpress_plugin_install_and_updateY sZ j(( -5I J J J
r- N) __name__
__module__ __qualname__r AV_IM360SCOPEr r, r0 r4 r7 r- r r r D s NE T
455
65
T
i((
)(
T
h''
('
T
233
43
r- r c e Zd Zej Z edd ddedz dedz d ed
ed edz d edz d
edz dedz dedz dedz de dz de
de e fd Z edd dd Z
dS )WordpressCommonEndpointsr! zlist-incidentsN2 r Fr r limitoffset by_abuser_ipby_country_code by_domainsearchsincetoorder_byinclude_hiddenr c
` K t || \ }
}n/# t $ r"}t t | |d}~ww xY wt |||
|||||| |
| | }|D ]:}| d |d< | d }|d|ind|d< ;t
| |S )ac
List WordPress security incidents.
Three calling contexts:
1. Root user: Can query all incidents or filter by specific user
2. Non-root user: Can only query their own incidents
3. Proxy service: Both user and site_search must be set, restricted to that site
Args:
user: Username to filter by (root or proxy service)
site_search: Site path to filter by (proxy service only)
limit: Maximum number of incidents to return
offset: Number of incidents to skip
by_abuser_ip: Filter by attacker IP address
by_country_code: Filter by country code
by_domain: Filter by domain
search: Search across multiple fields
since: Filter by timestamp >= this value (unix timestamp)
to: Filter by timestamp <= this value (unix timestamp)
order_by: List of fields to order by (e.g., ['timestamp-', 'severity-'])
Returns:
List of incident dictionaries
Raises:
ValidationError: If the specified user doesn't exist
N) rA rB r rC rD rE rF r rG rH rI rJ retriestimescountrycode)r r r strr
popr )r+ r r rA rB rC rD rE rF rG rH rI rJ r site_pathe incidentsincidentrN s r wordpress_plugin_list_incidentsz8WordpressCommonEndpoints.wordpress_plugin_list_incidentsc s V 1!?k" " GYY 1 1 1!#a&&))q 0 1 ,% + ! )
" H ( Y 7 7HW ll9--G%,%8!!d
Y -Y777s
A ?Az
list-sitesc f K d}|r/ t j | j }n# t $ r dg fcY S w xY wt ||| \ }}t d{V }g }|D ]K} | | j g }
|
r|
d n| j } | | | j d L||fS )z
List WordPress sites with Imunify plugin installed.
For root users: returns all sites.
For non-root users: returns only sites belonging to that user.
Nr )uidrA rB )domaindocroot)
r r r r r r
getrZ rY append) r+ rA rB r rX max_countsitesdocroot_domainsitemssitedomainsprimary_domains r
list_sitesz#WordpressCommonEndpoints.list_sites s
l4((/
"u
95
5
!1 2 2222222
D%))$,;;G+2 CWQZZ N LL , #|
% s " 33) NNr@ r NNNNNNNF)r@ r N)r8 r9 r: r r; r< r rP intlistbooldictrV rd r= r- r r? r? ` s\ NE T
.// "&#'&* $ ! $ $J JDjJ 4ZJ J
J Dj
J tJ :J d
J TzJ
$JJ +J J
d J J J 0/JX
T
l++# # # ,+# # # r- r? )NN) loggingr r defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r r defence360agent.utilsr r "defence360agent.contracts.messagesr (defence360agent.model.wordpress_incidentr
&defence360agent.model.wp_disabled_ruler )defence360agent.wordpress.site_repositoryr defence360agent.wordpress.utilsr
getLoggerr8 r rP tuplere r r r? r= r- r <module>rt s
5 5 5 5 5 5
6 5 5 5 5 5 5 5 : : : : : : L L L L L L = < < < < < 8 $ $ 8<($ ($
*($*-*($
3:sTz !"($ ($ ($ ($V
8t t t t t t t t t t r- defence360agent/simple_rpc/__pycache__/wordpress_security_plugin.cpython-311.pyc 0000644 0000000 0000000 00000022636 00000000000 025163 0 ustar
r_j
" d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m
Z
m Z d dl m
Z
d dlmZ d dlmZ d dlmZ d d lmZ e j e Z dd
edz d edz d eedz edz f fd
Z G d de Z G d de Z dS ) N)ValidationError)CommonEndpoints
RootEndpointsbind)Scope is_root_user) MessageType)get_wordpress_incidents)$enrich_incidents_with_disabled_state) get_installed_sites_paginated)get_domain_pathsuser site_searchreturnc x t j }t rt d| d}| s t j | j }t d| | n<# t $ r/ t d| t d| d w xY w||fS ||fS )a
Determine the user_id and site_path for filtering WordPress incidents.
Three calling contexts:
1. Root user: Can query all incidents or filter by specific user
2. Non-root user: Can only query their own incidents (user/site_search ignored)
3. Proxy service: Both user and site_search must be set, restricted to that site
Args:
user: Username to filter by
site_search: Site path to filter by
Returns:
Tuple of (user_id, site_path) to filter by, or (None, None) for all
Raises:
KeyError: If the specified user doesn't exist
ValueError: If proxy service call is missing required parameters
z-Root user querying incidents, user filter: %sNz(Filtering incidents for user %s (uid=%d)zUser not found: %szUser 'z ' not found)
osgetuidr loggerdebugpwdgetpwnampw_uidKeyErrorwarning)r r current_uiduser_ids i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/wordpress_security_plugin.py get_user_id_and_site_for_queryr s , )++K~~ $ DdKKK
; ,t,,3 >g
;
;
; 3T::: 9 9 9 9:::
; ## ##s 5A8 89B1c e Zd Zej Z edd d Z edd d Z edd d Z edd d Z
d
S ) WordpressEndpointswordpress-pluginzinstall-on-new-sitesc p K | j t j d d {V d S )Ninstall_on_new_sitesaction_sinkprocess_messager WordpressPluginActionselfs r wordpress_plugin_installz+WordpressEndpoints.wordpress_plugin_installG sZ j(( -5K L L L
ztidy-upc p K | j t j d d {V d S )Ntidy_upr$ r& r* s r wordpress_plugin_tidy_upz+WordpressEndpoints.wordpress_plugin_tidy_upM sY j(( -Y ? ? ?
r- updatec p K | j t j d d {V d S )Nupdate_existingr$ r& r* s r wordpress_plugin_updatez*WordpressEndpoints.wordpress_plugin_updateS sZ j(( -5F G G G
r- zinstall-and-updatec p K | j t j d d {V d S )Ninstall_and_updater$ r& r* s r #wordpress_plugin_install_and_updatez6WordpressEndpoints.wordpress_plugin_install_and_updateY sZ j(( -5I J J J
r- N) __name__
__module__ __qualname__r AV_IM360SCOPEr r, r0 r4 r7 r- r r r D s NE T
455
65
T
i((
)(
T
h''
('
T
233
43
r- r c e Zd Zej Z edd ddedz dedz d ed
ed edz d edz d
edz dedz dedz dedz de dz de
de e fd Z edd dd Z
dS )WordpressCommonEndpointsr! zlist-incidentsN2 r Fr r limitoffset by_abuser_ipby_country_code by_domainsearchsincetoorder_byinclude_hiddenr c
` K t || \ }
}n/# t $ r"}t t | |d}~ww xY wt |||
|||||| |
| | }|D ]:}| d |d< | d }|d|ind|d< ;t
| |S )ac
List WordPress security incidents.
Three calling contexts:
1. Root user: Can query all incidents or filter by specific user
2. Non-root user: Can only query their own incidents
3. Proxy service: Both user and site_search must be set, restricted to that site
Args:
user: Username to filter by (root or proxy service)
site_search: Site path to filter by (proxy service only)
limit: Maximum number of incidents to return
offset: Number of incidents to skip
by_abuser_ip: Filter by attacker IP address
by_country_code: Filter by country code
by_domain: Filter by domain
search: Search across multiple fields
since: Filter by timestamp >= this value (unix timestamp)
to: Filter by timestamp <= this value (unix timestamp)
order_by: List of fields to order by (e.g., ['timestamp-', 'severity-'])
Returns:
List of incident dictionaries
Raises:
ValidationError: If the specified user doesn't exist
N) rA rB r rC rD rE rF r rG rH rI rJ retriestimescountrycode)r r r strr
popr )r+ r r rA rB rC rD rE rF rG rH rI rJ r site_pathe incidentsincidentrN s r wordpress_plugin_list_incidentsz8WordpressCommonEndpoints.wordpress_plugin_list_incidentsc s V 1!?k" " GYY 1 1 1!#a&&))q 0 1 ,% + ! )
" H ( Y 7 7HW ll9--G%,%8!!d
Y -Y777s
A ?Az
list-sitesc f K d}|r/ t j | j }n# t $ r dg fcY S w xY wt ||| \ }}t d{V }g }|D ]K} | | j g }
|
r|
d n| j } | | | j d L||fS )z
List WordPress sites with Imunify plugin installed.
For root users: returns all sites.
For non-root users: returns only sites belonging to that user.
Nr )uidrA rB )domaindocroot)
r r r r r r
getrZ rY append) r+ rA rB r rX max_countsitesdocroot_domainsitemssitedomainsprimary_domains r
list_sitesz#WordpressCommonEndpoints.list_sites s
l4((/
"u
95
5
!1 2 2222222
D%))$,;;G+2 CWQZZ N LL , #|
% s " 33) NNr@ r NNNNNNNF)r@ r N)r8 r9 r: r r; r< r rP intlistbooldictrV rd r= r- r r? r? ` s\ NE T
.// "&#'&* $ ! $ $J JDjJ 4ZJ J
J Dj
J tJ :J d
J TzJ
$JJ +J J
d J J J 0/JX
T
l++# # # ,+# # # r- r? )NN) loggingr r defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r r defence360agent.utilsr r "defence360agent.contracts.messagesr (defence360agent.model.wordpress_incidentr
&defence360agent.model.wp_disabled_ruler )defence360agent.wordpress.site_repositoryr defence360agent.wordpress.utilsr
getLoggerr8 r rP tuplere r r r? r= r- r <module>rt s
5 5 5 5 5 5
6 5 5 5 5 5 5 5 : : : : : : L L L L L L = < < < < < 8 $ $ 8<($ ($
*($*-*($
3:sTz !"($ ($ ($ ($V
8t t t t t t t t t t r- defence360agent/simple_rpc/__pycache__/wp_disabled_rules.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000032320 00000000000 024243 0 ustar
r_j( d Z ddlZddlZddlZddlZddlmZ ddlmZm Z ddl
m Z ddl m
Z
mZ ddlmZ ddlmZ dd lmZmZ dd
lmZ dd lmZmZ dd lm Z dd
l m Z m Z ddl m!Z! ddl"m#Z# ej$ e% Z&de'de(e' fdZ)de'de(e' dz de(e' fdZ*de(e+ de+dz de(e+ fdZ, d de(e' de dz ddfdZ- G d de Z.dS ) z6RPC endpoints for WordPress disabled protection rules. N) MessageType)WP_WAF_RULES_EDITcheck_permission) MessageSink)IndexWP_RULES)WPDisabledRule)ValidationError)CommonEndpointsbind)
hosting_panel)Scopelog_future_errors)ChangelogProcessor)redeploy_rules_php update_disabled_rules_on_sites) get_installed_sites_by_domains)get_wp_rules_datauserreturnc K t j }| d{V }| | g S # t $ r(}t
d| | g cY d}~S d}~ww xY w)z
Get domains for a user from the hosting panel.
Returns:
List of domains the user owns, or empty list on error.
Nz%Failed to get domains for user %s: %s)r
HostingPanelget_domains_per_userget Exceptionloggerwarning)r hpdomains_per_useres a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/wp_disabled_rules.py_get_user_domainsr" # s
'
)
)!#!8!8!:!::::::: ##D"--- >aHHH s AA
A9 A4.A94A9domainsc K t | d{V |sst d S fd|D }|st d |S )a
Validate and filter domains for a non-root user.
If no domains specified, returns all user's domains.
If domains specified, filters to only those the user owns.
Args:
user: Username to validate domains for
domains: Requested domains, or None for all user's domains
Returns:
List of validated domains the user can access
Raises:
ValidationError: If user has no domains or no access to requested domains
NzNo domains found for userc g | ]}|v | S r& .0d user_domainss r!
<listcomp>z*_validate_user_domains.<locals>.<listcomp>L s# BBB\0A0A!0A0A0A z5You don't have access to any of the specified domains)r" r
)r r# authorized_domainsr* s @r! _validate_user_domainsr. 3 s & +400000000L ?!"=>> >BBBBWBBB
C
r, disabled_rules
wp_rules_datac g }| D ]f}|d }|r| |i ni }| i || d | d d g|S )a9
Enrich disabled rules with metadata from wp-rules.yaml.
Args:
disabled_rules: List of disabled rule dicts from WPDisabledRule.fetch()
wp_rules_data: Parsed wp-rules.yaml data, or None if unavailable
Returns:
List of enriched rule dicts with component and versions added
rule_idtargetversions) componentr4 )r append)r/ r0 enrichedruler2 metadatas r! _enrich_with_metadatar: T s H
y/5BJ=$$Wb111
%\\( 3 3 $LL 4 4
Or, sinkc K t | }|sdS t || d{V dS # t $ r(}t d|d Y d}~dS d}~ww xY w)a Process pending changelog files for the given domains before an API change.
This "Just-in-Time" sync ensures the database reflects any WordPress-side
changes before the agent applies its own disable/enable operation.
File regeneration (disabled-rules.php) is intentionally skipped here because
the calling API endpoint will regenerate files after its own DB mutation.
N)r; z JIT changelog sync failed: %sT)exc_info)r r process_changelogs_for_sitesr r r )r# r; sitesr s r! _jit_sync_changelogsr@ q s J.w77 F ""?? @
J J J6DIIIIIIIIIJs A )A
A4 A//A4c e Zd ZdZej Z eddd dded ed
e e
dz d e
dz d e ee e f f
d
Z
de
de
d
e e
dz d e
dz d e f
dZ eddd dde
d
e e
dz d e
dz d e fd Z eddd dde
d
e e
dz d e
dz d e fd ZdS )WPDisabledRulesEndpointsz:Endpoints for listing disabled WordPress protection rules.zwordpress-pluginrulesz
list-disabled2 r Nlimitoffsetr# r r c K |r.t | d{V |s }n fd|D }|sdg fS t j ||||du \ }} t t d }t | }n4# t $ r'} t d| d}Y d} ~ nd} ~ ww xY wt || }
||
fS )a
List disabled WordPress protection rules with metadata.
When user is provided, returns rules for that user's domains.
Otherwise, returns all disabled rules.
Args:
limit: Maximum number of rules to return
offset: Number of rules to skip
domains: Filter by specific domains (optional)
user: Username (populated by middleware)
Returns:
Tuple of (total_count, list of enriched rule dicts)
Nc g | ]}|v | S r& r& r' s r! r+ z@WPDisabledRulesEndpoints.list_disabled_rules.<locals>.<listcomp> s# CCCl1B1B11B1B1Br, r )rE rF r* include_globalF)integrity_checkz Failed to load wp-rules data: %s)
r" r fetchr r r r r r r: ) selfrE rF r# r total_countr/ wp_rules_indexr0 r enriched_rulesr* s @r! list_disabled_rulesz,WPDisabledRulesEndpoints.list_disabled_rules s 0 !!24!8!8888888L
!&CCCCgCCC ! b5L '5&: 4< '
'
'
# ^ ! "8U C C CN -n = =MM ! ! ! NN=q A A A MMMMMM !
/~}MMN**s %A8 8
B) B$$B)actionr8 c
K t t | d{V |d}n< t j | j }n!# t
$ r t
d| d w xY w|rt || d{V }|rt || j d{V |dk r/t j ||t j | t j }n"t j || t j } | j |d||pg t% j |t j d{V n4# t& $ r'}t( d
||| Y d}~nd}~ww xY w|r#t- j t1 | }n t- j t3 }| t6 i S ) z8Shared implementation for disable/enable rule endpoints.Nr zUser 'z ' not founddisable)r2 r# sourceuser_id)r2 r# wordpress) plugin_idr8 r# timestamprU rT z#Failed to report rule %s for %s: %s)r# ) r r pwdgetpwnampw_uidKeyErrorr
r. r@ _sinkr store SOURCE_AGENTr WPRuleDisabledremove
WPRuleEnabledprocess_messagetimer r errorasyncio create_taskr r add_done_callbackr ) rL rQ r8 r# r rU message_clsr tasks r! _toggle_rulez%WPDisabledRulesEndpoints._toggle_rule so 0$777777777 <GG
B ,t,,3
B
B
B%&@t&@&@&@AAA
B B 24 A AAAAAAAG
<&w
;; ; ; ; ; ; ; ; Y %2
&4KK !$ @ @ @ @%3K *,, ) #Mr "ikk #)6
LL5vtQ
=&.w??? DD
&'9';';<<D 0111 s" > A ,A D9 9
E* E%%E*rS c B K | d||| d{V S )av
Disable a WordPress protection rule globally or for specific domains.
Root users can disable globally (no domains) or for specific domains.
Non-root users can disable for all their domains (by specifying no
domains) or for specific domains.
Non-root users can only disable for domains they own.
Args:
rule: The rule ID to disable (e.g., "CVE-2025-001")
domains: List of domains to disable the rule for, or None for global
user: Username (populated by middleware for non-root users)
Returns:
Empty dict on success.
rS Nrk rL r8 r# r s r! disable_rulez%WPDisabledRulesEndpoints.disable_rule s4 . &&y$FFFFFFFFFr, enablec B K | d||| d{V S )a
Re-enable a WordPress protection rule globally or for specific domains.
Root users can enable globally (no domains) or for specific domains.
Non-root users can enable for all their domains (no domains) or
specific ones.
Non-root users can only enable for domains they own.
Note: Enabling at one scope doesn't affect the other scope.
E.g., enabling globally leaves domain-specific disables intact.
Args:
rule: The rule ID to enable (e.g., "CVE-2025-001")
domains: List of domains to enable the rule for, or None for global
user: Username (populated by middleware for non-root users)
Returns:
Empty dict on success
rp Nrm rn s r! enable_rulez$WPDisabledRulesEndpoints.enable_rule s4 4 &&xwEEEEEEEEEr, )rD r NN)NN)__name__
__module__ __qualname____doc__r AV_IM360SCOPEr intliststrtupledictrP rk ro rr r& r, r! rB rB s DD NE T
g77 $( 6+ 6+6+ 6+ cT! 6+
Dj 6+
sDJ
6+ 6+ 6+ 876+p@@ @ cT! @
Dj @
@ @ @ @D
T
gy11 %) G GG cT!G Dj G
G G G 21G0
T
gx00 %) F FF cT!F Dj F
F F F 10F F Fr, rB )N)/rv rf loggingrY rd "defence360agent.contracts.messagesr %defence360agent.contracts.permissionsr r !defence360agent.contracts.pluginsr defence360agent.filesr r &defence360agent.model.wp_disabled_ruler defence360agent.rpc_toolsr
defence360agent.rpc_tools.lookupr r defence360agent.subsys.panelsr
defence360agent.utilsr r -defence360agent.wordpress.changelog_processorr defence360agent.wordpress.pluginr r )defence360agent.wordpress.site_repositoryr "defence360agent.wordpress.wp_rulesr getLoggerrs r r{ rz r" r. r} r: r@ rB r& r, r! <module>r s < <
: : : : : : : 9 9 9 9 9 1 1 1 1 1 1 1 1 A A A A A A 5 5 5 5 5 5 B B B B B B B B 7 7 7 7 7 7 : : : : : : : : A @ @ @ @ @ 8 $ $
#
$s)
S D( #Y BJ/3d{ $Z < 48J J
#YJ )D 0J J J J J*sF sF sF sF sF sF sF sF sF sFr, defence360agent/simple_rpc/__pycache__/wp_disabled_rules.cpython-311.pyc 0000644 0000000 0000000 00000032320 00000000000 023304 0 ustar
r_j( d Z ddlZddlZddlZddlZddlmZ ddlmZm Z ddl
m Z ddl m
Z
mZ ddlmZ ddlmZ dd lmZmZ dd
lmZ dd lmZmZ dd lm Z dd
l m Z m Z ddl m!Z! ddl"m#Z# ej$ e% Z&de'de(e' fdZ)de'de(e' dz de(e' fdZ*de(e+ de+dz de(e+ fdZ, d de(e' de dz ddfdZ- G d de Z.dS ) z6RPC endpoints for WordPress disabled protection rules. N) MessageType)WP_WAF_RULES_EDITcheck_permission) MessageSink)IndexWP_RULES)WPDisabledRule)ValidationError)CommonEndpointsbind)
hosting_panel)Scopelog_future_errors)ChangelogProcessor)redeploy_rules_php update_disabled_rules_on_sites) get_installed_sites_by_domains)get_wp_rules_datauserreturnc K t j }| d{V }| | g S # t $ r(}t
d| | g cY d}~S d}~ww xY w)z
Get domains for a user from the hosting panel.
Returns:
List of domains the user owns, or empty list on error.
Nz%Failed to get domains for user %s: %s)r
HostingPanelget_domains_per_userget Exceptionloggerwarning)r hpdomains_per_useres a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/wp_disabled_rules.py_get_user_domainsr" # s
'
)
)!#!8!8!:!::::::: ##D"--- >aHHH s AA
A9 A4.A94A9domainsc K t | d{V |sst d S fd|D }|st d |S )a
Validate and filter domains for a non-root user.
If no domains specified, returns all user's domains.
If domains specified, filters to only those the user owns.
Args:
user: Username to validate domains for
domains: Requested domains, or None for all user's domains
Returns:
List of validated domains the user can access
Raises:
ValidationError: If user has no domains or no access to requested domains
NzNo domains found for userc g | ]}|v | S r& .0d user_domainss r!
<listcomp>z*_validate_user_domains.<locals>.<listcomp>L s# BBB\0A0A!0A0A0A z5You don't have access to any of the specified domains)r" r
)r r# authorized_domainsr* s @r! _validate_user_domainsr. 3 s & +400000000L ?!"=>> >BBBBWBBB
C
r, disabled_rules
wp_rules_datac g }| D ]f}|d }|r| |i ni }| i || d | d d g|S )a9
Enrich disabled rules with metadata from wp-rules.yaml.
Args:
disabled_rules: List of disabled rule dicts from WPDisabledRule.fetch()
wp_rules_data: Parsed wp-rules.yaml data, or None if unavailable
Returns:
List of enriched rule dicts with component and versions added
rule_idtargetversions) componentr4 )r append)r/ r0 enrichedruler2 metadatas r! _enrich_with_metadatar: T s H
y/5BJ=$$Wb111
%\\( 3 3 $LL 4 4
Or, sinkc K t | }|sdS t || d{V dS # t $ r(}t d|d Y d}~dS d}~ww xY w)a Process pending changelog files for the given domains before an API change.
This "Just-in-Time" sync ensures the database reflects any WordPress-side
changes before the agent applies its own disable/enable operation.
File regeneration (disabled-rules.php) is intentionally skipped here because
the calling API endpoint will regenerate files after its own DB mutation.
N)r; z JIT changelog sync failed: %sT)exc_info)r r process_changelogs_for_sitesr r r )r# r; sitesr s r! _jit_sync_changelogsr@ q s J.w77 F ""?? @
J J J6DIIIIIIIIIJs A )A
A4 A//A4c e Zd ZdZej Z eddd dded ed
e e
dz d e
dz d e ee e f f
d
Z
de
de
d
e e
dz d e
dz d e f
dZ eddd dde
d
e e
dz d e
dz d e fd Z eddd dde
d
e e
dz d e
dz d e fd ZdS )WPDisabledRulesEndpointsz:Endpoints for listing disabled WordPress protection rules.zwordpress-pluginrulesz
list-disabled2 r Nlimitoffsetr# r r c K |r.t | d{V |s }n fd|D }|sdg fS t j ||||du \ }} t t d }t | }n4# t $ r'} t d| d}Y d} ~ nd} ~ ww xY wt || }
||
fS )a
List disabled WordPress protection rules with metadata.
When user is provided, returns rules for that user's domains.
Otherwise, returns all disabled rules.
Args:
limit: Maximum number of rules to return
offset: Number of rules to skip
domains: Filter by specific domains (optional)
user: Username (populated by middleware)
Returns:
Tuple of (total_count, list of enriched rule dicts)
Nc g | ]}|v | S r& r& r' s r! r+ z@WPDisabledRulesEndpoints.list_disabled_rules.<locals>.<listcomp> s# CCCl1B1B11B1B1Br, r )rE rF r* include_globalF)integrity_checkz Failed to load wp-rules data: %s)
r" r fetchr r r r r r r: ) selfrE rF r# r total_countr/ wp_rules_indexr0 r enriched_rulesr* s @r! list_disabled_rulesz,WPDisabledRulesEndpoints.list_disabled_rules s 0 !!24!8!8888888L
!&CCCCgCCC ! b5L '5&: 4< '
'
'
# ^ ! "8U C C CN -n = =MM ! ! ! NN=q A A A MMMMMM !
/~}MMN**s %A8 8
B) B$$B)actionr8 c
K t t | d{V |d}n< t j | j }n!# t
$ r t
d| d w xY w|rt || d{V }|rt || j d{V |dk r/t j ||t j | t j }n"t j || t j } | j |d||pg t% j |t j d{V n4# t& $ r'}t( d
||| Y d}~nd}~ww xY w|r#t- j t1 | }n t- j t3 }| t6 i S ) z8Shared implementation for disable/enable rule endpoints.Nr zUser 'z ' not founddisable)r2 r# sourceuser_id)r2 r# wordpress) plugin_idr8 r# timestamprU rT z#Failed to report rule %s for %s: %s)r# ) r r pwdgetpwnampw_uidKeyErrorr
r. r@ _sinkr store SOURCE_AGENTr WPRuleDisabledremove
WPRuleEnabledprocess_messagetimer r errorasyncio create_taskr r add_done_callbackr ) rL rQ r8 r# r rU message_clsr tasks r! _toggle_rulez%WPDisabledRulesEndpoints._toggle_rule so 0$777777777 <GG
B ,t,,3
B
B
B%&@t&@&@&@AAA
B B 24 A AAAAAAAG
<&w
;; ; ; ; ; ; ; ; Y %2
&4KK !$ @ @ @ @%3K *,, ) #Mr "ikk #)6
LL5vtQ
=&.w??? DD
&'9';';<<D 0111 s" > A ,A D9 9
E* E%%E*rS c B K | d||| d{V S )av
Disable a WordPress protection rule globally or for specific domains.
Root users can disable globally (no domains) or for specific domains.
Non-root users can disable for all their domains (by specifying no
domains) or for specific domains.
Non-root users can only disable for domains they own.
Args:
rule: The rule ID to disable (e.g., "CVE-2025-001")
domains: List of domains to disable the rule for, or None for global
user: Username (populated by middleware for non-root users)
Returns:
Empty dict on success.
rS Nrk rL r8 r# r s r! disable_rulez%WPDisabledRulesEndpoints.disable_rule s4 . &&y$FFFFFFFFFr, enablec B K | d||| d{V S )a
Re-enable a WordPress protection rule globally or for specific domains.
Root users can enable globally (no domains) or for specific domains.
Non-root users can enable for all their domains (no domains) or
specific ones.
Non-root users can only enable for domains they own.
Note: Enabling at one scope doesn't affect the other scope.
E.g., enabling globally leaves domain-specific disables intact.
Args:
rule: The rule ID to enable (e.g., "CVE-2025-001")
domains: List of domains to enable the rule for, or None for global
user: Username (populated by middleware for non-root users)
Returns:
Empty dict on success
rp Nrm rn s r! enable_rulez$WPDisabledRulesEndpoints.enable_rule s4 4 &&xwEEEEEEEEEr, )rD r NN)NN)__name__
__module__ __qualname____doc__r AV_IM360SCOPEr intliststrtupledictrP rk ro rr r& r, r! rB rB s DD NE T
g77 $( 6+ 6+6+ 6+ cT! 6+
Dj 6+
sDJ
6+ 6+ 6+ 876+p@@ @ cT! @
Dj @
@ @ @ @D
T
gy11 %) G GG cT!G Dj G
G G G 21G0
T
gx00 %) F FF cT!F Dj F
F F F 10F F Fr, rB )N)/rv rf loggingrY rd "defence360agent.contracts.messagesr %defence360agent.contracts.permissionsr r !defence360agent.contracts.pluginsr defence360agent.filesr r &defence360agent.model.wp_disabled_ruler defence360agent.rpc_toolsr
defence360agent.rpc_tools.lookupr r defence360agent.subsys.panelsr
defence360agent.utilsr r -defence360agent.wordpress.changelog_processorr defence360agent.wordpress.pluginr r )defence360agent.wordpress.site_repositoryr "defence360agent.wordpress.wp_rulesr getLoggerrs r r{ rz r" r. r} r: r@ rB r& r, r! <module>r s < <
: : : : : : : 9 9 9 9 9 1 1 1 1 1 1 1 1 A A A A A A 5 5 5 5 5 5 B B B B B B B B 7 7 7 7 7 7 : : : : : : : : A @ @ @ @ @ 8 $ $
#
$s)
S D( #Y BJ/3d{ $Z < 48J J
#YJ )D 0J J J J J*sF sF sF sF sF sF sF sF sF sFr, defence360agent/simple_rpc/__pycache__/wp_waf_bulk.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000025773 00000000000 023072 0 ustar
r_jz d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m
Z
ddl m Z ddl
mZ ddlmZ dd lmZmZ dd
lmZ ej e Zd Zd Zd
ZdZ de e de e e e dz e!e f fdZ"de e e dz e!e f de#e e f de#fdZ$de e e dz e!e f de dz de dz de!fdZ% G d de Z&dS )z Bulk WAF set + status endpoints. N) Wordpress)ValidationError)
RootEndpointsbind)
hosting_panel)Scope)
update_config)waf_global_snapshot#waf_status_and_source_for_user_sync) count_installed_sites_by_uid
enableddisabledi usersreturnc g }| D ]Z} t j | j }n# t $ r d }Y nw xY wt | \ }}| ||||f [|S )N)pwdgetpwnampw_uidKeyErrorr append)r rowsnameuidr sources [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/wp_waf_bulk.py_resolve_accounts_syncr " s D 2 2 ,t$$+CC CCC =dCC T301111 Ks " 11row site_countsc b | \ }}}}||rt nt || |d dS )Nr )r
waf_statusr wp_sites)_STATUS_ENABLED_STATUS_DISABLEDget)r r r r r r s r _status_itemr& 0 sE "% D#w)0Foo6F OOC++ statusr c \ | \ }}}}|rt nt }|||k rdS |||k rdS dS )NFT)r# r$ )r r( r _r srcr! s r _matchesr, < sN
Aq'3$+A 1AJ
jF 2 2u
cVmmu 4r' c e Zd Zej Z eddd ddedede e dz d e
fd
Z eddd dd edz dedz d
edz de dz de d e
f d Z
dS )WordpressWafBulkEndpointszwordpress-pluginwafsetFNr( all_usersr r c X K |r|t d |s|t d ||st d t j st d t d||| t t
j d {V }n%# t $ r}t d| |d }~ww xY wg }g }g }|rt | } nQg } t | D ]4}
|
|v r|
|
|
|
dd 5|d k d
t d t t t d z f f fd t! d
t# | t$ D ]l} fd| | | t$ z D } t' j | d {V }
|
D ]5\ }
}||
|
|
|
|d 6mg d |D d |D d |D }||||dS )Nz/Specify either --all-users or --users, not bothz%Specify either --all-users or --usersz--users must not be emptyzNWordPress Security Plugin is disabled. Enable it before changing WAF settings.z>AUDIT wordpress-plugin.waf.set status=%r all_users=%r users=%r#Could not enumerate hosting users: zNot a hosting user)userreasonr ur c K t j ddii| d {V | d fS # t $ r}| t | fcY d }~S d }~ww xY w)N WORDPRESS waf_enabled)r4 )r _sink Exceptionstr)r6 eself waf_values r _apply_to_userz9WordpressWafBulkEndpoints.waf_set.<locals>._apply_to_user s
!#J =)"<=
$w
!
!
!#a&&y
!s $*
AA
A
Ar c & g | ]
} | S rB ).0r6 r@ s r
<listcomp>z5WordpressWafBulkEndpoints.waf_set.<locals>.<listcomp> s0 &'q!! r' c g | ]}|d dd S ) succeeded r4 r( r5 rB )rC r6 s r rD z5WordpressWafBulkEndpoints.waf_set.<locals>.<listcomp> s2 kR@@ r' c 2 g | ]}|d d|d dS )r4 skippedr5 rH rB )rC ss r rD z5WordpressWafBulkEndpoints.waf_set.<locals>.<listcomp> s: 6i1X;OO r' c 2 g | ]}|d d|d dS )r4 failedr5 rH rB )rC fs r rD z5WordpressWafBulkEndpoints.waf_set.<locals>.<listcomp> s: 6h!H+NN r' )itemsrF rJ rM )r r SECURITY_PLUGIN_ENABLEDloggerwarningr0 r HostingPanel get_usersr; listdictfromkeysr r< tuplerangelen_MAX_CONCURRENTasynciogather)r> r( r1 r panel_usersr= rF rJ rM valid_usersr6 ibatchresultserrrO r@ r? s ` @@r waf_setz!WordpressWafBulkEndpoints.waf_setM sL *!A
KU]!"IJJ J U !"=>> >0 !;
L
M$>$@$@$J$J$L$L L L L L L LMMKK !9a99
" P {++KK K]]5))
P
P ## &&q))))NNA9M#N#NOOOOi' !C !E#sTz/,B ! ! ! ! ! ! ! q#k**O<< > >A +6q1;N7N+O E $NE 2222222G!
>
>3; $$Q''''MM1"<"<====
>
"
"
s 88B1 1
C;CCr r4 r limitoffsetc 8 K ||dk rt d |dk rt d t j }t \ }}} t t
t j d {V }
n%# t $ r} t d| | d } ~ ww xY w|&|t |
vrt | d |g}
| d t d {V |t nt |t } \Zt! |
}
t# |
||| z }| d t$ | d {V }fd|D }ne| d t$ |
d {V }fd|D }| d t! | }
|||| z }||rt( nt* | rt( nt* |
|d
S ) Nr z--limit must be >= 0z--offset must be >= 0r3 z is not a hosting userc 0 g | ]}t | S rB )r& )rC r r s r rD z8WordpressWafBulkEndpoints.waf_status.<locals>.<listcomp> s# DDD\#{33DDDr' c R g | ]#}t | t | $S rB )r, r& )rC r r r r( s r rD z8WordpressWafBulkEndpoints.waf_status.<locals>.<listcomp> sE C00 S+.. r' c | d S )Nr rB )r` s r <lambda>z6WordpressWafBulkEndpoints.waf_status.<locals>.<lambda> s
QvY r' )key)security_plugin_enabled
global_wafglobal_waf_default total_countrO )r r\ get_running_loopr
rU rV rW r rS rT r; r0 run_in_executorr _SAFETY_CAPminrZ sortedr sortr# r$ )r> r4 r( r re rf looprm global_waf_enabledro r^ r= page_sizerp pager rO r s `` @r r! z$WordpressWafBulkEndpoints.waf_status s !"899 9 A::!"9:: :'))
! !
#
M$>$@$@$J$J$L$L L L L L L LMM KK !9a99
3{++++%&E&E&EFFF &K 0 0 .
$)=KKc%6M6M >fn
k**K+&&v0B'BCD --,d D EDDDtDDDEE --,k D E
JJ..J / / / e**K&6I#556E (?#5K;K $6K;K&
s AB) )
C 3CC )FN)NNNNr )__name__
__module__ __qualname__r AV_IM360SCOPEr r< boolrU rV rd intr! rB r' r r. r. J s, NE T
eU++ "& ]
]
]
]
Cy4 ]
]
]
]
,+]
~
T
eX.. ! !
L
L
DjL
d
L
d
L
Tz L
L
L
L
L
/.L
L
L
r' r. )'__doc__r\ loggingr defence360agent.contracts.configr defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r defence360agent.subsys.panelsr defence360agent.utilsr defence360agent.utils.configr defence360agent.wordpress.pluginr
r )defence360agent.wordpress.site_repositoryr getLoggerr{ rQ r[ r# r$ rs rU r< rX r r r rV r& r, r. rB r' r <module>r s & &
6 6 6 6 6 6 5 5 5 5 5 5 @ @ @ @ @ @ @ @ 7 7 7 7 7 7 ' ' ' ' ' ' 6 6 6 6 6 6
8 $ $
9 %S4Zs*
+, sC$Jc) * 9=c3h sC$Jc) * $J
$J
p
p
p
p
p
p
p
p
p
p
r' defence360agent/simple_rpc/__pycache__/wp_waf_bulk.cpython-311.pyc 0000644 0000000 0000000 00000025773 00000000000 022133 0 ustar
r_jz d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m
Z
ddl m Z ddl
mZ ddlmZ dd lmZmZ dd
lmZ ej e Zd Zd Zd
ZdZ de e de e e e dz e!e f fdZ"de e e dz e!e f de#e e f de#fdZ$de e e dz e!e f de dz de dz de!fdZ% G d de Z&dS )z Bulk WAF set + status endpoints. N) Wordpress)ValidationError)
RootEndpointsbind)
hosting_panel)Scope)
update_config)waf_global_snapshot#waf_status_and_source_for_user_sync) count_installed_sites_by_uid
enableddisabledi usersreturnc g }| D ]Z} t j | j }n# t $ r d }Y nw xY wt | \ }}| ||||f [|S )N)pwdgetpwnampw_uidKeyErrorr append)r rowsnameuidr sources [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/wp_waf_bulk.py_resolve_accounts_syncr " s D 2 2 ,t$$+CC CCC =dCC T301111 Ks " 11row site_countsc b | \ }}}}||rt nt || |d dS )Nr )r
waf_statusr wp_sites)_STATUS_ENABLED_STATUS_DISABLEDget)r r r r r r s r _status_itemr& 0 sE "% D#w)0Foo6F OOC++ statusr c \ | \ }}}}|rt nt }|||k rdS |||k rdS dS )NFT)r# r$ )r r( r _r srcr! s r _matchesr, < sN
Aq'3$+A 1AJ
jF 2 2u
cVmmu 4r' c e Zd Zej Z eddd ddedede e dz d e
fd
Z eddd dd edz dedz d
edz de dz de d e
f d Z
dS )WordpressWafBulkEndpointszwordpress-pluginwafsetFNr( all_usersr r c X K |r|t d |s|t d ||st d t j st d t d||| t t
j d {V }n%# t $ r}t d| |d }~ww xY wg }g }g }|rt | } nQg } t | D ]4}
|
|v r|
|
|
|
dd 5|d k d
t d t t t d z f f fd t! d
t# | t$ D ]l} fd| | | t$ z D } t' j | d {V }
|
D ]5\ }
}||
|
|
|
|d 6mg d |D d |D d |D }||||dS )Nz/Specify either --all-users or --users, not bothz%Specify either --all-users or --usersz--users must not be emptyzNWordPress Security Plugin is disabled. Enable it before changing WAF settings.z>AUDIT wordpress-plugin.waf.set status=%r all_users=%r users=%r#Could not enumerate hosting users: zNot a hosting user)userreasonr ur c K t j ddii| d {V | d fS # t $ r}| t | fcY d }~S d }~ww xY w)N WORDPRESS waf_enabled)r4 )r _sink Exceptionstr)r6 eself waf_values r _apply_to_userz9WordpressWafBulkEndpoints.waf_set.<locals>._apply_to_user s
!#J =)"<=
$w
!
!
!#a&&y
!s $*
AA
A
Ar c & g | ]
} | S rB ).0r6 r@ s r
<listcomp>z5WordpressWafBulkEndpoints.waf_set.<locals>.<listcomp> s0 &'q!! r' c g | ]}|d dd S ) succeeded r4 r( r5 rB )rC r6 s r rD z5WordpressWafBulkEndpoints.waf_set.<locals>.<listcomp> s2 kR@@ r' c 2 g | ]}|d d|d dS )r4 skippedr5 rH rB )rC ss r rD z5WordpressWafBulkEndpoints.waf_set.<locals>.<listcomp> s: 6i1X;OO r' c 2 g | ]}|d d|d dS )r4 failedr5 rH rB )rC fs r rD z5WordpressWafBulkEndpoints.waf_set.<locals>.<listcomp> s: 6h!H+NN r' )itemsrF rJ rM )r r SECURITY_PLUGIN_ENABLEDloggerwarningr0 r HostingPanel get_usersr; listdictfromkeysr r< tuplerangelen_MAX_CONCURRENTasynciogather)r> r( r1 r panel_usersr= rF rJ rM valid_usersr6 ibatchresultserrrO r@ r? s ` @@r waf_setz!WordpressWafBulkEndpoints.waf_setM sL *!A
KU]!"IJJ J U !"=>> >0 !;
L
M$>$@$@$J$J$L$L L L L L L LMMKK !9a99
" P {++KK K]]5))
P
P ## &&q))))NNA9M#N#NOOOOi' !C !E#sTz/,B ! ! ! ! ! ! ! q#k**O<< > >A +6q1;N7N+O E $NE 2222222G!
>
>3; $$Q''''MM1"<"<====
>
"
"
s 88B1 1
C;CCr r4 r limitoffsetc 8 K ||dk rt d |dk rt d t j }t \ }}} t t
t j d {V }
n%# t $ r} t d| | d } ~ ww xY w|&|t |
vrt | d |g}
| d t d {V |t nt |t } \Zt! |
}
t# |
||| z }| d t$ | d {V }fd|D }ne| d t$ |
d {V }fd|D }| d t! | }
|||| z }||rt( nt* | rt( nt* |
|d
S ) Nr z--limit must be >= 0z--offset must be >= 0r3 z is not a hosting userc 0 g | ]}t | S rB )r& )rC r r s r rD z8WordpressWafBulkEndpoints.waf_status.<locals>.<listcomp> s# DDD\#{33DDDr' c R g | ]#}t | t | $S rB )r, r& )rC r r r r( s r rD z8WordpressWafBulkEndpoints.waf_status.<locals>.<listcomp> sE C00 S+.. r' c | d S )Nr rB )r` s r <lambda>z6WordpressWafBulkEndpoints.waf_status.<locals>.<lambda> s
QvY r' )key)security_plugin_enabled
global_wafglobal_waf_default total_countrO )r r\ get_running_loopr
rU rV rW r rS rT r; r0 run_in_executorr _SAFETY_CAPminrZ sortedr sortr# r$ )r> r4 r( r re rf looprm global_waf_enabledro r^ r= page_sizerp pager rO r s `` @r r! z$WordpressWafBulkEndpoints.waf_status s !"899 9 A::!"9:: :'))
! !
#
M$>$@$@$J$J$L$L L L L L L LMM KK !9a99
3{++++%&E&E&EFFF &K 0 0 .
$)=KKc%6M6M >fn
k**K+&&v0B'BCD --,d D EDDDtDDDEE --,k D E
JJ..J / / / e**K&6I#556E (?#5K;K $6K;K&
s AB) )
C 3CC )FN)NNNNr )__name__
__module__ __qualname__r AV_IM360SCOPEr r< boolrU rV rd intr! rB r' r r. r. J s, NE T
eU++ "& ]
]
]
]
Cy4 ]
]
]
]
,+]
~
T
eX.. ! !
L
L
DjL
d
L
d
L
Tz L
L
L
L
L
/.L
L
L
r' r. )'__doc__r\ loggingr defence360agent.contracts.configr defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r defence360agent.subsys.panelsr defence360agent.utilsr defence360agent.utils.configr defence360agent.wordpress.pluginr
r )defence360agent.wordpress.site_repositoryr getLoggerr{ rQ r[ r# r$ rs rU r< rX r r r rV r& r, r. rB r' r <module>r s & &
6 6 6 6 6 6 5 5 5 5 5 5 @ @ @ @ @ @ @ @ 7 7 7 7 7 7 ' ' ' ' ' ' 6 6 6 6 6 6
8 $ $
9 %S4Zs*
+, sC$Jc) * 9=c3h sC$Jc) * $J
$J
p
p
p
p
p
p
p
p
p
p
r' defence360agent/simple_rpc/advisor.py 0000644 0000000 0000000 00000002771 00000000000 014733 0 ustar from collections import defaultdict
from defence360agent.contracts.config import ConfigFile
from defence360agent.rpc_tools.lookup import RootEndpoints
from defence360agent.utils.config import update_config
from defence360agent.rpc_tools import lookup
from defence360agent.api.server.events import EventsAPI
from defence360agent.feature_management.checkers import config_cleanup
class AdvisorEndpoints(RootEndpoints):
@lookup.bind("advisor", "apply")
async def advisor_apply(self, advices):
return await self._apply(advices)
@lookup.bind("advisor", "apply-all")
async def apply_all(self):
advices = await EventsAPI.advices()
return await self._apply(advices)
async def _apply(self, advices):
target_conf = defaultdict(dict)
current_conf = ConfigFile().config_to_dict()
for advise in advices:
self._extract_conf_from_advise(advise, current_conf, target_conf)
await update_config(self._sink, target_conf)
return {"items": config_cleanup(ConfigFile().config_to_dict())}
@staticmethod
def _extract_conf_from_advise(advise, current_conf, target_conf):
for section_key, section_value in advise["ignore"].items():
for value_key, ignored_values in section_value.items():
if current_conf[section_key][value_key] in ignored_values:
return
for section_key, section_value in advise["config_action"].items():
target_conf[section_key].update(section_value)
defence360agent/simple_rpc/analyst_cleanup.py 0000644 0000000 0000000 00000021706 00000000000 016445 0 ustar import warnings
from logging import getLogger
from datetime import datetime, timedelta
from defence360agent.rpc_tools import ValidationError
from defence360agent.rpc_tools.lookup import RootEndpoints, bind
import defence360agent.subsys.panels.hosting_panel as hp
from defence360agent.utils.sshutil import (
get_ssh_port,
check_ssh_connection,
install_pub_key,
)
from defence360agent.model.analyst_cleanup import AnalystCleanupRequest
from defence360agent.api.server.analyst_cleanup import (
NO_AGENT_TOKEN,
AnalystCleanupAPI,
)
logger = getLogger(__name__)
PREPARE_SERVER_GUIDE = "https://cloudlinux.zendesk.com/hc/en-us/articles/6245743410460-How-to-authenticate-your-server-for-Support-Team-and-use-the-SSH-access-form"
ZENDESK_REGISTRATION_URL = (
"https://cloudlinux.zendesk.com/auth/v2/login/registration"
)
NOT_ALLOWLISTED_MESSAGE = (
"You are not authorized to submit Analyst Cleanup requests."
" Contact sales@cloudlinux.com to get access"
)
_NOT_AUTHENTICATED_MESSAGE = (
"This server could not authenticate with the Imunify360 API."
" Make sure the agent is registered and its license is active."
)
_UNKNOWN_RESPONSE_MESSAGE = (
"Our support system returned an unexpected response."
" Check your email for a ticket confirmation before retrying."
)
_TICKET_ERROR_MESSAGES = {
"not_allowlisted": NOT_ALLOWLISTED_MESSAGE,
"not_authorized": (
"This server is not linked to a CloudLinux customer account."
" Make sure its license is active and try again."
),
NO_AGENT_TOKEN: _NOT_AUTHENTICATED_MESSAGE,
"zendesk_unreachable": (
"Our support system is temporarily unreachable."
" Please try again in a few minutes."
),
"zendesk_upstream_error": (
"Our support system rejected the request."
" Please try again in a few minutes."
),
"zendesk_suspended": (
"Our support system did not accept the request."
" Please contact CloudLinux support directly."
),
"zendesk_unknown_response": _UNKNOWN_RESPONSE_MESSAGE,
}
_TICKET_ERROR_MESSAGES_BY_STATUS = {
200: _UNKNOWN_RESPONSE_MESSAGE,
400: (
"The cleanup request was rejected as invalid."
" Try again with a shorter message."
),
401: _NOT_AUTHENTICATED_MESSAGE,
}
_TICKET_ERROR_DEFAULT = "Failed to create support ticket"
# Conditions the admin can act on themselves; not an agent fault, so they
# must not reach the error reporter.
_CLIENT_STATE_CODES = frozenset(
{"not_allowlisted", "not_authorized", NO_AGENT_TOKEN}
)
def _ticket_error_message(status, body):
return _TICKET_ERROR_MESSAGES.get(
body.get("message"),
_TICKET_ERROR_MESSAGES_BY_STATUS.get(status, _TICKET_ERROR_DEFAULT),
)
def _is_expected_client_state(status, body):
if body.get("message") in _CLIENT_STATE_CODES:
return True
return status is not None and 400 <= status < 500
class AnalystCleanupEndpoints(RootEndpoints):
async def _create_zendesk_ticket(
self,
email,
subject,
full_description,
) -> (str, str):
"""
Creates a Zendesk ticket and return link and id of the ticket
On any error raises ValidationError, which would be added to RPC answer
"""
status, body = await AnalystCleanupAPI.create_ticket(
email,
subject,
full_description,
)
ticket = body.get("ticket") or {}
if status == 200 and ticket.get("url") and ticket.get("id"):
logger.info(f"Created ticket on url {ticket['url']}")
return ticket["url"], str(ticket["id"])
log = (
logger.warning
if _is_expected_client_state(status, body)
else logger.error
)
log("Failed to create support ticket: status=%s body=%s", status, body)
raise ValidationError(_ticket_error_message(status, body))
@bind("analyst-cleanup", "request")
async def request_cleanup(self, email, username, message):
"""Handle analyst cleanup request"""
# Check active tickets
if active_ticket := AnalystCleanupRequest.get_active_request_link(
username
):
raise ValidationError(
"You already have an active request for cleaning this user."
" If you have additional information, you may follow"
f" the link and provide new data here: {active_ticket}"
)
# Check if cleanup is allowed
if not (await AnalystCleanupAPI.check_cleanup_allowed()):
raise ValidationError(NOT_ALLOWLISTED_MESSAGE)
email_status = await AnalystCleanupAPI.check_registered(email)
# Check if email is registered
if not email_status.get("result", False):
raise ValidationError(
f"{email_status.get('message', '')} Couldn't register"
" your email in our Zendesk system. You can make it manually"
f" by following the link {ZENDESK_REGISTRATION_URL} and then"
" try sending the request again."
)
if email_status.get("is_new", False):
warnings.warn(
"We’ve set up a Zendesk account for you! To complete your"
" registration, check your email and click the “Reset"
" Password” button."
)
# Install public key
key_installed = await install_pub_key(username)
# Get SSH port and check connection
ssh_port = await get_ssh_port()
connection_ok = await check_ssh_connection(ssh_port)
# Prepare ticket subject and description
subject = "Analyst Cleanup Request"
server_access = (
f"{hp.HostingPanel().get_server_ip()}:{ssh_port}/{username}"
)
full_description = (
f"Username: {username}\n"
f"Server Access: {server_access}\n\n"
f"Customer Message:\n{message}\n\n"
)
if not key_installed:
warnings.warn("Support SSH public key is not installed", Warning)
full_description += (
"\n\nWARNING: Not able to install analyst's public key\n"
" Please make it manually by reffering to"
f" {PREPARE_SERVER_GUIDE}\n and provide credentials "
"to zendesk ticket"
)
elif not connection_ok:
warnings.warn("SSH connection test failed", Warning)
full_description += (
"\n\nWARNING: SSH connection test failed. Please verify SSH"
" access and refer to the access request form."
)
# Create Zendesk ticket
# In a case of no url|id
# ValidationError is raised from _create_zendesk_ticket
ticket_url, ticket_id = await self._create_zendesk_ticket(
email,
subject,
full_description,
)
# Store request in database
AnalystCleanupRequest.create_request(
username=username,
zendesk_id=ticket_id,
ticket_link=ticket_url,
)
return {"items": {"ticket_url": ticket_url}}
@bind("analyst-cleanup", "get-requests")
async def request_status(self, username=None, limit=50, offset=0):
"""
Get status of analyst cleanup requests for all or a specific user
Completed tickets will only be visible for 2 weeks after their last update
"""
# Get user's requests using the get_user_requests method from the model
# This will return the most recent requests first (ordered by created_at desc)
if username is None:
requests = AnalystCleanupRequest.get_all_requests(limit, offset)
else:
requests = AnalystCleanupRequest.get_user_requests(
username, limit, offset
)
# If no requests found, return appropriate response
if not requests or len(requests) == 0:
return []
# Calculate the cutoff date (2 weeks ago)
two_weeks_ago = datetime.utcnow() - timedelta(weeks=2)
logger.info(f"Showing requests since {two_weeks_ago}")
# Filter requests: show all except completed tickets older than 2 weeks
filtered_requests = [
{
"username": req.username,
"ticket_url": req.ticket_link,
"status": req.status,
"created_at": str(datetime.timestamp(req.created_at)),
"last_update": str(datetime.timestamp(req.last_updated)),
"zendesk_id": req.zendesk_id,
}
for req in requests
if req.status != "completed" or req.last_updated > two_weeks_ago
]
logger.info(f"Got requests: {filtered_requests}")
# Return the request details
return filtered_requests
@bind("analyst-cleanup", "is-allowed")
async def is_allowed(self):
is_allowed = await AnalystCleanupAPI.check_cleanup_allowed()
return {"items": {"is_allowed": is_allowed}}
defence360agent/simple_rpc/endpoints.py 0000644 0000000 0000000 00000035235 00000000000 015270 0 ustar """
Here you enumerate rpc endpoints
"""
import asyncio
import json
import time
from collections import deque
from logging import getLogger
from typing import Dict
from defence360agent import files
from defence360agent.api.jwt_issuer import JWTIssuer
from defence360agent.api.newsfeed import NewsFeed
from defence360agent.api.pam_auth import PamAuth
from defence360agent.contracts import config, eula
from defence360agent.contracts.config import (
ANTIVIRUS_MODE,
Core as CoreConfig,
ImmutableMerger,
LocalConfig,
MutableMerger,
effective_user_config,
int_from_envvar,
)
from defence360agent.contracts.license import LicenseCLN
from defence360agent.internals.cln import CLN, CLNError, InvalidLicenseError
from defence360agent.myimunify.billing import (
collect_billing_incompatibilities,
get_license_type,
)
from defence360agent.rpc_tools import ValidationError
from defence360agent.rpc_tools.lookup import (
CommonEndpoints,
RootEndpoints,
bind,
)
from defence360agent.simple_rpc import caller_uid_var
from defence360agent.subsys.panels.base import PanelException
from defence360agent.utils import (
IMUNIFY_PACKAGE_NAMES,
CheckRunError,
check_db,
getpwnam,
system_packages_info,
)
from defence360agent.utils.config import update_config
from defence360agent.utils.support import ZendeskAPIError, send_request
from defence360agent.utils.whmcs import sync_billing_data
from defence360agent.utils.doctor import get_doctor_key
from defence360agent.subsys.panels import hosting_panel
logger = getLogger(__name__)
class ConfigEndpoints(CommonEndpoints):
@bind("config", "show")
async def config_show(self, user=None):
full_conf = config.ConfigFile()
if user:
user_conf_dict = effective_user_config(
full_conf, config.ConfigFile(user)
)
return {"items": user_conf_dict}
else:
return {"items": full_conf.config_to_dict()}
@bind("config", "show", "defaults")
async def config_show_defaults(self):
layer_paths = MutableMerger.get_layer_names()
return {
"items": {
"mutable_config": MutableMerger(layer_paths).configs_to_dict(),
"local_config": LocalConfig().config_to_dict(normalize=False),
"immutable_config": ImmutableMerger(
layer_paths
).configs_to_dict(),
}
}
@bind("config", "update")
async def config_update(self, items=None, data=None, user=None):
# workaround for https://cloudlinux.atlassian.net/browse/DEF-3902
# TODO: remove items from method parameters
if items:
data = items[0]
new_data = json.loads(data)
logger.warning("AUDIT config.update user=%r data=%r", user, new_data)
await update_config(
self._sink,
new_data,
user,
)
return await self.config_show(user)
@bind("config", "patch")
async def config_update_ui(self, data=None, user=None):
logger.warning("AUDIT config.patch user=%r data=%r", user, data)
await update_config(self._sink, data, user)
return await self.config_show(user)
@bind("config", "patch-many")
async def config_update_many_ui(self, data=None, users=None):
if users is None:
users = []
logger.warning("AUDIT config.patch-many users=%r data=%r", users, data)
for user in users:
await update_config(self._sink, data, user)
return {}
@bind("config", "get-many")
async def config_get_many_ui(self, users=None):
if users is None:
return {}
result = {"items": {}}
full_conf = config.ConfigFile()
for user in users:
user_conf_dict = effective_user_config(
full_conf, config.ConfigFile(user)
)
result["items"][user] = user_conf_dict
return result
# Defence-in-depth behind a UID-scoped socket; persistent state would be disproportionate.
_LOGIN_PAM_MAX = 5
_LOGIN_PAM_WINDOW = 60.0
_LOGIN_PAM_MAX_TRACKED = 10_000
_login_pam_failures: Dict[str, deque] = {}
_LOGIN_PAM_UID_MAX = int_from_envvar("I360_LOGIN_PAM_UID_MAX", 300)
_LOGIN_PAM_UID_WINDOW = 60.0
_LOGIN_PAM_UID_MAX_TRACKED = 10_000
_login_pam_uid_failures: Dict[int, deque] = {}
def _login_pam_allowed(username: str, now: float) -> bool:
history = _login_pam_failures.get(username)
if history is None:
return True
cutoff = now - _LOGIN_PAM_WINDOW
while history and history[0] < cutoff:
history.popleft()
if not history:
del _login_pam_failures[username]
return True
return len(history) < _LOGIN_PAM_MAX
def _login_pam_sweep(now: float) -> None:
cutoff = now - _LOGIN_PAM_WINDOW
stale = [u for u, h in _login_pam_failures.items() if h[-1] < cutoff]
for username in stale:
del _login_pam_failures[username]
def _login_pam_record_failure(username: str, now: float) -> None:
if (
username not in _login_pam_failures
and len(_login_pam_failures) >= _LOGIN_PAM_MAX_TRACKED
):
_login_pam_sweep(now)
if len(_login_pam_failures) >= _LOGIN_PAM_MAX_TRACKED:
del _login_pam_failures[next(iter(_login_pam_failures))]
_login_pam_failures.setdefault(username, deque()).append(now)
def _login_pam_reset(username: str) -> None:
_login_pam_failures.pop(username, None)
def _login_pam_uid_allowed(uid: int, now: float) -> bool:
if _LOGIN_PAM_UID_MAX <= 0:
return True
history = _login_pam_uid_failures.get(uid)
if history is None:
return True
cutoff = now - _LOGIN_PAM_UID_WINDOW
while history and history[0] < cutoff:
history.popleft()
if not history:
del _login_pam_uid_failures[uid]
return True
return len(history) < _LOGIN_PAM_UID_MAX
def _login_pam_uid_sweep(now: float) -> None:
cutoff = now - _LOGIN_PAM_UID_WINDOW
stale = [u for u, h in _login_pam_uid_failures.items() if h[-1] < cutoff]
for uid in stale:
del _login_pam_uid_failures[uid]
def _login_pam_uid_record_failure(uid: int, now: float) -> None:
if _LOGIN_PAM_UID_MAX <= 0:
return
if (
uid not in _login_pam_uid_failures
and len(_login_pam_uid_failures) >= _LOGIN_PAM_UID_MAX_TRACKED
):
_login_pam_uid_sweep(now)
if len(_login_pam_uid_failures) >= _LOGIN_PAM_UID_MAX_TRACKED:
del _login_pam_uid_failures[next(iter(_login_pam_uid_failures))]
_login_pam_uid_failures.setdefault(uid, deque()).append(now)
class LoginEndpoints(CommonEndpoints):
@bind("login", "pam")
async def login_via_pam(self, username, password):
now = time.monotonic()
try:
caller_uid = caller_uid_var.get()
except LookupError:
logger.error("AUDIT login.pam REJECTED: caller_uid_var unset")
raise RuntimeError("login.pam reached without caller_uid_var set")
if caller_uid != 0 and not _login_pam_uid_allowed(caller_uid, now):
logger.warning("AUDIT login.pam RATE_LIMITED uid=%r", caller_uid)
raise ValidationError("Authentication rate limit exceeded")
if not _login_pam_allowed(username, now):
logger.warning(
"AUDIT login.pam RATE_LIMITED username=%r", username
)
raise ValidationError("Authentication rate limit exceeded")
pam_auth = PamAuth()
authenticated = pam_auth.authenticate(username, password)
if not authenticated:
_login_pam_record_failure(username, now)
if caller_uid != 0:
_login_pam_uid_record_failure(caller_uid, now)
logger.warning("AUDIT login.pam FAILED username=%r", username)
raise ValidationError("Authentication failed")
_login_pam_reset(username)
logger.info("AUDIT login.pam SUCCESS username=%r", username)
return {
"items": JWTIssuer().get_token(
username, await pam_auth.get_user_type(username)
)
}
class RootLoginEndpoints(RootEndpoints):
@bind("login", "get")
async def login_get(self, username):
if not getpwnam(username):
raise ValidationError("User name not found")
return {
"items": JWTIssuer().get_token(
username, await PamAuth().get_user_type(username)
)
}
class PackageVersionsEndpoints(CommonEndpoints):
@bind("get-package-versions")
async def get_package_versions(self, user=None):
return {"items": await system_packages_info(IMUNIFY_PACKAGE_NAMES)}
class NewsEndpoints(RootEndpoints):
@bind("get-news")
async def get_news(self):
return {"items": await NewsFeed.get()}
class Endpoints(RootEndpoints):
license_info = LicenseCLN.license_info
@bind("register")
async def register(self, regkey=None):
LicenseCLN.get_token.cache_clear()
if LicenseCLN.is_registered():
if LicenseCLN.is_valid():
if not ANTIVIRUS_MODE:
raise ValidationError("Agent is already registered")
else:
logger.info(
"Unregistering invalid license: %s"
% LicenseCLN.get_token()
)
await self.unregister()
try:
await CLN.register(regkey)
except InvalidLicenseError as e:
raise ValidationError(str(e))
except CLNError as e:
logger.warning(
"Can't register %r as imunify360 key. Trying to "
"register it as a web panel key instead",
regkey,
)
try:
await CLN.register(
await hosting_panel.HostingPanel().retrieve_key()
)
except NotImplementedError:
logger.warning(
"Registration with web panel's key doesn't supported"
)
raise ValidationError(str(e))
except PanelException as panel_e:
raise ValidationError("{}, {}".format(str(e), str(panel_e)))
except (CLNError, InvalidLicenseError) as e:
raise ValidationError(str(e))
return {}
@bind("unregister")
async def unregister(self):
if not LicenseCLN.is_registered():
raise ValidationError("Agent is not registered yet")
if LicenseCLN.is_free():
raise ValidationError("Free license can not be unregistered")
await CLN.unregister()
return {}
@bind("update-license")
async def update_license(self):
if not LicenseCLN.is_registered():
raise ValidationError("Unregistered (server-id is not assigned)")
token = LicenseCLN.get_token()
LicenseCLN.users_count = (
await hosting_panel.HostingPanel().users_count()
)
new_token = await CLN.refresh_token(token)
if new_token is None:
raise ValidationError("License does not exist. Agent unregistered")
return {}
@bind("rstatus")
async def rstatus(self, paid=False):
LicenseCLN.get_token.cache_clear()
if not LicenseCLN.is_valid():
raise ValidationError("License is invalid for current server")
if paid and LicenseCLN.is_free():
raise ValidationError("Free license")
return self.license_info()
@bind("version")
async def version(self):
return {"items": CoreConfig.VERSION}
@bind("wakeup")
async def wakeup(self):
"""Wake up the agent, so it can process the request, if it's sleeping"""
return {}
@bind("update")
async def update_files(
self, subj=None, force=False, list=False, version="latest"
):
if subj and subj in config.FilesUpdate.DISABLED:
if list:
return files.Index(subj).get_list()
if version:
return await files.Index(subj).update_to(version, force)
else:
if list or version != "latest":
raise ValidationError(
"Listing and version are not supported for this files type"
)
try:
await files.update(subj, force)
except (asyncio.TimeoutError, files.UpdateError):
pass # the error has been logged in files.update already
@bind("eula", "accept")
async def eula_accept(self):
await eula.accept()
@bind("eula", "show")
async def eula_show(self):
return eula.text()
@bind("checkdb")
async def checkdb(self, recreate_schema=False):
"""Check DB consistency and repair if needed.
If recreate_schema is set recreate schema for attached DB."""
if recreate_schema:
check_db.recreate_schema()
else:
check_db.check_and_repair()
@bind("doctor")
async def doctor(self):
key = await get_doctor_key()
return (
"Please, provide this key:\n%s\nto Imunify360 Support Team\n" % key
)
@bind("support", "send")
async def send_to_support(
self, email, subject, description, cln=None, attachments=None
):
# Generating doctor and extracting key from output
try:
doctor_key = await get_doctor_key()
except CheckRunError:
doctor_key = None
# Sending request via Zendesk API
# https://developer.zendesk.com/rest_api/docs/core/requests#anonymous-requests
try:
ticket_url = await send_request(
email, subject, description, doctor_key, cln, attachments
)
except ZendeskAPIError as e:
logger.error(
"Got error from Zendesk API. error=%s, description=%s,"
" details=%s",
e.error,
e.description,
e.details,
)
raise
return {"items": [ticket_url]}
class WhmcsEndpoint(RootEndpoints):
"""
Describes all endpoints for interaction with WHMCS
"""
# needed by WHMCS to know whether it is compatible
VERSION = "1"
@bind("billing", "sync")
async def billing_sync(self, data):
try:
decoded_data = json.loads(data)
except json.JSONDecodeError:
raise ValueError("Invalid JSON")
result = await sync_billing_data(self._sink, decoded_data)
return {"result": "success", "data": result}
@bind("billing", "get-config")
async def billing_get_config(self):
result = dict(
version=self.VERSION,
billing_license=get_license_type(),
issues=await collect_billing_incompatibilities(),
)
return {"result": "success", "data": result}
defence360agent/simple_rpc/hooks.py 0000644 0000000 0000000 00000005510 00000000000 014401 0 ustar import json
import logging
from defence360agent.contracts.config import HookEvents
from defence360agent.contracts.hooks import HooksConfig
from defence360agent.contracts.license import LicenseCLN
from defence360agent.model.event_hook import EventHook
from defence360agent.rpc_tools import ValidationError
from defence360agent.rpc_tools.lookup import RootEndpoints, bind
from defence360agent.subsys import notifier
logger = logging.getLogger(__name__)
class HooksEndpoints(RootEndpoints):
def _check_event(self, event, extra=None):
if event not in HookEvents.EVENTS and event != extra:
raise ValidationError(
'"{}" is not valid event for hook'.format(event)
)
@bind("hook", "add")
async def hook_add(self, event, path):
self._check_event(event)
result = EventHook.add_hook(event=event, path=path)
if not result:
raise ValidationError(
'Unable to add hook "{} {}"'.format(event, path)
)
result["status"] = "registered"
return {"items": result}
@bind("hook", "delete")
async def hook_delete(self, event, path):
self._check_event(event)
result = EventHook.delete_hook(event=event, path=path)
if not result:
raise ValidationError(
'Unable to delete hook "{} {}"'.format(event, path)
)
result["status"] = "unregistered"
return {"items": result}
@bind("hook", "list")
async def hook_list(self, event):
self._check_event(event, "all")
result = EventHook.list_events(event)
return {"items": result}
@bind("hook", "add-native")
async def hook_add_native(self, event, path):
self._check_event(event)
result = EventHook.add_hook(event=event, path=path, native=True)
if not result:
raise ValidationError(
'Unable to add native hook "{} {}"'.format(event, path)
)
result["status"] = "registered"
return {"items": result}
@bind("notifications-config", "show")
async def show(self):
return {"items": HooksConfig().get()}
@bind("notifications-config", "update")
async def update(self, items=None, data=None):
if LicenseCLN.is_demo():
raise ValidationError("This action is not allowed in demo version")
if items:
data = items[0]
new_data = json.loads(data)
HooksConfig().update(new_data)
await notifier.config_updated()
return await self.show()
@bind("notifications-config", "patch")
async def update_ui(self, data=None):
if LicenseCLN.is_demo():
raise ValidationError("This action is not allowed in demo version")
HooksConfig().update(data)
await notifier.config_updated()
return await self.show()
defence360agent/simple_rpc/hosting_panel.py 0000644 0000000 0000000 00000002745 00000000000 016117 0 ustar from defence360agent.subsys.panels.base import PanelException
from defence360agent.subsys.panels.directadmin import DirectAdmin
from defence360agent.subsys.panels.hosting_panel import HostingPanel
from defence360agent.rpc_tools import ValidationError
from defence360agent.rpc_tools.lookup import RootEndpoints, bind
class HostingPanelEndpoints(RootEndpoints):
@bind("enable-plugin")
async def enable_plugin(self, plugin_name=None):
return await self.hosting_panel.enable_imunify_plugin(plugin_name)
@bind("disable-plugin")
async def disable_plugin(self, plugin_name=None):
return await self.hosting_panel.disable_imunify_plugin(plugin_name)
@bind("add-sudouser")
async def add_sudouser(self, user):
hp = self.hosting_panel
if not isinstance(hp, DirectAdmin):
raise ValidationError("Feature available only for DirectAdmin")
return await hp.add_sudouser(user)
@bind("delete-sudouser")
async def delete_sudouser(self, user):
hp = self.hosting_panel
if not isinstance(hp, DirectAdmin):
raise ValidationError("Feature available only for DirectAdmin")
return await hp.delete_sudouser(user)
@bind("list-docroots")
async def get_docroots(self):
return {"items": await self.hosting_panel.list_docroots()}
@property
def hosting_panel(self):
try:
return HostingPanel()
except PanelException as e:
raise ValidationError(str(e))
defence360agent/simple_rpc/myimunify.py 0000644 0000000 0000000 00000005315 00000000000 015307 0 ustar import urllib.parse
from typing import List, Optional
import defence360agent.subsys.panels.hosting_panel as hp
from defence360agent.contracts.config import (
MyImunifyConfig,
is_mi_freemium_license,
)
from defence360agent.myimunify.model import (
MyImunify,
set_protection_status_for_all_users,
update_users_protection,
)
from defence360agent.rpc_tools import lookup
from defence360agent.utils import Scope
class MyImunifyEndpoints(lookup.RootEndpoints):
SCOPE = Scope.IM360
@lookup.bind("myimunify", "update")
async def update(self, items: List[str], protection: str):
await update_users_protection(
self._sink, items, protection == "enabled"
)
return {}
@lookup.bind("myimunify", "enable-all")
async def enable_all(self):
await set_protection_status_for_all_users(self._sink, True)
@lookup.bind("myimunify", "disable-all")
async def disable_all(self):
await set_protection_status_for_all_users(self._sink, False)
class MyImunifyCommonEndpoints(lookup.CommonEndpoints):
SCOPE = Scope.IM360
@lookup.bind("myimunify", "status")
async def status(self, items: List[str], user: Optional[str] = None):
purchase_url = MyImunifyConfig.PURCHASE_PAGE_URL
panel_manager = hp.HostingPanel()
if user is not None:
items = [user]
# if MY_IMNUNIFY is disabled, we don't need to generate purchase
# url with domain and ip [because it will not been shown to user]
if MyImunifyConfig.ENABLED:
user_domains = (
await panel_manager.get_domains_per_user()
).get(user, [])
domain = next(iter(user_domains), None)
purchase_url = (
MyImunifyConfig.PURCHASE_PAGE_URL
+ "/?"
+ urllib.parse.urlencode(
{
"m": "cloudlinux_advantage",
"action": "provisioning",
"suite": "my_imunify_account_protection",
"username": user,
"domain": domain,
"server_ip": panel_manager.get_server_ip(),
}
)
)
response = MyImunify.select().where(MyImunify.user.in_(items)).dicts()
return {
"myimunify_enabled": MyImunifyConfig.ENABLED,
"purchase_page_url": purchase_url,
"is_freemium": is_mi_freemium_license(),
"items": [
{"username": item["user"], "protection": item["protection"]}
for item in response
],
}
defence360agent/simple_rpc/permissions.py 0000644 0000000 0000000 00000000475 00000000000 015636 0 ustar from defence360agent.contracts.permissions import permissions_list
from defence360agent.rpc_tools.lookup import CommonEndpoints, bind
class PermissionEndpoints(CommonEndpoints):
@bind("permissions", "list")
async def permissions_list(self, user=None):
return {"items": await permissions_list(user)}
defence360agent/simple_rpc/plesk_stats.py 0000644 0000000 0000000 00000011065 00000000000 015614 0 ustar import datetime
import json
from contextlib import suppress
from defence360agent.contracts.license import LicenseCLN
from defence360agent.rpc_tools.lookup import RootEndpoints, bind
from defence360agent.rpc_tools.utils import run_in_executor_decorator
from defence360agent.subsys.panels.hosting_panel import HostingPanel
from defence360agent.subsys.panels.plesk.api import list_docroots_domains_users
from defence360agent.utils import atomic_rewrite
from defence360agent.subsys.panels.plesk import Plesk
from defence360agent.subsys.features import kernel_care
from defence360agent.utils import importer
MalwareHit = importer.get(
module="imav.malwarelib.model", name="MalwareHit", default=None
)
class PleskStatsEndpoints(RootEndpoints):
MAX_DOMAINS_COUNT = 100
@bind("plesk-stats")
async def plesk_stats(self):
panel = HostingPanel()
assert isinstance(panel, Plesk), "only for plesk"
current_timestamp = int(round(datetime.datetime.now().timestamp()))
last_modified_str = str(
datetime.datetime.fromtimestamp(
current_timestamp,
datetime.timezone.utc,
)
)
domains_stats = await self._domains_stats(
await list_docroots_domains_users(),
)
return {
"items": {
"last_modified": current_timestamp * 1000,
"last_modified_str": last_modified_str,
**domains_stats,
**(await self._get_stats_field_in_plugin_info()),
"license": (1 if LicenseCLN.is_valid() else 0),
}
}
@classmethod
async def _get_stats_field_in_plugin_info(cls):
if not await kernel_care.KernelCare().check_installed():
return {}
plugin_info = await kernel_care.KernelCare().get_plugin_info()
previous = {
"effective_kernel": None,
"first_time_update_available": None,
}
with suppress(FileNotFoundError):
with open(kernel_care.KernelCare.KC_PROPERTIES) as file:
previous = json.load(file)
update_available = plugin_info["updateCode"] == "1"
first_time_update_available = (
datetime.datetime.now(tz=datetime.timezone.utc)
if plugin_info["effectiveKernel"] != previous["effective_kernel"]
else datetime.datetime.fromtimestamp(
previous["first_time_update_available"], datetime.timezone.utc
)
)
outdated_since_days = (
0
if not update_available
else (
datetime.datetime.now(tz=datetime.timezone.utc)
- first_time_update_available
).days
)
atomic_rewrite(
kernel_care.KernelCare.KC_PROPERTIES,
json.dumps(
{
"effective_kernel": plugin_info["effectiveKernel"],
"first_time_update_available": first_time_update_available.timestamp(), # noqa
}
),
backup=False,
)
return {
"kernel_uptodate": plugin_info["autoUpdate"],
"outdated_since_days": outdated_since_days,
}
@run_in_executor_decorator
def _domains_stats(self, plesk_response):
if MalwareHit is None:
return {
"infected_sites": [],
"wsites_infected": 0,
}
file_names = list(
MalwareHit.select(MalwareHit.orig_file)
.where(MalwareHit.is_infected())
.tuples()
)
# usually infected_users << total_users (according to ch)
# so we can compare each hit only with docroots, whose owners are
# marked as infected in imunify database
infected_users = set(
data[0]
for data in list(
MalwareHit.select(MalwareHit.user)
.where(MalwareHit.is_infected())
.distinct()
.tuples()
)
)
infected_plesk_response = list(
filter(
lambda data: data[2] in infected_users,
plesk_response,
)
)
infected_sites = []
for docroot, domain, user in infected_plesk_response:
for (filename,) in file_names:
if filename.startswith(docroot):
infected_sites.append(domain)
break
return {
"infected_sites": infected_sites[: self.MAX_DOMAINS_COUNT],
"wsites_infected": len(infected_sites),
}
defence360agent/simple_rpc/reputation_management.py 0000644 0000000 0000000 00000003711 00000000000 017645 0 ustar import logging
from defence360agent.rpc_tools import lookup
from defence360agent.rpc_tools.validate import (
ValidationError,
validate_av_plus_license,
)
from defence360agent.subsys.panels.base import PanelException
from defence360agent.model.infected_domain import InfectedDomainList
from defence360agent.subsys.panels import hosting_panel
from defence360agent.api.server.reputation import ReputationAPI
from defence360agent.model.simplification import run_in_executor
logger = logging.getLogger(__name__)
class ReputationManagementEndpoints(lookup.RootEndpoints):
@lookup.bind("infected-domains")
@validate_av_plus_license
async def list_domains(self, limit, offset):
existing_users = set(await hosting_panel.HostingPanel().get_users())
items, max_count = InfectedDomainList.get_by_user(
existing_users, offset=offset, limit=limit
)
return {
"items": items,
"max_count": max_count,
}
@lookup.bind("check-domains")
@validate_av_plus_license
async def check_domains(self):
hp = hosting_panel.HostingPanel()
# TODO: strange behaviour is detected
# I think it's normal case for cPanel DNS only
# we should do not process domains if it not found or panel
# not available
if not hp.is_installed():
raise ValidationError("No avaliable control panel found!")
try:
domains = await hp.get_user_domains()
except PanelException as e:
raise ValidationError(str(e))
if not domains:
raise ValidationError("Domains not found")
reputation_data = await ReputationAPI.check(domains)
domain_to_user = (
await hosting_panel.HostingPanel().get_domain_to_owner()
)
await run_in_executor(
None,
lambda: InfectedDomainList.refresh_domains(
reputation_data, domain_to_user
),
)
defence360agent/simple_rpc/schema/ 0000755 0000000 0000000 00000000000 00000000000 014143 5 ustar defence360agent/simple_rpc/schema.py 0000644 0000000 0000000 00000017765 00000000000 014535 0 ustar from cerberus.errors import BaseErrorHandler, BasicErrorHandler
from cerberus.schema import DefinitionSchema, UnvalidatedSchema
from defence360agent.contracts.config import UserType
from defence360agent.rpc_tools.middleware import (
add_eula,
add_license,
add_license_user,
add_version,
collect_warnings,
counts,
default_to_items,
max_count,
preserve_remote_addr,
resolve_caller_panel_login,
send_command_invoke_message,
set_caller_type_context,
)
from defence360agent.rpc_tools.utils import prepare_schema
class ErrorHandler(BaseErrorHandler):
messages = BasicErrorHandler.messages.copy()
def collect_errors(self, error):
if error.child_errors:
for err in error.child_errors:
yield from self.collect_errors(err)
else:
# avoid abstract error: required field
yield "field: '{}', value: '{}', error: {}".format(
error.field,
error.value,
self.messages.get(error.code, "").format(
*error.info,
constraint=error.constraint,
field=error.field,
value=error.value
),
)
def __call__(self, errors):
string_representation = []
for error in errors:
for info in self.collect_errors(error):
string_representation.append(info)
return string_representation
def init_validator(schema_validator, validate_middleware, schema_paths):
# Cerberus meta-validates any plain mapping handed to it as a schema, and
# then re-hashes it on every normalized() call. Ours ships with the
# package, so that is ~0.26s per process plus ~76ms per validated request
# spent re-deriving one constant answer; unit tests check the schema
# instead. expand() must stay - child validators get sub-schemas as-is.
_validator = schema_validator(
UnvalidatedSchema(
DefinitionSchema.expand(prepare_schema(schema_paths))
),
error_handler=ErrorHandler,
)
# NOTE: it is processed in the reversed order, see _apply_middleware
_middleware = {
None: [
# First entry = outermost wrapper, so the caller type is set
# before validate_middleware runs the coerce functions.
(set_caller_type_context, (UserType.ROOT, UserType.NON_ROOT)),
# before send_command_invoke_message so CommandInvoke reports
# the resolved login
(resolve_caller_panel_login, (UserType.NON_ROOT,)),
(send_command_invoke_message, (UserType.ROOT, UserType.NON_ROOT)),
# validation before processing the data
(
validate_middleware(_validator),
(UserType.ROOT, UserType.NON_ROOT),
),
# inject license for root
(add_license, (UserType.ROOT,)),
# inject license for regular user
(add_license_user, (UserType.NON_ROOT,)),
# inject eula
(add_eula, (UserType.ROOT,)),
# inject version
(add_version, (UserType.ROOT, UserType.NON_ROOT)),
# add warnings if any
(collect_warnings, (UserType.ROOT, UserType.NON_ROOT)),
# for backward compatibility
(default_to_items, (UserType.ROOT, UserType.NON_ROOT)),
],
("whitelist", "ip", "list"): [
(counts, (UserType.ROOT, UserType.NON_ROOT))
],
("blacklist", "ip", "list"): [
(max_count, (UserType.ROOT, UserType.NON_ROOT))
],
("graylist", "ip", "list"): [
(counts, (UserType.ROOT, UserType.NON_ROOT))
],
("whitelist", "ip", "add"): [
(preserve_remote_addr, (UserType.ROOT, UserType.NON_ROOT))
],
("blacklist", "ip", "add"): [
(preserve_remote_addr, (UserType.ROOT, UserType.NON_ROOT))
],
("whitelist", "country", "list"): [
(max_count, (UserType.ROOT, UserType.NON_ROOT))
],
("blacklist", "country", "list"): [
(max_count, (UserType.ROOT, UserType.NON_ROOT))
],
("graylist", "country", "list"): [
(max_count, (UserType.ROOT, UserType.NON_ROOT))
],
("blacklist",): [(counts, (UserType.ROOT, UserType.NON_ROOT))],
("whitelist",): [(counts, (UserType.ROOT, UserType.NON_ROOT))],
("whitelisted-crawlers", "list"): [
(max_count, (UserType.ROOT, UserType.NON_ROOT))
],
("blocked-port", "list"): [
(counts, (UserType.ROOT, UserType.NON_ROOT))
],
("blocked-port-ip", "list"): [
(max_count, (UserType.ROOT, UserType.NON_ROOT))
],
("rules", "list-disabled"): [
(max_count, (UserType.ROOT, UserType.NON_ROOT))
],
("wordpress-plugin", "rules", "list-disabled"): [
(max_count, (UserType.ROOT, UserType.NON_ROOT))
],
("wordpress-plugin", "list-sites"): [
(max_count, (UserType.ROOT, UserType.NON_ROOT))
],
("proactive", "ignore", "list"): [
(max_count, (UserType.ROOT, UserType.NON_ROOT))
],
("feature-management", "show"): [
(max_count, (UserType.ROOT, UserType.NON_ROOT))
],
("ip-list", "synced"): [(counts, (UserType.ROOT, UserType.NON_ROOT))],
("ip-list", "local", "list"): [
(counts, (UserType.ROOT, UserType.NON_ROOT))
],
("ip-list", "local", "add"): [
(preserve_remote_addr, (UserType.ROOT, UserType.NON_ROOT))
],
("ip-list", "local", "delete"): [
(preserve_remote_addr, (UserType.ROOT, UserType.NON_ROOT))
],
}
_middleware_exclude = {
("enable-plugin",): [add_eula],
("disable-plugin",): [add_eula],
("switch-max-webserver",): [add_eula],
("install-vendors",): [add_eula],
("uninstall-vendors",): [add_eula],
("add-sudouser",): [add_eula],
("delete-sudouser",): [add_eula],
("doctor",): [add_eula],
("captcha", "update-localizations"): [add_eula],
("captcha", "compile-localizations"): [add_eula],
("update",): [add_eula],
("kcarectl", "disable-auto-update"): [add_eula],
("kcarectl", "enable-auto-update"): [add_eula],
("kcarectl", "plugin-info"): [add_eula],
("register",): [add_eula],
("unregister",): [add_eula],
("rstatus",): [add_eula],
("update-license",): [add_eula],
("3rdparty", "list"): [add_eula],
("admin-emails",): [add_eula],
("list-docroots",): [add_eula],
("features", "list"): [add_eula],
("features", "status"): [add_eula],
("features", "install"): [add_eula],
("features", "remove"): [add_eula],
("feature-management", "native", "enable"): [add_eula],
("feature-management", "native", "disable"): [add_eula],
("feature-management", "native", "status"): [add_eula],
("import", "wblist"): [add_eula],
("rules", "update-app-specific-rules"): [add_eula],
("support", "send"): [add_eula],
("3rdparty", "conflicts"): [add_eula],
("smtp-blocking", "reset"): [add_eula],
("smtp-blocking", "sync"): [add_eula],
("malware", "on-demand", "check-detached"): [add_eula],
("checkdb",): [add_eula],
("restore-configs",): [add_eula],
("patchman", "users"): [add_eula],
("patchman", "register"): [add_eula],
("patchman", "install"): [add_eula],
("patchman", "migrate"): [add_eula],
("patchman", "uninstall"): [add_eula],
("patchman", "status"): [add_eula],
("patchman", "install", "realtime"): [add_eula],
("patchman", "uninstall", "realtime"): [add_eula],
("analyst-cleanup", "request"): [add_eula],
("analyst-cleanup", "get-requests"): [add_eula],
("analyst-cleanup", "is-allowed"): [add_eula],
}
return _validator, _middleware, _middleware_exclude
defence360agent/simple_rpc/schema/advisor.pickle 0000644 0000000 0000000 00000000232 00000000000 017000 0 ustar }(advisor apply-all}(help
(internal)cli}users]rootasu
advisor apply}(help
(internal)cli}users]rootasuu. defence360agent/simple_rpc/schema/advisor.yaml 0000644 0000000 0000000 00000000207 00000000000 016475 0 ustar advisor apply-all:
help: (internal)
cli:
users:
- root
advisor apply:
help: (internal)
cli:
users:
- root
defence360agent/simple_rpc/schema/analyst-cleanup.pickle 0000644 0000000 0000000 00000002000 00000000000 020424 0 ustar }(analyst-cleanup request}(help6Send request to malware remediation team of imunify360 return_type AnalystCleanupRequestResponsetypedictcli}(users]roota require_rpcanyuschema}(email}(typestringregex[^@]+@[^@]+\.[^@]+$requireduusername}(typestringrequiredemptyumessage}(typestringrequiredemptyuuu analyst-cleanup get-requests}(helpTGet analyst-cleanup requests for provided username or all if username isn't provided return_type!AnalystCleanupGetRequestsResponsetypedictcli}(users]roota require_rpcanyuschema}(username}(typestringrequiredemptyulimit}(typeintegercoerceintdefaultK2uoffset}(typeintegercoerceintdefaultK uuuanalyst-cleanup is-allowed}(help@Send request imunify360 API and shows is analyst-cleanup allowed return_type AnalystCleanupAllowedResponsecli}(users]roota require_rpcanyuuu.defence360agent/simple_rpc/schema/analyst-cleanup.yaml 0000644 0000000 0000000 00000002113 00000000000 020124 0 ustar analyst-cleanup request:
help: "Send request to malware remediation team of imunify360"
return_type: AnalystCleanupRequestResponse
type: dict
cli:
users:
- root
require_rpc: any
schema:
email:
type: string
regex: '[^@]+@[^@]+\.[^@]+$'
required: true
username:
type: string
required: true
empty: false
message:
type: string
required: true
empty: false
analyst-cleanup get-requests:
help: "Get analyst-cleanup requests for provided username or all if username isn't provided"
return_type: AnalystCleanupGetRequestsResponse
type: dict
cli:
users:
- root
require_rpc: any
schema:
username:
type: string
required: false
empty: true
limit:
type: integer
coerce: int
default: 50
offset:
type: integer
coerce: int
default: 0
analyst-cleanup is-allowed:
help: "Send request imunify360 API and shows is analyst-cleanup allowed"
return_type: AnalystCleanupAllowedResponse
cli:
users:
- root
require_rpc: any
defence360agent/simple_rpc/schema/auth-cloud.pickle 0000644 0000000 0000000 00000000361 00000000000 017401 0 ustar }(
auth-cloud}( return_typeTokenAgentResponsehelp Get independent agent ID tokencli}users]rootasuauth-cloud-refresh-token}(help&Refresh the independent agent ID tokencli}users]rootasuu. defence360agent/simple_rpc/schema/auth-cloud.yaml 0000644 0000000 0000000 00000000335 00000000000 017075 0 ustar auth-cloud:
return_type: TokenAgentResponse
help: Get independent agent ID token
cli:
users:
- root
auth-cloud-refresh-token:
help: Refresh the independent agent ID token
cli:
users:
- root
defence360agent/simple_rpc/schema/billing.pickle 0000644 0000000 0000000 00000001112 00000000000 016747 0 ustar ? }( billing sync}( return_typeWhmcsUpdateResponsecli_onlyhelp1(internal) For communication with whmcs updates.
cli}users]rootastypedictschema}data}(typestringnullable
positionalhelpConfig options to update, as a JSON-encoded string.
Note: it doesn't have to be a full config, only the options that need to be updated.
Example: `{"MY_IMUNIFY": {"protection": "disabled"}}`
usubilling get-config}(cli_onlyhelp1(internal) For communication with whmcs updates.
cli}users]rootastypedictuu. defence360agent/simple_rpc/schema/billing.yaml 0000644 0000000 0000000 00000001167 00000000000 016454 0 ustar billing sync:
return_type: WhmcsUpdateResponse
cli_only: true
help: |
(internal) For communication with whmcs updates.
cli:
users:
- root
type: dict
schema:
data:
type: string
nullable: false
positional: true
help: |
Config options to update, as a JSON-encoded string.
Note: it doesn't have to be a full config, only the options that need to be updated.
Example: `{"MY_IMUNIFY": {"protection": "disabled"}}`
billing get-config:
cli_only: true
help: |
(internal) For communication with whmcs updates.
cli:
users:
- root
type: dict
defence360agent/simple_rpc/schema/checkdb.pickle 0000644 0000000 0000000 00000000275 00000000000 016723 0 ustar }checkdb}(help
(internal)cli}(users]roota require_rpcstoppedutypedictschema}recreate_schema}(typebooleandefaultrequiredusus. defence360agent/simple_rpc/schema/checkdb.yaml 0000644 0000000 0000000 00000000277 00000000000 016420 0 ustar checkdb:
help: (internal)
cli:
users:
- root
require_rpc: stopped
type: dict
schema:
recreate_schema:
type: boolean
default: false
required: false
defence360agent/simple_rpc/schema/config.pickle 0000644 0000000 0000000 00000006411 00000000000 016603 0 ustar }(
config update}( return_typeConfigAgentResponsehelpk(internal) Update Imunify configuration (`/etc/sysconfig/imunify360/imunify360.config.d/90-local.config`).
cli}users]rootastypedictschema}(items}(typelistschema}typestringshelp
(internal)udata}(typestringnullable
positionalhelpConfig options to update, as a JSON-encoded string.
Note: it doesn't have to be a full config, only the options that need to be updated.
Example: `{"MALWARE_SCAN": {"enabled": true}}`
uuser}(typestringnullablehelpAdmins can specify a user to update the config for.
If not specified, and executed by admin, the config will be updated for root.
If not specified, and executed by user, the config will be updated for that user.
uuu config patch}( return_typeConfigAgentResponsehelp`Update Imunify configuration (`/etc/sysconfig/imunify360/imunify360.config.d/90-local.config`).
cli}users]rootastypedictschema}(data}(typedictnullablehelpConfig options to update.
Note: it doesn't have to be a full config, only the options that need to be updated.
Example: `{"MALWARE_SCAN": {"enabled": true}}`
uuser}(typestringnullablehelpAdmins can specify a user to update the config for.
If not specified, and executed by admin, the config will be updated for root.
If not specified, and executed by user, the config will be updated for that user.
uuuconfig patch-many}(help1Update Imunify configuration for multiple users.
cli}users]rootastypedictschema}(data}(typedictnullablehelpConfig options to update.
Note: it doesn't have to be a full config, only the options that need to be updated.
Example: `{"MALWARE_SCAN": {"enabled": true}}`
uusers}(typelistschema}typestringsnullablehelpNList of users to update the config for.
Example: `["user1", "user2", "root"]`
uuuconfig get-many}( return_typeConfigAgentResponsehelp.Get Imunify configuration for multiple users.
cli}users]rootastypedictschema}users}(typelistschema}typestringsnullablehelpIList of users to get the config for.
Example: `"user1", "user2", "root"`
usu config show}( return_typeConfigAgentResponsehelpGet Imunify configuration.
This is the result of merging all config files in `/etc/sysconfig/imunify360/imunify360.config.d/` directory.
cli}users]rootastypedictschema}user}(typestringnullablehelpAdmins can specify whose config to get.
If not specified, and executed by admin, returns the root config.
If not specified, and executed by user, returns the config of that user.
usuconfig show defaults}(helpX Get details on how the config is merged:
- `mutable_config` - all files in `/etc/sysconfig/imunify360/imunify360.config.d/` directory before `90-local.config`. They can be overridden via API.
- `local_config` - `/etc/sysconfig/imunify360/imunify360.config.d/90-local.config`, controlled by API.
- `immutable_config` - all files in `/etc/sysconfig/imunify360/imunify360.config.d/` directory after `90-local.config`. They cannot be overridden via API.
cli}users]rootastypedictuu. defence360agent/simple_rpc/schema/config.yaml 0000644 0000000 0000000 00000007444 00000000000 016305 0 ustar config update:
return_type: ConfigAgentResponse
help: |
(internal) Update Imunify configuration (`/etc/sysconfig/imunify360/imunify360.config.d/90-local.config`).
# FIXME: cli section required for UI tests
cli:
users:
- root
type: dict
schema:
# workaround for https://cloudlinux.atlassian.net/browse/DEF-3902
# TODO: remove items, make data not nullable
items:
type: list
schema:
type: string
help: (internal)
data:
type: string
nullable: true
positional: true
help: |
Config options to update, as a JSON-encoded string.
Note: it doesn't have to be a full config, only the options that need to be updated.
Example: `{"MALWARE_SCAN": {"enabled": true}}`
user:
type: string
nullable: true
help: |
Admins can specify a user to update the config for.
If not specified, and executed by admin, the config will be updated for root.
If not specified, and executed by user, the config will be updated for that user.
config patch:
return_type: ConfigAgentResponse
help: |
Update Imunify configuration (`/etc/sysconfig/imunify360/imunify360.config.d/90-local.config`).
# FIXME: cli section required for UI tests
cli:
users:
- root
type: dict
schema:
data:
type: dict
nullable: true
help: |
Config options to update.
Note: it doesn't have to be a full config, only the options that need to be updated.
Example: `{"MALWARE_SCAN": {"enabled": true}}`
user:
type: string
nullable: true
help: |
Admins can specify a user to update the config for.
If not specified, and executed by admin, the config will be updated for root.
If not specified, and executed by user, the config will be updated for that user.
config patch-many:
help: |
Update Imunify configuration for multiple users.
cli:
users:
- root
type: dict
schema:
data:
type: dict
nullable: true
help: |
Config options to update.
Note: it doesn't have to be a full config, only the options that need to be updated.
Example: `{"MALWARE_SCAN": {"enabled": true}}`
users:
type: list
schema:
type: string
nullable: false
help: |
List of users to update the config for.
Example: `["user1", "user2", "root"]`
config get-many:
return_type: ConfigAgentResponse
help: |
Get Imunify configuration for multiple users.
cli:
users:
- root
type: dict
schema:
users:
type: list
schema:
type: string
nullable: false
help: |
List of users to get the config for.
Example: `"user1", "user2", "root"`
config show:
return_type: ConfigAgentResponse
help: |
Get Imunify configuration.
This is the result of merging all config files in `/etc/sysconfig/imunify360/imunify360.config.d/` directory.
cli:
users:
- root
type: dict
schema:
user:
type: string
nullable: true
help: |
Admins can specify whose config to get.
If not specified, and executed by admin, returns the root config.
If not specified, and executed by user, returns the config of that user.
config show defaults:
help: |
Get details on how the config is merged:
- `mutable_config` - all files in `/etc/sysconfig/imunify360/imunify360.config.d/` directory before `90-local.config`. They can be overridden via API.
- `local_config` - `/etc/sysconfig/imunify360/imunify360.config.d/90-local.config`, controlled by API.
- `immutable_config` - all files in `/etc/sysconfig/imunify360/imunify360.config.d/` directory after `90-local.config`. They cannot be overridden via API.
cli:
users:
- root
type: dict
defence360agent/simple_rpc/schema/conflicts.pickle 0000644 0000000 0000000 00000000205 00000000000 017315 0 ustar z }3rdparty conflicts}(cli}(users]roota require_rpcanyuhelp#Shows conflicts with other softwareus. defence360agent/simple_rpc/schema/conflicts.yaml 0000644 0000000 0000000 00000000166 00000000000 017016 0 ustar 3rdparty conflicts:
cli:
users:
- root
require_rpc: any
help: "Shows conflicts with other software"
defence360agent/simple_rpc/schema/doctor.pickle 0000644 0000000 0000000 00000000143 00000000000 016624 0 ustar X }doctor}(help
(internal)cli}(users]roota require_rpcdirectuus. defence360agent/simple_rpc/schema/doctor.yaml 0000644 0000000 0000000 00000000122 00000000000 016314 0 ustar doctor:
help: (internal)
cli:
users:
- root
require_rpc: direct
defence360agent/simple_rpc/schema/eula.pickle 0000644 0000000 0000000 00000000261 00000000000 016261 0 ustar }( eula accept}(help Accept EULA return_typeNullAgentResponsecli}users]rootasu eula show}(helpGet EULAcli}users]rootasuu. defence360agent/simple_rpc/schema/eula.yaml 0000644 0000000 0000000 00000000235 00000000000 015755 0 ustar eula accept:
help: Accept EULA
return_type: NullAgentResponse
cli:
users:
- root
eula show:
help: Get EULA
cli:
users:
- root
defence360agent/simple_rpc/schema/files.pickle 0000644 0000000 0000000 00000000444 00000000000 016440 0 ustar }update}(help
(internal)cli}(users]roota require_rpcanyutypedictschema}(subj}(typestring
positionaluforce}(typebooleandefaultulist}(typebooleandefaultuversion}(typestringdefaultlatestuuus. defence360agent/simple_rpc/schema/files.yaml 0000644 0000000 0000000 00000000467 00000000000 016140 0 ustar update:
help: (internal)
cli:
users:
- root
require_rpc: any
type: dict
schema:
subj:
type: string
positional: true
force:
type: boolean
default: false
list:
type: boolean
default: false
version:
type: string
default: latest
defence360agent/simple_rpc/schema/get-news.pickle 0000644 0000000 0000000 00000000200 00000000000 017055 0 ustar u }get-news}(help
(internal)cli}users]rootastypedict return_typeGetNewsAgentResponseus. defence360agent/simple_rpc/schema/get-news.yaml 0000644 0000000 0000000 00000000155 00000000000 016561 0 ustar get-news:
help: (internal)
cli:
users:
- root
type: dict
return_type: GetNewsAgentResponse
defence360agent/simple_rpc/schema/google-safe-engine.pickle 0000644 0000000 0000000 00000000666 00000000000 020777 0 ustar }(infected-domains}(typedict return_typeReputationAgentResponsecli}users]rootashelp Returns infected domain listschema}(limit}(typeintegerdefaultK2coerceinthelpoffset for paginationuoffset}(typeintegerdefaultK coerceinthelplimit for paginationuuu
check-domains}(typedictcli}users]rootashelpSend domain list checkuu. defence360agent/simple_rpc/schema/google-safe-engine.yaml 0000644 0000000 0000000 00000000667 00000000000 020473 0 ustar infected-domains:
type: dict
return_type: ReputationAgentResponse
cli:
users:
- root
help: Returns infected domain list
schema:
limit:
type: integer
default: 50
coerce: int
help: offset for pagination
offset:
type: integer
default: 0
coerce: int
help: limit for pagination
check-domains:
type: dict
cli:
users:
- root
help: Send domain list check defence360agent/simple_rpc/schema/hook.pickle 0000644 0000000 0000000 00000001103 00000000000 016267 0 ustar 8 }( hook list}(typedictcli}users]rootasschema}event}(typestringrequiredusuhook add}(typedictcli}users]rootasschema}(event}(typestringrequiredupath}(typestringrequireduuu hook delete}(typedictcli}users]rootasschema}(event}(typestringrequiredupath}(typestringrequireduuuhook add-native}(typedictcli}users]rootasschema}(event}(typestringrequiredupath}(typestringrequireduuuu. defence360agent/simple_rpc/schema/hook.yaml 0000644 0000000 0000000 00000001157 00000000000 015773 0 ustar hook list:
type: dict
cli:
users:
- root
schema:
event:
type: string
required: true
hook add:
type: dict
cli:
users:
- root
schema:
event:
type: string
required: true
path:
type: string
required: true
hook delete:
type: dict
cli:
users:
- root
schema:
event:
type: string
required: true
path:
type: string
required: true
hook add-native:
type: dict
cli:
users:
- root
schema:
event:
type: string
required: true
path:
type: string
required: true defence360agent/simple_rpc/schema/hooks.pickle 0000644 0000000 0000000 00000001462 00000000000 016462 0 ustar ' }(notifications-config update}( return_typeConfigAgentResponsehelpS(internal) https://docs.imunify360.com/command_line_interface/#notifications-configcli}users]rootastypedictschema}(items}(typelistschema}typestringsudata}(typestringnullable
positionaluuunotifications-config patch}( return_type NotificationConfigAgentResponsehelpS(internal) https://docs.imunify360.com/command_line_interface/#notifications-configcli}users]rootastypedictschema}data}(typedictnullableusunotifications-config show}( return_type NotificationConfigAgentResponsehelpS(internal) https://docs.imunify360.com/command_line_interface/#notifications-configcli}users]rootastypedictuu. defence360agent/simple_rpc/schema/hooks.yaml 0000644 0000000 0000000 00000001474 00000000000 016160 0 ustar notifications-config update:
return_type: ConfigAgentResponse
help: (internal) https://docs.imunify360.com/command_line_interface/#notifications-config
cli:
users:
- root
type: dict
schema:
items:
type: list
schema:
type: string
data:
type: string
nullable: true
positional: true
notifications-config patch:
return_type: NotificationConfigAgentResponse
help: (internal) https://docs.imunify360.com/command_line_interface/#notifications-config
cli:
users:
- root
type: dict
schema:
data:
type: dict
nullable: false
notifications-config show:
return_type: NotificationConfigAgentResponse
help: (internal) https://docs.imunify360.com/command_line_interface/#notifications-config
cli:
users:
- root
type: dict
defence360agent/simple_rpc/schema/hosting-panel.pickle 0000644 0000000 0000000 00000001514 00000000000 020105 0 ustar A }(
enable-plugin}(help4(internal) Enable hosting panel plugin (if detected)typedictcli}(users]roota require_rpcdirectuschema} plugin_name}(typestringnullableusudisable-plugin}(help'(internal) Disable hosting panel plugintypedictcli}(users]roota require_rpcdirectuschema} plugin_name}(typestringnullableusu add-sudouser}(help
(internal)typedictcli}(users]roota require_rpcdirectuschema}user}(typestringrequiredusudelete-sudouser}(help
(internal)typedictcli}(users]roota require_rpcdirectuschema}user}(typestringrequiredusu
list-docroots}(help'(internal) Get docroots for all domainscli}(users]roota require_rpcanyuuu. defence360agent/simple_rpc/schema/hosting-panel.yaml 0000644 0000000 0000000 00000001577 00000000000 017611 0 ustar enable-plugin:
help: (internal) Enable hosting panel plugin (if detected)
type: dict
cli:
users:
- root
require_rpc: direct
schema:
plugin_name:
type: string
nullable: true
disable-plugin:
help: (internal) Disable hosting panel plugin
type: dict
cli:
users:
- root
require_rpc: direct
schema:
plugin_name:
type: string
nullable: true
# Need only for DA
add-sudouser:
help: (internal)
type: dict
cli:
users:
- root
require_rpc: direct
schema:
user:
type: string
required: true
# Need only for DA
delete-sudouser:
help: (internal)
type: dict
cli:
users:
- root
require_rpc: direct
schema:
user:
type: string
required: true
list-docroots:
help: (internal) Get docroots for all domains
cli:
users:
- root
require_rpc: any
defence360agent/simple_rpc/schema/login.pickle 0000644 0000000 0000000 00000001042 00000000000 016441 0 ustar }( login pam}(helpaUses PAM to check the provided credential and returns a token for USERNAME if PASSWORD is correctcli}users]rootasschema}(username}(typestringrequiredemptyupassword}(typestringrequiredemptyenvvarPASSWORDuu return_typeTokenAgentResponseu login get}(help8Returns a token for USERNAME (must be executed by admin)cli}users]rootasschema}username}(typestringrequiredemptyus return_typeTokenAgentResponseuu. defence360agent/simple_rpc/schema/login.yaml 0000644 0000000 0000000 00000001114 00000000000 016134 0 ustar login pam:
help: Uses PAM to check the provided credential and returns a token for USERNAME if PASSWORD is correct
cli:
users:
- root
schema:
username:
type: string
required: true
empty: false
password:
type: string
required: true
empty: false
envvar: 'PASSWORD'
return_type: TokenAgentResponse
login get:
help: Returns a token for USERNAME (must be executed by admin)
cli:
users:
- root
schema:
username:
type: string
required: true
empty: false
return_type: TokenAgentResponse
defence360agent/simple_rpc/schema/package-versions.pickle 0000644 0000000 0000000 00000000211 00000000000 020567 0 ustar ~ }get-package-versions}( return_type GetPackageVersionsAgentResponsehelp
(internal)cli}users]rootasus. defence360agent/simple_rpc/schema/package-versions.yaml 0000644 0000000 0000000 00000000167 00000000000 020274 0 ustar get-package-versions:
return_type: GetPackageVersionsAgentResponse
help: (internal)
cli:
users:
- root
defence360agent/simple_rpc/schema/permissions.pickle 0000644 0000000 0000000 00000000226 00000000000 017707 0 ustar }permissions list}(help
(internal)typedictcli}users]rootasschema}user}(typestringrequiredusus. defence360agent/simple_rpc/schema/permissions.yaml 0000644 0000000 0000000 00000000216 00000000000 017401 0 ustar permissions list:
help: (internal)
type: dict
cli:
users:
- root
schema:
user:
type: string
required: false
defence360agent/simple_rpc/schema/plesk-stats.pickle 0000644 0000000 0000000 00000000157 00000000000 017611 0 ustar d } plesk-stats}(cli}users]rootashelp)Return stats, required by plesk extensionus. defence360agent/simple_rpc/schema/plesk-stats.yaml 0000644 0000000 0000000 00000000140 00000000000 017274 0 ustar plesk-stats:
cli:
users:
- root
help: "Return stats, required by plesk extension"
defence360agent/simple_rpc/schema/registration.pickle 0000644 0000000 0000000 00000001240 00000000000 020043 0 ustar }(rstatus}(cli}(users]roota require_rpcanyuhelpGet registration statusschema}paid}(typebooleandefaultusuregister}( return_typeNoItemsAndEulaAgentResponsecli}(users]roota require_rpcanyutypedicthelpRegister the agentschema}regkey}(envvarREG_KEYtypestringdefaultIPLisascii
positionalhelp8Registration key or 'IPL' word (if you registered by IP)usu
unregister}(cli}(users]roota require_rpcanyuhelpUnregister the agentuupdate-license}(cli}(users]roota require_rpcanyuhelpForce update licenseuu. defence360agent/simple_rpc/schema/registration.yaml 0000644 0000000 0000000 00000001274 00000000000 017545 0 ustar rstatus:
cli:
users:
- root
require_rpc: any
help: "Get registration status"
schema:
paid:
type: boolean
default: false
register:
return_type: NoItemsAndEulaAgentResponse
cli:
users:
- root
require_rpc: any
type: dict
help: "Register the agent"
schema:
regkey:
envvar: "REG_KEY"
type: string
default: "IPL"
isascii: true
positional: true
help: "Registration key or 'IPL' word (if you registered by IP)"
unregister:
cli:
users:
- root
require_rpc: any
help: "Unregister the agent"
update-license:
cli:
users:
- root
require_rpc: any
help: "Force update license"
defence360agent/simple_rpc/schema/support.pickle 0000644 0000000 0000000 00000000677 00000000000 017062 0 ustar } support send}(help"Contact support team of imunify360typedictcli}(users]roota require_rpcanyuschema}(email}(typestringregex[^@]+@[^@]+\.[^@]+$requiredusubject}(typestringrequiredemptyu description}(typestringrequiredemptyucln}typestrings attachments}(typelistschema}(typestringdefault]is_absolute_pathuuuus. defence360agent/simple_rpc/schema/support.yaml 0000644 0000000 0000000 00000001003 00000000000 016535 0 ustar support send:
help: "Contact support team of imunify360"
type: dict
cli:
users:
- root
require_rpc: any
schema:
email:
type: string
regex: '[^@]+@[^@]+\.[^@]+$'
required: true
subject:
type: string
required: true
empty: false
description:
type: string
required: true
empty: false
cln:
type: string
attachments:
type: list
schema:
type: string
default: []
is_absolute_path: True defence360agent/simple_rpc/schema/version.pickle 0000644 0000000 0000000 00000000243 00000000000 017020 0 ustar }(version}(helpGet Imunify Agent versioncli}users]rootasuwakeup}(helpWake up Imunify Agentcli}users]rootasuu. defence360agent/simple_rpc/schema/version.yaml 0000644 0000000 0000000 00000000220 00000000000 016506 0 ustar version:
help: Get Imunify Agent version
cli:
users:
- root
wakeup:
help: Wake up Imunify Agent
cli:
users:
- root
defence360agent/simple_rpc/schema/wordpress.pickle 0000644 0000000 0000000 00000005472 00000000000 017374 0 ustar / }(%wordpress-plugin install-on-new-sites}(helpEInstall Imunify Security plugin for WordPress on new WordPress sites.cli}users]rootasuwordpress-plugin tidy-up}(help`Tidy-up on WordPress sites where the Imunify Security plugin for WordPress was manually removed.cli}users]rootasuwordpress-plugin update}(helpxUpdates Imunify Security plugin for WordPress to the latest version on all WordPress sites where it's already installed.cli}users]rootasu#wordpress-plugin install-and-update}(helpInstall Imunify Security plugin for WordPress on new sites, tidy-up manually deleted plugins, and update existing installations. This combines install-on-new-sites, tidy-up, and update in a single atomic operation.cli}users]rootasu wordpress-plugin list-incidents}(helpList WordPress incidentstypedict return_type#WordpressIncidentsListAgentResponsecli}users]rootasschema}(user}(typestringnullableu site_search}(typestringnullablehelpFilter by site path
u by_abuser_ip}(typestringnullablehelp Filter by abuser IP address
uby_country_code}(typestringnullablehelpFilter by country code
u by_domain}(typestringnullablehelpFilter by domain
usearch}(typestringnullablehelp(Search by IP address, name, description
usince}(typeintegercoerceintnullable
check_with] timestampahelp5Show incidents after this unix timestamp (inclusive)
uto}(typeintegercoerceintnullable
check_with] timestampahelp6Show incidents before this unix timestamp (inclusive)
uinclude_hidden}(typebooleandefaulthelpxInclude incidents whose rule has the internal TEST- prefix
(hidden from the WordPress plugin admin UI). Default: false.
uorder_by}(typelistnullableschema}(typeorder_bycoerceorder_byuhelpList of fields to order by, each followed by a `+` (ascending) or `-` (descending).
Supported fields: timestamp, severity, domain, abuser.
E.g. `["timestamp-","severity-"]` would order by timestamp descending and severity descending.
ulimit}(typeintegercoerceintdefaultK2uoffset}(typeintegercoerceintdefaultK uuuwordpress-plugin list-sites}(help<List WordPress sites with Imunify Security plugin installed.cli}users]rootastypedict return_typeWordpressDomainsResponseschema}(user}(typestringnullablehelpRAdmins can filter results by user.
Users can only see the sites relevant to them.
ulimit}(typeintegerdefaultK2coerceinthelp"Maximum number of items to return.uoffset}(typeintegerdefaultK coerceinthelpNumber of items to skip.uuuu. defence360agent/simple_rpc/schema/wordpress.yaml 0000644 0000000 0000000 00000006207 00000000000 017064 0 ustar wordpress-plugin install-on-new-sites :
help: Install Imunify Security plugin for WordPress on new WordPress sites.
cli:
users:
- root
wordpress-plugin tidy-up :
help: Tidy-up on WordPress sites where the Imunify Security plugin for WordPress was manually removed.
cli:
users:
- root
wordpress-plugin update :
help: Updates Imunify Security plugin for WordPress to the latest version on all WordPress sites where it's already installed.
cli:
users:
- root
wordpress-plugin install-and-update :
help: Install Imunify Security plugin for WordPress on new sites, tidy-up manually deleted plugins, and update existing installations. This combines install-on-new-sites, tidy-up, and update in a single atomic operation.
cli:
users:
- root
wordpress-plugin list-incidents:
help: "List WordPress incidents"
type: dict
return_type: WordpressIncidentsListAgentResponse
cli:
users:
- root
schema:
user:
type: string
nullable: true
site_search:
type: string
nullable: true
help: |
Filter by site path
by_abuser_ip:
type: string
nullable: true
help: |
Filter by abuser IP address
by_country_code:
type: string
nullable: true
help: |
Filter by country code
by_domain:
type: string
nullable: true
help: |
Filter by domain
search:
type: string
nullable: true
help: |
Search by IP address, name, description
since:
type: integer
coerce: int
nullable: true
check_with:
- timestamp
help: |
Show incidents after this unix timestamp (inclusive)
to:
type: integer
coerce: int
nullable: true
check_with:
- timestamp
help: |
Show incidents before this unix timestamp (inclusive)
include_hidden:
type: boolean
default: false
help: |
Include incidents whose rule has the internal TEST- prefix
(hidden from the WordPress plugin admin UI). Default: false.
order_by:
type: list
nullable: true
schema:
type: order_by
coerce: order_by
help: |
List of fields to order by, each followed by a `+` (ascending) or `-` (descending).
Supported fields: timestamp, severity, domain, abuser.
E.g. `["timestamp-","severity-"]` would order by timestamp descending and severity descending.
limit:
type: integer
coerce: int
default: 50
offset:
type: integer
coerce: int
default: 0
wordpress-plugin list-sites:
help: List WordPress sites with Imunify Security plugin installed.
cli:
users:
- root
type: dict
return_type: WordpressDomainsResponse
schema:
user:
type: string
nullable: true
help: |
Admins can filter results by user.
Users can only see the sites relevant to them.
limit:
type: integer
default: 50
coerce: int
help: Maximum number of items to return.
offset:
type: integer
default: 0
coerce: int
help: Number of items to skip.
defence360agent/simple_rpc/schema/wp-disabled-rules.pickle 0000644 0000000 0000000 00000002777 00000000000 020674 0 ustar }($wordpress-plugin rules list-disabled}(help7List disabled WordPress protection rules with metadata.typedictcli}users]rootasschema}(limit}(typeintegercoerceintdefaultK2help"Maximum number of rules to return.uoffset}(typeintegercoerceintdefaultK helpNumber of rules to skip.udomains}(typelistnullableschema}typestringshelpFilter by specific domains.uuser}(typestringnullablehelpHFilter rules visible to this user (shows only rules for user's domains).uuu wordpress-plugin rules disable}(helpEDisable a WordPress protection rule globally or for specific domains.typedictcli}users]rootasschema}(rule}(typestringrequiredhelp,The rule ID to disable (e.g., CVE-2025-001).udomains}(typelistnullableschema}typestringshelpGList of domains to disable the rule for. If omitted, disables globally.uuser}(typestringnullablehelp
(internal)uuu wordpress-plugin rules enable}(helpGRe-enable a WordPress protection rule globally or for specific domains.typedictcli}users]rootasschema}(rule}(typestringrequiredhelp+The rule ID to enable (e.g., CVE-2025-001).udomains}(typelistnullableschema}typestringshelpEList of domains to enable the rule for. If omitted, enables globally.uuser}(typestringnullablehelp
(internal)uuuu. defence360agent/simple_rpc/schema/wp-disabled-rules.yaml 0000644 0000000 0000000 00000003177 00000000000 020362 0 ustar wordpress-plugin rules list-disabled:
help: List disabled WordPress protection rules with metadata.
type: dict
cli:
users:
- root
schema:
limit:
type: integer
coerce: int
default: 50
help: Maximum number of rules to return.
offset:
type: integer
coerce: int
default: 0
help: Number of rules to skip.
domains:
type: list
nullable: true
schema:
type: string
help: Filter by specific domains.
user:
type: string
nullable: true
help: Filter rules visible to this user (shows only rules for user's domains).
wordpress-plugin rules disable:
help: Disable a WordPress protection rule globally or for specific domains.
type: dict
cli:
users:
- root
schema:
rule:
type: string
required: true
help: The rule ID to disable (e.g., CVE-2025-001).
domains:
type: list
nullable: true
schema:
type: string
help: List of domains to disable the rule for. If omitted, disables globally.
user:
type: string
nullable: true
help: (internal)
wordpress-plugin rules enable:
help: Re-enable a WordPress protection rule globally or for specific domains.
type: dict
cli:
users:
- root
schema:
rule:
type: string
required: true
help: The rule ID to enable (e.g., CVE-2025-001).
domains:
type: list
nullable: true
schema:
type: string
help: List of domains to enable the rule for. If omitted, enables globally.
user:
type: string
nullable: true
help: (internal)
defence360agent/simple_rpc/schema/wp-waf.pickle 0000644 0000000 0000000 00000003124 00000000000 016535 0 ustar I }(wordpress-plugin waf set}(helpBulk enable or disable WAF for hosting users.
Examples:
imunify360-agent wordpress-plugin waf set --status enabled --all-users
imunify360-agent wordpress-plugin waf set --status disabled --users alice bob carol
typedictcli}users]rootasschema}(status}(typestringrequiredallowed](enableddisabledehelp(Target WAF state for the selected users.u all_users}(typebooleandefaulthelp*Apply to every hosting user on the server.uusers}(typelistnullableschema}typestringshelpPApply to a space-separated list of hosting users (e.g. --users alice bob carol).uuuwordpress-plugin waf status}(helpX Report effective WAF status and its source for every hosting account.
Examples:
imunify360-agent wordpress-plugin waf status
imunify360-agent wordpress-plugin waf status --status disabled --json
imunify360-agent wordpress-plugin waf status --user alice
typedictcli}users]rootasschema}(user}(typestringnullablehelp Show only this hosting account.ustatus}(typestringnullableallowed](enableddisabledehelp Filter by effective WAF status.usource}(typestringnullableallowed](defaultoverrideehelp:Filter by status source (default or per-account override).ulimit}(typeintegercoerceintnullablehelp5Maximum number of accounts to return (capped at 500).uoffset}(typeintegercoerceintdefaultK helpNumber of accounts to skip.uuuu. defence360agent/simple_rpc/schema/wp-waf.yaml 0000644 0000000 0000000 00000003320 00000000000 016226 0 ustar wordpress-plugin waf set:
help: |
Bulk enable or disable WAF for hosting users.
Examples:
imunify360-agent wordpress-plugin waf set --status enabled --all-users
imunify360-agent wordpress-plugin waf set --status disabled --users alice bob carol
type: dict
cli:
users:
- root
schema:
status:
type: string
required: true
allowed: [enabled, disabled]
help: Target WAF state for the selected users.
all_users:
type: boolean
default: false
help: Apply to every hosting user on the server.
users:
type: list
nullable: true
schema: {type: string}
help: Apply to a space-separated list of hosting users (e.g. --users alice bob carol).
wordpress-plugin waf status:
help: |
Report effective WAF status and its source for every hosting account.
Examples:
imunify360-agent wordpress-plugin waf status
imunify360-agent wordpress-plugin waf status --status disabled --json
imunify360-agent wordpress-plugin waf status --user alice
type: dict
cli:
users:
- root
schema:
user:
type: string
nullable: true
help: Show only this hosting account.
status:
type: string
nullable: true
allowed: [enabled, disabled]
help: Filter by effective WAF status.
source:
type: string
nullable: true
allowed: [default, override]
help: Filter by status source (default or per-account override).
limit:
type: integer
coerce: int
nullable: true
help: Maximum number of accounts to return (capped at 500).
offset:
type: integer
coerce: int
default: 0
help: Number of accounts to skip.
defence360agent/simple_rpc/schema_responses/ 0000755 0000000 0000000 00000000000 00000000000 016244 5 ustar defence360agent/simple_rpc/schema_responses/AnalystCleanupAllowedResponse.json 0000644 0000000 0000000 00000007104 00000000000 025113 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<IAnalystCleanupAllowedResult>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"AgentResponseData<IAnalystCleanupAllowedResult>":{"type":"object","properties":{"items":{"$ref":"#/definitions/IAnalystCleanupAllowedResult"},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"IAnalystCleanupAllowedResult":{"type":"object","properties":{"is_allowed":{"type":"boolean"}},"additionalProperties":false,"required":["is_allowed"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/AnalystCleanupGetRequestsResponse.json 0000644 0000000 0000000 00000007704 00000000000 026005 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/ListResponseData<IAnalystCleanupGetRequestsItem>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"ListResponseData<IAnalystCleanupGetRequestsItem>":{"type":"object","properties":{"max_count":{"type":"number"},"items":{"type":"array","items":{"$ref":"#/definitions/IAnalystCleanupGetRequestsItem"}},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"IAnalystCleanupGetRequestsItem":{"type":"object","properties":{"username":{"type":"string"},"ticket_url":{"type":"string"},"status":{"$ref":"#/definitions/AnalystCleanupStatus"},"created_at":{"type":"string"},"last_update":{"type":"string"},"zendesk_id":{"type":"string"}},"additionalProperties":false,"required":["created_at","last_update","status","ticket_url","username","zendesk_id"]},"AnalystCleanupStatus":{"enum":["completed","in_progress","pending"],"type":"string"},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/AnalystCleanupRequestResponse.json 0000644 0000000 0000000 00000007103 00000000000 025153 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<IAnalystCleanupRequestResult>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"AgentResponseData<IAnalystCleanupRequestResult>":{"type":"object","properties":{"items":{"$ref":"#/definitions/IAnalystCleanupRequestResult"},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"IAnalystCleanupRequestResult":{"type":"object","properties":{"ticket_url":{"type":"string"}},"additionalProperties":false,"required":["ticket_url"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/ConfigAgentResponse.json 0000644 0000000 0000000 00000005355 00000000000 023052 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<I360ConfigDataItems>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"definitions":{"AgentResponseData<I360ConfigDataItems>":{"type":"object","properties":{"items":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{}}},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"allOf":[{"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}}},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}}},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}}},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}}},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}}}}},"expiration":{"type":["null","number"]},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}}},{"type":"object","properties":{"expiration":{}}}]},{"allOf":[{"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]}}},{"type":"object","properties":{"expiration":{}}}]},{"allOf":[{"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]}}},{"type":"object","properties":{"expiration":{}}}]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}}},{"type":"null"}]}}},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/FeaturesManagementDefaultsAgentResponse.json 0000644 0000000 0000000 00000007047 00000000000 027110 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<FeaturesStatus>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"AgentResponseData<FeaturesStatus>":{"type":"object","properties":{"items":{"$ref":"#/definitions/FeaturesStatus"},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"FeaturesStatus":{"type":"object","properties":{"proactive":{"type":"boolean"},"av":{"type":"boolean"}},"additionalProperties":false,"required":["av","proactive"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/FeaturesManagementEditAgentResponse.json 0000644 0000000 0000000 00000016066 00000000000 026227 0 ustar {"anyOf":[{"$ref":"#/definitions/FeaturesManagementEditDefaultsAgentResponse"},{"$ref":"#/definitions/FeaturesManagementEditUsersAgentResponse"}],"definitions":{"FeaturesManagementEditDefaultsAgentResponse":{"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<\"succeed\">"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"]},"AgentResponseData<\"succeed\">":{"type":"object","properties":{"items":{"type":"string","enum":["succeed"]},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"Result":{"enum":["error","success","warnings"],"type":"string"},"FeaturesManagementEditUsersAgentResponse":{"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<{succeeded:string[];failed:string[];}>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"]},"AgentResponseData<{succeeded:string[];failed:string[];}>":{"type":"object","properties":{"items":{"type":"object","properties":{"succeeded":{"type":"array","items":{"type":"string"}},"failed":{"type":"array","items":{"type":"string"}}},"additionalProperties":false,"required":["failed","succeeded"]},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/FeaturesManagementGetAgentResponse.json 0000644 0000000 0000000 00000007233 00000000000 026055 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<ClientFeatures>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"AgentResponseData<ClientFeatures>":{"type":"object","properties":{"items":{"$ref":"#/definitions/ClientFeatures"},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"ClientFeatures":{"type":"object","properties":{"proactive":{"$ref":"#/definitions/ProactiveFeature"},"av":{"enum":["full","na","report"],"type":"string"}},"additionalProperties":false,"required":["av","proactive"]},"ProactiveFeature":{"enum":["full","log","na"],"type":"string"},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/FeaturesManagementListAgentResponse.json 0000644 0000000 0000000 00000006662 00000000000 026256 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<(keyofFeaturesStatus)[]>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"AgentResponseData<(keyofFeaturesStatus)[]>":{"type":"object","properties":{"items":{"type":"array","items":{"enum":["av","proactive"],"type":"string"}},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/FeaturesManagementNativeStatusAgentResponse.json 0000644 0000000 0000000 00000007161 00000000000 027770 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<NativeFeaturesManagementStatus>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"AgentResponseData<NativeFeaturesManagementStatus>":{"type":"object","properties":{"items":{"$ref":"#/definitions/NativeFeaturesManagementStatus"},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"NativeFeaturesManagementStatus":{"type":"object","properties":{"supported":{"type":"boolean"},"enabled":{"type":"boolean"}},"additionalProperties":false,"required":["enabled","supported"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/FeaturesManagementShowAgentResponse.json 0000644 0000000 0000000 00000007625 00000000000 026263 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/ListResponseData<FeaturesManagementResponseItem>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"ListResponseData<FeaturesManagementResponseItem>":{"type":"object","properties":{"max_count":{"type":"number"},"items":{"type":"array","items":{"$ref":"#/definitions/FeaturesManagementResponseItem"}},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"FeaturesManagementResponseItem":{"type":"object","properties":{"name":{"type":"string"},"domains":{"type":"array","items":{"type":"string"}},"features":{"$ref":"#/definitions/FeaturesStatus"}},"additionalProperties":false,"required":["domains","features","name"]},"FeaturesStatus":{"type":"object","properties":{"proactive":{"type":"boolean"},"av":{"type":"boolean"}},"additionalProperties":false,"required":["av","proactive"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/GetNewsAgentResponse.json 0000644 0000000 0000000 00000007154 00000000000 023220 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<NewsItem[]>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"AgentResponseData<NewsItem[]>":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/definitions/NewsItem"}},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"NewsItem":{"type":"object","properties":{"title":{"type":"string"},"pubDate":{"type":"string"},"guid":{"type":"string"},"link":{"type":"string"}},"additionalProperties":false,"required":["guid","link","pubDate","title"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/GetPackageVersionsAgentResponse.json 0000644 0000000 0000000 00000007426 00000000000 025372 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<PackageVersions|null>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"AgentResponseData<PackageVersions|null>":{"type":"object","properties":{"items":{"anyOf":[{"$ref":"#/definitions/PackageVersions"},{"type":"null"}]},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"PackageVersions":{"type":"object","additionalProperties":{"type":["null","string"]},"properties":{"imunify-ui":{"type":["null","string"]},"imunify-antivirus":{"type":["null","string"]},"imunify360-firewall":{"type":["null","string"]},"imunify-core":{"type":["null","string"]}},"required":["imunify-antivirus","imunify-core","imunify-ui","imunify360-firewall"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/NoItemsAndEulaAgentResponse.json 0000644 0000000 0000000 00000006505 00000000000 024453 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/ResponseDataExceptItemsAndEula"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"ResponseDataExceptItemsAndEula":{"type":"object","properties":{"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["license","version"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/NotificationConfigAgentResponse.json 0000644 0000000 0000000 00000016416 00000000000 025421 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<NotificationConfigType>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"AgentResponseData<NotificationConfigType>":{"type":"object","properties":{"items":{"type":"object","properties":{"admin":{"type":"object","additionalProperties":{},"properties":{"default_emails":{"type":"array","items":{"type":"string"}},"notify_from_email":{"type":["null","string"]},"locale":{"type":"string"}},"required":["default_emails","notify_from_email"]},"rules":{"type":"object","properties":{"REALTIME_MALWARE_FOUND":{"additionalProperties":false,"type":"object","properties":{"ADMIN":{"type":"object","properties":{"admin_emails":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["admin_emails","enabled"]},"SCRIPT":{"type":"object","properties":{"scripts":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["enabled","scripts"]}},"required":["SCRIPT"]},"USER_SCAN_STARTED":{"type":"object","properties":{"SCRIPT":{"type":"object","properties":{"scripts":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["enabled","scripts"]}},"additionalProperties":false,"required":["SCRIPT"]},"CUSTOM_SCAN_STARTED":{"type":"object","properties":{"SCRIPT":{"type":"object","properties":{"scripts":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["enabled","scripts"]}},"additionalProperties":false,"required":["SCRIPT"]},"USER_SCAN_FINISHED":{"type":"object","properties":{"SCRIPT":{"type":"object","properties":{"scripts":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["enabled","scripts"]}},"additionalProperties":false,"required":["SCRIPT"]},"CUSTOM_SCAN_FINISHED":{"type":"object","properties":{"SCRIPT":{"type":"object","properties":{"scripts":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["enabled","scripts"]}},"additionalProperties":false,"required":["SCRIPT"]},"CUSTOM_SCAN_MALWARE_FOUND":{"additionalProperties":false,"type":"object","properties":{"ADMIN":{"type":"object","properties":{"admin_emails":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["admin_emails","enabled"]},"SCRIPT":{"type":"object","properties":{"scripts":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["enabled","scripts"]}},"required":["SCRIPT"]},"USER_SCAN_MALWARE_FOUND":{"additionalProperties":false,"type":"object","properties":{"ADMIN":{"type":"object","properties":{"admin_emails":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["admin_emails","enabled"]},"SCRIPT":{"type":"object","properties":{"scripts":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["enabled","scripts"]}},"required":["SCRIPT"]},"SCRIPT_BLOCKED":{"additionalProperties":false,"type":"object","properties":{"ADMIN":{"type":"object","properties":{"admin_emails":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["admin_emails","enabled"]},"SCRIPT":{"type":"object","properties":{"scripts":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"period":{"type":"number"}},"additionalProperties":false,"required":["enabled","scripts"]}},"required":["SCRIPT"]}},"additionalProperties":false,"required":["CUSTOM_SCAN_FINISHED","CUSTOM_SCAN_MALWARE_FOUND","CUSTOM_SCAN_STARTED","USER_SCAN_FINISHED","USER_SCAN_MALWARE_FOUND","USER_SCAN_STARTED"]}},"additionalProperties":false,"required":["rules"]},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/NullAgentResponse.json 0000644 0000000 0000000 00000006527 00000000000 022561 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<null>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"AgentResponseData<null>":{"type":"object","properties":{"items":{"type":"null"},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/README.md 0000644 0000000 0000000 00000000404 00000000000 017521 0 ustar # Agent responses validation
## The schemas are stored here
Source files are stored in `defence360/src/asyncclient/ui/spa/api`
To generate schemas:
```
cd defence360/src/asyncclient/ui/spa/api
npm i # one time
npm start # on each api/*.ts files change
```
defence360agent/simple_rpc/schema_responses/ReputationAgentResponse.json 0000644 0000000 0000000 00000007777 00000000000 024011 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/ListResponseData<ReputationBackendItem>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"ListResponseData<ReputationBackendItem>":{"type":"object","properties":{"max_count":{"type":"number"},"items":{"type":"array","items":{"$ref":"#/definitions/ReputationBackendItem"}},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"ReputationBackendItem":{"type":"object","properties":{"username":{"type":"string"},"domain":{"type":"string"},"threats":{"type":"array","items":{"type":"object","properties":{"type":{"type":["null","string"]},"vendor":{"$ref":"#/definitions/Vendor"},"timestamp":{"type":"number"}},"additionalProperties":false,"required":["timestamp","type","vendor"]}}},"additionalProperties":false,"required":["domain","threats","username"]},"Vendor":{"enum":["google-safe-browsing","mitchellkrogza","openphish","phishtank","spamhaus","yandex-safe-browsing"],"type":"string"},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/TokenAgentResponse.json 0000644 0000000 0000000 00000006535 00000000000 022726 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/AgentResponseData<string>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"AgentResponseData<string>":{"type":"object","properties":{"items":{"type":"string"},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/WhmcsUpdateResponse.json 0000644 0000000 0000000 00000002525 00000000000 023106 0 ustar {
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"result": {
"type": "string"
},
"messages": {},
"data": {
"type": "object",
"properties": {
"result": {
"type": "string"
},
"data": {
"type": "object",
"properties": {
"status": {
"type": "string"
},
"purchase_page_url": {
"type": "string",
"format": "uri"
},
"protection": {
"type": "array",
"items": {
"type": "object",
"properties": {
"user": {
"type": "string"
},
"protection": {
"type": "string"
}
},
"required": ["user", "protection"]
}
}
},
"required": ["status", "purchase_page_url", "protection"],
"additionalProperties": true
},
"strategy": {},
"warnings": {},
"version": {},
"eula": {},
"license": {}
},
"required": ["result", "data"],
"additionalProperties": true
}
},
"required": ["result", "data"],
"additionalProperties": true
} defence360agent/simple_rpc/schema_responses/WordpressDomainsResponse.json 0000644 0000000 0000000 00000007110 00000000000 024160 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/ListResponseData<IUserDomain>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"ListResponseData<IUserDomain>":{"type":"object","properties":{"max_count":{"type":"number"},"items":{"type":"array","items":{"$ref":"#/definitions/IUserDomain"}},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"IUserDomain":{"type":"object","properties":{"domain":{"type":"string"},"docroot":{"type":"string"}},"additionalProperties":false,"required":["domain"]},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/schema_responses/WordpressIncidentsListAgentResponse.json 0000644 0000000 0000000 00000012262 00000000000 026325 0 ustar {"type":"object","properties":{"data":{"$ref":"#/definitions/ListResponseData<IWordpressIncident>"},"result":{"$ref":"#/definitions/Result"},"messages":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]},"status":{"enum":["downgrading","failed_to_install","installing","not_installed","running","socket_inaccessible","stopped","upgrading"],"type":"string"}},"additionalProperties":false,"required":["data","messages","result"],"definitions":{"ListResponseData<IWordpressIncident>":{"type":"object","properties":{"max_count":{"type":"number"},"items":{"type":"array","items":{"$ref":"#/definitions/IWordpressIncident"}},"version":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"strategy":{"type":"string"},"license":{"anyOf":[{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"message":{"type":["null","string"]},"redirect_url":{"type":["null","string"]},"status":{"type":"boolean"},"user_count":{"type":["null","number"]},"user_limit":{"type":"number"},"ip_license":{"type":"boolean"},"pricing":{"type":"object","properties":{"im_av":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_1":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_30":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_250":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]},"im_360_unlimited":{"type":"object","properties":{"standard":{"type":"string"},"bulk":{"type":"string"}},"additionalProperties":false,"required":["standard"]}},"additionalProperties":false},"expiration":{},"demo":{"type":["null","boolean"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]}},"required":["eligible_for_imunify_patch","id","license_type","message","status","upgrade_url","upgrade_url_360","user_count","user_limit"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean","enum":[false]},"redirect_url":{"type":"null"},"upgrade_url_360":{"type":["null","string"]},"upgrade_url":{"type":["null","string"]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","redirect_url","status","upgrade_url","upgrade_url_360"]},{"additionalProperties":false,"type":"object","properties":{"status":{"type":"boolean"},"license_type":{"anyOf":[{"enum":["imunify360","imunify360Trial","imunifyAV","imunifyAVPlus"],"type":"string"},{"type":"null"}]},"eligible_for_imunify_patch":{"type":["null","boolean"]},"expiration":{}},"required":["eligible_for_imunify_patch","license_type","status"]}]},"eula":{"anyOf":[{"type":"object","properties":{"message":{"type":"string"},"text":{"type":"string"},"updated":{"type":"string"}},"additionalProperties":false,"required":["message","text","updated"]},{"type":"null"}]}},"additionalProperties":false,"required":["items","license","version"]},"IWordpressIncident":{"type":"object","properties":{"abuser":{"type":["null","string"]},"country":{"anyOf":[{"$ref":"#/definitions/Partial<ICountry>"},{"type":"null"}]},"description":{"type":"string"},"id":{"type":"number"},"name":{"type":"string"},"times":{"type":"number"},"rule":{"type":"string"},"is_rule_disabled":{"type":"boolean"},"severity":{"type":["null","number"]},"timestamp":{"type":"number"},"plugin":{"$ref":"#/definitions/RulePlugin"},"domain":{"type":["null","string"]},"extra_info":{"$ref":"#/definitions/IWordpressExtraInfo"}},"additionalProperties":false,"required":["abuser","country","description","domain","id","name","plugin","rule","severity","timestamp"]},"Partial<ICountry>":{"type":"object","properties":{"code":{"type":"string"},"name":{"type":"string"},"id":{"type":"string"}},"additionalProperties":false},"RulePlugin":{"enum":["cl_dos","control_panel_protector","cphulk","enhanced_dos","lfd","modsec","ossec","unknown","wordpress"],"type":"string"},"IWordpressExtraInfo":{"type":"object","properties":{"cve":{"type":"string"},"mode":{"type":"string"},"target":{"type":"string"},"slug":{"type":"string"},"version":{"type":"string"},"user_logged_in":{"type":["null","string","boolean"]},"username":{"type":"string"},"user_id":{"type":["null","string","number"]},"site_path":{"type":"string"},"request_method":{"type":"string"},"script_filename":{"type":"string"},"php_self":{"type":"string"},"path_info":{"type":"string"},"request_uri":{"type":"string"},"query_string":{"type":"string"},"http_x_forwarded_for":{"type":"string"},"http_user_agent":{"type":"string"},"http_referer":{"type":"string"},"files":{"type":"string"},"get_names":{"type":"string"},"post_names":{"type":"string"},"raw_data":{"type":"string"}},"additionalProperties":false},"Result":{"enum":["error","success","warnings"],"type":"string"}},"$schema":"http://json-schema.org/draft-07/schema#"} defence360agent/simple_rpc/wordpress_security_plugin.py 0000644 0000000 0000000 00000016003 00000000000 020612 0 ustar import logging
import os
import pwd
from defence360agent.rpc_tools import ValidationError
from defence360agent.rpc_tools.lookup import (
CommonEndpoints,
RootEndpoints,
bind,
)
from defence360agent.utils import Scope, is_root_user
from defence360agent.contracts.messages import MessageType
from defence360agent.model.wordpress_incident import get_wordpress_incidents
from defence360agent.model.wp_disabled_rule import (
enrich_incidents_with_disabled_state,
)
from defence360agent.wordpress.site_repository import (
get_installed_sites_paginated,
)
from defence360agent.wordpress.utils import get_domain_paths
logger = logging.getLogger(__name__)
def get_user_id_and_site_for_query(
user: str | None = None, site_search: str | None = None
) -> tuple[int | None, str | None]:
"""
Determine the user_id and site_path for filtering WordPress incidents.
Three calling contexts:
1. Root user: Can query all incidents or filter by specific user
2. Non-root user: Can only query their own incidents (user/site_search ignored)
3. Proxy service: Both user and site_search must be set, restricted to that site
Args:
user: Username to filter by
site_search: Site path to filter by
Returns:
Tuple of (user_id, site_path) to filter by, or (None, None) for all
Raises:
KeyError: If the specified user doesn't exist
ValueError: If proxy service call is missing required parameters
"""
current_uid = os.getuid()
if is_root_user():
# Root user can see all incidents or filter by user
logger.debug("Root user querying incidents, user filter: %s", user)
user_id = None # Root can see all incidents by default
if user is not None:
# Root user specified a username to filter by
try:
user_id = pwd.getpwnam(user).pw_uid
logger.debug(
"Filtering incidents for user %s (uid=%d)", user, user_id
)
except KeyError:
logger.warning("User not found: %s", user)
raise KeyError(f"User '{user}' not found")
return user_id, site_search
return current_uid, site_search
class WordpressEndpoints(RootEndpoints):
SCOPE = Scope.AV_IM360
@bind("wordpress-plugin", "install-on-new-sites")
async def wordpress_plugin_install(self):
await self._sink.process_message(
MessageType.WordpressPluginAction(action="install_on_new_sites")
)
@bind("wordpress-plugin", "tidy-up")
async def wordpress_plugin_tidy_up(self):
await self._sink.process_message(
MessageType.WordpressPluginAction(action="tidy_up")
)
@bind("wordpress-plugin", "update")
async def wordpress_plugin_update(self):
await self._sink.process_message(
MessageType.WordpressPluginAction(action="update_existing")
)
@bind("wordpress-plugin", "install-and-update")
async def wordpress_plugin_install_and_update(self):
await self._sink.process_message(
MessageType.WordpressPluginAction(action="install_and_update")
)
class WordpressCommonEndpoints(CommonEndpoints):
SCOPE = Scope.AV_IM360
@bind("wordpress-plugin", "list-incidents")
async def wordpress_plugin_list_incidents(
self,
user: str | None = None,
site_search: str | None = None,
limit: int = 50,
offset: int = 0,
by_abuser_ip: str | None = None,
by_country_code: str | None = None,
by_domain: str | None = None,
search: str | None = None,
since: int | None = None,
to: int | None = None,
order_by: list | None = None,
include_hidden: bool = False,
) -> list[dict]:
"""
List WordPress security incidents.
Three calling contexts:
1. Root user: Can query all incidents or filter by specific user
2. Non-root user: Can only query their own incidents
3. Proxy service: Both user and site_search must be set, restricted to that site
Args:
user: Username to filter by (root or proxy service)
site_search: Site path to filter by (proxy service only)
limit: Maximum number of incidents to return
offset: Number of incidents to skip
by_abuser_ip: Filter by attacker IP address
by_country_code: Filter by country code
by_domain: Filter by domain
search: Search across multiple fields
since: Filter by timestamp >= this value (unix timestamp)
to: Filter by timestamp <= this value (unix timestamp)
order_by: List of fields to order by (e.g., ['timestamp-', 'severity-'])
Returns:
List of incident dictionaries
Raises:
ValidationError: If the specified user doesn't exist
"""
try:
user_id, site_path = get_user_id_and_site_for_query(
user, site_search
)
except KeyError as e:
raise ValidationError(str(e)) from e
incidents = get_wordpress_incidents(
limit=limit,
offset=offset,
user_id=user_id,
by_abuser_ip=by_abuser_ip,
by_country_code=by_country_code,
by_domain=by_domain,
search=search,
site_search=site_path,
since=since,
to=to,
order_by=order_by,
include_hidden=include_hidden,
)
# Fields transformation for UI
for incident in incidents:
incident["times"] = incident.pop("retries")
country = incident.pop("country")
incident["country"] = (
{"code": country} if country is not None else None
)
enrich_incidents_with_disabled_state(incidents)
return incidents
@bind("wordpress-plugin", "list-sites")
async def list_sites(self, limit=50, offset=0, user=None):
"""
List WordPress sites with Imunify plugin installed.
For root users: returns all sites.
For non-root users: returns only sites belonging to that user.
"""
uid = None
if user:
try:
uid = pwd.getpwnam(user).pw_uid
except KeyError:
return 0, []
max_count, sites = get_installed_sites_paginated(
uid=uid, limit=limit, offset=offset
)
# Get docroot to domain mapping from control panel
docroot_domains = await get_domain_paths()
# Build result with primary domain resolution
items = []
for site in sites:
# Get domains from control panel, fall back to stored domain
domains = docroot_domains.get(site.docroot, [])
primary_domain = domains[0] if domains else site.domain
items.append(
{
"domain": primary_domain,
"docroot": site.docroot,
}
)
return max_count, items
defence360agent/simple_rpc/wp_disabled_rules.py 0000644 0000000 0000000 00000024372 00000000000 016754 0 ustar """RPC endpoints for WordPress disabled protection rules."""
import asyncio
import logging
import pwd
import time
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.permissions import (
WP_WAF_RULES_EDIT,
check_permission,
)
from defence360agent.contracts.plugins import MessageSink
from defence360agent.files import Index, WP_RULES
from defence360agent.model.wp_disabled_rule import WPDisabledRule
from defence360agent.rpc_tools import ValidationError
from defence360agent.rpc_tools.lookup import CommonEndpoints, bind
from defence360agent.subsys.panels import hosting_panel
from defence360agent.utils import Scope, log_future_errors
from defence360agent.wordpress.changelog_processor import (
ChangelogProcessor,
)
from defence360agent.wordpress.plugin import (
redeploy_rules_php,
update_disabled_rules_on_sites,
)
from defence360agent.wordpress.site_repository import (
get_installed_sites_by_domains,
)
from defence360agent.wordpress.wp_rules import get_wp_rules_data
logger = logging.getLogger(__name__)
async def _get_user_domains(user: str) -> list[str]:
"""
Get domains for a user from the hosting panel.
Returns:
List of domains the user owns, or empty list on error.
"""
try:
hp = hosting_panel.HostingPanel()
domains_per_user = await hp.get_domains_per_user()
return domains_per_user.get(user, [])
except Exception as e:
logger.warning("Failed to get domains for user %s: %s", user, e)
return []
async def _validate_user_domains(
user: str, domains: list[str] | None
) -> list[str]:
"""
Validate and filter domains for a non-root user.
If no domains specified, returns all user's domains.
If domains specified, filters to only those the user owns.
Args:
user: Username to validate domains for
domains: Requested domains, or None for all user's domains
Returns:
List of validated domains the user can access
Raises:
ValidationError: If user has no domains or no access to requested domains
"""
user_domains = await _get_user_domains(user)
if not domains:
if not user_domains:
raise ValidationError("No domains found for user")
return user_domains
authorized_domains = [d for d in domains if d in user_domains]
if not authorized_domains:
raise ValidationError(
"You don't have access to any of the specified domains"
)
return authorized_domains
def _enrich_with_metadata(
disabled_rules: list[dict], wp_rules_data: dict | None
) -> list[dict]:
"""
Enrich disabled rules with metadata from wp-rules.yaml.
Args:
disabled_rules: List of disabled rule dicts from WPDisabledRule.fetch()
wp_rules_data: Parsed wp-rules.yaml data, or None if unavailable
Returns:
List of enriched rule dicts with component and versions added
"""
enriched = []
for rule in disabled_rules:
rule_id = rule["rule_id"]
metadata = wp_rules_data.get(rule_id, {}) if wp_rules_data else {}
enriched.append(
{
**rule,
"component": metadata.get("target"),
"versions": metadata.get("versions"),
}
)
return enriched
async def _jit_sync_changelogs(
domains: list[str], sink: MessageSink | None = None
) -> None:
"""Process pending changelog files for the given domains before an API change.
This "Just-in-Time" sync ensures the database reflects any WordPress-side
changes before the agent applies its own disable/enable operation.
File regeneration (disabled-rules.php) is intentionally skipped here because
the calling API endpoint will regenerate files after its own DB mutation.
"""
try:
sites = get_installed_sites_by_domains(domains)
if not sites:
return
await ChangelogProcessor().process_changelogs_for_sites(
sites, sink=sink
)
except Exception as e:
logger.warning("JIT changelog sync failed: %s", e, exc_info=True)
class WPDisabledRulesEndpoints(CommonEndpoints):
"""Endpoints for listing disabled WordPress protection rules."""
SCOPE = Scope.AV_IM360
@bind("wordpress-plugin", "rules", "list-disabled")
async def list_disabled_rules(
self,
limit: int = 50,
offset: int = 0,
domains: list[str] | None = None,
user: str | None = None,
) -> tuple[int, list[dict]]:
"""
List disabled WordPress protection rules with metadata.
When user is provided, returns rules for that user's domains.
Otherwise, returns all disabled rules.
Args:
limit: Maximum number of rules to return
offset: Number of rules to skip
domains: Filter by specific domains (optional)
user: Username (populated by middleware)
Returns:
Tuple of (total_count, list of enriched rule dicts)
"""
if user:
user_domains = await _get_user_domains(user)
if not domains:
domains = user_domains
else:
domains = [d for d in domains if d in user_domains]
# if user cannot access any of the requested domains, return empty list
if not domains:
return 0, []
# Fetch disabled rules from database
# Root users see all rules (including global), non-root only see their domain rules
total_count, disabled_rules = WPDisabledRule.fetch(
limit=limit,
offset=offset,
user_domains=domains,
include_global=user is None,
)
# Load wp-rules metadata for enrichment
try:
wp_rules_index = Index(WP_RULES, integrity_check=False)
wp_rules_data = get_wp_rules_data(wp_rules_index)
except Exception as e:
logger.warning("Failed to load wp-rules data: %s", e)
wp_rules_data = None
# Enrich with metadata
enriched_rules = _enrich_with_metadata(disabled_rules, wp_rules_data)
return total_count, enriched_rules
async def _toggle_rule(
self,
action: str,
rule: str,
domains: list[str] | None,
user: str | None,
) -> dict:
"""Shared implementation for disable/enable rule endpoints."""
await check_permission(WP_WAF_RULES_EDIT, user)
if user is None:
user_id = 0
else:
try:
user_id = pwd.getpwnam(user).pw_uid
except KeyError:
raise ValidationError(f"User '{user}' not found")
if user:
domains = await _validate_user_domains(user, domains)
# JIT Sync: process pending changelogs before applying API changes.
# Skipped for global operations (domains=None) because global and
# domain-level disables are independent scopes and cannot conflict.
if domains:
await _jit_sync_changelogs(domains, self._sink)
if action == "disable":
WPDisabledRule.store(
rule_id=rule,
domains=domains,
source=WPDisabledRule.SOURCE_AGENT,
user_id=user_id,
)
message_cls = MessageType.WPRuleDisabled
else:
WPDisabledRule.remove(rule_id=rule, domains=domains)
message_cls = MessageType.WPRuleEnabled
try:
await self._sink.process_message(
message_cls(
plugin_id="wordpress",
rule=rule,
domains=domains or [],
timestamp=time.time(),
user_id=user_id,
source=WPDisabledRule.SOURCE_AGENT,
)
)
except Exception as e:
logger.error(
"Failed to report rule %s for %s: %s", action, rule, e
)
if domains:
# Domain-specific: update disabled-rules.php for affected sites
task = asyncio.create_task(
update_disabled_rules_on_sites(domains=domains)
)
else:
# Global: re-deploy rules.php with the rule filtered out
task = asyncio.create_task(redeploy_rules_php())
task.add_done_callback(log_future_errors)
return {}
@bind("wordpress-plugin", "rules", "disable")
async def disable_rule(
self,
rule: str,
domains: list[str] | None = None,
user: str | None = None,
) -> dict:
"""
Disable a WordPress protection rule globally or for specific domains.
Root users can disable globally (no domains) or for specific domains.
Non-root users can disable for all their domains (by specifying no
domains) or for specific domains.
Non-root users can only disable for domains they own.
Args:
rule: The rule ID to disable (e.g., "CVE-2025-001")
domains: List of domains to disable the rule for, or None for global
user: Username (populated by middleware for non-root users)
Returns:
Empty dict on success.
"""
return await self._toggle_rule("disable", rule, domains, user)
@bind("wordpress-plugin", "rules", "enable")
async def enable_rule(
self,
rule: str,
domains: list[str] | None = None,
user: str | None = None,
) -> dict:
"""
Re-enable a WordPress protection rule globally or for specific domains.
Root users can enable globally (no domains) or for specific domains.
Non-root users can enable for all their domains (no domains) or
specific ones.
Non-root users can only enable for domains they own.
Note: Enabling at one scope doesn't affect the other scope.
E.g., enabling globally leaves domain-specific disables intact.
Args:
rule: The rule ID to enable (e.g., "CVE-2025-001")
domains: List of domains to enable the rule for, or None for global
user: Username (populated by middleware for non-root users)
Returns:
Empty dict on success
"""
return await self._toggle_rule("enable", rule, domains, user)
defence360agent/simple_rpc/wp_waf_bulk.py 0000644 0000000 0000000 00000017572 00000000000 015571 0 ustar """Bulk WAF set + status endpoints."""
import asyncio
import logging
import pwd
from defence360agent.contracts.config import Wordpress
from defence360agent.rpc_tools import ValidationError
from defence360agent.rpc_tools.lookup import RootEndpoints, bind
from defence360agent.subsys.panels import hosting_panel
from defence360agent.utils import Scope
from defence360agent.utils.config import update_config
from defence360agent.wordpress.plugin import (
waf_global_snapshot,
waf_status_and_source_for_user_sync,
)
from defence360agent.wordpress.site_repository import (
count_installed_sites_by_uid,
)
logger = logging.getLogger(__name__)
_MAX_CONCURRENT = 10
_STATUS_ENABLED = "enabled"
_STATUS_DISABLED = "disabled"
# Upper bound on items returned in a single response, regardless of --limit,
# so enumerating a server with tens of thousands of accounts can't build an
# unbounded payload.
_SAFETY_CAP = 500
def _resolve_accounts_sync(
users: list[str],
) -> list[tuple[str, int | None, bool, str]]:
rows = []
for name in users:
try:
uid = pwd.getpwnam(name).pw_uid
except KeyError:
uid = None
enabled, source = waf_status_and_source_for_user_sync(name)
rows.append((name, uid, enabled, source))
return rows
def _status_item(
row: tuple[str, int | None, bool, str], site_counts: dict[int, int]
) -> dict:
name, uid, enabled, source = row
return {
"name": name,
"waf_status": _STATUS_ENABLED if enabled else _STATUS_DISABLED,
"source": source,
"wp_sites": site_counts.get(uid, 0),
}
def _matches(
row: tuple[str, int | None, bool, str],
status: str | None,
source: str | None,
) -> bool:
_, _, enabled, src = row
waf_status = _STATUS_ENABLED if enabled else _STATUS_DISABLED
if status is not None and waf_status != status:
return False
if source is not None and src != source:
return False
return True
class WordpressWafBulkEndpoints(RootEndpoints):
SCOPE = Scope.AV_IM360
@bind("wordpress-plugin", "waf", "set")
async def waf_set(
self,
status: str,
all_users: bool = False,
users: list[str] | None = None,
) -> dict:
if all_users and users is not None:
raise ValidationError(
"Specify either --all-users or --users, not both"
)
if not all_users and users is None:
raise ValidationError("Specify either --all-users or --users")
if users is not None and not users:
raise ValidationError("--users must not be empty")
if not Wordpress.SECURITY_PLUGIN_ENABLED:
raise ValidationError(
"WordPress Security Plugin is disabled."
" Enable it before changing WAF settings."
)
logger.warning(
"AUDIT wordpress-plugin.waf.set status=%r all_users=%r users=%r",
status,
all_users,
users,
)
try:
panel_users = set(await hosting_panel.HostingPanel().get_users())
except Exception as e:
raise ValidationError(
f"Could not enumerate hosting users: {e}"
) from e
succeeded: list[str] = []
skipped: list[dict] = []
failed: list[dict] = []
if all_users:
valid_users = list(panel_users)
else:
valid_users = []
for u in dict.fromkeys(users):
if u in panel_users:
valid_users.append(u)
else:
skipped.append({"user": u, "reason": "Not a hosting user"})
waf_value = status == "enabled"
async def _apply_to_user(u: str) -> tuple[str, str | None]:
try:
await update_config(
self._sink,
{"WORDPRESS": {"waf_enabled": waf_value}},
user=u,
)
return u, None
except Exception as e:
return u, str(e)
for i in range(0, len(valid_users), _MAX_CONCURRENT):
batch = [
_apply_to_user(u) for u in valid_users[i : i + _MAX_CONCURRENT]
]
results = await asyncio.gather(*batch)
for u, err in results:
if err is None:
succeeded.append(u)
else:
failed.append({"user": u, "reason": err})
items = [
*[
{"user": u, "status": "succeeded", "reason": ""}
for u in succeeded
],
*[
{"user": s["user"], "status": "skipped", "reason": s["reason"]}
for s in skipped
],
*[
{"user": f["user"], "status": "failed", "reason": f["reason"]}
for f in failed
],
]
return {
"items": items,
"succeeded": succeeded,
"skipped": skipped,
"failed": failed,
}
@bind("wordpress-plugin", "waf", "status")
async def waf_status(
self,
user: str | None = None,
status: str | None = None,
source: str | None = None,
limit: int | None = None,
offset: int = 0,
) -> dict:
if limit is not None and limit < 0:
raise ValidationError("--limit must be >= 0")
if offset < 0:
raise ValidationError("--offset must be >= 0")
loop = asyncio.get_running_loop()
(
security_plugin_enabled,
global_waf_enabled,
global_waf_default,
) = waf_global_snapshot()
try:
panel_users = list(
dict.fromkeys(await hosting_panel.HostingPanel().get_users())
)
except Exception as e:
raise ValidationError(
f"Could not enumerate hosting users: {e}"
) from e
if user is not None:
if user not in set(panel_users):
raise ValidationError(f"{user} is not a hosting user")
panel_users = [user]
site_counts = await loop.run_in_executor(
None, count_installed_sites_by_uid
)
page_size = _SAFETY_CAP if limit is None else min(limit, _SAFETY_CAP)
if status is None and source is None:
# No status/source filter: the total is just the account count and
# results are ordered by name (known before resolution), so resolve
# only the requested page instead of every account — otherwise a
# small --limit/--offset page still costs O(all-users) work.
total_count = len(panel_users)
page = sorted(panel_users)[offset : offset + page_size]
rows = await loop.run_in_executor(
None, _resolve_accounts_sync, page
)
items = [_status_item(row, site_counts) for row in rows]
else:
# A status/source filter's total is post-filter, so every account
# must be resolved before it can be counted and paginated.
rows = await loop.run_in_executor(
None, _resolve_accounts_sync, panel_users
)
items = [
_status_item(row, site_counts)
for row in rows
if _matches(row, status, source)
]
items.sort(key=lambda i: i["name"])
total_count = len(items)
items = items[offset : offset + page_size]
return {
"security_plugin_enabled": security_plugin_enabled,
"global_waf": (
_STATUS_ENABLED if global_waf_enabled else _STATUS_DISABLED
),
"global_waf_default": (
_STATUS_ENABLED if global_waf_default else _STATUS_DISABLED
),
"total_count": total_count,
"items": items,
}
defence360agent/subsys/ 0000755 0000000 0000000 00000000000 00000000000 012076 5 ustar defence360agent/subsys/__init__.py 0000644 0000000 0000000 00000000000 00000000000 014175 0 ustar defence360agent/subsys/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 014306 5 ustar defence360agent/subsys/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000301 00000000000 021500 0 ustar
r_j d S )N r T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/__init__.py<module>r s r defence360agent/subsys/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000301 00000000000 020541 0 ustar
r_j d S )N r T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/__init__.py<module>r s r defence360agent/subsys/__pycache__/ainotify.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000027526 00000000000 021605 0 ustar
r_jL d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
edd Z ej e
Z G d d Z G d d ZdS )
)
namedtupleN)sysctlEvent)pathflagscookienamewdc e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d Zd
ZdZdZdZdZdZdZdZdZdZd ej dk rdnd Z e j e d Z e j! d Z"e#d Z$e#d Z%e#d Z&e#d! Z'e#d" Z(e#d# Z)d$S )%InotifyzE
Tiny wrapper for inotify api. See `man inotify` for details
@ i i i i @ i i i i i i @l zlibc.{}Darwinzso.6dylibT) use_errnoiIIIc t t j | | }|dk r5t j }t |t
j | |S )a
Wrapper to all calls to C functions. Raises OSError with appropriate
errno as argument in case of error return value.
:param method: method to call
:param args: method args
:return: called function return value in case of success
)getattrr _libcctypes get_errnoOSErrorosstrerror)methodargsreterrnos T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/ainotify.py_callz
Inotify._call4 sR -ggmV,,d3 "99$&&E%U!3!344 4
c 6 t d S )z
Initialize an inotify instance.
See `man inotify_init` for details
:return: a file descriptor of new inotify instance
inotify_initr r) r* r( initz Inotify.initC s }}^,,,r* c < t d| || S )a
Add a watch to an initialized inotify instance. This method is
idempotent. If called twice with the same :fd: and :path: and
different mask, will change watch flags of current watch.
See `man inotify_add_watch` for details
:param fd: file descriptor returned by `init()`
:param path: path to file or directory to watch
:param mask: bitmask of events to monitor
:return: file descriptor of watch
inotify_add_watchr- )fdr masks r( add_watchzInotify.add_watchL s }} 0"dDAAAr* c : t d| | S )z
Remove existing watch from inotify instance.
:param fd: file descriptor of inotify instance
:param wd: watch file descriptor, returned by `add_watch()`
:return: zero
inotify_rm_watchr- )r2 r
s r( rm_watchzInotify.rm_watchZ s }} /R888r* c @ t j | S )z
Unpacks prefix of event struct.
See `man inotify` for details
:param data: struct bytestring
:return: tuple of (wd, flag, cookie, length)
)r event_prefixunpackdatas r(
unpack_prefixzInotify.unpack_prefixd s #**4000r* c ~ t j dt | z | d d S )z
Unpack name field of inotify event struct
See `man inotify` for details
:param data: struct bytestring
:return: name string
z%dsr )structr: lenrstripr; s r( unpack_namezInotify.unpack_namen s4 }USYY .55a8??HHHr* N)*__name__
__module__ __qualname____doc__ACCESSMODIFYATTRIB CLOSE_WRITE
CLOSE_NOWRITEOPEN
MOVED_FROMMOVED_TOCREATEDELETE DELETE_SELF MOVE_SELFUNMOUNT
Q_OVERFLOWIGNOREDONLYDIR DONT_FOLLOW EXCL_UNLINKMASK_ADDISDIRONESHOTformatplatformsystem_nr CDLLr r@ Structr9 staticmethodr) r/ r4 r7 r= rC r. r* r( r r s F
F
FKM DJH
F
FKIGJGGKKH EG OHO$5$5$A$A&&w O OB FKd + + +E 6=((L \ - - \- B B \ B 9 9 \9 1 1 \1 I I \I I Ir* r c Z e Zd ZdZdZdZdZdZddZd Z d Z
d
Z d Z d Z
d
Zd Zd ZdS )Watcherz1
Asynchronous watcher for inotify events
r g ?zfs.inotify.max_user_watchesNc || _ t | _ t j | _ |p | j j | _ | j | j | j
| d S N) _loopr r/ _fdasyncioQueue_queueput _callback
add_reader_read _reset_state)selfloop
coro_callbacks r( __init__zWatcher.__init__ si
<<>> moo &9$+/
dh
333 r* c 0 i | _ i | _ d| _ d S )Nr* )paths descriptorsbufrs s r( rr zWatcher._reset_state s
r* c F | xj t j | j | j z
c_ t
j j }t | j |k rIt
| j d | \ }}}}||z }t
| j || }| j |d | _ || j vr| j | }|t
j z r1t d| | | |t
j z r t d t% ||||| } | j | | t | j |k Gd S d S )Nz(Got IGNORED event for %s, cleaning watchzInotify queue overflow)rz r" readrj _CHUNK_SIZEr r9 sizerA r= rC rx rV loggerwarning_cleanup_watchrU errorr ri create_taskro )
rs struct_sizer
r r length
struct_endr r evs
r( rq z
Watcher._read s BGDHd&6777 */ $(mm{**(/(=(= + &) ) %Bvv %v-J&&tx J0F'GHHDx
,DH##:b>Dw&
> ##D)))w))
5666tUFD"55B J " "4>>"#5#5 6 6 6/ $(mm{******r* c t j | j }|t || j z z }t
d| j | t j | j | d S )NzRaising %s to %s)r r} _MAX_USER_WATCHESint_WATCHERS_RAISE_COEFFr infowrite)rs current_max_watchesnew_max_watcherss r( _raise_user_watcheszWatcher._raise_user_watches sx $k$*@ A A. $"< <2
2
68H
T+-=>>>>>r* c | j | j t j | j | d| _ dS # | d| _ w xY w)za
Close watcher. Close inotify fd, remove reader and reset state
:return:
N)ri
remove_readerrj r" closerr r{ s r( r z
Watcher.close st
*** HTX DHHH
DHOOOOs A A4c t |t s
J d t d| d} t | j || }|| j |< || j |< dS # t $ rz}|| j
k rN|j t j k r9|
|dz
}t d| Y d}~t d| d}~ww xY w) z
Add file to watch
:param path: file or directory to watch
:param mask: events mask for this watch
zPath must be bytesz Watching %rr Tr
z-Inotify: not enough watches (%r), retrying...Nz Inotify failed while watching %r)
isinstancebytesr r r r4 rj rx ry r! _MAX_WATCH_RETRIESr' ENOSPCr r r )rs r r3 retriesr
es r( watchz
Watcher.watch s $&&<<(<<<& M4(((
&&txt<<!%
2)+ &
d 5555<//,,...qLGNNG HHHH ?FFF
s 5A6 6
C: AC5 C55C:c z | j |d }| | j |d d S d S rh )ry poprx )rs r
descriptors r( r zWatcher._cleanup_watch sD %))$55
! JNN:t , , , , , " !r* c || j vrdS t d| t | j | j | | | dS # | | w xY w)zq
Remove file or directory from watch
:param path: file or directory to remove watch from
NzStop watching %r)ry r r r r7 rj r )rs r s r( unwatchzWatcher.unwatch s
t' ' ' F &--- & TXt'7'= > > > % % % % %D % % % %s +A* *Bc ~ K | j d{V }t d| |S )zF
Get watch event
:return: `Event` named tuple
NzInotify event: %s)rm getr debug)rs events r( get_eventzWatcher.get_event sE
koo'''''''' (%000 r* rh )rD rE rF rG r~ r r r rv rr rq r r r r r r r. r* r( re re y s K 5
7 7 7:? ? ?
:- - -
& & & r* re ) collectionsr rk r r' loggingr" r@ r^ defence360agent.subsysr r getLoggerrD r r re r. r* r( <module>r s " " " " " "
) ) ) ) ) )
7 EFF
8 $ $dI dI dI dI dI dI dI dIN@ @ @ @ @ @ @ @ @ @r* defence360agent/subsys/__pycache__/ainotify.cpython-311.pyc 0000644 0000000 0000000 00000027526 00000000000 020646 0 ustar
r_jL d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
edd Z ej e
Z G d d Z G d d ZdS )
)
namedtupleN)sysctlEvent)pathflagscookienamewdc e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d Zd
ZdZdZdZdZdZdZdZdZdZd ej dk rdnd Z e j e d Z e j! d Z"e#d Z$e#d Z%e#d Z&e#d! Z'e#d" Z(e#d# Z)d$S )%InotifyzE
Tiny wrapper for inotify api. See `man inotify` for details
@ i i i i @ i i i i i i @l zlibc.{}Darwinzso.6dylibT) use_errnoiIIIc t t j | | }|dk r5t j }t |t
j | |S )a
Wrapper to all calls to C functions. Raises OSError with appropriate
errno as argument in case of error return value.
:param method: method to call
:param args: method args
:return: called function return value in case of success
)getattrr _libcctypes get_errnoOSErrorosstrerror)methodargsreterrnos T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/ainotify.py_callz
Inotify._call4 sR -ggmV,,d3 "99$&&E%U!3!344 4
c 6 t d S )z
Initialize an inotify instance.
See `man inotify_init` for details
:return: a file descriptor of new inotify instance
inotify_initr r) r* r( initz Inotify.initC s }}^,,,r* c < t d| || S )a
Add a watch to an initialized inotify instance. This method is
idempotent. If called twice with the same :fd: and :path: and
different mask, will change watch flags of current watch.
See `man inotify_add_watch` for details
:param fd: file descriptor returned by `init()`
:param path: path to file or directory to watch
:param mask: bitmask of events to monitor
:return: file descriptor of watch
inotify_add_watchr- )fdr masks r( add_watchzInotify.add_watchL s }} 0"dDAAAr* c : t d| | S )z
Remove existing watch from inotify instance.
:param fd: file descriptor of inotify instance
:param wd: watch file descriptor, returned by `add_watch()`
:return: zero
inotify_rm_watchr- )r2 r
s r( rm_watchzInotify.rm_watchZ s }} /R888r* c @ t j | S )z
Unpacks prefix of event struct.
See `man inotify` for details
:param data: struct bytestring
:return: tuple of (wd, flag, cookie, length)
)r event_prefixunpackdatas r(
unpack_prefixzInotify.unpack_prefixd s #**4000r* c ~ t j dt | z | d d S )z
Unpack name field of inotify event struct
See `man inotify` for details
:param data: struct bytestring
:return: name string
z%dsr )structr: lenrstripr; s r( unpack_namezInotify.unpack_namen s4 }USYY .55a8??HHHr* N)*__name__
__module__ __qualname____doc__ACCESSMODIFYATTRIB CLOSE_WRITE
CLOSE_NOWRITEOPEN
MOVED_FROMMOVED_TOCREATEDELETE DELETE_SELF MOVE_SELFUNMOUNT
Q_OVERFLOWIGNOREDONLYDIR DONT_FOLLOW EXCL_UNLINKMASK_ADDISDIRONESHOTformatplatformsystem_nr CDLLr r@ Structr9 staticmethodr) r/ r4 r7 r= rC r. r* r( r r s F
F
FKM DJH
F
FKIGJGGKKH EG OHO$5$5$A$A&&w O OB FKd + + +E 6=((L \ - - \- B B \ B 9 9 \9 1 1 \1 I I \I I Ir* r c Z e Zd ZdZdZdZdZdZddZd Z d Z
d
Z d Z d Z
d
Zd Zd ZdS )Watcherz1
Asynchronous watcher for inotify events
r g ?zfs.inotify.max_user_watchesNc || _ t | _ t j | _ |p | j j | _ | j | j | j
| d S N) _loopr r/ _fdasyncioQueue_queueput _callback
add_reader_read _reset_state)selfloop
coro_callbacks r( __init__zWatcher.__init__ si
<<>> moo &9$+/
dh
333 r* c 0 i | _ i | _ d| _ d S )Nr* )paths descriptorsbufrs s r( rr zWatcher._reset_state s
r* c F | xj t j | j | j z
c_ t
j j }t | j |k rIt
| j d | \ }}}}||z }t
| j || }| j |d | _ || j vr| j | }|t
j z r1t d| | | |t
j z r t d t% ||||| } | j | | t | j |k Gd S d S )Nz(Got IGNORED event for %s, cleaning watchzInotify queue overflow)rz r" readrj _CHUNK_SIZEr r9 sizerA r= rC rx rV loggerwarning_cleanup_watchrU errorr ri create_taskro )
rs struct_sizer
r r length
struct_endr r evs
r( rq z
Watcher._read s BGDHd&6777 */ $(mm{**(/(=(= + &) ) %Bvv %v-J&&tx J0F'GHHDx
,DH##:b>Dw&
> ##D)))w))
5666tUFD"55B J " "4>>"#5#5 6 6 6/ $(mm{******r* c t j | j }|t || j z z }t
d| j | t j | j | d S )NzRaising %s to %s)r r} _MAX_USER_WATCHESint_WATCHERS_RAISE_COEFFr infowrite)rs current_max_watchesnew_max_watcherss r( _raise_user_watcheszWatcher._raise_user_watches sx $k$*@ A A. $"< <2
2
68H
T+-=>>>>>r* c | j | j t j | j | d| _ dS # | d| _ w xY w)za
Close watcher. Close inotify fd, remove reader and reset state
:return:
N)ri
remove_readerrj r" closerr r{ s r( r z
Watcher.close st
*** HTX DHHH
DHOOOOs A A4c t |t s
J d t d| d} t | j || }|| j |< || j |< dS # t $ rz}|| j
k rN|j t j k r9|
|dz
}t d| Y d}~t d| d}~ww xY w) z
Add file to watch
:param path: file or directory to watch
:param mask: events mask for this watch
zPath must be bytesz Watching %rr Tr
z-Inotify: not enough watches (%r), retrying...Nz Inotify failed while watching %r)
isinstancebytesr r r r4 rj rx ry r! _MAX_WATCH_RETRIESr' ENOSPCr r r )rs r r3 retriesr
es r( watchz
Watcher.watch s $&&<<(<<<& M4(((
&&txt<<!%
2)+ &
d 5555<//,,...qLGNNG HHHH ?FFF
s 5A6 6
C: AC5 C55C:c z | j |d }| | j |d d S d S rh )ry poprx )rs r
descriptors r( r zWatcher._cleanup_watch sD %))$55
! JNN:t , , , , , " !r* c || j vrdS t d| t | j | j | | | dS # | | w xY w)zq
Remove file or directory from watch
:param path: file or directory to remove watch from
NzStop watching %r)ry r r r r7 rj r )rs r s r( unwatchzWatcher.unwatch s
t' ' ' F &--- & TXt'7'= > > > % % % % %D % % % %s +A* *Bc ~ K | j d{V }t d| |S )zF
Get watch event
:return: `Event` named tuple
NzInotify event: %s)rm getr debug)rs events r( get_eventzWatcher.get_event sE
koo'''''''' (%000 r* rh )rD rE rF rG r~ r r r rv rr rq r r r r r r r. r* r( re re y s K 5
7 7 7:? ? ?
:- - -
& & & r* re ) collectionsr rk r r' loggingr" r@ r^ defence360agent.subsysr r getLoggerrD r r re r. r* r( <module>r s " " " " " "
) ) ) ) ) )
7 EFF
8 $ $dI dI dI dI dI dI dI dIN@ @ @ @ @ @ @ @ @ @r* defence360agent/subsys/__pycache__/backup_systems.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000062040 00000000000 023005 0 ustar
r_j, d dl Z d dlZd dlZd dlmZ d dlmZmZmZm Z d dl
m Z m Z m
ZmZmZmZmZmZmZmZmZmZmZmZ d dlmZ d dl m Z m Z d dl m Z d dl!m"Z" d d l#m$Z$ e sd d
l%m&Z& d d l'm(Z( d d l)m*Z*m+Z+ ej, e- Z.d
Z/dee0 fdZ1 d.dee0ef fdZ2de e0 fdZ3de e4 fdZ5d Z6 G d de7 Z8 G d d Z9 G d de9 Z: G d d e9 Z; G d d e9 Z< G d d!e9 Z= G d" d#e9 Z> G d$ d%e9 Z? G d& d'e9 Z@ G d( d)e@ ZA G d* d+eA ZB G d, d-eA ZCdS )/ N)timezone)CallableDictListOptional)ACRONISANTIVIRUS_MODE
AcronisBackup BackupConfig
BackupRestore
CLOUDLINUXCLOUDLINUX_ON_PREMISE
CLUSTERLOGICSCPANELCore DIRECTADMINPLESKR1SOFTSAMPLE_BACKEND)
LicenseCLN)BackupNotFoundRestCLN)cPanel) DirectAdmin)Plesk)backup_backends) BackupFailed)BackendNonApplicableErrorBackendNotAuthorizedErrorc t d | S # t t f$ r# t d | w xY w)NT)include_samplez"Backup system is not available: {})_get_avalible_backendsKeyErrorr
ValueErrorformat)names Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/backup_systems.py get_backendr( ( si L@%T:::4@BBB / 0 L L L=DDTJJKKKLs 4Areturnc g } t d D ]5\ }} | | | &# t $ r Y 2w xY w| S )NF)
include_cl)r" itemsappendr )namesr& clss r' get_available_backends_namesr0 / s E+u===CCEE c CEEE
LL ) D
Ls
A
AAFTc t t t t i}t j r|rt |t < t j rt |t < t j rt |t < nEt j rt |t" < n"t% j rt& |t( < | rt* |t, < |S N)r Acronisr R1Softr CL_BACKUP_ALLOWED
CloudLinuxr
CL_ON_PREMISE_BACKUP_ALLOWEDCloudLinuxOnPremiser r is_installed cPanelBackupr r PleskBackupr r DirectAdminBackupr Sampler )r! r+ backendss r' r" r" = s
H & *: * ) 1 >*=&'
2' 2% ! # # 2 1 *#) O c t di } | d o| d S N
BACKUP_SYSTEMenabled
backup_system)r config_to_dictget)confs r' get_current_backendrH W sJ >> ( ( * * . . C CD 88I <488O#<#<<r? c | K t } | sd S t | }| d {V S r2 )rH r( get_last_backup_timestamp)backendbackend_instances r' rJ rJ \ sP !##G t"7++!;;== = = = = = ==r? c fd}|S )Nc K d} | g|R i | d {V }d}| | n# | | w xY w|S )NFTrC _update_backups_config)r/ argskwargsokrvfs r' wrapperz transactional.<locals>.wrapperf s
3q.t...v........BB & &r & 2 2 2 2C & &r & 2 2 2 2 s 2 A
)rV rW s ` r'
transactionalrY e s# Nr? c e Zd ZdS )BackupExceptionN)__name__
__module__ __qualname__rX r? r' r[ r[ r s Dr? r[ c ` e Zd Zd
dZd Zd ZddZd Zd Zd Z d
e
fd Z d
e e
fd ZdS ) BackupSystemNc " || _ || _ d S r2 )r& log_path)selfr& rb s r' __init__zBackupSystem.__init__w s
r? c n d||r| j nd di}t |dd d S )NrB )rC rD T) overwritevalidate)r& r dict_to_config)rc rC new_confs r' rQ z#BackupSystem._update_backups_config{ sN ".5!?4
%%h$%NNNNNr? c 6 K | d d S )NTrO rP )rc rR rS s r' initzBackupSystem.init s# ##D#11111r? Fc 6 K | d d S )NFrO rP )rc delete_backupss r' disablezBackupSystem.disable s# ##E#22222r? c
K i S r2 rX rc s r' checkzBackupSystem.check r? c
K i S r2 rX rp s r' showzBackupSystem.show rr r? c
K d S r2 rX rp s r' make_backupzBackupSystem.make_backup s r? r) c K t di }| d o | d | j k S rA )r rE rF r& )rc rG s r' check_statezBackupSystem.check_state sU ~~,,..22?BGGxx ""Mtxx'@'@DI'MMr? c
K d S r2 rX rp s r' rJ z&BackupSystem.get_last_backup_timestamp s tr? r2 F)r\ r] r^ rd rQ rk rn rq rt rv boolrx r intrJ rX r? r' r` r` v s ! ! ! !O O O2 2 23 3 3 3
N4 N N N N# r? r` c e Zd Z fdZ xZS )r; c T t t d S r2 )superrd r rc __class__s r' rd zPleskBackup.__init__ s!
r? r\ r] r^ rd
__classcell__r s @r' r; r; s8 r? r; c e Zd Z fdZ xZS )r: c T t t d S r2 )r rd r r s r' rd zcPanelBackup.__init__ s!
r? r r s @r' r: r: s8 ! ! ! ! ! ! ! ! !r? r: c e Zd Z fdZ xZS )r< c T t t d S r2 )r rd r r s r' rd zDirectAdminBackup.__init__ s!
%%%%%r? r r s @r' r< r< s8 & & & & & & & & &r? r< c @ e Zd Z fdZdefdZed Z xZS )r4 c t t t j dd | _ d S )Nr1softTasync_)r rd r r rK r s r' rd zR1Soft.__init__ s6
&.xEEE r? r) c K | j d {V }d | D S )Nc " i | ] \ }}|d v ||
S ))username timestampiprX .0kvs r'
<dictcomp>z R1Soft.show.<locals>.<dictcomp> s4
1333
q333r? rK infor, rc info_datas r' rt z R1Soft.show V ,++--------
!))
r? c P K | j |||| d {V d S r2 rK rk )rc r r passwordencryption_keyrS s r' rk z R1Soft.init s: l HhGGGGGGGGGGGr? r\ r] r^ rd dictrt rY rk r r s @r' r4 r4 sz F F F F F
D
H H ]H H H H Hr? r4 c @ e Zd Z fdZdefdZed Z xZS )
ClusterLogicsc t t t j t d | _ d S NTr )r rd r r rK r s r' rd zClusterLogics.__init__ s6
'''&.}TJJJ r? r) c K | j d {V }d | D S )Nc " i | ] \ }}|d v ||
S ))r urlapikeyrX r s r' r z&ClusterLogics.show.<locals>.<dictcomp> s4
1111
q111r? r r s r' rt zClusterLogics.show r r? c @ K |d= | j j di | d {V d S )NforcerX r )rc rS s r' rk zClusterLogics.init sB
7O dl ))&)))))))))))r? r r s @r' r r ss K K K K K
D
* * ]* * * * *r? r c e Zd Z fdZ xZS )r= c t t t j | j d | _ d S r )r rd r r rK r& r s r' rd zSample.__init__ s8
(((&.tyFFF r? r r s @r' r= r= sA G G G G G G G G Gr? r= c n e Zd Z fdZdefdZed
d Zd dZde e
fdZ de fd Z
xZS ) r3 c t t dt j dt
j t j | j d | _ d S )Nz /var/log//Tr )
r rd r r PRODUCTAcronisBackupConfigLOG_NAMEr rK r& r s r' rd zAcronis.__init__ sX
G $ .A.J.J K
'.tyFFF r? r) c K | j d {V }d | D S )Nc " i | ] \ }}|d v ||
S ))r r rX r s r' r z Acronis.show.<locals>.<dictcomp> s4
1---
q---r? r r s r' rt z Acronis.show r r? Fc K | j d {V }| j ||||t j d {V d S )N provisionr tmp_dir)rK is_agent_installedrk r TMPDIRrc r r r rS r s r' rk z Acronis.init s "l = = ? ???????? l K
r? Nc F K | j | d {V S r2 )rK backups)rc untils r'
_list_backupszAcronis._list_backups s. \))%000000000r? c K | d {V }|r&t t d |D S d S )Nc 3 K | ];}|j t j V <dS ))tzinfoN)createdreplacer utcr )r backups r' <genexpr>z4Acronis.get_last_backup_timestamp.<locals>.<genexpr> sW N**(,*??IIKK r? )r r| max)rc r s r' rJ z!Acronis.get_last_backup_timestamp ss **,,,,,,,, ")
tr? c K t | d{V S # t j t f$ r t
$ r t d Y dS w xY w)z if backup exists, than state OKNzError during checking stateF)r{ r asyncioCancelledErrorr Exceptionlogger exceptionrp s r' rx zAcronis.check_state s d 0 0 2 222222233 3&(AB : ; ; ;55 s &+ :A)(A)rz r2 )r\ r] r^ rd r rt rY rk r r r| rJ r{ rx r r s @r' r3 r3 s G G G G G
D
]
1 1 1 1 # 4 r? r3 c @ e Zd ZdefdZd Zdee fdZddZ dS ) CloudLinuxBaser) c K | j d {V }| d |d< | j d {V |d< |S )Nusagebackup_space_used_bytes login_url)rK r popr r s r' rt zCloudLinuxBase.show
sr ,++-------- /8}}W/E/E +,'+|'='='?'?!?!?!?!?!?!? + r? c H K t d | j d {V d S # t $ rX}t j d t t |j r |j d rt | nd d }~ww xY w)Nz
Making backupzCloudLinux backup failedr r ) r r rK make_initial_backup_strictr loggingr r[ lenrR str)rc es r' rv zCloudLinuxBase.make_backup s O$$$ ,99;; ; ; ; ; ; ; ; ; ; 8 9 9 9! af++G!&)GA
s ?
B! AB B!c D K | j d {V S r2 )rK get_backup_progressrp s r' r z"CloudLinuxBase.get_backup_progress s, \55777777777r? Fc K t d| j z | j d {V }| j ||||t j d {V d S )NzStarting %s initr )r r r& rK r rk r r r s r' rk zCloudLinuxBase.init s &2333 "l = = ? ???????? l K
r? Nrz )
r\ r] r^ r rt rv r r| r rk rX r? r' r r sq D 88C= 8 8 8 8
r? r c Z e Zd Zd\ ZZ fdZed fd Z G d d Zej de
f fd Z ej fd Z ej de
e f fd
Zej de
e f fd Zej def fd Zde
fd
Zd fd Z xZS )r6 )paidunpaidc ` t t | _ d S r2 )r rd r
r& r s r' rd zCloudLinux.__init__/ s$
r? Fc K t j t j d {V }t |d |d | d {V d S )N server_idloginr r )r acronis_credentialsr
get_server_idr rk )rc r rS credentialsr s r' rk zCloudLinux.init3 s # 7 .00
ggll
#
r? c $ e Zd Zed ZdS )CloudLinux.Decoratorsc F t j fd }|S )Nc K | g|R i | d {V S # t $ r1 | d d {V | g|R i | d {V cY S w xY w)NTr )r rk )rc rR rS rV s r' wrappedzOCloudLinux.Decorators.update_credentials_on_unauthorized_error.<locals>.wrappedA s :!"4!9$!9!9!9&!9!999999990 : : : ))$)/////////!"4!9$!9!9!9&!9!9999999999:s 8AA) functoolswraps)rV r s ` r' (update_credentials_on_unauthorized_errorz>CloudLinux.Decorators.update_credentials_on_unauthorized_error? s8
_Q
:
:
:
:
: Nr? N)r\ r] r^ staticmethodr rX r? r'
Decoratorsr > s-
r? r r) c K t d {V }t j t j d {V }| dd }| dd }||d< ||d< |S )Nr sizer r purchased_backup_gb
resize_url)r rt r
acronis_checkr r rF )rc r responser r r s r' rt zCloudLinux.showK s '',,..(((((( . .00
'll61 5 5 \\%..
+> '(", , r? c X K t d {V d S r2 )r rv r s r' rv zCloudLinux.make_backupZ s5 gg!!###########r? c T K t d {V S r2 )r r r s r' r z CloudLinux.get_backup_progress^ s/ WW00222222222r? c T K t d {V S r2 )r rJ r s r' rJ z$CloudLinux.get_last_backup_timestampb s/ WW66888888888r? c T K t d {V S r2 )r rx r s r' rx zCloudLinux.check_statef s/ WW((*********r? c K t j t j d {V }n3# t $ r&}| j | dcY d }~S d }~ww xY w| j | d dS )Nr )statusr r )r r ) r r r r r UNPAIDadd_used_spacePAIDrF )rc contentr s r' rq zCloudLinux.checkj s F # 1$244 GG F F F "k!2B2B2D2DEE E E E E E E F )W[[-@-@AAAs ,1
A!A A! A!c K t d {V |r.t j t j d {V d S d S )Nr )r rn r acronis_remover r )rc rm r s r' rn zCloudLinux.disablet sw ggoo O(:3K3M3MNNN N N N N N N N N N O Or? rz )r\ r] r^ r r rd rY rk r r r rt rv r r| r rJ r{ rx rq rn r r s @r' r6 r6 , s #LD&
]
8 D 98 8$ $ $ $ 98$ 838C= 3 3 3 3 3 983 89# 9 9 9 9 9 989 8+4 + + + + + 98+BT B B B BO O O O O O O O O Or? r6 c 8 e Zd Z fdZe fd Z xZS )r8 c ` t t | _ d S r2 )r rd r r& r s r' rd z CloudLinuxOnPremise.__init__{ s$
) r? c J K t j |i | d {V d S r2 )r rk )rc rR rS r s r' rk zCloudLinuxOnPremise.init s: egglD+F+++++++++++r? )r\ r] r^ rd rY rk r r s @r' r8 r8 z s] * * * * * , , , , ], , , , ,r? r8 )FT)Dr r r datetimer typingr r r r defence360agent.contracts.configr r r
r r r r
r r r r r r r r !defence360agent.contracts.licenser defence360agent.internals.clnr r *defence360agent.subsys.panels.cpanel.panelr /defence360agent.subsys.panels.directadmin.panelr )defence360agent.subsys.panels.plesk.panelr restore_infectedr (restore_infected.backup_backends.acronisr $restore_infected.backup_backends_libr r getLoggerr\ r r( r r0 r" rH r| rJ rY r r[ r` r; r: r< r4 r r= r3 r r6 r8 rX r? r' <module>r s 1 1 1 1 1 1 1 1 1 1 1 1 9 8 8 8 8 8 A A A A A A A A = = = = = = G G G G G G ; ; ; ; ; ; 000000EEEEEE
8 $ $L L L d3i
#x- 4=Xc] = = = =
># > > > >
i " " " " " " " "J ,
! ! ! ! !< ! ! !
& & & & & & & &
H H H H H\ H H H$* * * * *L * * *,G G G G G\ G G G 1 1 1 1 1l 1 1 1h
W
@KO KO KO KO KO KO KO KO\, , , , ,. , , , , ,r? defence360agent/subsys/__pycache__/backup_systems.cpython-311.pyc 0000644 0000000 0000000 00000062040 00000000000 022046 0 ustar
r_j, d dl Z d dlZd dlZd dlmZ d dlmZmZmZm Z d dl
m Z m Z m
ZmZmZmZmZmZmZmZmZmZmZmZ d dlmZ d dl m Z m Z d dl m Z d dl!m"Z" d d l#m$Z$ e sd d
l%m&Z& d d l'm(Z( d d l)m*Z*m+Z+ ej, e- Z.d
Z/dee0 fdZ1 d.dee0ef fdZ2de e0 fdZ3de e4 fdZ5d Z6 G d de7 Z8 G d d Z9 G d de9 Z: G d d e9 Z; G d d e9 Z< G d d!e9 Z= G d" d#e9 Z> G d$ d%e9 Z? G d& d'e9 Z@ G d( d)e@ ZA G d* d+eA ZB G d, d-eA ZCdS )/ N)timezone)CallableDictListOptional)ACRONISANTIVIRUS_MODE
AcronisBackup BackupConfig
BackupRestore
CLOUDLINUXCLOUDLINUX_ON_PREMISE
CLUSTERLOGICSCPANELCore DIRECTADMINPLESKR1SOFTSAMPLE_BACKEND)
LicenseCLN)BackupNotFoundRestCLN)cPanel) DirectAdmin)Plesk)backup_backends) BackupFailed)BackendNonApplicableErrorBackendNotAuthorizedErrorc t d | S # t t f$ r# t d | w xY w)NT)include_samplez"Backup system is not available: {})_get_avalible_backendsKeyErrorr
ValueErrorformat)names Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/backup_systems.py get_backendr( ( si L@%T:::4@BBB / 0 L L L=DDTJJKKKLs 4Areturnc g } t d D ]5\ }} | | | &# t $ r Y 2w xY w| S )NF)
include_cl)r" itemsappendr )namesr& clss r' get_available_backends_namesr0 / s E+u===CCEE c CEEE
LL ) D
Ls
A
AAFTc t t t t i}t j r|rt |t < t j rt |t < t j rt |t < nEt j rt |t" < n"t% j rt& |t( < | rt* |t, < |S N)r Acronisr R1Softr CL_BACKUP_ALLOWED
CloudLinuxr
CL_ON_PREMISE_BACKUP_ALLOWEDCloudLinuxOnPremiser r is_installed cPanelBackupr r PleskBackupr r DirectAdminBackupr Sampler )r! r+ backendss r' r" r" = s
H & *: * ) 1 >*=&'
2' 2% ! # # 2 1 *#) O c t di } | d o| d S N
BACKUP_SYSTEMenabled
backup_system)r config_to_dictget)confs r' get_current_backendrH W sJ >> ( ( * * . . C CD 88I <488O#<#<<r? c | K t } | sd S t | }| d {V S r2 )rH r( get_last_backup_timestamp)backendbackend_instances r' rJ rJ \ sP !##G t"7++!;;== = = = = = ==r? c fd}|S )Nc K d} | g|R i | d {V }d}| | n# | | w xY w|S )NFTrC _update_backups_config)r/ argskwargsokrvfs r' wrapperz transactional.<locals>.wrapperf s
3q.t...v........BB & &r & 2 2 2 2C & &r & 2 2 2 2 s 2 A
)rV rW s ` r'
transactionalrY e s# Nr? c e Zd ZdS )BackupExceptionN)__name__
__module__ __qualname__rX r? r' r[ r[ r s Dr? r[ c ` e Zd Zd
dZd Zd ZddZd Zd Zd Z d
e
fd Z d
e e
fd ZdS ) BackupSystemNc " || _ || _ d S r2 )r& log_path)selfr& rb s r' __init__zBackupSystem.__init__w s
r? c n d||r| j nd di}t |dd d S )NrB )rC rD T) overwritevalidate)r& r dict_to_config)rc rC new_confs r' rQ z#BackupSystem._update_backups_config{ sN ".5!?4
%%h$%NNNNNr? c 6 K | d d S )NTrO rP )rc rR rS s r' initzBackupSystem.init s# ##D#11111r? Fc 6 K | d d S )NFrO rP )rc delete_backupss r' disablezBackupSystem.disable s# ##E#22222r? c
K i S r2 rX rc s r' checkzBackupSystem.check r? c
K i S r2 rX rp s r' showzBackupSystem.show rr r? c
K d S r2 rX rp s r' make_backupzBackupSystem.make_backup s r? r) c K t di }| d o | d | j k S rA )r rE rF r& )rc rG s r' check_statezBackupSystem.check_state sU ~~,,..22?BGGxx ""Mtxx'@'@DI'MMr? c
K d S r2 rX rp s r' rJ z&BackupSystem.get_last_backup_timestamp s tr? r2 F)r\ r] r^ rd rQ rk rn rq rt rv boolrx r intrJ rX r? r' r` r` v s ! ! ! !O O O2 2 23 3 3 3
N4 N N N N# r? r` c e Zd Z fdZ xZS )r; c T t t d S r2 )superrd r rc __class__s r' rd zPleskBackup.__init__ s!
r? r\ r] r^ rd
__classcell__r s @r' r; r; s8 r? r; c e Zd Z fdZ xZS )r: c T t t d S r2 )r rd r r s r' rd zcPanelBackup.__init__ s!
r? r r s @r' r: r: s8 ! ! ! ! ! ! ! ! !r? r: c e Zd Z fdZ xZS )r< c T t t d S r2 )r rd r r s r' rd zDirectAdminBackup.__init__ s!
%%%%%r? r r s @r' r< r< s8 & & & & & & & & &r? r< c @ e Zd Z fdZdefdZed Z xZS )r4 c t t t j dd | _ d S )Nr1softTasync_)r rd r r rK r s r' rd zR1Soft.__init__ s6
&.xEEE r? r) c K | j d {V }d | D S )Nc " i | ] \ }}|d v ||
S ))username timestampiprX .0kvs r'
<dictcomp>z R1Soft.show.<locals>.<dictcomp> s4
1333
q333r? rK infor, rc info_datas r' rt z R1Soft.show V ,++--------
!))
r? c P K | j |||| d {V d S r2 rK rk )rc r r passwordencryption_keyrS s r' rk z R1Soft.init s: l HhGGGGGGGGGGGr? r\ r] r^ rd dictrt rY rk r r s @r' r4 r4 sz F F F F F
D
H H ]H H H H Hr? r4 c @ e Zd Z fdZdefdZed Z xZS )
ClusterLogicsc t t t j t d | _ d S NTr )r rd r r rK r s r' rd zClusterLogics.__init__ s6
'''&.}TJJJ r? r) c K | j d {V }d | D S )Nc " i | ] \ }}|d v ||
S ))r urlapikeyrX r s r' r z&ClusterLogics.show.<locals>.<dictcomp> s4
1111
q111r? r r s r' rt zClusterLogics.show r r? c @ K |d= | j j di | d {V d S )NforcerX r )rc rS s r' rk zClusterLogics.init sB
7O dl ))&)))))))))))r? r r s @r' r r ss K K K K K
D
* * ]* * * * *r? r c e Zd Z fdZ xZS )r= c t t t j | j d | _ d S r )r rd r r rK r& r s r' rd zSample.__init__ s8
(((&.tyFFF r? r r s @r' r= r= sA G G G G G G G G Gr? r= c n e Zd Z fdZdefdZed
d Zd dZde e
fdZ de fd Z
xZS ) r3 c t t dt j dt
j t j | j d | _ d S )Nz /var/log//Tr )
r rd r r PRODUCTAcronisBackupConfigLOG_NAMEr rK r& r s r' rd zAcronis.__init__ sX
G $ .A.J.J K
'.tyFFF r? r) c K | j d {V }d | D S )Nc " i | ] \ }}|d v ||
S ))r r rX r s r' r z Acronis.show.<locals>.<dictcomp> s4
1---
q---r? r r s r' rt z Acronis.show r r? Fc K | j d {V }| j ||||t j d {V d S )N provisionr tmp_dir)rK is_agent_installedrk r TMPDIRrc r r r rS r s r' rk z Acronis.init s "l = = ? ???????? l K
r? Nc F K | j | d {V S r2 )rK backups)rc untils r'
_list_backupszAcronis._list_backups s. \))%000000000r? c K | d {V }|r&t t d |D S d S )Nc 3 K | ];}|j t j V <dS ))tzinfoN)createdreplacer utcr )r backups r' <genexpr>z4Acronis.get_last_backup_timestamp.<locals>.<genexpr> sW N**(,*??IIKK r? )r r| max)rc r s r' rJ z!Acronis.get_last_backup_timestamp ss **,,,,,,,, ")
tr? c K t | d{V S # t j t f$ r t
$ r t d Y dS w xY w)z if backup exists, than state OKNzError during checking stateF)r{ r asyncioCancelledErrorr Exceptionlogger exceptionrp s r' rx zAcronis.check_state s d 0 0 2 222222233 3&(AB : ; ; ;55 s &+ :A)(A)rz r2 )r\ r] r^ rd r rt rY rk r r r| rJ r{ rx r r s @r' r3 r3 s G G G G G
D
]
1 1 1 1 # 4 r? r3 c @ e Zd ZdefdZd Zdee fdZddZ dS ) CloudLinuxBaser) c K | j d {V }| d |d< | j d {V |d< |S )Nusagebackup_space_used_bytes login_url)rK r popr r s r' rt zCloudLinuxBase.show
sr ,++-------- /8}}W/E/E +,'+|'='='?'?!?!?!?!?!?!? + r? c H K t d | j d {V d S # t $ rX}t j d t t |j r |j d rt | nd d }~ww xY w)Nz
Making backupzCloudLinux backup failedr r ) r r rK make_initial_backup_strictr loggingr r[ lenrR str)rc es r' rv zCloudLinuxBase.make_backup s O$$$ ,99;; ; ; ; ; ; ; ; ; ; 8 9 9 9! af++G!&)GA
s ?
B! AB B!c D K | j d {V S r2 )rK get_backup_progressrp s r' r z"CloudLinuxBase.get_backup_progress s, \55777777777r? Fc K t d| j z | j d {V }| j ||||t j d {V d S )NzStarting %s initr )r r r& rK r rk r r r s r' rk zCloudLinuxBase.init s &2333 "l = = ? ???????? l K
r? Nrz )
r\ r] r^ r rt rv r r| r rk rX r? r' r r sq D 88C= 8 8 8 8
r? r c Z e Zd Zd\ ZZ fdZed fd Z G d d Zej de
f fd Z ej fd Z ej de
e f fd
Zej de
e f fd Zej def fd Zde
fd
Zd fd Z xZS )r6 )paidunpaidc ` t t | _ d S r2 )r rd r
r& r s r' rd zCloudLinux.__init__/ s$
r? Fc K t j t j d {V }t |d |d | d {V d S )N server_idloginr r )r acronis_credentialsr
get_server_idr rk )rc r rS credentialsr s r' rk zCloudLinux.init3 s # 7 .00
ggll
#
r? c $ e Zd Zed ZdS )CloudLinux.Decoratorsc F t j fd }|S )Nc K | g|R i | d {V S # t $ r1 | d d {V | g|R i | d {V cY S w xY w)NTr )r rk )rc rR rS rV s r' wrappedzOCloudLinux.Decorators.update_credentials_on_unauthorized_error.<locals>.wrappedA s :!"4!9$!9!9!9&!9!999999990 : : : ))$)/////////!"4!9$!9!9!9&!9!9999999999:s 8AA) functoolswraps)rV r s ` r' (update_credentials_on_unauthorized_errorz>CloudLinux.Decorators.update_credentials_on_unauthorized_error? s8
_Q
:
:
:
:
: Nr? N)r\ r] r^ staticmethodr rX r? r'
Decoratorsr > s-
r? r r) c K t d {V }t j t j d {V }| dd }| dd }||d< ||d< |S )Nr sizer r purchased_backup_gb
resize_url)r rt r
acronis_checkr r rF )rc r responser r r s r' rt zCloudLinux.showK s '',,..(((((( . .00
'll61 5 5 \\%..
+> '(", , r? c X K t d {V d S r2 )r rv r s r' rv zCloudLinux.make_backupZ s5 gg!!###########r? c T K t d {V S r2 )r r r s r' r z CloudLinux.get_backup_progress^ s/ WW00222222222r? c T K t d {V S r2 )r rJ r s r' rJ z$CloudLinux.get_last_backup_timestampb s/ WW66888888888r? c T K t d {V S r2 )r rx r s r' rx zCloudLinux.check_statef s/ WW((*********r? c K t j t j d {V }n3# t $ r&}| j | dcY d }~S d }~ww xY w| j | d dS )Nr )statusr r )r r ) r r r r r UNPAIDadd_used_spacePAIDrF )rc contentr s r' rq zCloudLinux.checkj s F # 1$244 GG F F F "k!2B2B2D2DEE E E E E E E F )W[[-@-@AAAs ,1
A!A A! A!c K t d {V |r.t j t j d {V d S d S )Nr )r rn r acronis_remover r )rc rm r s r' rn zCloudLinux.disablet sw ggoo O(:3K3M3MNNN N N N N N N N N N O Or? rz )r\ r] r^ r r rd rY rk r r r rt rv r r| r rJ r{ rx rq rn r r s @r' r6 r6 , s #LD&
]
8 D 98 8$ $ $ $ 98$ 838C= 3 3 3 3 3 983 89# 9 9 9 9 9 989 8+4 + + + + + 98+BT B B B BO O O O O O O O O Or? r6 c 8 e Zd Z fdZe fd Z xZS )r8 c ` t t | _ d S r2 )r rd r r& r s r' rd z CloudLinuxOnPremise.__init__{ s$
) r? c J K t j |i | d {V d S r2 )r rk )rc rR rS r s r' rk zCloudLinuxOnPremise.init s: egglD+F+++++++++++r? )r\ r] r^ rd rY rk r r s @r' r8 r8 z s] * * * * * , , , , ], , , , ,r? r8 )FT)Dr r r datetimer typingr r r r defence360agent.contracts.configr r r
r r r r
r r r r r r r r !defence360agent.contracts.licenser defence360agent.internals.clnr r *defence360agent.subsys.panels.cpanel.panelr /defence360agent.subsys.panels.directadmin.panelr )defence360agent.subsys.panels.plesk.panelr restore_infectedr (restore_infected.backup_backends.acronisr $restore_infected.backup_backends_libr r getLoggerr\ r r( r r0 r" rH r| rJ rY r r[ r` r; r: r< r4 r r= r3 r r6 r8 rX r? r' <module>r s 1 1 1 1 1 1 1 1 1 1 1 1 9 8 8 8 8 8 A A A A A A A A = = = = = = G G G G G G ; ; ; ; ; ; 000000EEEEEE
8 $ $L L L d3i
#x- 4=Xc] = = = =
># > > > >
i " " " " " " " "J ,
! ! ! ! !< ! ! !
& & & & & & & &
H H H H H\ H H H$* * * * *L * * *,G G G G G\ G G G 1 1 1 1 1l 1 1 1h
W
@KO KO KO KO KO KO KO KO\, , , , ,. , , , , ,r? defence360agent/subsys/__pycache__/clcagefs.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000031226 00000000000 021522 0 ustar
r_j' d dl Z d dlZd dlZdZdZ G d de Z G d d Zd Zdd
Z dd
Z
d Z d Z ddZ
dS ) Nz/etc/cagefs/cagefs.mpz/usr/sbin/cagefsctlc e Zd Zd Zd ZdS )CagefsMpConflictc 2 d|dt d|d| _ d S )NzConflict in adding 'z' to z5 because of pre-existing alternative specification: '')CAGEFS_MP_FILENAME_msg)selfnew_item
existing_items T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/clcagefs.py__init__zCagefsMpConflict.__init__ s, xx+++]]]
<
c | j S N)r r s r __str__zCagefsMpConflict.__str__ s
yr N)__name__
__module__ __qualname__r
r r r r r s2
r r c e Zd ZdZdZdZd Zd Zd Ze d Z
d Z d Z d
Z
e d Ze d Ze d
Zd Zd Zd ZdS ) CagefsMpItems @!%r !c |dd dk r d| _ dS | dk r d| _ dS || _ dS )zConstructor
:param arg: Is either path to add to cagefs.mp or a raw line is read
from cagefs.mp
:param prefix: The same as adding prefix '!' to arg before passing it
to ctorN #r )
_path_specstrip)r args r r
zCagefsMpItem.__init__# sI rr7d?? "DOOO
YY[[C
"DOOO !DOOOr c \ | dk r|d| j |fz | _ | S )z%Specify mode as in fluent constructor @Ns %s,%03o)prefixr )r modes r r# zCagefsMpItem.mode2 s4 ;;==D T%5 (DOT+B BDO r c 4 t j | j S r )osfsdecoder r s r r zCagefsMpItem.__str__: s {4?+++r c 8 | dk rdS | d dk r| dz S | S )Nr // r )paths r
_add_slashzCagefsMpItem._add_slash= s. 3;;4 8w $; r c d t | }| s| rdS t | }t | }| | S )NF)r _adoptis_dummyr, r+
startswith)r anotheradopted this_pathtest_preexist_in_paths r pre_exist_inzCagefsMpItem.pre_exist_inE s %%g.. ==?? g . . 0 0 5 ++DIIKK88 , 7 7 G G ##$9:::r c t | }| s| rdS | | k rdS t j t j gi}g }| | | | v S )NFT)r r. r/ r" _PREFIX_MOUNT_RW_PREFIX_MOUNT_ROget)r existingr2 prefix_compatibility_map null_optionss r is_compatible_by_prefix_withz)CagefsMpItem.is_compatible_by_prefix_withP s %%h// ==?? g . . 0 0 5 ;;==GNN , , , ,4
)L,I+J$
{{}} 8 < < NN l!
!
r c | j d u S r r r s r r/ zCagefsMpItem.is_dummyc s $&&r c N t | t r| S t | S r )
isinstancer )xs r r. zCagefsMpItem._adoptf s% a & & #H ?? "r c 8 | d d S )zjCut off mode from path spec like @/var/run/screen,777
Only one comma per path spec is allowed ;-) ,r )split path_specs r
_cut_off_modezCagefsMpItem._cut_off_modem s t$$Q''r c @ | t j S r )lstripr PREFIX_LISTrF s r _cut_off_prefixz CagefsMpItem._cut_off_prefixu s 8999r c p t t | j S r )r rL rH r r s r r+ zCagefsMpItem.pathy s- ++ & &t 7 7
r c ^ | j | k r| j dd S dS )Nr r r )r r+ r s r r" zCagefsMpItem.prefix~ s- ?diikk ) )?1Q3' '3r c | j S r r? r s r speczCagefsMpItem.spec s
r N)r r r rK r7 r8 r
r# r staticmethodr, r5 r= r/ r. rH rL r+ r" rP r r r r r s K
"
"
" , , , \ ; ; ;
&' ' ' # # \# ( ( \( : : \:
r r c J t j t S r )r% r+ existsCAGEFSCTL_TOOLr r r is_cagefs_presentrU s
7>>. ) ))r c |d}|d}t j | st j | |t j | | t j | || d S )Nr) )r% r+ isdirmkdirchmodchown)r+ r# owner_idgroup_ids r _mk_mount_dir_setup_permr^ sm
7==
t HT8X&&&&&r r Tc
t | ||| t j t st j t dg t j t dg t t d } t || z
|
d |D }
fd|D } | s| dd | dd }|
d
| d z d z |
d z | |rt j t d
g n1
| d st%
| d | dS # | w xY w)a
Add mount point to /etc/cagefs/cagefs.mp
:param path: Directory path to be added in cagefs.mp and mounted
from within setup_mount_dir_cagefs().
If this directory does not exist, then it is created.
:param added_by: package or component, mount dir relates to, or whatever
will stay in cagefs.mp with "# added by..." comment
:param mode: If is not None: Regardless of whether directory exists or not
prior this call, it's permissions will be set to mode.
:param owner_id: Regardless of whether directory exists or not prior this
call, it's owner id will be set to.
If None, the owner won't be changed.
:param group_id: Regardless of whether directory exists or not prior this
call, it's group id will be set to.
If None, the group won't be changed.
:param prefix: Mount point prefix. Default is mount as RW.
Pass '!' to add read-only mount point.
Refer CageFS section at http://docs.cloudlinux.com/
for more options.
:param remount_cagefs: If True, cagefs skeleton will be automatically
remounted to apply changes.
:returns: None
Propagates native EnvironmentError if no CageFS installed or something
else goes wrong.
Raises CagefsMpConflict if path is already specified in cagefs.mp,
but in a way which is opposite to mount_as_readonly param.
z --create-mpz
--check-mpzrb+c 3 > K | ]}| V d S r )rstrip).0 file_lines r <genexpr>z)setup_mount_dir_cagefs.<locals>.<genexpr> s. FFy ((**FFFFFFr c > g | ]} | |S r )r5 )rb rB r
s r
<listcomp>z*setup_mount_dir_cagefs.<locals>.<listcomp> s<
x'<'<Q'?'?
r r
s # next line is added by zutf-8
--remount-allr) N)r^ r% r+ rS r
subprocesscallrT openr r# seekreplacewriteencoderP closer= r ) r+ added_byr# r\ r] r" remount_cagefs cagefs_mp trim_nl_iterpre_exist_optionr
s @r setup_mount_dir_cagefsry s ^ T48<<< 7>>, - - 9 7888O^\2333
'//I
..33D99FFIFFF
#
C NN1a ''c22H OO+hoog.F.FFN
OOHMMOOe 3 4 4 4 OO
C ABBB667G7KLL C"8-=b-ABB B s
D(G Gc t t d 5 } | cd d d S # 1 swxY w Y d S )Nrb)rn r readlines)fs r _get_cagefs_mp_linesr~ s
$ ' ' 1{{}} s 7;;c t t d 5 }| | cd d d S # 1 swxY w Y d S )Nwb)rn r
writelines)linesr} s r _write_cagefs_mp_linesr s
$ ' ' #1||E""# # # # # # # # # # # # # # # # # #s 8<<c t }t j dt j t j | fz fd|D }t
| |r t j t dg dS dS )z
Remove mount points matching given path from cagefs.mp file
:param str path: Path that should be removed from file.
:param bool remount_cagefs: Remount cagefs skeleton or not
:return: Nothing
s ^[%s]?%s(,\d+)?$c 3 F K | ]} | |V d S r )match)rb liners r rd z*remove_mount_dir_cagefs.<locals>.<genexpr> s2 L Laggdmm L L L L L L Lr rk N)
r~ recompiler rK escaper rl rm rT )r+ ru r lines_with_excluded_pathr s @r remove_mount_dir_cagefsr s
! " "E
8")D// JJ A M L L L L L L 3444 ; 9:::::; ;r )rV NN)rV NNr T)T)r% r rl r rT Exceptionr r rU r^ ry r~ r r r r r <module>r s
, & y g g g g g g g g T* * *
'
'
'
'&
V V V Vr
# # #
; ; ; ; ; ;r defence360agent/subsys/__pycache__/clcagefs.cpython-311.pyc 0000644 0000000 0000000 00000031226 00000000000 020563 0 ustar
r_j' d dl Z d dlZd dlZdZdZ G d de Z G d d Zd Zdd
Z dd
Z
d Z d Z ddZ
dS ) Nz/etc/cagefs/cagefs.mpz/usr/sbin/cagefsctlc e Zd Zd Zd ZdS )CagefsMpConflictc 2 d|dt d|d| _ d S )NzConflict in adding 'z' to z5 because of pre-existing alternative specification: '')CAGEFS_MP_FILENAME_msg)selfnew_item
existing_items T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/clcagefs.py__init__zCagefsMpConflict.__init__ s, xx+++]]]
<
c | j S N)r r s r __str__zCagefsMpConflict.__str__ s
yr N)__name__
__module__ __qualname__r
r r r r r s2
r r c e Zd ZdZdZdZd Zd Zd Ze d Z
d Z d Z d
Z
e d Ze d Ze d
Zd Zd Zd ZdS ) CagefsMpItems @!%r !c |dd dk r d| _ dS | dk r d| _ dS || _ dS )zConstructor
:param arg: Is either path to add to cagefs.mp or a raw line is read
from cagefs.mp
:param prefix: The same as adding prefix '!' to arg before passing it
to ctorN #r )
_path_specstrip)r args r r
zCagefsMpItem.__init__# sI rr7d?? "DOOO
YY[[C
"DOOO !DOOOr c \ | dk r|d| j |fz | _ | S )z%Specify mode as in fluent constructor @Ns %s,%03o)prefixr )r modes r r# zCagefsMpItem.mode2 s4 ;;==D T%5 (DOT+B BDO r c 4 t j | j S r )osfsdecoder r s r r zCagefsMpItem.__str__: s {4?+++r c 8 | dk rdS | d dk r| dz S | S )Nr // r )paths r
_add_slashzCagefsMpItem._add_slash= s. 3;;4 8w $; r c d t | }| s| rdS t | }t | }| | S )NF)r _adoptis_dummyr, r+
startswith)r anotheradopted this_pathtest_preexist_in_paths r pre_exist_inzCagefsMpItem.pre_exist_inE s %%g.. ==?? g . . 0 0 5 ++DIIKK88 , 7 7 G G ##$9:::r c t | }| s| rdS | | k rdS t j t j gi}g }| | | | v S )NFT)r r. r/ r" _PREFIX_MOUNT_RW_PREFIX_MOUNT_ROget)r existingr2 prefix_compatibility_map null_optionss r is_compatible_by_prefix_withz)CagefsMpItem.is_compatible_by_prefix_withP s %%h// ==?? g . . 0 0 5 ;;==GNN , , , ,4
)L,I+J$
{{}} 8 < < NN l!
!
r c | j d u S r r r s r r/ zCagefsMpItem.is_dummyc s $&&r c N t | t r| S t | S r )
isinstancer )xs r r. zCagefsMpItem._adoptf s% a & & #H ?? "r c 8 | d d S )zjCut off mode from path spec like @/var/run/screen,777
Only one comma per path spec is allowed ;-) ,r )split path_specs r
_cut_off_modezCagefsMpItem._cut_off_modem s t$$Q''r c @ | t j S r )lstripr PREFIX_LISTrF s r _cut_off_prefixz CagefsMpItem._cut_off_prefixu s 8999r c p t t | j S r )r rL rH r r s r r+ zCagefsMpItem.pathy s- ++ & &t 7 7
r c ^ | j | k r| j dd S dS )Nr r r )r r+ r s r r" zCagefsMpItem.prefix~ s- ?diikk ) )?1Q3' '3r c | j S r r? r s r speczCagefsMpItem.spec s
r N)r r r rK r7 r8 r
r# r staticmethodr, r5 r= r/ r. rH rL r+ r" rP r r r r r s K
"
"
" , , , \ ; ; ;
&' ' ' # # \# ( ( \( : : \:
r r c J t j t S r )r% r+ existsCAGEFSCTL_TOOLr r r is_cagefs_presentrU s
7>>. ) ))r c |d}|d}t j | st j | |t j | | t j | || d S )Nr) )r% r+ isdirmkdirchmodchown)r+ r# owner_idgroup_ids r _mk_mount_dir_setup_permr^ sm
7==
t HT8X&&&&&r r Tc
t | ||| t j t st j t dg t j t dg t t d } t || z
|
d |D }
fd|D } | s| dd | dd }|
d
| d z d z |
d z | |rt j t d
g n1
| d st%
| d | dS # | w xY w)a
Add mount point to /etc/cagefs/cagefs.mp
:param path: Directory path to be added in cagefs.mp and mounted
from within setup_mount_dir_cagefs().
If this directory does not exist, then it is created.
:param added_by: package or component, mount dir relates to, or whatever
will stay in cagefs.mp with "# added by..." comment
:param mode: If is not None: Regardless of whether directory exists or not
prior this call, it's permissions will be set to mode.
:param owner_id: Regardless of whether directory exists or not prior this
call, it's owner id will be set to.
If None, the owner won't be changed.
:param group_id: Regardless of whether directory exists or not prior this
call, it's group id will be set to.
If None, the group won't be changed.
:param prefix: Mount point prefix. Default is mount as RW.
Pass '!' to add read-only mount point.
Refer CageFS section at http://docs.cloudlinux.com/
for more options.
:param remount_cagefs: If True, cagefs skeleton will be automatically
remounted to apply changes.
:returns: None
Propagates native EnvironmentError if no CageFS installed or something
else goes wrong.
Raises CagefsMpConflict if path is already specified in cagefs.mp,
but in a way which is opposite to mount_as_readonly param.
z --create-mpz
--check-mpzrb+c 3 > K | ]}| V d S r )rstrip).0 file_lines r <genexpr>z)setup_mount_dir_cagefs.<locals>.<genexpr> s. FFy ((**FFFFFFr c > g | ]} | |S r )r5 )rb rB r
s r
<listcomp>z*setup_mount_dir_cagefs.<locals>.<listcomp> s<
x'<'<Q'?'?
r r
s # next line is added by zutf-8
--remount-allr) N)r^ r% r+ rS r
subprocesscallrT openr r# seekreplacewriteencoderP closer= r ) r+ added_byr# r\ r] r" remount_cagefs cagefs_mp trim_nl_iterpre_exist_optionr
s @r setup_mount_dir_cagefsry s ^ T48<<< 7>>, - - 9 7888O^\2333
'//I
..33D99FFIFFF
#
C NN1a ''c22H OO+hoog.F.FFN
OOHMMOOe 3 4 4 4 OO
C ABBB667G7KLL C"8-=b-ABB B s
D(G Gc t t d 5 } | cd d d S # 1 swxY w Y d S )Nrb)rn r readlines)fs r _get_cagefs_mp_linesr~ s
$ ' ' 1{{}} s 7;;c t t d 5 }| | cd d d S # 1 swxY w Y d S )Nwb)rn r
writelines)linesr} s r _write_cagefs_mp_linesr s
$ ' ' #1||E""# # # # # # # # # # # # # # # # # #s 8<<c t }t j dt j t j | fz fd|D }t
| |r t j t dg dS dS )z
Remove mount points matching given path from cagefs.mp file
:param str path: Path that should be removed from file.
:param bool remount_cagefs: Remount cagefs skeleton or not
:return: Nothing
s ^[%s]?%s(,\d+)?$c 3 F K | ]} | |V d S r )match)rb liners r rd z*remove_mount_dir_cagefs.<locals>.<genexpr> s2 L Laggdmm L L L L L L Lr rk N)
r~ recompiler rK escaper rl rm rT )r+ ru r lines_with_excluded_pathr s @r remove_mount_dir_cagefsr s
! " "E
8")D// JJ A M L L L L L L 3444 ; 9:::::; ;r )rV NN)rV NNr T)T)r% r rl r rT Exceptionr r rU r^ ry r~ r r r r r <module>r s
, & y g g g g g g g g T* * *
'
'
'
'&
V V V Vr
# # #
; ; ; ; ; ;r defence360agent/subsys/__pycache__/notifier.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006641 00000000000 021575 0 ustar
r_jI d Z ddlZddlZddlZdZdZdZdZdZdZ d Z
d
Z d Z d Z
d
ZdZdedededefdZdeddfdZdedededdfdZddZdS )z$Send events via Notification service Nz /opt/imunify360/lib/event.sockg $@ i CONFIG_UPDATEDUSER_SCAN_STARTEDUSER_SCAN_FINISHEDUSER_SCAN_MALWARE_FOUNDCUSTOM_SCAN_STARTEDCUSTOM_SCAN_FINISHEDCUSTOM_SCAN_MALWARE_FOUNDSCRIPT_BLOCKEDevent_iduserbodyreturnc t j | |t j t j | d d d }| d }t
| t k r5t d t
| t t
|
t d |z S )Nzutf-8)r r
r z#message size {} exceeds limit of {}big) byteorder) jsondumpsbase64 b64encodeencodedecodelen _MAX_SIZE Exceptionformatto_bytes
_LEN_BYTES)r r
r eventbinarys T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/notifier.py_prepare_eventr" s J $TZ%5%5%<%<W%E%EFFMM
E \\'
"
"F
6{{Y 1 8 8F Y
v;;
e < <v EE r c K t j t d {V \ }} | | | d {V | d S # | w xY w)N)asyncioopen_unix_connection SOCKET_PATHwritedrainclose)r _writers r! _send_eventr- * s 2;????????IAv Ullnn s /A+ +Bc K t | || }t j t | t d{V dS )z>Send an event with given event_id and user, having given body.N)r" r% wait_forr- SOCKET_TIMEOUT)r r
r r s r!
trigger_eventr1 3 sJ 8T4 0 0E
;u--~
>
>>>>>>>>>>r# c B K t t di d{V dS )zRSend CONFIG_UPDATED event.
This forces imunify-notifier to reread its config. N)r1 CONFIG_UPDATED_EVENT_ID r# r! config_updatedr6 9 s3 /R
8
8888888888r# )r N)__doc__r% r r r' r0 r r r4 USER_SCAN_STARTED_EVENT_IDUSER_SCAN_FINISHED_EVENT_ID USER_SCAN_MALWARE_FOUND_EVENT_ID CUSTOM_SCAN_STARTED_EVENT_ID CUSTOM_SCAN_FINISHED_EVENT_ID"CUSTOM_SCAN_MALWARE_FOUND_EVENT_IDSCRIPT_BLOCKED_EVENT_IDstrdictbytesr" r- r1 r6 r5 r# r! <module>rB s * *
.
* 0 2 #< 4 6 %@ "* FS F F4 FE F F F F(U t ?# ?S ? ? ? ? ? ? 9 9 9 9 9 9r# defence360agent/subsys/__pycache__/notifier.cpython-311.pyc 0000644 0000000 0000000 00000006641 00000000000 020636 0 ustar
r_jI d Z ddlZddlZddlZdZdZdZdZdZdZ d Z
d
Z d Z d Z
d
ZdZdedededefdZdeddfdZdedededdfdZddZdS )z$Send events via Notification service Nz /opt/imunify360/lib/event.sockg $@ i CONFIG_UPDATEDUSER_SCAN_STARTEDUSER_SCAN_FINISHEDUSER_SCAN_MALWARE_FOUNDCUSTOM_SCAN_STARTEDCUSTOM_SCAN_FINISHEDCUSTOM_SCAN_MALWARE_FOUNDSCRIPT_BLOCKEDevent_iduserbodyreturnc t j | |t j t j | d d d }| d }t
| t k r5t d t
| t t
|
t d |z S )Nzutf-8)r r
r z#message size {} exceeds limit of {}big) byteorder) jsondumpsbase64 b64encodeencodedecodelen _MAX_SIZE Exceptionformatto_bytes
_LEN_BYTES)r r
r eventbinarys T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/notifier.py_prepare_eventr" s J $TZ%5%5%<%<W%E%EFFMM
E \\'
"
"F
6{{Y 1 8 8F Y
v;;
e < <v EE r c K t j t d {V \ }} | | | d {V | d S # | w xY w)N)asyncioopen_unix_connection SOCKET_PATHwritedrainclose)r _writers r! _send_eventr- * s 2;????????IAv Ullnn s /A+ +Bc K t | || }t j t | t d{V dS )z>Send an event with given event_id and user, having given body.N)r" r% wait_forr- SOCKET_TIMEOUT)r r
r r s r!
trigger_eventr1 3 sJ 8T4 0 0E
;u--~
>
>>>>>>>>>>r# c B K t t di d{V dS )zRSend CONFIG_UPDATED event.
This forces imunify-notifier to reread its config. N)r1 CONFIG_UPDATED_EVENT_ID r# r! config_updatedr6 9 s3 /R
8
8888888888r# )r N)__doc__r% r r r' r0 r r r4 USER_SCAN_STARTED_EVENT_IDUSER_SCAN_FINISHED_EVENT_ID USER_SCAN_MALWARE_FOUND_EVENT_ID CUSTOM_SCAN_STARTED_EVENT_ID CUSTOM_SCAN_FINISHED_EVENT_ID"CUSTOM_SCAN_MALWARE_FOUND_EVENT_IDSCRIPT_BLOCKED_EVENT_IDstrdictbytesr" r- r1 r6 r5 r# r! <module>rB s * *
.
* 0 2 #< 4 6 %@ "* FS F F4 FE F F F F(U t ?# ?S ? ? ? ? ? ? 9 9 9 9 9 9r# defence360agent/subsys/__pycache__/persistent_state.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000007221 00000000000 023351 0 ustar
r_j d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl m
Z
ee Z ed Z
e
dz Z e Zd ed
ee
j e
j e
j f d efd Zd
edefdZd efdZd ZdS ) N) getLogger)Path)Literal)ANTIVIRUS_MODE)Scopez/var/imunify360z.persistent_state lock_filescopereturnc > t d| dz }|t j k rt | nc|t j k r"t rt | n1|t j k r!t st | |S )z%Register lock file for further usage..z.lock)PERSISTENT_STATE_DIRr AV_IM360
LOCK_FILESaddAVr IM360)r r
_lock_files \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/persistent_state.pyregister_lock_filer s &(<I(<(<(<<J z"""" %( ~ z"""" %+ n z"""
class_namevaluesc t } | dd || dz }t j || d dS # t
t f$ r'}t d| | Y d}~dS d}~ww xY w)z1Save state to a file in .persistent_state folder.T)parentsexist_ok.statewzFailed to save state: %s %sN) r
mkdirjsondumpopenAttributeErrorOSErrorloggererror)r r folder_path file_pathes r
save_stater) s 'KC$666 Z"7"7"77 &)..--..... G $ C C C 2JBBBBBBBBBCs AA B
# BB
c > t }|| dz }| rm t j | d S # t j t t f$ r&}t d| | Y d}~nd}~ww xY wt S )z3Load state from a file in .persistent_state folder.r rzFailed to load state: %s %sN) r
existsr loadr! JSONDecodeErrorr# UnicodeDecodeErrorr$ r% dict)r r& r' r( s r
load_stater1 * s 'K 3 3 33I G G9Y^^C 0 011 1$g/AB G G G LL6
A F F F F F F F F G 66Ms &A B( B Bc z t d D ] } | t vr| dS )z;Remove all unused lock files from .persistent_state folder.z*.lockN)r
globr unlink)r s r remove_unused_locksr5 8 sG )..x88 J & & r )r loggingr pathlibr typingr defence360agent.contracts.configr !defence360agent.contracts.pluginsr __name__r$ BASE_DIRr
setr strr r r r r0 r) r1 r5 r r <module>r@ s: ; ; ; ; ; ; 3 3 3 3 3 3
8 4! " " "55
SUU
"58U[%.#HI C3 C C C C C d r defence360agent/subsys/__pycache__/persistent_state.cpython-311.pyc 0000644 0000000 0000000 00000007221 00000000000 022412 0 ustar
r_j d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl m
Z
ee Z ed Z
e
dz Z e Zd ed
ee
j e
j e
j f d efd Zd
edefdZd efdZd ZdS ) N) getLogger)Path)Literal)ANTIVIRUS_MODE)Scopez/var/imunify360z.persistent_state lock_filescopereturnc > t d| dz }|t j k rt | nc|t j k r"t rt | n1|t j k r!t st | |S )z%Register lock file for further usage..z.lock)PERSISTENT_STATE_DIRr AV_IM360
LOCK_FILESaddAVr IM360)r r
_lock_files \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/persistent_state.pyregister_lock_filer s &(<I(<(<(<<J z"""" %( ~ z"""" %+ n z"""
class_namevaluesc t } | dd || dz }t j || d dS # t
t f$ r'}t d| | Y d}~dS d}~ww xY w)z1Save state to a file in .persistent_state folder.T)parentsexist_ok.statewzFailed to save state: %s %sN) r
mkdirjsondumpopenAttributeErrorOSErrorloggererror)r r folder_path file_pathes r
save_stater) s 'KC$666 Z"7"7"77 &)..--..... G $ C C C 2JBBBBBBBBBCs AA B
# BB
c > t }|| dz }| rm t j | d S # t j t t f$ r&}t d| | Y d}~nd}~ww xY wt S )z3Load state from a file in .persistent_state folder.r rzFailed to load state: %s %sN) r
existsr loadr! JSONDecodeErrorr# UnicodeDecodeErrorr$ r% dict)r r& r' r( s r
load_stater1 * s 'K 3 3 33I G G9Y^^C 0 011 1$g/AB G G G LL6
A F F F F F F F F G 66Ms &A B( B Bc z t d D ] } | t vr| dS )z;Remove all unused lock files from .persistent_state folder.z*.lockN)r
globr unlink)r s r remove_unused_locksr5 8 sG )..x88 J & & r )r loggingr pathlibr typingr defence360agent.contracts.configr !defence360agent.contracts.pluginsr __name__r$ BASE_DIRr
setr strr r r r r0 r) r1 r5 r r <module>r@ s: ; ; ; ; ; ; 3 3 3 3 3 3
8 4! " " "55
SUU
"58U[%.#HI C3 C C C C C d r defence360agent/subsys/__pycache__/svcctl.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000026052 00000000000 021252 0 ustar
r_j 4 d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z m
Z
ej e ZdZdZdZdZd Zd
Zd Zd ed
fdZ G d d
Z G d de Z G d de Zd Z d Z d Z d Z d Z d Z!d Z"d Z#d Z$dS ) N)Iterable)Core) check_run
CheckRunErrorrun
OsReleaseInfozimunify360-dos-protectionz imunify360-unified-access-loggerzimunify360-pamzimunify-auditd-log-readerzimunify360-scanlogdzimunify360-agentc fd}|S )Nc | K | i |}t d| t | d {V d S )Nzcheck_call(%r))loggerdebugr )argskwargscmdfuncs R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/svcctl.pywrapperz_apply_cmd.<locals>.wrapper sT dD#F## %s+++nn )r r s ` r
_apply_cmdr s#
Nr services_SystemctlBasedc K | D ]} | d {V | d {V n5# t $ r(}t d|| Y d }~ d S d }~ww xY wt d D ]T}| d {V r n7t d|d t j d d {V Ud S )Nz/Failed to reset failed state for service %s: %s
z4Service %s is still not active, sleep for %s seconds ) reset_failedrestartr r warningrange is_activeasynciosleep)r se_s r _reset_failed_stater% s; # # .."" " " " " " " "))++ NNA1a
FFFFFF
r # #A[[]]""""""
NNF1
-"" " " " " " " " " # #s 4=
A/ A**A/c e Zd ZdZd Zed Zed Zed Zede fd Z
de fdZ d Z d
Z
ede fd Zed Zd
Zed Zd ZdS )r systemctlc || _ d S N)
_service_name)self service_names r __init__z_SystemctlBased.__init__5 s )r c | j d| j gS )Nstart SVC_CTL_BINr* r+ s r r/ z_SystemctlBased.start8 s '4+=>>r c | j d| j gS )Nstopr0 r2 s r r4 z_SystemctlBased.stop< s &$*<==r c | j d| j gS )Nr r0 r2 s r r z_SystemctlBased.restart@ s )T-?@@r nowc 0 | j dg|rdgng | j S )Nenable--nowr0 r+ r6 s r _enable_nowz_SystemctlBased._enable_nowD s9
&wiiB
r c j K | | d {V i } t j | n# t t f$ r Y d S w xY w| dd dk rd S | dd dk r | d {V d S d S )N)r6 ID ubuntu
VERSION_IDz16.04)r; r dict_from_fileFileNotFoundErrorPermissionErrorgetlowerr )r+ r6 osinfos r r8 z_SystemctlBased.enableM s 3 ''''''''' ( 0 0 0 0!?3 FF ::dB % % ' '8 3 3 F ::lB ' '7 2 2,,.. 3 2s 7 A A c K | j d| j g}t j |t j t j d d {V }| d {V | d {V }|dk S Nz
is-enabledstdoutstderrr )r1 r* r create_subprocess_execsuDEVNULL communicatewait)r+ r procrcs r
is_enabledz_SystemctlBased.is_enabled^ s t/AB 3
BJ
99;;
Qwr c | j d| j g}t j |t j t j }|dk S rH )r1 r* rM callrN )r+ r rR s r is_enabled_syncz _SystemctlBased.is_enabled_syncg s7 t/AB
WSBJ
?
?
?Qwr c 0 | j dg|rdgng | j S )Ndisabler9 r0 r: s r rX z_SystemctlBased.disablel s9
&wiiB
r c | j d| j gS )Nreloadr0 r2 s r rZ z_SystemctlBased.reloadu s (D,>??r c b K | j d| j g}t | d {V \ }}}|dk S )Nz is-activer )r1 r* r )r+ r exit_coder$ s r r z_SystemctlBased.is_activey s? d.@A #C...... 1aA~ r c | j d| j gS )Nz reset-failedr0 r2 s r r z _SystemctlBased.reset_failed~ s .$2DEEr c t j | j d| j gt j t j }|j dk S )NcatrI r )rM r r1 r* rN
returncode)r+ cps r unit_existsz_SystemctlBased.unit_exists sA
V
ud&8 9::
}!!r N)__name__
__module__ __qualname__r1 r- r r/ r4 r boolr; r8 rS rV rX rZ r r rb r r r r r 2 s] K* * * ? ? Z? > > Z> A A ZA
$
Z
!4 ! ! ! !"
d
Z
@ @ Z@
F F ZF" " " " "r c e Zd ZdZdS )_CentOs7z/usr/bin/systemctlNrc rd re r1 r r r rh rh s &KKKr rh c e Zd ZdZdS )
_DebianUbuntuz/bin/systemctlNri r r r rk rk s "KKKr rk c t t fD ]3}t j |j r
|| c S 4t
d )Nz'Cannot instantiate appropriate adaptor.)rk rh ospathexistsr1 RuntimeError)r, as r adaptorrr sV X
& # #
7>>!- ( ( #1\?? " " " #
@
A
AAr c K t | }t | d }| d {V r| d {V s| d {V t |f d {V t d D ]9}t
j d d {V | d {V r d S :t d| d| d S d S d S )Nz.socket r zFailed to await active z.socket after reseting )
rr rS r r r% r r r! r error)r,
agent_serviceagent_service_socketr$ s r activate_socket_servicerx s L))M"l#;#;#;<< #--////////
*4466666666
#//111111111!="2333333333 q A-"" " " " " " " ")3355555555
l
r c 4 t t j S r) )rr r SVC_NAMEr r r imunify360_servicer{ s 4= ! !!r c t t S # t $ r t d Y d S w xY w)Nz5DOS Protector service is not available on this system)rr DOS_PROTECTOR_SERVICE_NAMErp r infor r r imunify360_dos_protector_servicer sK 1222 KLLLtts $>>c * t t S r) )rr UAL_SERVICE_NAMEr r r imunify360_ual_servicer # $ $$r c * t t S r) )rr PAM_SERVICE_NAMEr r r imunify360_pam_servicer r r c * t t S r) )rr SCANLOGD_SERVICE_NAMEr r r imunify360_scanlogd_servicer s ( ) ))r c * t t S r) )rr AGENT_SERVICE_NAMEr r r imunify360_agent_servicer s % & &&r c t t } | rt t S t d d S )Nz9Auditd-log-reader service is not available on this system)rr AUDITD_SERVICE_NAMErb r r~ )units r imunify360_auditd_servicer sK & ' 'D ,*+++
KKKLLL 4r )%r loggingrm
subprocessrM typingr defence360agent.contracts.configr defence360agent.utilsr r r r getLoggerrc r r} r r r r r r r% r rh rk rr rx r{ r r r r r r r r r <module>r s 1 1 1 1 1 1 N N N N N N N N N N N N 8 $ $ 8 5 # 1 - ' #()# # # #*V" V" V" V" V" V" V" V"r' ' ' ' ' ' ' '# # # # #O # # #B B B
0" " " % % %% % %* * *' ' ' r defence360agent/subsys/__pycache__/svcctl.cpython-311.pyc 0000644 0000000 0000000 00000026052 00000000000 020313 0 ustar
r_j 4 d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z m
Z
ej e ZdZdZdZdZd Zd
Zd Zd ed
fdZ G d d
Z G d de Z G d de Zd Z d Z d Z d Z d Z d Z!d Z"d Z#d Z$dS ) N)Iterable)Core) check_run
CheckRunErrorrun
OsReleaseInfozimunify360-dos-protectionz imunify360-unified-access-loggerzimunify360-pamzimunify-auditd-log-readerzimunify360-scanlogdzimunify360-agentc fd}|S )Nc | K | i |}t d| t | d {V d S )Nzcheck_call(%r))loggerdebugr )argskwargscmdfuncs R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/svcctl.pywrapperz_apply_cmd.<locals>.wrapper sT dD#F## %s+++nn )r r s ` r
_apply_cmdr s#
Nr services_SystemctlBasedc K | D ]} | d {V | d {V n5# t $ r(}t d|| Y d }~ d S d }~ww xY wt d D ]T}| d {V r n7t d|d t j d d {V Ud S )Nz/Failed to reset failed state for service %s: %s
z4Service %s is still not active, sleep for %s seconds ) reset_failedrestartr r warningrange is_activeasynciosleep)r se_s r _reset_failed_stater% s; # # .."" " " " " " " "))++ NNA1a
FFFFFF
r # #A[[]]""""""
NNF1
-"" " " " " " " " " # #s 4=
A/ A**A/c e Zd ZdZd Zed Zed Zed Zede fd Z
de fdZ d Z d
Z
ede fd Zed Zd
Zed Zd ZdS )r systemctlc || _ d S N)
_service_name)self service_names r __init__z_SystemctlBased.__init__5 s )r c | j d| j gS )Nstart SVC_CTL_BINr* r+ s r r/ z_SystemctlBased.start8 s '4+=>>r c | j d| j gS )Nstopr0 r2 s r r4 z_SystemctlBased.stop< s &$*<==r c | j d| j gS )Nr r0 r2 s r r z_SystemctlBased.restart@ s )T-?@@r nowc 0 | j dg|rdgng | j S )Nenable--nowr0 r+ r6 s r _enable_nowz_SystemctlBased._enable_nowD s9
&wiiB
r c j K | | d {V i } t j | n# t t f$ r Y d S w xY w| dd dk rd S | dd dk r | d {V d S d S )N)r6 ID ubuntu
VERSION_IDz16.04)r; r dict_from_fileFileNotFoundErrorPermissionErrorgetlowerr )r+ r6 osinfos r r8 z_SystemctlBased.enableM s 3 ''''''''' ( 0 0 0 0!?3 FF ::dB % % ' '8 3 3 F ::lB ' '7 2 2,,.. 3 2s 7 A A c K | j d| j g}t j |t j t j d d {V }| d {V | d {V }|dk S Nz
is-enabledstdoutstderrr )r1 r* r create_subprocess_execsuDEVNULL communicatewait)r+ r procrcs r
is_enabledz_SystemctlBased.is_enabled^ s t/AB 3
BJ
99;;
Qwr c | j d| j g}t j |t j t j }|dk S rH )r1 r* rM callrN )r+ r rR s r is_enabled_syncz _SystemctlBased.is_enabled_syncg s7 t/AB
WSBJ
?
?
?Qwr c 0 | j dg|rdgng | j S )Ndisabler9 r0 r: s r rX z_SystemctlBased.disablel s9
&wiiB
r c | j d| j gS )Nreloadr0 r2 s r rZ z_SystemctlBased.reloadu s (D,>??r c b K | j d| j g}t | d {V \ }}}|dk S )Nz is-activer )r1 r* r )r+ r exit_coder$ s r r z_SystemctlBased.is_activey s? d.@A #C...... 1aA~ r c | j d| j gS )Nz reset-failedr0 r2 s r r z _SystemctlBased.reset_failed~ s .$2DEEr c t j | j d| j gt j t j }|j dk S )NcatrI r )rM r r1 r* rN
returncode)r+ cps r unit_existsz_SystemctlBased.unit_exists sA
V
ud&8 9::
}!!r N)__name__
__module__ __qualname__r1 r- r r/ r4 r boolr; r8 rS rV rX rZ r r rb r r r r r 2 s] K* * * ? ? Z? > > Z> A A ZA
$
Z
!4 ! ! ! !"
d
Z
@ @ Z@
F F ZF" " " " "r c e Zd ZdZdS )_CentOs7z/usr/bin/systemctlNrc rd re r1 r r r rh rh s &KKKr rh c e Zd ZdZdS )
_DebianUbuntuz/bin/systemctlNri r r r rk rk s "KKKr rk c t t fD ]3}t j |j r
|| c S 4t
d )Nz'Cannot instantiate appropriate adaptor.)rk rh ospathexistsr1 RuntimeError)r, as r adaptorrr sV X
& # #
7>>!- ( ( #1\?? " " " #
@
A
AAr c K t | }t | d }| d {V r| d {V s| d {V t |f d {V t d D ]9}t
j d d {V | d {V r d S :t d| d| d S d S d S )Nz.socket r zFailed to await active z.socket after reseting )
rr rS r r r% r r r! r error)r,
agent_serviceagent_service_socketr$ s r activate_socket_servicerx s L))M"l#;#;#;<< #--////////
*4466666666
#//111111111!="2333333333 q A-"" " " " " " " ")3355555555
l
r c 4 t t j S r) )rr r SVC_NAMEr r r imunify360_servicer{ s 4= ! !!r c t t S # t $ r t d Y d S w xY w)Nz5DOS Protector service is not available on this system)rr DOS_PROTECTOR_SERVICE_NAMErp r infor r r imunify360_dos_protector_servicer sK 1222 KLLLtts $>>c * t t S r) )rr UAL_SERVICE_NAMEr r r imunify360_ual_servicer # $ $$r c * t t S r) )rr PAM_SERVICE_NAMEr r r imunify360_pam_servicer r r c * t t S r) )rr SCANLOGD_SERVICE_NAMEr r r imunify360_scanlogd_servicer s ( ) ))r c * t t S r) )rr AGENT_SERVICE_NAMEr r r imunify360_agent_servicer s % & &&r c t t } | rt t S t d d S )Nz9Auditd-log-reader service is not available on this system)rr AUDITD_SERVICE_NAMErb r r~ )units r imunify360_auditd_servicer sK & ' 'D ,*+++
KKKLLL 4r )%r loggingrm
subprocessrM typingr defence360agent.contracts.configr defence360agent.utilsr r r r getLoggerrc r r} r r r r r r r% r rh rk rr rx r{ r r r r r r r r r <module>r s 1 1 1 1 1 1 N N N N N N N N N N N N 8 $ $ 8 5 # 1 - ' #()# # # #*V" V" V" V" V" V" V" V"r' ' ' ' ' ' ' '# # # # #O # # #B B B
0" " " % % %% % %* * *' ' ' r defence360agent/subsys/__pycache__/sysctl.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003153 00000000000 021272 0 ustar
r_j{ d dl Z d Zd Zd ZdS ) Nc n t j j t j ddg| d R S )Nprocsys.)ospathjoinsepsplit)names R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/sysctl.py _build_pathr s,
7< @
3 @ @ @@ c t t | 5 }| }|j rt | cd d d S |cd d d S # 1 swxY w Y d S )N)openr readstripisdigitint)r fdatas r
r r s
k$ Avvxx~~ < t99
s <A4&A44A8;A8c t t | d 5 }| t | d d d d S # 1 swxY w Y d S )Nw)r r writestr)r valuer s r
r r s
k$ % % E
s #AAA)r r r r r r
<module>r sH A A A r defence360agent/subsys/__pycache__/sysctl.cpython-311.pyc 0000644 0000000 0000000 00000003153 00000000000 020333 0 ustar
r_j{ d dl Z d Zd Zd ZdS ) Nc n t j j t j ddg| d R S )Nprocsys.)ospathjoinsepsplit)names R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/sysctl.py _build_pathr s,
7< @
3 @ @ @@ c t t | 5 }| }|j rt | cd d d S |cd d d S # 1 swxY w Y d S )N)openr readstripisdigitint)r fdatas r
r r s
k$ Avvxx~~ < t99
s <A4&A44A8;A8c t t | d 5 }| t | d d d d S # 1 swxY w Y d S )Nw)r r writestr)r valuer s r
r r s
k$ % % E
s #AAA)r r r r r r
<module>r sH A A A r defence360agent/subsys/__pycache__/systemd_notifier.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000005316 00000000000 023343 0 ustar
r_j ~ d Z ddlZddlZddlZddlmZ ej e Zda da
G d de Z d Z
d ZdS ) z"Notify systemd about process state N)ANTIVIRUS_MODEFc " e Zd ZdZdZdZdZdZdS )
AgentStatez*Allowed agent state for notifying systemd.zREADY=1z STATUS=Starting main processz#STATUS=Applying database migrationszSTATUS=DemonizedN)__name__
__module__ __qualname____doc__READYSTARTING MIGRATING
DAEMONIZED \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/systemd_notifier.pyr r s( 44 E-H5I#JJJr r c b t s"t j dd ada t S )N
NOTIFY_SOCKETT)_socket_detachedosenvironpop_notify_socket_addrr r r _take_notify_socketr s.
jnn_d C C r c t rdS t }|sdS | d r
d|dd z n|} t j t j t j t j z 5 }| | | | ddd dS # 1 swxY w Y dS # t $ r&}t d| Y d}~dS d}~ww xY w)z
Send notification to systemd, allowed formats described here
https://www.freedesktop.org/software/systemd/man/sd_notify.html
For example:
notify("STATUS=Almost ready")
N@ z9some problem has occurred during notifying of systemd: %s)
r r
startswithsocketAF_UNIX
SOCK_DGRAM SOCK_CLOEXECconnectsendallencodeOSErrorlogger exception)stateaddr connect_addrsockes r notifyr- # se D '+ooc&:&:D4$qrr(??L
] NF -0C C
)
LL & & & LL ( ( ( ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) )
G
s< 6C 7=C4 C CC C C
C>C99C>)r loggingr r defence360agent.contracts.configr getLoggerr r& r r objectr r r- r r r <module>r2 s ( (
; ; ; ; ; ;
8 $ $ $ $ $ $ $ $ $ $
r defence360agent/subsys/__pycache__/systemd_notifier.cpython-311.pyc 0000644 0000000 0000000 00000005316 00000000000 022404 0 ustar
r_j ~ d Z ddlZddlZddlZddlmZ ej e Zda da
G d de Z d Z
d ZdS ) z"Notify systemd about process state N)ANTIVIRUS_MODEFc " e Zd ZdZdZdZdZdZdS )
AgentStatez*Allowed agent state for notifying systemd.zREADY=1z STATUS=Starting main processz#STATUS=Applying database migrationszSTATUS=DemonizedN)__name__
__module__ __qualname____doc__READYSTARTING MIGRATING
DAEMONIZED \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/systemd_notifier.pyr r s( 44 E-H5I#JJJr r c b t s"t j dd ada t S )N
NOTIFY_SOCKETT)_socket_detachedosenvironpop_notify_socket_addrr r r _take_notify_socketr s.
jnn_d C C r c t rdS t }|sdS | d r
d|dd z n|} t j t j t j t j z 5 }| | | | ddd dS # 1 swxY w Y dS # t $ r&}t d| Y d}~dS d}~ww xY w)z
Send notification to systemd, allowed formats described here
https://www.freedesktop.org/software/systemd/man/sd_notify.html
For example:
notify("STATUS=Almost ready")
N@ z9some problem has occurred during notifying of systemd: %s)
r r
startswithsocketAF_UNIX
SOCK_DGRAM SOCK_CLOEXECconnectsendallencodeOSErrorlogger exception)stateaddr connect_addrsockes r notifyr- # se D '+ooc&:&:D4$qrr(??L
] NF -0C C
)
LL & & & LL ( ( ( ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) )
G
s< 6C 7=C4 C CC C C
C>C99C>)r loggingr r defence360agent.contracts.configr getLoggerr r& r r objectr r r- r r r <module>r2 s ( (
; ; ; ; ; ;
8 $ $ $ $ $ $ $ $ $ $
r defence360agent/subsys/__pycache__/web_server.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000124050 00000000000 022114 0 ustar
r_jk
d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m c m Z
d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZm Z d dl m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ d dl%Z%d d l&m'Z' d d
l(m)Z)m*Z* d d l+m,Z, d d l-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d d
l6m7Z7 e8ej9 : dd Z; dZ< ed Z=dZ>dZ?dZ@dZAdZBdZC ejD d ZE eFd eGe jH D ZIdZJ ejK eL ZM G d d eN ZO G d d eN ZP G d d ZQd! ZRd" ZSd#eTfd$ZUd#e!eT fd%ZVd#eWfd&ZX eY d'd(ZZd) Z[d* Z\d+ Z] dXd-e g e f d.e8fd/Z^d0 Z_d#e eT fd1Z`d#e!e$eT fd2Zad3Zb ejc d45 d#edfd6 Zed7edd#e eT fd8ZfdYd7edd#e$eT fd:Zgd#edfd;Zhd#e!eT fd<ZidZd7edd#e$eT fd>Zjd#e$eT fd?Zk ed@ ZldAeTd#edfdBZmd[dCZn e7jo e; d[dD Zpd[dEZqdF ZrdG Zsd#edfdHZtd#edfdIZud\dJZvd#edfdKZwdYdLZxdM ZydNeWd#e eW fdOZzdP Z{dQ Z| e.d45 dR Z} e4 e e8ej9 : dSdT U V dW Z~dS )] N)suppress)
ContextVar) timedelta)Version)Path)CalledProcessError
check_call check_outputDEVNULL)AnyCallableListOptionalSetTupleIterable)IntegrationConfig)is_generic_panel_installedis_plesk_installed)g)async_lru_cacheatomic_rewrite check_runget_system_user_names
OsReleaseInfo
CheckRunError
TimedCacheBACKUP_EXTENSION)webserver_gracefull_restart!IM360_GRACEFUL_RESTART_MIN_PERIODi, z*/usr/local/cpanel/scripts/restartsrv_httpdz/tmp/lshttpd/lshttpd.pid) /usr/local/lsws/bin/lswsctrl condrestart)r! restartz%/usr/local/lsws/conf/httpd_config.xmlz /usr/local/lsws/bin/litespeedz/usr/sbin/apache2z/usr/sbin/httpdz Server version:.*(\d+\.\d+\.\d+)c # > K | ]}| V d S N)encode).0xs V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/web_server.py <genexpr>r* : s* @@1AHHJJ@@@@@@ apachec e Zd ZdZdS )NotRunningErrorz[
Error for cases when the web server is expected to be running but it
is not.
N__name__
__module__ __qualname____doc__ r+ r) r. r. @ s r+ r. c e Zd ZdZdS )ConfigInvalidErrorzO
Error used to indicate that the web server config is having error(s).
Nr/ r4 r+ r) r6 r6 H s r+ r6 c e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
e fd Z
d e fd
Zd
eeeef fdZd Zd
efdZdS )LiteSpeedConfiguseIpInProxyHeadersecurity
accessControlallowdenyr c 8 t j | | _ d S r% )ET
fromstringconfig)selfcontents r) __init__zLiteSpeedConfig.__init__X s mG,, r+ returnc | j | j }||j s| j S t |j S r% )rC findCLIENT_IP_IN_HEADER_TAGtext CLIENT_IP_IN_HEADER_DISABLEDintrD elements r) client_ip_in_headerz#LiteSpeedConfig.client_ip_in_header[ s> +""4#?@@ ?',?4 47< r+ valuec | j | j }|3t j | j }| j | t
| |_ d S r% )rC rI rJ rA ElementappendstrrK )rD rQ rO s r) set_client_ip_in_headerz'LiteSpeedConfig.set_client_ip_in_headera sX +""4#?@@ ?j!=>>G K w ' ' '5zz r+ c | j d d| j | j | j g }|*|j r#d |j D S t S )N/.c h | ]R}| d D ]:}|| d r
|dd n|| d f;SS ),TN)splitendswith)r' sitems r) <setcomp>z>LiteSpeedConfig.access_control_allowed_list.<locals>.<setcomp>t s} GGCLL "mmC 0 0:crcdDMM#<N<NO r+ ) rC rI join SECURITY_TAGACCESS_CONTROL_TAGACCESS_CONTROL_ALLOWED_TAGrK r^ setrN s r) access_control_allowed_listz+LiteSpeedConfig.access_control_allowed_listh s +"" HH%+3
7< ++--
uu r+ c d |D }d | }| j d d| j | j | j g }|t
j | j }| j d d| j | j g }|t
j | j }| j | j }|3t
j | j }| j | | | | | ||_ d S )Nc D g | ] }|d r |d dz n|d S )r> r r\ r4 )r' ra s r)
<listcomp>zCLiteSpeedConfig.set_access_control_allowed_list.<locals>.<listcomp>} s1 KKK4$q'6a3 tAwKKKr+ r[ rX rY )
rc rC rI rd re rf rA rS rT rK )rD alloweditemsrQ rO access_controlr: s r) set_access_control_allowed_listz/LiteSpeedConfig.set_access_control_allowed_list| sL KK7KKK+"" HH%+3
?j!@AAG ![ - - ) / N %!#D,C!D!D ;++D,=>># !z$*; < <HK&&x000/// ! !' * * * r+ c t j }t j | j }| |dd | S )Nzutf-8T)encodingxml_declaration)ioBytesIOrA ElementTreerC writegetvalue)rD buftrees r) tostringzLiteSpeedConfig.tostring sD jll~dk**
3$
???||~~ r+ N)r0 r1 r2 rJ rd re rf ACCESS_CONTROL_DENIED_TAGrL CLIENT_IP_IN_HEADER_ENABLED#CLIENT_IP_IN_HEADER_TRUSTED_IP_ONLYrF rM rP rV r r rU boolrh ro bytesrz r4 r+ r) r8 r8 N s 2 L(!( & #$ "# *+'- - -!S ! ! ! ! "S " " " "SsDy1A-B ( D % r+ r8 c t t t 5 t t cddd S # 1 swxY w Y dS )z3Return LiteSpeed's pid or None if it can't be read.N)r OSError
ValueErrorrM LITESPEED_PID_FILE_PATH
read_bytesr4 r+ r) _get_litespeed_pidr s ': & & 9 9*5577889 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9s &AAAc t } t | ot j | S # t $ r Y dS w xY w)zb
Litespeed use constant PID file path, so using it to determinate status
:return bool
F)r r~ psutil
pid_exists
OverflowError)pids r) litespeed_runningr sT
CC2F -c 2 2333 uus "3
A ArG c 8 t j d pt S )N litespeed)shutilwhichLITESPEED_BIN_PATHr4 r+ r) _litespeed_binr s < $ $ :(::r+ c 6 t } | r| d ndS )z
Finding process with name 'httpd' which belongs to system user.
:return str: path to the apache binary if it is running
:return None: if apache is not running
httpd_binN)_apache_running_process)infos r) apache_runningr s$ # $ $D $ .4 $.r+ c K t }|st d t j t j z rqt d rPt d t j
| t j | d d {V }nt |g| d {V }n+# t $ r t d Y dS w xY w|S )NApache is not runningz/etc/apache2/envvarsz . /etc/apache2/envvars && {} {}T)shellz Apache doesn't work properlyr+ )r r. r id_likeDEBIANr existsr formatshlexquoterc r loggerwarning)argsr stdouts r) apache_binary_callr s0 I 7 5666 ! # #m&: :
9+,,3355
9 %188K **EJt,<,< FF %i%7$%788888888F 5666ss Ms B)C
$C54C5
exclude_usersc d }t j t j z r t s
| rt }nt
}t
t | z
}t | }|rm|d J ||d< |d }t j
|| r|S n2# t $ r%}t d| Y d}~nd}~ww xY wdS )z
Finding process with name 'httpd' which belongs to system user.
Return process info for the apache binary if it is running.
Return None if apache is not running
c ^ t r t j dd t k S dS )N
web_server server_typeF)r r getAPACHEr4 r+ r) is_generic_panel_on_apachez;_apache_running_process.<locals>.is_generic_panel_on_apache s. % ' ' P$( }EEO Our+ exeNr z#Can't determine apache bin path: %s)r r r r APACHE2_BIN_PATHHTTPD_BIN_PATHrg r _apache_running_process_infoospathsamefiler r r )r r r sys_usersr httpd_process_exeexcs r) r r s# "
-"66 # # : : < <# % " )++,,}<I ' 2 2D DE{&&& %[ D $U w +<==
D D D KK=s C C C C C C C C D 4s
)B5 5
C$?C C$c t d D ]a}t t 5 t fdt j g d D d cddd c S # 1 swxY w Y bdS )z#Retry process_iter() on IndexError.r? c 3 K | ]G}|j d 8|j d d r|j d v >|j V HdS )r N)z/httpdz/apache2usernamer r_ )r' pr s r) r* z/_apache_running_process_info.<locals>.<genexpr> sp
u
1 F5M 2 23I J J 2 F: .) ; ; F < ; ; ;
r+ )namer r uidsgidsattrsN)ranger
IndexErrornextr process_iter)r _s ` r) r r
s
1XX
j
!
!
# 0 I I I
s 1A''A+ .A+ c t dh }|st d t j | |d d |d d dS )z&Make web server user/group own *path*.rootr z5Can't find running apache process without root owner.r r r N)r r. r chown)r r s r) r r s] "& : : :D
C
HT4<?DLO44444r+ c ` t d t j g d D d S )z;Return path to a running nginx binary or None if not found.c 3 K | ]i}|j d Z|j d d r:|j d -d|j d v r |j d dv Z|j d V jdS )r Nnginxr r )r zwww-datar )r' r s r) r* z%find_running_nginx.<locals>.<genexpr>+ s
v*F6N++G44 +F5M-qve},,F:&*???
F5M @???
r+ )r r r r N)r r r r4 r+ r) find_running_nginxr ( sJ
(/J/J/JKKK
r+
webserver_running_cb granularityc K |dk sJ t | D ]/} | }|r|c S t j ||z d {V 0|S )Nr )r asynciosleep)r timeout_secr r results r) check_with_timeoutr : sz
????
;
%%'' MMMmK+ 56666666666
r+ c @ t j d S )z8
though, available != running
:return bool:
z/etc/cpanel/ea4/is_ea4)r r isfiler4 r+ r) is_EA4_availabler J s
7>>2 3 33r+ c t j t }|r|gS t j t j z r#dddt j | gS | ddgS )a{
:return list: command which can be passed to check_call(..., shell=False)
'apache2 -k graceful' will not work for Ubuntu
and will produce
'Invalid Mutex directory in argument file:${APACHE_LOCK_DIR}' error.
https://serverfault.com/questions/558283/apache2-config-variable-is-not-defined
That is why this specialization for Ubuntu graceful restart.
systemctlreloadz --job-mode=replace-irreversiblyz-kgraceful) r r CPANEL_RESTART_APACHE_SCRIPTr r r r r basename) apachectlrestartsrv_httpds r) _apache_graceful_restart_cmdr R sv |$@AA " !! !55 -
- G Y ' '
4,,r+ c t j r t j d d } | s t d d S | }t j |d r|S t d| n*# t $ r t d Y nw xY wd S )Nr graceful_restart_scriptz'graceful_restart_script option is emptyr z,Web server restart script does not exist: %sz;Integration config is missing graceful_restart_script field) r r to_dictr r r^ r r KeyError)restart_scriptcmds r) +_graceful_restart_cmd_from_integration_confr l s !! . 6 8 8 F) N "
= t &&((Cw~~c!f%%
NN>
NNM
" 4s B) )$CC r> )maxsizec B t j d } | sdS t | dgt }n# t
t f$ r Y dS w xY wt j d| }|d uo*t |
d t k S )N systemd-runFz --version)stderrzsystemd\s+(\d+)r> ) r r r
r decoder r researchrM group _SYSTEMD_RUN_WAIT_MIN_VERSION) systemd_runoutmatchs r) _systemd_run_supports_waitr s ,}--K uK5gFFFMMOO ' ( uu I(# . .E EKKNN <<s *A AAwaitc g }t j d x}rC||dddgz
}| r#t r| d | d |S )Nr z-pzSendSIGKILL=noz--slice=graceful_restartz--waitz--)r r r rT )r prefixr s r) _systemd_run_prefixr s| F l=111{ &
$.00 $ MM( # # #
d Mr+ Fc t | }t }||t | z S t r|t t z S t x}r|t
| z S t d )z Gracefully restart a web server.N Could not detect a web server)r r listr LITESPEED_RESTART_CMDr r RuntimeError)r r r r s r) _graceful_restart_cmdr s
&
&F
5
7
7C
S !! 4 23333"$$$y @4Y????
6
7
77r+ c J t j t S r% )r r r LITESPEED_CONF_PATHr4 r+ r) _litespeed_installedr s
7>>- . ..r+ c d} t r7 t j dd }n# t $ r Y dS w xY w|t k rdS d} t j t
j z r4t s| r$t j
t S t j
t S )u systemd unit for this host's Apache, or None when the host is not
Apache-based. Derived from OS/panel, not a running process — recovery
runs precisely when the server is not alive.Fr r NT)r r r r r r r r r r r r r r )on_generic_apacher s r) _apache_systemd_unitr s !## ! +/ mLLKK 44 & 4 -"66 2 2 12 w 0111
7 N + ++s (
66Tc t | }t r|t t z S t j t x}r||dgz S t }|t d |dd|gz S )a- Full (non-graceful) restart to bring a web server back up after a
reload left it down. Detects the server by install/config presence (not a
running process, which may be down) and raises when no safe command is
known (e.g. generic nginx, which has only a graceful integration script).
z --restartNz0No safe hard-restart command for this web serverr r# ) r r r LITESPEED_HARD_RESTART_CMDr r r r r )r r r units r) _hard_restart_cmdr s !
&
&F 9 78888!<(DEEE 8);777 ! !D |MNNN [)T2 22r+ c t r= t j dd } | r| S n# t $ r Y nw xY wt x}r(t
j t j z rddgS |dgS t rt dgS t x}r|dgS t d )Nr config_test_scriptr
configtest-tr )
r r r r^ r r r r r r r r r )r
apache_bin nginx_bins r) _configtest_cmdr s !## #' 6JKKC
#yy{{"
# D $%%%z ! " "]%9 9 / . .D!! ! $''(** * !4
6
7
77s *<
A A graceful_restart_caller
new_configc
K t j t z fd
t j }t || sdS fd t
d d{V t n=# t $ r0}t
d| Y d}~dS d}~ww xY wt j
fd } t j t |
t }t# j d }t& |j } | d{V t& | n # t& | w xY wt d dS # t0 $ r/}t
d
| Y d}~nd}~ww xY wdS )a
Update Web-server config with fallback in case of an error happens.
It tries to do all the best but because of graceful_restart() the
faulty config might still be applied but in practice it is barely
probable (because of premature config check).
1. The new config is checked before to be applied.
2. The new config (if checked valid) is atomically applied.
3. The graceful Web-server restart is scheduled. It may hold the actual
restart for some time, but it is a required workaround
of a litespeed issue.
4. If the Web-server failed to restart the config is reverted.
Return value: True if no errors (at least up to the server restart),
False if There was an error and config was reverted.
Note: It is possible that the config may be reverted even when return
value is True. It is because the graceful_restart may delay the actual
restart and config may be reverted on that (delayed) stage.
c t t 5 t j d d d d S # 1 swxY w Y d S r% )r FileNotFoundErrorr unlink)config_backup_paths r)
remove_backupz)safe_update_config.<locals>.remove_backup s
'
(
( * * I( ) ) ) * * * * * * * * * * * * * * * * * *s 8<<)backupTc t j d S # t $ r& t d Y d S w xY w)Nw)r renamer openclose)r config_paths r) revertz"safe_update_config.<locals>.revert" sa + I(+ 6 6 6 6 6 + + + c " " ( ( * * * * * * +s ,A
A
raise_exceptionNz*Failed to get graceful restart command: %sFc d }d }| s| t d| t d } | | t } | | d S d S )Nc | sD| 2t d| d S d S d S )Nz'The reverted config seems to be invalidexc_info cancelled exceptionr criticalfuts r) log_config_errorzFsafe_update_config.<locals>.restart_callback.<locals>.log_config_error9 sb }} 3==??+FOOA!$ $ +F+Fr+ c | sD| 2t d| d S d S d S )Nzuncaught exceptionr' r) r- s r) log_uncaught_exceptionzLsafe_update_config.<locals>.restart_callback.<locals>.log_uncaught_exception@ sa }} 3==??+FOO,s}} $ +F+Fr+ z7Web server failed to start... Revert changes back. (%s)Tr# )r* r+ r error create_taskr add_done_callback_graceful_restart)taskr/ r1 loopr restart_cmdr" s r) restart_callbackz,safe_update_config.<locals>.restart_callback8 s
>>##
(8(8(D MNN$$ ''
4(H(H(HII&&'7888''(9+(F(FGG&&'=>>>>>
r+ )
done_callbackr> z)Successfully scheduled web server restartz Web server config is invalid: %s)r fspathr r r r r r r r r2 r get_running_loopr coalesce_callsGRACEFUL_RESTART_MIN_PERIODr5 inspectstack_graceful_restart_callerrg functionresetr r6 )
r! r make_backuper9 graceful_restart caller_frame
context_tokenr r7 r r8 r" s
` @@@@@r) safe_update_configrI sh * ;//2BB* * * * * '..--K +z+ F F F t+ + + + + +6..........
/11KK LLEq I I I FHHH55555
')) 8
6E '7G
}q) 044\5JKK
:"";// / / / / / / / $ * *= 9 9 9 9 $ * *= 9 9 9 9 ?@@@ti 7;;;j 5s< $F+ ;B
C%B??CE0 0 F +
G$5%G G$c K t t | p
t d{V t d dS # t
$ r&}t d| Y d}~dS d}~ww xY w)]
Gracefully restart a web server.
If web server cannot be detected, do nothing.
N!Successfully restarted web server"Could not restart a Web server: %s)_log_graceful_restart_startr r r r r r )r8 errs r) r5 r5 c s !!!9 >'<'>'>????????? 788888 B B B;SAAAAAAAAABs #A
BA<<Bc K t | }|t _ | d {V t j d S # t j d w xY w)Nweb_server_restart_task)r5 r rQ pop)r8 r6 s r) _graceful_restart_coalescedrS r s] [ ) )D $A )zzzzzz '(((('((((s < Ac K t j d }t |j } t | d{V }t | n # t | w xY w|S )rK r> N)r? r@ rA rg rB rS rC )r8 rG rH r s r) rF rF | s =??1%L,00 1FGGM62;???????? &&}5555 &&}5555 Ms A, , Bc p t d } t d| d S )Nunknownz/Performing web server graceful restart, from %s)rA r r r )callers r) rN rN s0
%
)
))
4
4F
KKA6JJJJJr+ c t j d } t | j } t t | n # t | w xY w t t t t t d dS # t $ r&}t
d| Y d}~dS d}~ww xY w)zk
Gracefully restart a web server synchronously.
If web server cannot be detected, do nothing.
r> )r r rL rM N)r? r@ rA rg rB rN rC r r r r r r r )rG rH rO s r) graceful_restart_syncrY s =??1%L,00 1FGGM6#%%% &&}5555 &&}55559(**77KKKK 788888 B B B;SAAAAAAAAABs# A# # A?(C
C7C22C7c K t j d } t | j } t t | n # t | w xY w t d }n3# t $ r&}t
d| Y d}~dS d}~ww xY wt | d{V r t d dS t
d t d{V t | d{V r t d dS t d{V S )
ay Graceful web-server restart that confirms the reload actually completed
and recovers the server if it did not.
Unlike graceful_restart() it bypasses the coalesce throttle (the
post-update reload must never be dropped); unlike graceful_restart_sync()
it observes the reload outcome instead of returning as soon as systemd-run
queues the transient unit.
r> Tr rM NFrL zLWeb server reload after update did not complete cleanly; attempting recoveryz-Web server recovered on graceful reload retry)r? r@ rA rg rB rN rC r r r r _reload_confirmedr r2 _log_failed_configtest
_hard_restart)rG rH r rO s r) graceful_restart_confirmedr_ s =??1%L,00 1FGGM6#%%% &&}5555 &&}5555#... ;SAAAuuuuu s
#
####### 7888t
LL !
"
""""""""
s
#
####### CDDDt s# A% % BB
C CCc K t | d{V n:# t t f$ r&}t d| Y d}~dS d}~ww xY wt rdS t
d d{V n# t $ r Y dS w xY wdS )a Run *cmd* and report whether the reload truly succeeded.
With systemd-run --wait the exit code already reflects completion; on
older systemd (no --wait) the reload is fire-and-forget, so fall back to
a config test to detect a broken reload.
Nz'Web server reload returned an error: %sFTr# )r r r r r r r r6 r rO s r) r\ r\ s nn < ( @#FFFuuuuu "## t........... uu 4s& AA A%A< <
B
B
c K t d d {V d S # t $ r&} t d| Y d } ~ d S d } ~ ww xY w)NTr# z.Web server config test failed after update: %s)r r6 r r2 )rO s r) r] r] s L............ L L L EsKKKKKKKKKLs
A AA c j K t d } n3# t $ r&}t d| Y d }~dS d }~ww xY w t | d {V n:# t
t f$ r&}t d| Y d }~dS d }~ww xY wt d dS )NTr[ z Cannot recover web server: %sFz"Web server hard restart failed: %sz-Web server hard-restarted after failed reload)r r r r2 r r r ra s r) r^ r^ s T*** 4c:::uuuuunn < ( 93???uuuuu KK?@@@ 4s,
AA A A B0BBc K t d t t t d{V dS # t
$ r8}t d| | rt d |Y d}~dS d}~ww xY w)z\
Check web server's config file.
If web server cannot be detected, do nothing.
z!Performing web server config test) raise_excNz Could not run configtest: %szFailed to check config)r r r r r6 r r )r$ rO s r) r r s KK3444H))5GHHHHHHHHHHHH H H H5s;;; H$%=>>C G H H H H H HHs (A
B
-BB
c t | }|"t | d S t d | )Nr> z)Failed to parse apache version string: {})apache_version_regexpr r r r r )outputr s r) _parse_apache_version_outputri sV ! ( ( 0 0E u{{1~~&&& 7 > >v F F
r+ rh c > d | D S )a:
Parse response of httpd -M
:param output: stdout of httpd -M (with spaces before module name)
Output example:
Loaded Modules:
core_module (static)
so_module (static)
http_module (static)
mpm_prefork_module (shared)
:return: list with installed modules
c g | ]H}| t | d IS )r )
startswith BYTE_SPACESstripr^ )r' lines r) rk z-_parse_apache_module_list.<locals>.<listcomp>! sS ??; ' '
Q r+ )
splitlines)rh s r) _parse_apache_module_listrq s/ %%'' r+ c g }| d D ]L}| d }|dk r/| ||d M|S )N
rX r )r r^ rI rT rn )dumpincludesro indexs r) _parse_includesrw ( sp H
##D)) 2 2 # 199 OODL . . 0 0 1 1 1 Or+ c t K t t g d d {V S # t $ r g cY S w xY w)N)r r z-D
DUMP_INCLUDES)rw r r r4 r+ r)
dump_includesrz 1 sg F F FGG G G G G G G
s #( 77c K t } | t d t | dg d {V }t | }t
d| |S )Nr z-vzApache %s version detected)r r. r ri r r r )r r versions r) apache_versionr} : sy !!J 5666:t,--
-
-
-
-
-
-C*3::<<88G
KK,g666 Nr+ 'IMUNIFY360_APACHE_MODULES_CACHE_TIMEOUTiX )seconds)
expirationc N K t d d {V } t | S )Nz-M)r rq )r s r) apache_modulesr E s5 &d++
+
+
+
+
+
+F $V , ,,r+ )r r )F)Tr% )rG N)r functoolsr? rs loggingr r r r stringxml.etree.ElementTreeetreeru rA
contextlibr contextvarsr datetimer packaging.versionr pathlibr
subprocessr r r
r typingr r
r r r r r r $defence360agent.api.integration_confr 3defence360agent.application.determine_hosting_panelr r &defence360agent.internals.global_scoper defence360agent.utilsr r r r r r r r defence360agent.utils.commonr rM environr r> r r r r r r r r compilerg tupler
whitespacerm r getLoggerr0 r r r. r6 r8 r r rU r r r r frozensetr r r r r r r r r lru_cacher~ r r r r r r r rA rI r5 r= rS rF rN rY r_ r\ r] r^ r ri rq rw rz r} r r4 r+ r) <module>r s
" " " " " " " " " " " " " " " % % % % % % L L L L L L L L L L L L F F F F F F F F F F F F F F F F F F
B B B B B B 5 4 4 4 4 4 E D D D D D !cJNN6?? L $ 9:: G I = 4 & ""
#FGG e@@V->(?(?@@@@@ 8 $ $ l T T T T T T T T n9 9 9 ; ; ; ; ; /
/ / / /u 2 .7Y[[ ' ' ' ' 'T (5 5 5 (
"2s7+
4 4 4-tCy - - - -4Xhsm5L > !$ Q D d tCy "8 8 8# 8 8 8 8"/d / / / /,hsm , , , ,(3 3D 3HSM 3 3 3 3(8# 8 8 8 8( &:&?@@ ^c ^d ^ ^ ^ ^B 9 9 9 9 , +,GHH) ) ) IH)
K K K
9 9 9*$!$ $! $! $! $!ND .L L L L T H H H H
e U & y JNNDc J J
- - - - -r+ defence360agent/subsys/__pycache__/web_server.cpython-311.pyc 0000644 0000000 0000000 00000124050 00000000000 021155 0 ustar
r_jk
d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m c m Z
d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZm Z d dl m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ d dl%Z%d d l&m'Z' d d
l(m)Z)m*Z* d d l+m,Z, d d l-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d d
l6m7Z7 e8ej9 : dd Z; dZ< ed Z=dZ>dZ?dZ@dZAdZBdZC ejD d ZE eFd eGe jH D ZIdZJ ejK eL ZM G d d eN ZO G d d eN ZP G d d ZQd! ZRd" ZSd#eTfd$ZUd#e!eT fd%ZVd#eWfd&ZX eY d'd(ZZd) Z[d* Z\d+ Z] dXd-e g e f d.e8fd/Z^d0 Z_d#e eT fd1Z`d#e!e$eT fd2Zad3Zb ejc d45 d#edfd6 Zed7edd#e eT fd8ZfdYd7edd#e$eT fd:Zgd#edfd;Zhd#e!eT fd<ZidZd7edd#e$eT fd>Zjd#e$eT fd?Zk ed@ ZldAeTd#edfdBZmd[dCZn e7jo e; d[dD Zpd[dEZqdF ZrdG Zsd#edfdHZtd#edfdIZud\dJZvd#edfdKZwdYdLZxdM ZydNeWd#e eW fdOZzdP Z{dQ Z| e.d45 dR Z} e4 e e8ej9 : dSdT U V dW Z~dS )] N)suppress)
ContextVar) timedelta)Version)Path)CalledProcessError
check_call check_outputDEVNULL)AnyCallableListOptionalSetTupleIterable)IntegrationConfig)is_generic_panel_installedis_plesk_installed)g)async_lru_cacheatomic_rewrite check_runget_system_user_names
OsReleaseInfo
CheckRunError
TimedCacheBACKUP_EXTENSION)webserver_gracefull_restart!IM360_GRACEFUL_RESTART_MIN_PERIODi, z*/usr/local/cpanel/scripts/restartsrv_httpdz/tmp/lshttpd/lshttpd.pid) /usr/local/lsws/bin/lswsctrl condrestart)r! restartz%/usr/local/lsws/conf/httpd_config.xmlz /usr/local/lsws/bin/litespeedz/usr/sbin/apache2z/usr/sbin/httpdz Server version:.*(\d+\.\d+\.\d+)c # > K | ]}| V d S N)encode).0xs V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/web_server.py <genexpr>r* : s* @@1AHHJJ@@@@@@ apachec e Zd ZdZdS )NotRunningErrorz[
Error for cases when the web server is expected to be running but it
is not.
N__name__
__module__ __qualname____doc__ r+ r) r. r. @ s r+ r. c e Zd ZdZdS )ConfigInvalidErrorzO
Error used to indicate that the web server config is having error(s).
Nr/ r4 r+ r) r6 r6 H s r+ r6 c e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
e fd Z
d e fd
Zd
eeeef fdZd Zd
efdZdS )LiteSpeedConfiguseIpInProxyHeadersecurity
accessControlallowdenyr c 8 t j | | _ d S r% )ET
fromstringconfig)selfcontents r) __init__zLiteSpeedConfig.__init__X s mG,, r+ returnc | j | j }||j s| j S t |j S r% )rC findCLIENT_IP_IN_HEADER_TAGtext CLIENT_IP_IN_HEADER_DISABLEDintrD elements r) client_ip_in_headerz#LiteSpeedConfig.client_ip_in_header[ s> +""4#?@@ ?',?4 47< r+ valuec | j | j }|3t j | j }| j | t
| |_ d S r% )rC rI rJ rA ElementappendstrrK )rD rQ rO s r) set_client_ip_in_headerz'LiteSpeedConfig.set_client_ip_in_headera sX +""4#?@@ ?j!=>>G K w ' ' '5zz r+ c | j d d| j | j | j g }|*|j r#d |j D S t S )N/.c h | ]R}| d D ]:}|| d r
|dd n|| d f;SS ),TN)splitendswith)r' sitems r) <setcomp>z>LiteSpeedConfig.access_control_allowed_list.<locals>.<setcomp>t s} GGCLL "mmC 0 0:crcdDMM#<N<NO r+ ) rC rI join SECURITY_TAGACCESS_CONTROL_TAGACCESS_CONTROL_ALLOWED_TAGrK r^ setrN s r) access_control_allowed_listz+LiteSpeedConfig.access_control_allowed_listh s +"" HH%+3
7< ++--
uu r+ c d |D }d | }| j d d| j | j | j g }|t
j | j }| j d d| j | j g }|t
j | j }| j | j }|3t
j | j }| j | | | | | ||_ d S )Nc D g | ] }|d r |d dz n|d S )r> r r\ r4 )r' ra s r)
<listcomp>zCLiteSpeedConfig.set_access_control_allowed_list.<locals>.<listcomp>} s1 KKK4$q'6a3 tAwKKKr+ r[ rX rY )
rc rC rI rd re rf rA rS rT rK )rD alloweditemsrQ rO access_controlr: s r) set_access_control_allowed_listz/LiteSpeedConfig.set_access_control_allowed_list| sL KK7KKK+"" HH%+3
?j!@AAG ![ - - ) / N %!#D,C!D!D ;++D,=>># !z$*; < <HK&&x000/// ! !' * * * r+ c t j }t j | j }| |dd | S )Nzutf-8T)encodingxml_declaration)ioBytesIOrA ElementTreerC writegetvalue)rD buftrees r) tostringzLiteSpeedConfig.tostring sD jll~dk**
3$
???||~~ r+ N)r0 r1 r2 rJ rd re rf ACCESS_CONTROL_DENIED_TAGrL CLIENT_IP_IN_HEADER_ENABLED#CLIENT_IP_IN_HEADER_TRUSTED_IP_ONLYrF rM rP rV r r rU boolrh ro bytesrz r4 r+ r) r8 r8 N s 2 L(!( & #$ "# *+'- - -!S ! ! ! ! "S " " " "SsDy1A-B ( D % r+ r8 c t t t 5 t t cddd S # 1 swxY w Y dS )z3Return LiteSpeed's pid or None if it can't be read.N)r OSError
ValueErrorrM LITESPEED_PID_FILE_PATH
read_bytesr4 r+ r) _get_litespeed_pidr s ': & & 9 9*5577889 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9s &AAAc t } t | ot j | S # t $ r Y dS w xY w)zb
Litespeed use constant PID file path, so using it to determinate status
:return bool
F)r r~ psutil
pid_exists
OverflowError)pids r) litespeed_runningr sT
CC2F -c 2 2333 uus "3
A ArG c 8 t j d pt S )N litespeed)shutilwhichLITESPEED_BIN_PATHr4 r+ r) _litespeed_binr s < $ $ :(::r+ c 6 t } | r| d ndS )z
Finding process with name 'httpd' which belongs to system user.
:return str: path to the apache binary if it is running
:return None: if apache is not running
httpd_binN)_apache_running_process)infos r) apache_runningr s$ # $ $D $ .4 $.r+ c K t }|st d t j t j z rqt d rPt d t j
| t j | d d {V }nt |g| d {V }n+# t $ r t d Y dS w xY w|S )NApache is not runningz/etc/apache2/envvarsz . /etc/apache2/envvars && {} {}T)shellz Apache doesn't work properlyr+ )r r. r id_likeDEBIANr existsr formatshlexquoterc r loggerwarning)argsr stdouts r) apache_binary_callr s0 I 7 5666 ! # #m&: :
9+,,3355
9 %188K **EJt,<,< FF %i%7$%788888888F 5666ss Ms B)C
$C54C5
exclude_usersc d }t j t j z r t s
| rt }nt
}t
t | z
}t | }|rm|d J ||d< |d }t j
|| r|S n2# t $ r%}t d| Y d}~nd}~ww xY wdS )z
Finding process with name 'httpd' which belongs to system user.
Return process info for the apache binary if it is running.
Return None if apache is not running
c ^ t r t j dd t k S dS )N
web_server server_typeF)r r getAPACHEr4 r+ r) is_generic_panel_on_apachez;_apache_running_process.<locals>.is_generic_panel_on_apache s. % ' ' P$( }EEO Our+ exeNr z#Can't determine apache bin path: %s)r r r r APACHE2_BIN_PATHHTTPD_BIN_PATHrg r _apache_running_process_infoospathsamefiler r r )r r r sys_usersr httpd_process_exeexcs r) r r s# "
-"66 # # : : < <# % " )++,,}<I ' 2 2D DE{&&& %[ D $U w +<==
D D D KK=s C C C C C C C C D 4s
)B5 5
C$?C C$c t d D ]a}t t 5 t fdt j g d D d cddd c S # 1 swxY w Y bdS )z#Retry process_iter() on IndexError.r? c 3 K | ]G}|j d 8|j d d r|j d v >|j V HdS )r N)z/httpdz/apache2usernamer r_ )r' pr s r) r* z/_apache_running_process_info.<locals>.<genexpr> sp
u
1 F5M 2 23I J J 2 F: .) ; ; F < ; ; ;
r+ )namer r uidsgidsattrsN)ranger
IndexErrornextr process_iter)r _s ` r) r r
s
1XX
j
!
!
# 0 I I I
s 1A''A+ .A+ c t dh }|st d t j | |d d |d d dS )z&Make web server user/group own *path*.rootr z5Can't find running apache process without root owner.r r r N)r r. r chown)r r s r) r r s] "& : : :D
C
HT4<?DLO44444r+ c ` t d t j g d D d S )z;Return path to a running nginx binary or None if not found.c 3 K | ]i}|j d Z|j d d r:|j d -d|j d v r |j d dv Z|j d V jdS )r Nnginxr r )r zwww-datar )r' r s r) r* z%find_running_nginx.<locals>.<genexpr>+ s
v*F6N++G44 +F5M-qve},,F:&*???
F5M @???
r+ )r r r r N)r r r r4 r+ r) find_running_nginxr ( sJ
(/J/J/JKKK
r+
webserver_running_cb granularityc K |dk sJ t | D ]/} | }|r|c S t j ||z d {V 0|S )Nr )r asynciosleep)r timeout_secr r results r) check_with_timeoutr : sz
????
;
%%'' MMMmK+ 56666666666
r+ c @ t j d S )z8
though, available != running
:return bool:
z/etc/cpanel/ea4/is_ea4)r r isfiler4 r+ r) is_EA4_availabler J s
7>>2 3 33r+ c t j t }|r|gS t j t j z r#dddt j | gS | ddgS )a{
:return list: command which can be passed to check_call(..., shell=False)
'apache2 -k graceful' will not work for Ubuntu
and will produce
'Invalid Mutex directory in argument file:${APACHE_LOCK_DIR}' error.
https://serverfault.com/questions/558283/apache2-config-variable-is-not-defined
That is why this specialization for Ubuntu graceful restart.
systemctlreloadz --job-mode=replace-irreversiblyz-kgraceful) r r CPANEL_RESTART_APACHE_SCRIPTr r r r r basename) apachectlrestartsrv_httpds r) _apache_graceful_restart_cmdr R sv |$@AA " !! !55 -
- G Y ' '
4,,r+ c t j r t j d d } | s t d d S | }t j |d r|S t d| n*# t $ r t d Y nw xY wd S )Nr graceful_restart_scriptz'graceful_restart_script option is emptyr z,Web server restart script does not exist: %sz;Integration config is missing graceful_restart_script field) r r to_dictr r r^ r r KeyError)restart_scriptcmds r) +_graceful_restart_cmd_from_integration_confr l s !! . 6 8 8 F) N "
= t &&((Cw~~c!f%%
NN>
NNM
" 4s B) )$CC r> )maxsizec B t j d } | sdS t | dgt }n# t
t f$ r Y dS w xY wt j d| }|d uo*t |
d t k S )N systemd-runFz --version)stderrzsystemd\s+(\d+)r> ) r r r
r decoder r researchrM group _SYSTEMD_RUN_WAIT_MIN_VERSION) systemd_runoutmatchs r) _systemd_run_supports_waitr s ,}--K uK5gFFFMMOO ' ( uu I(# . .E EKKNN <<s *A AAwaitc g }t j d x}rC||dddgz
}| r#t r| d | d |S )Nr z-pzSendSIGKILL=noz--slice=graceful_restartz--waitz--)r r r rT )r prefixr s r) _systemd_run_prefixr s| F l=111{ &
$.00 $ MM( # # #
d Mr+ Fc t | }t }||t | z S t r|t t z S t x}r|t
| z S t d )z Gracefully restart a web server.N Could not detect a web server)r r listr LITESPEED_RESTART_CMDr r RuntimeError)r r r r s r) _graceful_restart_cmdr s
&
&F
5
7
7C
S !! 4 23333"$$$y @4Y????
6
7
77r+ c J t j t S r% )r r r LITESPEED_CONF_PATHr4 r+ r) _litespeed_installedr s
7>>- . ..r+ c d} t r7 t j dd }n# t $ r Y dS w xY w|t k rdS d} t j t
j z r4t s| r$t j
t S t j
t S )u systemd unit for this host's Apache, or None when the host is not
Apache-based. Derived from OS/panel, not a running process — recovery
runs precisely when the server is not alive.Fr r NT)r r r r r r r r r r r r r r )on_generic_apacher s r) _apache_systemd_unitr s !## ! +/ mLLKK 44 & 4 -"66 2 2 12 w 0111
7 N + ++s (
66Tc t | }t r|t t z S t j t x}r||dgz S t }|t d |dd|gz S )a- Full (non-graceful) restart to bring a web server back up after a
reload left it down. Detects the server by install/config presence (not a
running process, which may be down) and raises when no safe command is
known (e.g. generic nginx, which has only a graceful integration script).
z --restartNz0No safe hard-restart command for this web serverr r# ) r r r LITESPEED_HARD_RESTART_CMDr r r r r )r r r units r) _hard_restart_cmdr s !
&
&F 9 78888!<(DEEE 8);777 ! !D |MNNN [)T2 22r+ c t r= t j dd } | r| S n# t $ r Y nw xY wt x}r(t
j t j z rddgS |dgS t rt dgS t x}r|dgS t d )Nr config_test_scriptr
configtest-tr )
r r r r^ r r r r r r r r r )r
apache_bin nginx_bins r) _configtest_cmdr s !## #' 6JKKC
#yy{{"
# D $%%%z ! " "]%9 9 / . .D!! ! $''(** * !4
6
7
77s *<
A A graceful_restart_caller
new_configc
K t j t z fd
t j }t || sdS fd t
d d{V t n=# t $ r0}t
d| Y d}~dS d}~ww xY wt j
fd } t j t |
t }t# j d }t& |j } | d{V t& | n # t& | w xY wt d dS # t0 $ r/}t
d
| Y d}~nd}~ww xY wdS )a
Update Web-server config with fallback in case of an error happens.
It tries to do all the best but because of graceful_restart() the
faulty config might still be applied but in practice it is barely
probable (because of premature config check).
1. The new config is checked before to be applied.
2. The new config (if checked valid) is atomically applied.
3. The graceful Web-server restart is scheduled. It may hold the actual
restart for some time, but it is a required workaround
of a litespeed issue.
4. If the Web-server failed to restart the config is reverted.
Return value: True if no errors (at least up to the server restart),
False if There was an error and config was reverted.
Note: It is possible that the config may be reverted even when return
value is True. It is because the graceful_restart may delay the actual
restart and config may be reverted on that (delayed) stage.
c t t 5 t j d d d d S # 1 swxY w Y d S r% )r FileNotFoundErrorr unlink)config_backup_paths r)
remove_backupz)safe_update_config.<locals>.remove_backup s
'
(
( * * I( ) ) ) * * * * * * * * * * * * * * * * * *s 8<<)backupTc t j d S # t $ r& t d Y d S w xY w)Nw)r renamer openclose)r config_paths r) revertz"safe_update_config.<locals>.revert" sa + I(+ 6 6 6 6 6 + + + c " " ( ( * * * * * * +s ,A
A
raise_exceptionNz*Failed to get graceful restart command: %sFc d }d }| s| t d| t d } | | t } | | d S d S )Nc | sD| 2t d| d S d S d S )Nz'The reverted config seems to be invalidexc_info cancelled exceptionr criticalfuts r) log_config_errorzFsafe_update_config.<locals>.restart_callback.<locals>.log_config_error9 sb }} 3==??+FOOA!$ $ +F+Fr+ c | sD| 2t d| d S d S d S )Nzuncaught exceptionr' r) r- s r) log_uncaught_exceptionzLsafe_update_config.<locals>.restart_callback.<locals>.log_uncaught_exception@ sa }} 3==??+FOO,s}} $ +F+Fr+ z7Web server failed to start... Revert changes back. (%s)Tr# )r* r+ r error create_taskr add_done_callback_graceful_restart)taskr/ r1 loopr restart_cmdr" s r) restart_callbackz,safe_update_config.<locals>.restart_callback8 s
>>##
(8(8(D MNN$$ ''
4(H(H(HII&&'7888''(9+(F(FGG&&'=>>>>>
r+ )
done_callbackr> z)Successfully scheduled web server restartz Web server config is invalid: %s)r fspathr r r r r r r r r2 r get_running_loopr coalesce_callsGRACEFUL_RESTART_MIN_PERIODr5 inspectstack_graceful_restart_callerrg functionresetr r6 )
r! r make_backuper9 graceful_restart caller_frame
context_tokenr r7 r r8 r" s
` @@@@@r) safe_update_configrI sh * ;//2BB* * * * * '..--K +z+ F F F t+ + + + + +6..........
/11KK LLEq I I I FHHH55555
')) 8
6E '7G
}q) 044\5JKK
:"";// / / / / / / / $ * *= 9 9 9 9 $ * *= 9 9 9 9 ?@@@ti 7;;;j 5s< $F+ ;B
C%B??CE0 0 F +
G$5%G G$c K t t | p
t d{V t d dS # t
$ r&}t d| Y d}~dS d}~ww xY w)]
Gracefully restart a web server.
If web server cannot be detected, do nothing.
N!Successfully restarted web server"Could not restart a Web server: %s)_log_graceful_restart_startr r r r r r )r8 errs r) r5 r5 c s !!!9 >'<'>'>????????? 788888 B B B;SAAAAAAAAABs #A
BA<<Bc K t | }|t _ | d {V t j d S # t j d w xY w)Nweb_server_restart_task)r5 r rQ pop)r8 r6 s r) _graceful_restart_coalescedrS r s] [ ) )D $A )zzzzzz '(((('((((s < Ac K t j d }t |j } t | d{V }t | n # t | w xY w|S )rK r> N)r? r@ rA rg rB rS rC )r8 rG rH r s r) rF rF | s =??1%L,00 1FGGM62;???????? &&}5555 &&}5555 Ms A, , Bc p t d } t d| d S )Nunknownz/Performing web server graceful restart, from %s)rA r r r )callers r) rN rN s0
%
)
))
4
4F
KKA6JJJJJr+ c t j d } t | j } t t | n # t | w xY w t t t t t d dS # t $ r&}t
d| Y d}~dS d}~ww xY w)zk
Gracefully restart a web server synchronously.
If web server cannot be detected, do nothing.
r> )r r rL rM N)r? r@ rA rg rB rN rC r r r r r r r )rG rH rO s r) graceful_restart_syncrY s =??1%L,00 1FGGM6#%%% &&}5555 &&}55559(**77KKKK 788888 B B B;SAAAAAAAAABs# A# # A?(C
C7C22C7c K t j d } t | j } t t | n # t | w xY w t d }n3# t $ r&}t
d| Y d}~dS d}~ww xY wt | d{V r t d dS t
d t d{V t | d{V r t d dS t d{V S )
ay Graceful web-server restart that confirms the reload actually completed
and recovers the server if it did not.
Unlike graceful_restart() it bypasses the coalesce throttle (the
post-update reload must never be dropped); unlike graceful_restart_sync()
it observes the reload outcome instead of returning as soon as systemd-run
queues the transient unit.
r> Tr rM NFrL zLWeb server reload after update did not complete cleanly; attempting recoveryz-Web server recovered on graceful reload retry)r? r@ rA rg rB rN rC r r r r _reload_confirmedr r2 _log_failed_configtest
_hard_restart)rG rH r rO s r) graceful_restart_confirmedr_ s =??1%L,00 1FGGM6#%%% &&}5555 &&}5555#... ;SAAAuuuuu s
#
####### 7888t
LL !
"
""""""""
s
#
####### CDDDt s# A% % BB
C CCc K t | d{V n:# t t f$ r&}t d| Y d}~dS d}~ww xY wt rdS t
d d{V n# t $ r Y dS w xY wdS )a Run *cmd* and report whether the reload truly succeeded.
With systemd-run --wait the exit code already reflects completion; on
older systemd (no --wait) the reload is fire-and-forget, so fall back to
a config test to detect a broken reload.
Nz'Web server reload returned an error: %sFTr# )r r r r r r r r6 r rO s r) r\ r\ s nn < ( @#FFFuuuuu "## t........... uu 4s& AA A%A< <
B
B
c K t d d {V d S # t $ r&} t d| Y d } ~ d S d } ~ ww xY w)NTr# z.Web server config test failed after update: %s)r r6 r r2 )rO s r) r] r] s L............ L L L EsKKKKKKKKKLs
A AA c j K t d } n3# t $ r&}t d| Y d }~dS d }~ww xY w t | d {V n:# t
t f$ r&}t d| Y d }~dS d }~ww xY wt d dS )NTr[ z Cannot recover web server: %sFz"Web server hard restart failed: %sz-Web server hard-restarted after failed reload)r r r r2 r r r ra s r) r^ r^ s T*** 4c:::uuuuunn < ( 93???uuuuu KK?@@@ 4s,
AA A A B0BBc K t d t t t d{V dS # t
$ r8}t d| | rt d |Y d}~dS d}~ww xY w)z\
Check web server's config file.
If web server cannot be detected, do nothing.
z!Performing web server config test) raise_excNz Could not run configtest: %szFailed to check config)r r r r r6 r r )r$ rO s r) r r s KK3444H))5GHHHHHHHHHHHH H H H5s;;; H$%=>>C G H H H H H HHs (A
B
-BB
c t | }|"t | d S t d | )Nr> z)Failed to parse apache version string: {})apache_version_regexpr r r r r )outputr s r) _parse_apache_version_outputri sV ! ( ( 0 0E u{{1~~&&& 7 > >v F F
r+ rh c > d | D S )a:
Parse response of httpd -M
:param output: stdout of httpd -M (with spaces before module name)
Output example:
Loaded Modules:
core_module (static)
so_module (static)
http_module (static)
mpm_prefork_module (shared)
:return: list with installed modules
c g | ]H}| t | d IS )r )
startswith BYTE_SPACESstripr^ )r' lines r) rk z-_parse_apache_module_list.<locals>.<listcomp>! sS ??; ' '
Q r+ )
splitlines)rh s r) _parse_apache_module_listrq s/ %%'' r+ c g }| d D ]L}| d }|dk r/| ||d M|S )N
rX r )r r^ rI rT rn )dumpincludesro indexs r) _parse_includesrw ( sp H
##D)) 2 2 # 199 OODL . . 0 0 1 1 1 Or+ c t K t t g d d {V S # t $ r g cY S w xY w)N)r r z-D
DUMP_INCLUDES)rw r r r4 r+ r)
dump_includesrz 1 sg F F FGG G G G G G G
s #( 77c K t } | t d t | dg d {V }t | }t
d| |S )Nr z-vzApache %s version detected)r r. r ri r r r )r r versions r) apache_versionr} : sy !!J 5666:t,--
-
-
-
-
-
-C*3::<<88G
KK,g666 Nr+ 'IMUNIFY360_APACHE_MODULES_CACHE_TIMEOUTiX )seconds)
expirationc N K t d d {V } t | S )Nz-M)r rq )r s r) apache_modulesr E s5 &d++
+
+
+
+
+
+F $V , ,,r+ )r r )F)Tr% )rG N)r functoolsr? rs loggingr r r r stringxml.etree.ElementTreeetreeru rA
contextlibr contextvarsr datetimer packaging.versionr pathlibr
subprocessr r r
r typingr r
r r r r r r $defence360agent.api.integration_confr 3defence360agent.application.determine_hosting_panelr r &defence360agent.internals.global_scoper defence360agent.utilsr r r r r r r r defence360agent.utils.commonr rM environr r> r r r r r r r r compilerg tupler
whitespacerm r getLoggerr0 r r r. r6 r8 r r rU r r r r frozensetr r r r r r r r r lru_cacher~ r r r r r r r rA rI r5 r= rS rF rN rY r_ r\ r] r^ r ri rq rw rz r} r r4 r+ r) <module>r s
" " " " " " " " " " " " " " " % % % % % % L L L L L L L L L L L L F F F F F F F F F F F F F F F F F F
B B B B B B 5 4 4 4 4 4 E D D D D D !cJNN6?? L $ 9:: G I = 4 & ""
#FGG e@@V->(?(?@@@@@ 8 $ $ l T T T T T T T T n9 9 9 ; ; ; ; ; /
/ / / /u 2 .7Y[[ ' ' ' ' 'T (5 5 5 (
"2s7+
4 4 4-tCy - - - -4Xhsm5L > !$ Q D d tCy "8 8 8# 8 8 8 8"/d / / / /,hsm , , , ,(3 3D 3HSM 3 3 3 3(8# 8 8 8 8( &:&?@@ ^c ^d ^ ^ ^ ^B 9 9 9 9 , +,GHH) ) ) IH)
K K K
9 9 9*$!$ $! $! $! $!ND .L L L L T H H H H
e U & y JNNDc J J
- - - - -r+ defence360agent/subsys/ainotify.py 0000644 0000000 0000000 00000017514 00000000000 014302 0 ustar from collections import namedtuple
import asyncio
import ctypes
import errno
import logging
import os
import struct
import platform
from defence360agent.subsys import sysctl
Event = namedtuple("Event", ("path", "flags", "cookie", "name", "wd"))
logger = logging.getLogger(__name__)
class Inotify:
"""
Tiny wrapper for inotify api. See `man inotify` for details
"""
ACCESS = 0x1 #: File was accessed
MODIFY = 0x2 #: File was modified
ATTRIB = 0x4 #: Metadata changed
CLOSE_WRITE = 0x8 #: Writable file was closed
CLOSE_NOWRITE = 0x10 #: Unwritable file closed
OPEN = 0x20 #: File was opened
MOVED_FROM = 0x40 #: File was moved from X
MOVED_TO = 0x80 #: File was moved to Y
CREATE = 0x100 #: Subfile was created
DELETE = 0x200 #: Subfile was deleted
DELETE_SELF = 0x400 #: Self was deleted
MOVE_SELF = 0x800 #: Self was moved
UNMOUNT = 0x2000 #: Backing fs was unmounted
Q_OVERFLOW = 0x4000 #: Event queue overflowed
IGNORED = 0x8000 #: File was ignored
ONLYDIR = 0x1000000 #: only watch the path if it is a directory
DONT_FOLLOW = 0x2000000 #: don't follow a sym link
EXCL_UNLINK = 0x4000000 #: exclude events on unlinked objects
MASK_ADD = 0x20000000 #: add to the mask of an already existing watch
ISDIR = 0x40000000 #: event occurred against dir
ONESHOT = 0x80000000 #: only send event once
_n = "libc.{}".format("so.6" if platform.system() != "Darwin" else "dylib")
_libc = ctypes.CDLL(_n, use_errno=True)
event_prefix = struct.Struct("iIII")
@staticmethod
def _call(method, *args):
"""
Wrapper to all calls to C functions. Raises OSError with appropriate
errno as argument in case of error return value.
:param method: method to call
:param args: method args
:return: called function return value in case of success
"""
ret = getattr(Inotify._libc, method)(*args)
if ret == -1:
errno = ctypes.get_errno()
raise OSError(errno, os.strerror(errno))
return ret
@staticmethod
def init():
"""
Initialize an inotify instance.
See `man inotify_init` for details
:return: a file descriptor of new inotify instance
"""
return Inotify._call("inotify_init")
@staticmethod
def add_watch(fd, path, mask):
"""
Add a watch to an initialized inotify instance. This method is
idempotent. If called twice with the same :fd: and :path: and
different mask, will change watch flags of current watch.
See `man inotify_add_watch` for details
:param fd: file descriptor returned by `init()`
:param path: path to file or directory to watch
:param mask: bitmask of events to monitor
:return: file descriptor of watch
"""
return Inotify._call("inotify_add_watch", fd, path, mask)
@staticmethod
def rm_watch(fd, wd):
"""
Remove existing watch from inotify instance.
:param fd: file descriptor of inotify instance
:param wd: watch file descriptor, returned by `add_watch()`
:return: zero
"""
return Inotify._call("inotify_rm_watch", fd, wd)
@staticmethod
def unpack_prefix(data):
"""
Unpacks prefix of event struct.
See `man inotify` for details
:param data: struct bytestring
:return: tuple of (wd, flag, cookie, length)
"""
return Inotify.event_prefix.unpack(data)
@staticmethod
def unpack_name(data):
"""
Unpack name field of inotify event struct
See `man inotify` for details
:param data: struct bytestring
:return: name string
"""
return struct.unpack("%ds" % len(data), data)[0].rstrip(b"\x00")
class Watcher:
"""
Asynchronous watcher for inotify events
"""
_CHUNK_SIZE = 1024
_MAX_WATCH_RETRIES = 3
_WATCHERS_RAISE_COEFF = 1.5
_MAX_USER_WATCHES = "fs.inotify.max_user_watches"
def __init__(self, loop, coro_callback=None):
self._loop = loop
self._fd = Inotify.init()
self._queue = asyncio.Queue()
self._callback = coro_callback or self._queue.put
self._loop.add_reader(self._fd, self._read)
self._reset_state()
def _reset_state(self):
self.paths = {}
self.descriptors = {}
self.buf = b""
def _read(self):
self.buf += os.read(self._fd, self._CHUNK_SIZE)
# shortcut
struct_size = Inotify.event_prefix.size
while len(self.buf) >= struct_size:
wd, flags, cookie, length = Inotify.unpack_prefix(
self.buf[:struct_size]
)
struct_end = struct_size + length
name = Inotify.unpack_name(self.buf[struct_size:struct_end])
self.buf = self.buf[struct_end:]
if wd not in self.paths:
continue
path = self.paths[wd]
if flags & Inotify.IGNORED:
logger.warning(
"Got IGNORED event for %s, cleaning watch", path
)
self._cleanup_watch(path)
continue
if flags & Inotify.Q_OVERFLOW:
logger.error("Inotify queue overflow")
continue
ev = Event(path, flags, cookie, name, wd)
self._loop.create_task(self._callback(ev))
def _raise_user_watches(self):
current_max_watches = sysctl.read(self._MAX_USER_WATCHES)
new_max_watchers = current_max_watches + int(
current_max_watches * self._WATCHERS_RAISE_COEFF
)
logger.info(
"Raising %s to %s", self._MAX_USER_WATCHES, new_max_watchers
)
sysctl.write(self._MAX_USER_WATCHES, new_max_watchers)
def close(self):
"""
Close watcher. Close inotify fd, remove reader and reset state
:return:
"""
self._loop.remove_reader(self._fd)
try:
os.close(self._fd)
finally:
self._reset_state()
self._fd = None
def watch(self, path, mask):
"""
Add file to watch
:param path: file or directory to watch
:param mask: events mask for this watch
"""
assert isinstance(path, bytes), "Path must be bytes"
logger.info("Watching %r", path)
retries = 0
while True:
try:
wd = Inotify.add_watch(self._fd, path, mask)
self.paths[wd] = path
self.descriptors[path] = wd
break
except OSError as e:
if (
retries < self._MAX_WATCH_RETRIES
and e.errno == errno.ENOSPC
):
self._raise_user_watches()
retries += 1
logger.warning(
"Inotify: not enough watches (%r), retrying...", path
)
continue
logger.error("Inotify failed while watching %r", path)
raise
def _cleanup_watch(self, path):
descriptor = self.descriptors.pop(path, None)
if descriptor is not None:
self.paths.pop(descriptor, None)
def unwatch(self, path):
"""
Remove file or directory from watch
:param path: file or directory to remove watch from
"""
if path not in self.descriptors:
return
logger.info("Stop watching %r", path)
try:
Inotify.rm_watch(self._fd, self.descriptors[path])
finally:
self._cleanup_watch(path)
async def get_event(self):
"""
Get watch event
:return: `Event` named tuple
"""
event = await self._queue.get()
logger.debug("Inotify event: %s", event)
return event
defence360agent/subsys/backup_systems.py 0000644 0000000 0000000 00000026301 00000000000 015506 0 ustar import asyncio
import functools
import logging
from datetime import timezone
from typing import Callable, Dict, List, Optional
from defence360agent.contracts.config import (
ACRONIS,
ANTIVIRUS_MODE,
AcronisBackup as AcronisBackupConfig,
BackupConfig,
BackupRestore,
CLOUDLINUX,
CLOUDLINUX_ON_PREMISE,
CLUSTERLOGICS,
CPANEL,
Core,
DIRECTADMIN,
PLESK,
R1SOFT,
SAMPLE_BACKEND,
)
from defence360agent.contracts.license import LicenseCLN
from defence360agent.internals.cln import BackupNotFound, RestCLN
from defence360agent.subsys.panels.cpanel.panel import cPanel
from defence360agent.subsys.panels.directadmin.panel import DirectAdmin
from defence360agent.subsys.panels.plesk.panel import Plesk
if not ANTIVIRUS_MODE:
from restore_infected import backup_backends
from restore_infected.backup_backends.acronis import BackupFailed
from restore_infected.backup_backends_lib import (
BackendNonApplicableError,
BackendNotAuthorizedError,
)
logger = logging.getLogger(__name__)
def get_backend(name):
try:
return _get_avalible_backends(include_sample=True)[name]()
except (KeyError, BackendNonApplicableError):
raise ValueError("Backup system is not available: {}".format(name))
def get_available_backends_names() -> List[str]:
names = []
# Don't list the CL Backup as available for selection
for name, cls in _get_avalible_backends(include_cl=False).items():
try:
cls()
except BackendNonApplicableError:
pass
else:
names.append(name)
return names
def _get_avalible_backends(
include_sample=False,
include_cl=True,
) -> Dict[str, Callable]:
backends = {
ACRONIS: Acronis,
R1SOFT: R1Soft,
# https://cloudlinux.atlassian.net/browse/DEF-8806
# CLUSTERLOGICS: ClusterLogics,
}
if BackupRestore.CL_BACKUP_ALLOWED and include_cl:
backends[CLOUDLINUX] = CloudLinux
if BackupRestore.CL_ON_PREMISE_BACKUP_ALLOWED:
backends[CLOUDLINUX_ON_PREMISE] = CloudLinuxOnPremise
if cPanel.is_installed():
backends[CPANEL] = cPanelBackup
elif Plesk.is_installed():
backends[PLESK] = PleskBackup
elif DirectAdmin.is_installed():
backends[DIRECTADMIN] = DirectAdminBackup
if include_sample:
backends[SAMPLE_BACKEND] = Sample
return backends
def get_current_backend() -> Optional[str]:
conf = BackupConfig().config_to_dict().get("BACKUP_SYSTEM", {})
return conf.get("enabled") and conf.get("backup_system")
async def get_last_backup_timestamp() -> Optional[int]:
backend = get_current_backend()
if not backend:
return None
backend_instance = get_backend(backend) # type: BackupSystem
return await backend_instance.get_last_backup_timestamp()
def transactional(f):
async def wrapper(cls, *args, **kwargs):
ok = False
try:
rv = await f(cls, *args, **kwargs)
ok = True
finally:
cls._update_backups_config(enabled=ok)
return rv
return wrapper
class BackupException(Exception):
pass
class BackupSystem:
def __init__(self, name, log_path=None):
self.name = name
self.log_path = log_path
def _update_backups_config(self, enabled):
new_conf = {
"BACKUP_SYSTEM": {
"enabled": enabled,
"backup_system": self.name if enabled else None,
}
}
BackupConfig().dict_to_config(new_conf, overwrite=True, validate=True)
async def init(self, *args, **kwargs):
self._update_backups_config(enabled=True)
async def disable(self, delete_backups=False):
self._update_backups_config(enabled=False)
async def check(self):
return {}
async def show(self):
return {}
async def make_backup(self):
pass
async def check_state(self) -> bool:
conf = BackupConfig().config_to_dict().get("BACKUP_SYSTEM", {})
return conf.get("enabled") and conf.get("backup_system") == self.name
async def get_last_backup_timestamp(self) -> Optional[int]:
return None
class PleskBackup(BackupSystem):
def __init__(self):
super().__init__(PLESK)
class cPanelBackup(BackupSystem):
def __init__(self):
super().__init__(CPANEL)
class DirectAdminBackup(BackupSystem):
def __init__(self):
super().__init__(DIRECTADMIN)
class R1Soft(BackupSystem):
def __init__(self):
super().__init__(R1SOFT)
self.backend = backup_backends.backend("r1soft", async_=True)
async def show(self) -> dict:
info_data = await self.backend.info()
return {
k: v
for k, v in info_data.items()
if k in ("username", "timestamp", "ip")
}
@transactional
async def init(self, ip, username, password, encryption_key, **kwargs):
await self.backend.init(ip, username, password, encryption_key)
class ClusterLogics(BackupSystem):
def __init__(self):
super().__init__(CLUSTERLOGICS)
self.backend = backup_backends.backend(CLUSTERLOGICS, async_=True)
async def show(self) -> dict:
info_data = await self.backend.info()
return {
k: v
for k, v in info_data.items()
if k in ("username", "url", "apikey")
}
@transactional
async def init(self, **kwargs):
# 'force' argument (for arconis only) has default value
# also, need to use default value for 'url',
# assigned inside backend.init
del kwargs["force"]
await self.backend.init(**kwargs)
class Sample(BackupSystem):
def __init__(self):
super().__init__(SAMPLE_BACKEND)
self.backend = backup_backends.backend(self.name, async_=True)
class Acronis(BackupSystem):
def __init__(self):
super().__init__(
ACRONIS,
"/var/log/%s/%s" % (Core.PRODUCT, AcronisBackupConfig.LOG_NAME),
)
self.backend = backup_backends.backend(self.name, async_=True)
async def show(self) -> dict:
info_data = await self.backend.info()
return {
k: v
for k, v in info_data.items()
if k in ("username", "timestamp")
}
@transactional
async def init(self, username, password, force=False, **kwargs):
provision = not await self.backend.is_agent_installed()
await self.backend.init(
username,
password,
provision=provision,
force=force,
tmp_dir=Core.TMPDIR,
)
async def _list_backups(self, until=None):
return await self.backend.backups(until)
async def get_last_backup_timestamp(self) -> Optional[int]:
backups = await self._list_backups()
if backups:
return int(
max(
backup.created.replace(tzinfo=timezone.utc).timestamp()
for backup in backups
)
)
return None
async def check_state(self) -> bool:
"""if backup exists, than state OK"""
try:
return bool(await self._list_backups())
except (asyncio.CancelledError, BackendNotAuthorizedError):
raise
except Exception:
logger.exception("Error during checking state")
return False
class CloudLinuxBase(Acronis):
async def show(self) -> dict:
info_data = await self.backend.info()
info_data["backup_space_used_bytes"] = info_data.pop("usage")
info_data["login_url"] = await self.backend.login_url()
return info_data
async def make_backup(self):
logger.info("Making backup")
try:
await self.backend.make_initial_backup_strict()
except BackupFailed as e:
logging.exception("CloudLinux backup failed")
raise BackupException(
str(e) if len(e.args) and e.args[0] else "BackupFailed"
)
async def get_backup_progress(self) -> Optional[int]:
return await self.backend.get_backup_progress()
async def init(self, username, password, force=False, **kwargs):
logger.info("Starting %s init" % self.name)
provision = not await self.backend.is_agent_installed()
await self.backend.init(
username,
password,
provision=provision,
force=force,
tmp_dir=Core.TMPDIR,
)
class CloudLinux(CloudLinuxBase):
PAID, UNPAID = "paid", "unpaid"
def __init__(self):
super().__init__()
self.name = CLOUDLINUX
@transactional
async def init(self, force=False, **kwargs):
credentials = await RestCLN.acronis_credentials(
server_id=LicenseCLN.get_server_id()
)
await super().init(
credentials["login"],
credentials["password"],
force=force,
)
class Decorators:
@staticmethod
def update_credentials_on_unauthorized_error(f):
@functools.wraps(f)
async def wrapped(self, *args, **kwargs):
try:
return await f(self, *args, **kwargs)
except BackendNotAuthorizedError:
await self.init(force=True)
return await f(self, *args, **kwargs)
return wrapped
@Decorators.update_credentials_on_unauthorized_error
async def show(self) -> dict:
info_data = await super().show()
# FIXME: raise exception when server_id is None
response = await RestCLN.acronis_check(
server_id=LicenseCLN.get_server_id()
)
purchased_backup_gb = response.get("size", 0)
resize_url = response.get("url", None)
info_data["purchased_backup_gb"] = purchased_backup_gb
info_data["resize_url"] = resize_url
return info_data
@Decorators.update_credentials_on_unauthorized_error
async def make_backup(self):
await super().make_backup()
@Decorators.update_credentials_on_unauthorized_error
async def get_backup_progress(self) -> Optional[int]:
return await super().get_backup_progress()
@Decorators.update_credentials_on_unauthorized_error
async def get_last_backup_timestamp(self) -> Optional[int]:
return await super().get_last_backup_timestamp()
@Decorators.update_credentials_on_unauthorized_error
async def check_state(self) -> bool:
return await super().check_state()
async def check(self) -> dict:
try:
content = await RestCLN.acronis_check(
server_id=LicenseCLN.get_server_id()
)
except BackupNotFound as e:
return {"status": self.UNPAID, "url": e.add_used_space()}
return {"status": self.PAID, "size": content.get("size")}
async def disable(self, delete_backups=False):
await super().disable()
if delete_backups:
await RestCLN.acronis_remove(server_id=LicenseCLN.get_server_id())
class CloudLinuxOnPremise(CloudLinuxBase):
def __init__(self):
super().__init__()
self.name = CLOUDLINUX_ON_PREMISE
@transactional
async def init(self, *args, **kwargs):
await super().init(*args, **kwargs)
defence360agent/subsys/clcagefs.py 0000644 0000000 0000000 00000017447 00000000000 014234 0 ustar # -*- coding: utf-8 -*-
# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc
# 2010-2018 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENSE.TXT
#
import os
import re
import subprocess
CAGEFS_MP_FILENAME = "/etc/cagefs/cagefs.mp"
CAGEFSCTL_TOOL = "/usr/sbin/cagefsctl"
class CagefsMpConflict(Exception):
def __init__(self, new_item, existing_item):
self._msg = (
"Conflict in adding '%s' to %s because of pre-existing "
"alternative specification: '%s'"
% (new_item, CAGEFS_MP_FILENAME, existing_item)
)
def __str__(self):
return self._msg
class CagefsMpItem:
PREFIX_LIST = b"@!%"
_PREFIX_MOUNT_RW = b""
_PREFIX_MOUNT_RO = b"!"
def __init__(self, arg):
"""Constructor
:param arg: Is either path to add to cagefs.mp or a raw line is read
from cagefs.mp
:param prefix: The same as adding prefix '!' to arg before passing it
to ctor"""
if arg[:1] == b"#": # is a comment? then init as dummy
self._path_spec = None
elif arg.strip() == b"": # init as dummy for empty lines
self._path_spec = None
else:
self._path_spec = arg
def mode(self, mode):
"""Specify mode as in fluent constructor"""
if self.prefix() == b"@" and mode is not None:
self._path_spec = b"%s,%03o" % (self._path_spec, mode)
return self
def __str__(self):
return os.fsdecode(self._path_spec)
@staticmethod
def _add_slash(path):
if path == b"":
return b"/"
if path[-1] != b"/"[0]:
return path + b"/"
return path
def pre_exist_in(self, another):
adopted = CagefsMpItem._adopt(another)
# overkill: just to keep strictly to comparing NULL objects principle
if self.is_dummy() or adopted.is_dummy():
return False
this_path = CagefsMpItem._add_slash(self.path())
test_preexist_in_path = CagefsMpItem._add_slash(adopted.path())
return this_path.startswith(test_preexist_in_path)
def is_compatible_by_prefix_with(self, existing):
adopted = CagefsMpItem._adopt(existing)
# overkill: just to keep strictly to comparing NULL objects principle
if self.is_dummy() or adopted.is_dummy():
return False
if self.prefix() == adopted.prefix():
return True
prefix_compatibility_map = {
CagefsMpItem._PREFIX_MOUNT_RW: [CagefsMpItem._PREFIX_MOUNT_RO]
}
null_options = []
return self.prefix() in prefix_compatibility_map.get(
adopted.prefix(), null_options
)
def is_dummy(self):
return self._path_spec is None
@staticmethod
def _adopt(x):
if isinstance(x, CagefsMpItem):
return x
else:
return CagefsMpItem(x)
@staticmethod
def _cut_off_mode(path_spec):
"""Cut off mode from path spec like @/var/run/screen,777
Only one comma per path spec is allowed ;-)"""
return path_spec.split(b",")[0]
@staticmethod
def _cut_off_prefix(path_spec):
return path_spec.lstrip(CagefsMpItem.PREFIX_LIST)
def path(self):
return CagefsMpItem._cut_off_prefix(
CagefsMpItem._cut_off_mode(self._path_spec)
)
def prefix(self):
if self._path_spec != self.path():
return self._path_spec[0:1]
else:
return b""
def spec(self):
return self._path_spec
def is_cagefs_present():
return os.path.exists(CAGEFSCTL_TOOL)
def _mk_mount_dir_setup_perm(path, mode=0o755, owner_id=None, group_id=None):
# -1 means 'unchanged'
if group_id is None:
group_id = -1
if owner_id is None:
owner_id = -1
if not os.path.isdir(path):
os.mkdir(path)
if mode is not None:
os.chmod(path, mode)
os.chown(path, owner_id, group_id)
def setup_mount_dir_cagefs(
path,
added_by,
mode=0o755,
owner_id=None,
group_id=None,
prefix=b"",
remount_cagefs=True,
):
"""
Add mount point to /etc/cagefs/cagefs.mp
:param path: Directory path to be added in cagefs.mp and mounted
from within setup_mount_dir_cagefs().
If this directory does not exist, then it is created.
:param added_by: package or component, mount dir relates to, or whatever
will stay in cagefs.mp with "# added by..." comment
:param mode: If is not None: Regardless of whether directory exists or not
prior this call, it's permissions will be set to mode.
:param owner_id: Regardless of whether directory exists or not prior this
call, it's owner id will be set to.
If None, the owner won't be changed.
:param group_id: Regardless of whether directory exists or not prior this
call, it's group id will be set to.
If None, the group won't be changed.
:param prefix: Mount point prefix. Default is mount as RW.
Pass '!' to add read-only mount point.
Refer CageFS section at http://docs.cloudlinux.com/
for more options.
:param remount_cagefs: If True, cagefs skeleton will be automatically
remounted to apply changes.
:returns: None
Propagates native EnvironmentError if no CageFS installed or something
else goes wrong.
Raises CagefsMpConflict if path is already specified in cagefs.mp,
but in a way which is opposite to mount_as_readonly param.
"""
_mk_mount_dir_setup_perm(path, mode, owner_id, group_id)
# Create cagefs.mp if absent. It will be merged when cagefsctl --init.
if not os.path.exists(CAGEFS_MP_FILENAME):
subprocess.call([CAGEFSCTL_TOOL, "--create-mp"])
subprocess.call([CAGEFSCTL_TOOL, "--check-mp"])
# ^^
# Hereafter we will not care if there was
# 'no newline at the end of file'
cagefs_mp = open(CAGEFS_MP_FILENAME, "rb+")
try:
new_item = CagefsMpItem(prefix + path).mode(mode)
trim_nl_iter = (file_line.rstrip() for file_line in cagefs_mp)
pre_exist_option = [
x for x in trim_nl_iter if new_item.pre_exist_in(x)
]
if not pre_exist_option:
cagefs_mp.seek(0, 2) # 2: seek to the end of file
# no newline is allowed
added_by = added_by.replace("\n", " ")
cagefs_mp.write(
b"# next line is added by " + added_by.encode("utf-8") + b"\n"
)
cagefs_mp.write(new_item.spec() + b"\n")
cagefs_mp.close()
if remount_cagefs:
subprocess.call([CAGEFSCTL_TOOL, "--remount-all"])
elif not new_item.is_compatible_by_prefix_with(pre_exist_option[-1]):
raise CagefsMpConflict(new_item, pre_exist_option[-1])
finally:
cagefs_mp.close()
def _get_cagefs_mp_lines():
with open(CAGEFS_MP_FILENAME, "rb") as f:
return f.readlines()
def _write_cagefs_mp_lines(lines):
with open(CAGEFS_MP_FILENAME, "wb") as f:
return f.writelines(lines)
def remove_mount_dir_cagefs(path, remount_cagefs=True):
"""
Remove mount points matching given path from cagefs.mp file
:param str path: Path that should be removed from file.
:param bool remount_cagefs: Remount cagefs skeleton or not
:return: Nothing
"""
lines = _get_cagefs_mp_lines()
r = re.compile(
rb"^[%s]?%s(,\d+)?$" % (CagefsMpItem.PREFIX_LIST, re.escape(path))
)
lines_with_excluded_path = (line for line in lines if not r.match(line))
_write_cagefs_mp_lines(lines_with_excluded_path)
if remount_cagefs:
subprocess.call([CAGEFSCTL_TOOL, "--remount-all"])
defence360agent/subsys/features/ 0000755 0000000 0000000 00000000000 00000000000 013714 5 ustar defence360agent/subsys/features/__init__.py 0000644 0000000 0000000 00000000000 00000000000 016013 0 ustar defence360agent/subsys/features/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 016124 5 ustar defence360agent/subsys/features/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000312 00000000000 023320 0 ustar
r_j d S )N r ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/features/__init__.py<module>r s r defence360agent/subsys/features/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000312 00000000000 022361 0 ustar
r_j d S )N r ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/features/__init__.py<module>r s r defence360agent/subsys/features/__pycache__/abstract_feature.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000024215 00000000000 025107 0 ustar
r_j d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlZ ej e
Z G d d Z d Z
G d de Z G d d
e Z G d d e
ZdS ) N)ABCMetaabstractmethod)isclosec * e Zd ZdZdZdZdZdZdZdZ dS )
FeatureStatuserror installed
installingremoving
not_installedmanaged_by_lveznot-supported-by-cl-soloN)
__name__
__module__ __qualname__ERROR INSTALLED
INSTALLINGREMOVING
NOT_INSTALLEDMANAGED_BY_LVENOT_SUPPORTED_BY_CL_SOLO e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/features/abstract_feature.pyr r s4 EI JH#M%N 9 r r c fd}|S )z
If Easy Apache 4 not installed, then raising an error
:raises FeatureError
:param func: install or remove func
:return func:
c K t j d st d | i | d {V S )Nz/etc/cpanel/ea4/is_ea4z3Hardened PHP is compatible only with Easy Apache 4!)ospathisfile FeatureError)argskwargsfuncs r wrapperzea4_only.<locals>.wrapper s\ w~~ 677 E
T4*6*********r r r# r$ s ` r ea4_onlyr& s# + + + + + Nr c e Zd ZdZdS )r z*Feature operation can't be performed errorNr r r __doc__r r r r r ( s 44Dr r c e Zd ZdZdS )
FeatureNoticez+Feature operation can't be performed noticeNr( r r r r+ r+ . s 55Dr r+ c , e Zd Zd ZdZdZg ZddZd Ze d Z
e d Z e d Z
ed Ze d Zd efd
Zed efd Zed efd Zed efd
Zed Zed Zd ZdS )AbstractFeatureNc X | j s
J d | j s
J d || _ d S )Nzvariable isn't set!)INSTALL_LOG_FILE_MASKREMOVE_LOG_FILE_MASK_sink)selfsinks r __init__zAbstractFeature.__init__: s= )@@+@@@)(??*???(
r c H K | d {V | _ | S N)check_installed is_installedr2 s r initzAbstractFeature.init@ s1 "&"6"6"8"8 8 8 8 8 8 8 r c 6 | | j S r6 )
_get_live_logr/ r9 s r installation_live_logz%AbstractFeature.installation_live_logD s !!$"<===r c 6 | | j S r6 )r< r0 r9 s r removal_live_logz AbstractFeature.removal_live_logH s !!$";<<<r c t |dz 5 }| \ }}t t j t | t
| d cddd S # 1 swxY w Y dS # t t t
j
f$ r Y dS w xY w)z+Checks if any processes are using log file.z.pidg-q=)rel_tolNF)openreadstripsplitr psutilProcessint create_timefloatfromhexOSError
ValueError
NoSuchProcess)clslog_filepfpid
creation_times r _log_still_usedz AbstractFeature._log_still_usedL s h'((
B%'WWYY__%6%6%<%<%>%>"] N3s88,,88::MM-00 !
V%9: 55 s5 C BB7* C 7B;;C >B;?C C$#C$c * t j | S )zo
:param str log_mask: regexp of log file path
:return: list of files found by log_mask
)glob)log_masks r _ls_logszAbstractFeature._ls_logsZ s y"""r c n t t | j | | d S )a
Returns path of log file, which used by some process.
If log file used by process, assuming that installation/removal
is in the progress
:param str file_mask: regexp of log file path
:return: str path of log, used by some process
N)nextfilterrT rX )rO file_masks r r< z AbstractFeature._get_live_logb s- F3. Y0G0GHH$OOOr returnc ^ K | j rdS | j rdS | d {V S )NFT)r= r? _check_installed_implr9 s r r7 z AbstractFeature.check_installedn sJ % 5 4//111111111r c
K dS )NFr r9 s r r_ z%AbstractFeature._check_installed_implu s ur c " K t )z
:return str: path to log file with installation process
:raise FeatureError: when feature is already installed,
concurrent operation is in progress, feature is not applicable
for given setup, etc.
NotImplementedErrorr9 s r installzAbstractFeature.instally s "###r c " K t r6 rb r9 s r removezAbstractFeature.remove s !###r c fd}|S )a
Checks before operation if similar or mutually exclusive operation
is in the progress. Checks if there are condition why operation
can't be performed.
:raises FeatureError: if operation couldn't be performed
:returns str msg: log path if already ongoing operation
:returns continue function isntall/remove: if operation is permitted
c K | j rt d | j r't d | j | j p | d {V S )Nz$Wait until uninstalling is finished!z{} is already installed)r? r r8 r+ formatNAMEr= r2 r# s r r$ z>AbstractFeature.raise_if_shouldnt_install_now.<locals>.wrapper s{ $
"#IJJJ"
#-44TY?? -AttDzz1A1A1A1A1A1A Ar r r% s ` r raise_if_shouldnt_install_nowz-AbstractFeature.raise_if_shouldnt_install_now s( B B B B B r c fd}|S )z
:raises FeatureError: if operation couldn't be performed
:returns str msg: log path if already ongoing operation
:returns continue function isntall/remove: if operation is permitted
c K | j rt d | j s't d | j | j p | d {V S )Nz$Wait until installation is finished!z+Can't delete {}, because it's not installed)r= r r8 r+ ri rj r? rk s r r$ z=AbstractFeature.raise_if_shouldnt_remove_now.<locals>.wrapper s )
"#IJJJ&
#AHH (<$$t**,<,<,<,<,<,< <r r r% s ` r raise_if_shouldnt_remove_nowz,AbstractFeature.raise_if_shouldnt_remove_now s# = = = = = r c K | j r'd | j }t j }n| j r'd | j }t j }ng| d {V r'd | j }t j }n&d | j }t j }d||diS )Nz{} is installingz{} is removingz{} is installedz{} is not installeditems)messagestatus)
r= ri rj r r r? r r7 r r )r2 msgrs s r rs zAbstractFeature.status s % 1$++DI66C"-FF
" 1"))$)44C"+FF''))
)
)
)
)
)
) 1#**4955C",FF'..ty99C"0F
r r6 )r r r rj r/ r0 _CMD_LISTr4 r: propertyr= r? classmethodrT staticmethodrX r< boolr7 r r_ strrd rf rl ro rs r r r r- r- 4 s D I > > X> = = X= [ # # \# P P [ P2t 2 2 2 2 T ^ $s $ $ $ ^$ $c $ $ $ ^$ \0 \,
r r- ) metaclass)rV loggingr abcr r mathr rF getLoggerr loggerr r& Exceptionr r+ r- r r r <module>r s4 ' ' ' ' ' ' ' '
8 $ $: : : : : : : : $ 9 L U
U
U
U
U
U
U
U
U
U
U
r defence360agent/subsys/features/__pycache__/abstract_feature.cpython-311.pyc 0000644 0000000 0000000 00000024215 00000000000 024150 0 ustar
r_j d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlZ ej e
Z G d d Z d Z
G d de Z G d d
e Z G d d e
ZdS ) N)ABCMetaabstractmethod)isclosec * e Zd ZdZdZdZdZdZdZdZ dS )
FeatureStatuserror installed
installingremoving
not_installedmanaged_by_lveznot-supported-by-cl-soloN)
__name__
__module__ __qualname__ERROR INSTALLED
INSTALLINGREMOVING
NOT_INSTALLEDMANAGED_BY_LVENOT_SUPPORTED_BY_CL_SOLO e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/features/abstract_feature.pyr r s4 EI JH#M%N 9 r r c fd}|S )z
If Easy Apache 4 not installed, then raising an error
:raises FeatureError
:param func: install or remove func
:return func:
c K t j d st d | i | d {V S )Nz/etc/cpanel/ea4/is_ea4z3Hardened PHP is compatible only with Easy Apache 4!)ospathisfile FeatureError)argskwargsfuncs r wrapperzea4_only.<locals>.wrapper s\ w~~ 677 E
T4*6*********r r r# r$ s ` r ea4_onlyr& s# + + + + + Nr c e Zd ZdZdS )r z*Feature operation can't be performed errorNr r r __doc__r r r r r ( s 44Dr r c e Zd ZdZdS )
FeatureNoticez+Feature operation can't be performed noticeNr( r r r r+ r+ . s 55Dr r+ c , e Zd Zd ZdZdZg ZddZd Ze d Z
e d Z e d Z
ed Ze d Zd efd
Zed efd Zed efd Zed efd
Zed Zed Zd ZdS )AbstractFeatureNc X | j s
J d | j s
J d || _ d S )Nzvariable isn't set!)INSTALL_LOG_FILE_MASKREMOVE_LOG_FILE_MASK_sink)selfsinks r __init__zAbstractFeature.__init__: s= )@@+@@@)(??*???(
r c H K | d {V | _ | S N)check_installed is_installedr2 s r initzAbstractFeature.init@ s1 "&"6"6"8"8 8 8 8 8 8 8 r c 6 | | j S r6 )
_get_live_logr/ r9 s r installation_live_logz%AbstractFeature.installation_live_logD s !!$"<===r c 6 | | j S r6 )r< r0 r9 s r removal_live_logz AbstractFeature.removal_live_logH s !!$";<<<r c t |dz 5 }| \ }}t t j t | t
| d cddd S # 1 swxY w Y dS # t t t
j
f$ r Y dS w xY w)z+Checks if any processes are using log file.z.pidg-q=)rel_tolNF)openreadstripsplitr psutilProcessint create_timefloatfromhexOSError
ValueError
NoSuchProcess)clslog_filepfpid
creation_times r _log_still_usedz AbstractFeature._log_still_usedL s h'((
B%'WWYY__%6%6%<%<%>%>"] N3s88,,88::MM-00 !
V%9: 55 s5 C BB7* C 7B;;C >B;?C C$#C$c * t j | S )zo
:param str log_mask: regexp of log file path
:return: list of files found by log_mask
)glob)log_masks r _ls_logszAbstractFeature._ls_logsZ s y"""r c n t t | j | | d S )a
Returns path of log file, which used by some process.
If log file used by process, assuming that installation/removal
is in the progress
:param str file_mask: regexp of log file path
:return: str path of log, used by some process
N)nextfilterrT rX )rO file_masks r r< z AbstractFeature._get_live_logb s- F3. Y0G0GHH$OOOr returnc ^ K | j rdS | j rdS | d {V S )NFT)r= r? _check_installed_implr9 s r r7 z AbstractFeature.check_installedn sJ % 5 4//111111111r c
K dS )NFr r9 s r r_ z%AbstractFeature._check_installed_implu s ur c " K t )z
:return str: path to log file with installation process
:raise FeatureError: when feature is already installed,
concurrent operation is in progress, feature is not applicable
for given setup, etc.
NotImplementedErrorr9 s r installzAbstractFeature.instally s "###r c " K t r6 rb r9 s r removezAbstractFeature.remove s !###r c fd}|S )a
Checks before operation if similar or mutually exclusive operation
is in the progress. Checks if there are condition why operation
can't be performed.
:raises FeatureError: if operation couldn't be performed
:returns str msg: log path if already ongoing operation
:returns continue function isntall/remove: if operation is permitted
c K | j rt d | j r't d | j | j p | d {V S )Nz$Wait until uninstalling is finished!z{} is already installed)r? r r8 r+ formatNAMEr= r2 r# s r r$ z>AbstractFeature.raise_if_shouldnt_install_now.<locals>.wrapper s{ $
"#IJJJ"
#-44TY?? -AttDzz1A1A1A1A1A1A Ar r r% s ` r raise_if_shouldnt_install_nowz-AbstractFeature.raise_if_shouldnt_install_now s( B B B B B r c fd}|S )z
:raises FeatureError: if operation couldn't be performed
:returns str msg: log path if already ongoing operation
:returns continue function isntall/remove: if operation is permitted
c K | j rt d | j s't d | j | j p | d {V S )Nz$Wait until installation is finished!z+Can't delete {}, because it's not installed)r= r r8 r+ ri rj r? rk s r r$ z=AbstractFeature.raise_if_shouldnt_remove_now.<locals>.wrapper s )
"#IJJJ&
#AHH (<$$t**,<,<,<,<,<,< <r r r% s ` r raise_if_shouldnt_remove_nowz,AbstractFeature.raise_if_shouldnt_remove_now s# = = = = = r c K | j r'd | j }t j }n| j r'd | j }t j }ng| d {V r'd | j }t j }n&d | j }t j }d||diS )Nz{} is installingz{} is removingz{} is installedz{} is not installeditems)messagestatus)
r= ri rj r r r? r r7 r r )r2 msgrs s r rs zAbstractFeature.status s % 1$++DI66C"-FF
" 1"))$)44C"+FF''))
)
)
)
)
)
) 1#**4955C",FF'..ty99C"0F
r r6 )r r r rj r/ r0 _CMD_LISTr4 r: propertyr= r? classmethodrT staticmethodrX r< boolr7 r r_ strrd rf rl ro rs r r r r- r- 4 s D I > > X> = = X= [ # # \# P P [ P2t 2 2 2 2 T ^ $s $ $ $ ^$ $c $ $ $ ^$ \0 \,
r r- ) metaclass)rV loggingr abcr r mathr rF getLoggerr loggerr r& Exceptionr r+ r- r r r <module>r s4 ' ' ' ' ' ' ' '
8 $ $: : : : : : : : $ 9 L U
U
U
U
U
U
U
U
U
U
U
r defence360agent/subsys/features/__pycache__/kernel_care.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000014457 00000000000 024052 0 ustar
r_j d dl Z d dlZd dlZd dlmZ d dlmZmZ d dlm Z m
Z
m Z d dl m
Z
d dlmZ e j e Z G d de ZdS ) N)Core)
OsReleaseInfo run_cmd_and_log_in_own_cgroup)AbstractFeature FeatureError
FeatureStatus)utils)
exceptionsc e Zd ZdZdZdej z Zd ZdZ dez Z
dez Z dez Z dZ
d Ze e
egZd
d d d
dZdefdZ fdZej d Zej d Zd Zd Zd Z xZ S )
KernelCarez4/var/imunify360/plesk-previous-kernelcare-stats.jsonz<https://repo.cloudlinux.com/kernelcare/kernelcare_install.shz /var/log/%sz/usr/bin/kcarectlz%s/install-kernelcare.log.*z%s/remove-kernelcare.log.*zcurl -s %s | bashzyum remove -y kernelcarez apt-get -y remove kernelcarez)Host is updated to the latest patch levelz There are no applied patchesz!There are new not applied patcheszKernel is unsupported)r returnc N K t j | j S N)ospathexistsBIN_PATHselfs `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/features/kernel_care.py_check_installed_implz KernelCare._check_installed_impl- s w~~dm,,, c
j K t d{V }|d d t j k }|s|S | d d{V \ }}} d|d d< | j | |d d< n'# t $ r t d| d | d
| d w xY w|S ) z}
:raises FeatureError: if kernelcare returns unexpected error
:return: str: feature's current status
Nitemsstatusz--statusF
edf_supportedmessagezCUnknown error occured while getting status from kcarectl. stdout: [z ], stderr: [z], return code: [])superr r INSTALLEDget_output_kcarectlSTATUS_MESSAGEKeyErrorr )r r is_feature_installedretouterr __class__s r r zKernelCare.status0 s
ww~~'''''''' 7OH % )@ @ $ M " 6 6z B BBBBBBB
S# /4F7OO ,)-)<S)AF7OI & & J J J-0J JCFJ J J
s *!B $B0c N K t | j | j ddi d {V S )NDEBIAN_FRONTENDnoninteractive)env)r INSTALL_CMDINSTALL_LOG_FILE_MASKr s r installzKernelCare.installI sR
3 &"$45
r c K t j t j z r| j }n| j }t || j d {V S r )r id_likeDEBIANREMOVE_CMD_DEBIANREMOVE_CMD_REDHATr REMOVE_LOG_FILE_MASK)r commands r removezKernelCare.removeT si " "]%9 9 -,GG,G2 T.
r c K | dd d {V }n]# t $ r t j d t j $ r.}|j dk r d|j v s t j d d }~ww xY w t j |
d d }n"# t $ r t j d w xY w|S )
Nz
--plugin-infoz--jsonzkcarectl not foundr s --jsonzbYour kcarectl version doesn't support --json option. Please, update to kernelcare-2.15-2 or newer.z --START--zTCan't decode kcarectl output as json. Try updating to the latest kernelcare version.)
run_kcarectlFileNotFoundErrorr
RpcErrorr
CheckRunError
returncodestderrjsonloadsdecode partition
ValueError)r outputeresultss r get_plugin_infozKernelCare.get_plugin_info^ s! ,,_hGGGGGGGGFF < < < %&:;; ;" LA%%)qx*?*? !)E j !:!:;!G!G!KLLGG %B
s! ! ,A;
)A66A;??B? ? C c L K t j | j f|z d {V S r )r check_runr )r optionss r r= zKernelCare.run_kcarectlu s2 _dm%5%?@@@@@@@@@r c K t j | j g| d {V \ }}}|| | fS r )r runr rE )r rN r( r) r* s r r$ z KernelCare.get_output_kcarectlx sT #i (A(A B BBBBBBB
S#CJJLL#**,,..r ) __name__
__module__ __qualname__
KC_PROPERTIES
KC_SCRIPT_URLr PRODUCTLOG_DIRNAMEr r1 r8 r0 r7 r6 _CMD_LISTr% boolr r r raise_if_shouldnt_install_nowr2 raise_if_shouldnt_remove_nowr: rK r= r$
__classcell__)r+ s @r r r s: JMF dl*G D"H 9G C7'A%
5K26 /1BCI 7 ) . " N-T - - - - 2 2
32
1
21
.A A A/ / / / / / /r r )loggingr rC defence360agent.contracts.configr defence360agent.utilsr r 0defence360agent.subsys.features.abstract_featurer r r defence360agentr defence360agent.rpc_toolsr
getLoggerrQ loggerr r r <module>rg s 1 1 1 1 1 1
" ! ! ! ! ! 0 0 0 0 0 0
8 $ $d/ d/ d/ d/ d/ d/ d/ d/ d/ d/r defence360agent/subsys/features/__pycache__/kernel_care.cpython-311.pyc 0000644 0000000 0000000 00000014457 00000000000 023113 0 ustar
r_j d dl Z d dlZd dlZd dlmZ d dlmZmZ d dlm Z m
Z
m Z d dl m
Z
d dlmZ e j e Z G d de ZdS ) N)Core)
OsReleaseInfo run_cmd_and_log_in_own_cgroup)AbstractFeature FeatureError
FeatureStatus)utils)
exceptionsc e Zd ZdZdZdej z Zd ZdZ dez Z
dez Z dez Z dZ
d Ze e
egZd
d d d
dZdefdZ fdZej d Zej d Zd Zd Zd Z xZ S )
KernelCarez4/var/imunify360/plesk-previous-kernelcare-stats.jsonz<https://repo.cloudlinux.com/kernelcare/kernelcare_install.shz /var/log/%sz/usr/bin/kcarectlz%s/install-kernelcare.log.*z%s/remove-kernelcare.log.*zcurl -s %s | bashzyum remove -y kernelcarez apt-get -y remove kernelcarez)Host is updated to the latest patch levelz There are no applied patchesz!There are new not applied patcheszKernel is unsupported)r returnc N K t j | j S N)ospathexistsBIN_PATHselfs `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/features/kernel_care.py_check_installed_implz KernelCare._check_installed_impl- s w~~dm,,, c
j K t d{V }|d d t j k }|s|S | d d{V \ }}} d|d d< | j | |d d< n'# t $ r t d| d | d
| d w xY w|S ) z}
:raises FeatureError: if kernelcare returns unexpected error
:return: str: feature's current status
Nitemsstatusz--statusF
edf_supportedmessagezCUnknown error occured while getting status from kcarectl. stdout: [z ], stderr: [z], return code: [])superr r INSTALLEDget_output_kcarectlSTATUS_MESSAGEKeyErrorr )r r is_feature_installedretouterr __class__s r r zKernelCare.status0 s
ww~~'''''''' 7OH % )@ @ $ M " 6 6z B BBBBBBB
S# /4F7OO ,)-)<S)AF7OI & & J J J-0J JCFJ J J
s *!B $B0c N K t | j | j ddi d {V S )NDEBIAN_FRONTENDnoninteractive)env)r INSTALL_CMDINSTALL_LOG_FILE_MASKr s r installzKernelCare.installI sR
3 &"$45
r c K t j t j z r| j }n| j }t || j d {V S r )r id_likeDEBIANREMOVE_CMD_DEBIANREMOVE_CMD_REDHATr REMOVE_LOG_FILE_MASK)r commands r removezKernelCare.removeT si " "]%9 9 -,GG,G2 T.
r c K | dd d {V }n]# t $ r t j d t j $ r.}|j dk r d|j v s t j d d }~ww xY w t j |
d d }n"# t $ r t j d w xY w|S )
Nz
--plugin-infoz--jsonzkcarectl not foundr s --jsonzbYour kcarectl version doesn't support --json option. Please, update to kernelcare-2.15-2 or newer.z --START--zTCan't decode kcarectl output as json. Try updating to the latest kernelcare version.)
run_kcarectlFileNotFoundErrorr
RpcErrorr
CheckRunError
returncodestderrjsonloadsdecode partition
ValueError)r outputeresultss r get_plugin_infozKernelCare.get_plugin_info^ s! ,,_hGGGGGGGGFF < < < %&:;; ;" LA%%)qx*?*? !)E j !:!:;!G!G!KLLGG %B
s! ! ,A;
)A66A;??B? ? C c L K t j | j f|z d {V S r )r check_runr )r optionss r r= zKernelCare.run_kcarectlu s2 _dm%5%?@@@@@@@@@r c K t j | j g| d {V \ }}}|| | fS r )r runr rE )r rN r( r) r* s r r$ z KernelCare.get_output_kcarectlx sT #i (A(A B BBBBBBB
S#CJJLL#**,,..r ) __name__
__module__ __qualname__
KC_PROPERTIES
KC_SCRIPT_URLr PRODUCTLOG_DIRNAMEr r1 r8 r0 r7 r6 _CMD_LISTr% boolr r r raise_if_shouldnt_install_nowr2 raise_if_shouldnt_remove_nowr: rK r= r$
__classcell__)r+ s @r r r s: JMF dl*G D"H 9G C7'A%
5K26 /1BCI 7 ) . " N-T - - - - 2 2
32
1
21
.A A A/ / / / / / /r r )loggingr rC defence360agent.contracts.configr defence360agent.utilsr r 0defence360agent.subsys.features.abstract_featurer r r defence360agentr defence360agent.rpc_toolsr
getLoggerrQ loggerr r r <module>rg s 1 1 1 1 1 1
" ! ! ! ! ! 0 0 0 0 0 0
8 $ $d/ d/ d/ d/ d/ d/ d/ d/ d/ d/r defence360agent/subsys/features/abstract_feature.py 0000644 0000000 0000000 00000013752 00000000000 017614 0 ustar import glob
import logging
import os
from abc import ABCMeta, abstractmethod
from math import isclose
import psutil
logger = logging.getLogger(__name__)
class FeatureStatus:
ERROR = "error"
INSTALLED = "installed"
INSTALLING = "installing"
REMOVING = "removing"
NOT_INSTALLED = "not_installed"
MANAGED_BY_LVE = "managed_by_lve"
NOT_SUPPORTED_BY_CL_SOLO = "not-supported-by-cl-solo"
def ea4_only(func):
"""
If Easy Apache 4 not installed, then raising an error
:raises FeatureError
:param func: install or remove func
:return func:
"""
async def wrapper(*args, **kwargs):
if not os.path.isfile("/etc/cpanel/ea4/is_ea4"):
raise FeatureError(
"Hardened PHP is compatible only with Easy Apache 4!"
)
return await func(*args, **kwargs)
return wrapper
class FeatureError(Exception):
"""Feature operation can't be performed error"""
pass
class FeatureNotice(FeatureError):
"""Feature operation can't be performed notice"""
pass
class AbstractFeature(metaclass=ABCMeta):
NAME = "AbstractFeature"
INSTALL_LOG_FILE_MASK = None # type: str
REMOVE_LOG_FILE_MASK = None # type: str
_CMD_LIST = [] # type: List[str]
def __init__(self, sink=None):
assert self.INSTALL_LOG_FILE_MASK, "variable isn't set!"
assert self.REMOVE_LOG_FILE_MASK, "variable isn't set!"
self._sink = sink
async def init(self):
self.is_installed = await self.check_installed()
return self
@property
def installation_live_log(self):
return self._get_live_log(self.INSTALL_LOG_FILE_MASK)
@property
def removal_live_log(self):
return self._get_live_log(self.REMOVE_LOG_FILE_MASK)
@classmethod
def _log_still_used(cls, log_file):
"""Checks if any processes are using log file."""
try:
with open(log_file + ".pid") as pf:
pid, creation_time = pf.read().strip().split()
return isclose(
psutil.Process(int(pid)).create_time(),
float.fromhex(creation_time),
rel_tol=1e-12,
)
except (OSError, ValueError, psutil.NoSuchProcess):
return False
@staticmethod
def _ls_logs(log_mask):
"""
:param str log_mask: regexp of log file path
:return: list of files found by log_mask
"""
return glob.glob(log_mask)
@classmethod
def _get_live_log(cls, file_mask):
"""
Returns path of log file, which used by some process.
If log file used by process, assuming that installation/removal
is in the progress
:param str file_mask: regexp of log file path
:return: str path of log, used by some process
"""
return next(filter(cls._log_still_used, cls._ls_logs(file_mask)), None)
async def check_installed(self) -> bool:
if self.installation_live_log:
return False
if self.removal_live_log:
return True
return await self._check_installed_impl()
@abstractmethod
async def _check_installed_impl(self) -> bool:
return False
@abstractmethod
async def install(self) -> str:
"""
:return str: path to log file with installation process
:raise FeatureError: when feature is already installed,
concurrent operation is in progress, feature is not applicable
for given setup, etc.
"""
raise NotImplementedError()
@abstractmethod
async def remove(self) -> str:
raise NotImplementedError()
@staticmethod
def raise_if_shouldnt_install_now(func):
"""
Checks before operation if similar or mutually exclusive operation
is in the progress. Checks if there are condition why operation
can't be performed.
:raises FeatureError: if operation couldn't be performed
:returns str msg: log path if already ongoing operation
:returns continue function isntall/remove: if operation is permitted
"""
async def wrapper(self):
# check if the operation is in progress
if self.removal_live_log:
raise FeatureError("Wait until uninstalling is finished!")
elif self.is_installed:
raise FeatureNotice(
"{} is already installed".format(self.NAME)
)
return self.installation_live_log or await func(self)
return wrapper
@staticmethod
def raise_if_shouldnt_remove_now(func):
"""
:raises FeatureError: if operation couldn't be performed
:returns str msg: log path if already ongoing operation
:returns continue function isntall/remove: if operation is permitted
"""
async def wrapper(self):
# check if the operation is in progress
if self.installation_live_log:
raise FeatureError("Wait until installation is finished!")
elif not self.is_installed:
raise FeatureNotice(
"Can't delete {}, because it's not installed".format(
self.NAME
)
)
return self.removal_live_log or await func(self)
return wrapper
async def status(self):
if self.installation_live_log:
msg = "{} is installing".format(self.NAME)
status = FeatureStatus.INSTALLING
elif self.removal_live_log:
msg = "{} is removing".format(self.NAME)
status = FeatureStatus.REMOVING
elif await self.check_installed():
msg = "{} is installed".format(self.NAME)
status = FeatureStatus.INSTALLED
else:
msg = "{} is not installed".format(self.NAME)
status = FeatureStatus.NOT_INSTALLED
return {
"items": {
"message": msg,
"status": status,
}
}
defence360agent/subsys/features/kernel_care.py 0000644 0000000 0000000 00000010435 00000000000 016543 0 ustar import logging
import os
import json
from defence360agent.contracts.config import Core
from defence360agent.utils import (
OsReleaseInfo,
run_cmd_and_log_in_own_cgroup,
)
from defence360agent.subsys.features.abstract_feature import (
AbstractFeature,
FeatureError,
FeatureStatus,
)
from defence360agent import utils
from defence360agent.rpc_tools import exceptions
logger = logging.getLogger(__name__)
class KernelCare(AbstractFeature):
KC_PROPERTIES = "/var/imunify360/plesk-previous-kernelcare-stats.json"
KC_SCRIPT_URL = (
"https://repo.cloudlinux.com/kernelcare/kernelcare_install.sh"
)
LOG_DIR = "/var/log/%s" % Core.PRODUCT
NAME = "KernelCare"
BIN_PATH = "/usr/bin/kcarectl"
INSTALL_LOG_FILE_MASK = "%s/install-kernelcare.log.*" % LOG_DIR
REMOVE_LOG_FILE_MASK = "%s/remove-kernelcare.log.*" % LOG_DIR
INSTALL_CMD = "curl -s %s | bash" % KC_SCRIPT_URL
REMOVE_CMD_REDHAT = "yum remove -y kernelcare"
REMOVE_CMD_DEBIAN = "apt-get -y remove kernelcare"
_CMD_LIST = [INSTALL_CMD, REMOVE_CMD_REDHAT, REMOVE_CMD_DEBIAN]
STATUS_MESSAGE = {
0: "Host is updated to the latest patch level",
1: "There are no applied patches",
2: "There are new not applied patches",
3: "Kernel is unsupported",
}
async def _check_installed_impl(self) -> bool:
return os.path.exists(self.BIN_PATH)
async def status(self):
"""
:raises FeatureError: if kernelcare returns unexpected error
:return: str: feature's current status
"""
status = await super().status()
is_feature_installed = (
status["items"]["status"] == FeatureStatus.INSTALLED
)
if not is_feature_installed:
return status
ret, out, err = await self.get_output_kcarectl("--status")
try:
# EDF is obsolete since 6.1
status["items"]["edf_supported"] = False
status["items"]["message"] = self.STATUS_MESSAGE[ret]
except KeyError:
raise FeatureError(
"Unknown error occured while getting status from kcarectl. "
f"stdout: [{out}], stderr: [{err}], return code: [{ret}]"
)
return status
@AbstractFeature.raise_if_shouldnt_install_now
async def install(self):
# Runs as a transient unit: the KernelCare RPM's %prein scriptlet
# needs an LSM domain transition on exec, and its dnf solve plus the
# SELinux policy rebuild must not be charged to the agent's cgroup.
return await run_cmd_and_log_in_own_cgroup(
self.INSTALL_CMD,
self.INSTALL_LOG_FILE_MASK,
env={"DEBIAN_FRONTEND": "noninteractive"},
)
@AbstractFeature.raise_if_shouldnt_remove_now
async def remove(self):
if OsReleaseInfo.id_like() & OsReleaseInfo.DEBIAN:
command = self.REMOVE_CMD_DEBIAN
else:
command = self.REMOVE_CMD_REDHAT
return await run_cmd_and_log_in_own_cgroup(
command, self.REMOVE_LOG_FILE_MASK
)
async def get_plugin_info(self):
try:
output = await self.run_kcarectl("--plugin-info", "--json")
except FileNotFoundError:
raise exceptions.RpcError("kcarectl not found")
except utils.CheckRunError as e:
if not (e.returncode == 2 and b"--json" in e.stderr):
raise # reraise as is
else: # unrecognized arguments: --json
# use RpcError, to get an error
raise exceptions.RpcError(
"Your kcarectl version doesn't support --json option."
" Please, update to kernelcare-2.15-2 or newer."
)
try:
results = json.loads(output.decode().partition("--START--")[-1])
except ValueError:
raise exceptions.RpcError(
"Can't decode kcarectl output as json."
" Try updating to the latest kernelcare version."
)
return results
async def run_kcarectl(self, *options):
return await utils.check_run((self.BIN_PATH,) + options)
async def get_output_kcarectl(self, *options):
ret, out, err = await utils.run([self.BIN_PATH, *options])
return ret, out.decode(), err.decode()
defence360agent/subsys/notifier.py 0000644 0000000 0000000 00000003511 00000000000 014267 0 ustar """Send events via Notification service"""
import asyncio
import base64
import json
SOCKET_PATH = "/opt/imunify360/lib/event.sock"
SOCKET_TIMEOUT = 10.0 # seconds
_LEN_BYTES = 4
_MAX_SIZE = 1024 * 1024
CONFIG_UPDATED_EVENT_ID = "CONFIG_UPDATED"
USER_SCAN_STARTED_EVENT_ID = "USER_SCAN_STARTED"
USER_SCAN_FINISHED_EVENT_ID = "USER_SCAN_FINISHED"
USER_SCAN_MALWARE_FOUND_EVENT_ID = "USER_SCAN_MALWARE_FOUND"
CUSTOM_SCAN_STARTED_EVENT_ID = "CUSTOM_SCAN_STARTED"
CUSTOM_SCAN_FINISHED_EVENT_ID = "CUSTOM_SCAN_FINISHED"
CUSTOM_SCAN_MALWARE_FOUND_EVENT_ID = "CUSTOM_SCAN_MALWARE_FOUND"
SCRIPT_BLOCKED_EVENT_ID = "SCRIPT_BLOCKED"
def _prepare_event(event_id: str, user: str, body: dict) -> bytes:
event = json.dumps(
{
"event_id": event_id,
"user": user,
"body": base64.b64encode(json.dumps(body).encode("utf-8")).decode(
"utf-8"
),
}
)
binary = event.encode("utf-8")
if len(binary) > _MAX_SIZE:
raise Exception(
"message size {} exceeds limit of {}".format(
len(binary), _MAX_SIZE
)
)
return len(binary).to_bytes(_LEN_BYTES, byteorder="big") + binary
async def _send_event(event: bytes) -> None:
_, writer = await asyncio.open_unix_connection(SOCKET_PATH)
try:
writer.write(event)
await writer.drain()
finally:
writer.close()
async def trigger_event(event_id: str, user: str, body: dict) -> None:
"""Send an event with given event_id and user, having given body."""
event = _prepare_event(event_id, user, body)
await asyncio.wait_for(_send_event(event), SOCKET_TIMEOUT)
async def config_updated() -> None:
"""Send CONFIG_UPDATED event.
This forces imunify-notifier to reread its config."""
await trigger_event(CONFIG_UPDATED_EVENT_ID, "", {})
defence360agent/subsys/panels/ 0000755 0000000 0000000 00000000000 00000000000 013360 5 ustar defence360agent/subsys/panels/__init__.py 0000644 0000000 0000000 00000000000 00000000000 015457 0 ustar defence360agent/subsys/panels/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 015570 5 ustar defence360agent/subsys/panels/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000310 00000000000 022762 0 ustar
r_j d S )N r [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/__init__.py<module>r s r defence360agent/subsys/panels/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000310 00000000000 022023 0 ustar
r_j d S )N r [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/__init__.py<module>r s r defence360agent/subsys/panels/__pycache__/base.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000036072 00000000000 022153 0 ustar
r_jS$ D d dl Z d dlmZmZ d dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZmZmZ d dlmZmZ g d Zd
Z G d d e Z G d
de Z G d de Ze G d d Z G d de Zd Z G d de Z d Z dS ) N)ABCabstractmethod) defaultdict) dataclass)IntEnum)Path)DictListOptionalSet)APIError IPEchoAPI) 202122255380110443587993995z
generic panelc e Zd ZdZdZdZdS ) UserLevel N)__name__
__module__ __qualname__ADMINRESSELER REGULAR_USER W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/base.pyr r s
EHLLLr& r c e Zd ZdS )PanelExceptionNr r r! r% r& r' r) r) " Dr& r) c e Zd ZdS )InvalidTokenExceptionNr* r% r& r' r- r- & r+ r& r- c 8 e Zd ZU eed< eed< eed< eed< dS )
DomainDatadocrootdomaintypeusernameN)r r r! str__annotations__r% r& r' r/ r/ * s4
LLL KKK
IIIMMMMMr& r/ c f e Zd ZdZdZdgez dgez dg dg dddZeZg Z e
e d Z e
d
Z
e
d Ze
d Ze d*d Ze d*d Ze d Ze dee fd Ze deeee f fd Ze deeee f fd Ze defd Zdeeeeef f fdZdefdZ de fdZ e
d Z de fdZ!e de"e fd Z#e
d ede$fd Z%e
d ede&e fd Z'e
defd Z(e
d
d!d" Z)e deeef fd# Z*e
d$e dd
fd% Z+deeee f fd&Z,d' Z-e
d(ede.e/ fd) Z0d
S )+
AbstractPanelzTAbstract class that provides only basic hosting panel integration
functionality.MINIMAL465113)inout)r r r r )r r r r: 123)tcpudpc dS )z\
Checks if hosting panel installed on the known path
:return: bool:
Nr% clss r' is_installedzAbstractPanel.is_installedD s
r& c L t j S # t $ r Y dS w xY w)zb
Stub with external IP as currently
only implementation for cPanel needed
)r server_ipr
rA s r'
get_server_ipzAbstractPanel.get_server_ipM s8 &(( ( 22 s
##c
K d S Nr% rA s r' versionzAbstractPanel.versionX s tr& c K | j S rI )NAMErA s r' namezAbstractPanel.name\ s
xr& Nc
K dS )zM
Registers and enables Imunify360 UI plugin in hosting panel
Nr% selfrM s r' enable_imunify_pluginz#AbstractPanel.enable_imunify_plugin`
r& c
K dS )zC
UnRegisters Imunify360 UI plugin in hosting panel
Nr% rO s r' disable_imunify_pluginz$AbstractPanel.disable_imunify_pluging rR r& c
K dS )zP
Returns domains hosted via control panel
:return: list
Nr% rP s r' get_user_domainsz AbstractPanel.get_user_domainsn
r& returnc
K dS )zO
Returns system users from hosting panel
:return: list
Nr% rV s r' get_userszAbstractPanel.get_usersv rX r& c
K dS )zA
Returns dict with domain to list of users pairs
Nr% rV s r' get_domain_to_ownerz!AbstractPanel.get_domain_to_owner~ rR r& c
K dS )zA
Returns dict with user to list of domains pairs
Nr% rV s r' get_domains_per_userz"AbstractPanel.get_domains_per_user rR r& c
K dS )z#
Returns panel url
Nr% )rP r3 s r' panel_user_linkz AbstractPanel.panel_user_link rR r& c N K d | d{V D S )z7
Returns dict with user to email pairs
c i | ]}|d d d S )rE )emaillocaler% ).0users r'
<dictcomp>z2AbstractPanel.get_user_details.<locals>.<dictcomp> s2
B"--
r& N)r[ rV s r' get_user_detailsz AbstractPanel.get_user_details sC
"nn . .......
r& c n K t t | d {V S rI )lenlistr[ rV s r' users_countzAbstractPanel.users_count s8 4dnn . .......//000r& datac n d}|j dk r t j |j }|j }|j |fS )z
Performs actions to distinguish endusers from admins
:param protocol: _RpcServerProtocol
:param data: parsed params
:returns (user_type, user_name)
Nr )_uidpwdgetpwuidpw_namerg )rP protocolrn rM pws r' authenticatezAbstractPanel.authenticate s= =A hm,,B:D}d""r& c t rI NotImplementedErrorrA s r' get_modsec_config_pathz$AbstractPanel.get_modsec_config_path s !!r& c dS )z(
Return Conflict status
Fr% rV s r' get_SMTP_conflict_statusz&AbstractPanel.get_SMTP_conflict_status s ur& c d S rI r% rV s r' basedirszAbstractPanel.basedirs s r& home_dirc R t | j }|S rI )r resolveparent)rB r base_dirs r'
base_home_dirzAbstractPanel.base_home_dir s! >>))++2r& c , | | }t | }| | }n# t t
f$ r Y d S w xY wddlm} t |dd x}r|}t |dz |z S )Nr ) MalwareTuneRAPID_SCAN_BASEDIR_OVERRIDEz.rapid-scan-db)
r r r relative_to
ValueError RuntimeError defence360agent.contracts.configr getattrr4 )rB r r
resolved_hometailr rapid_scan_basedir_overrides r' get_rapid_scan_db_dirz#AbstractPanel.get_rapid_scan_db_dir s ((22H NN 2 2 4 4M ,,X66DDL) 44 A@@@@@*1 6+
+
& 3 3H8 ..5666s A A A#"A#c K t )z
Returns registration key from panel, if possible, raise
PanelException if not successful (or wrong panel key provided),
or NoImplemented if method not supported
by the panel.
rx rA s r' retrieve_keyzAbstractPanel.retrieve_key s "!r& )rg c
K dS )zD
Notify a customer using the panel internal tooling
Nr% )rB message_typeparamsrg s r' notifyzAbstractPanel.notify
tr& c
K dS )z5
:return dict with docroot to domain
Nr% rV s r'
list_docrootszAbstractPanel.list_docroots rR r& myimunify_enabledc
K dS )zK
Switch UI panel configuration between Im360 and MyImunify
Nr% )rB r s r' switch_ui_configz AbstractPanel.switch_ui_config r r& c K | d{V }t t }| D ] \ }}|| | !|S )z
Domain to docroot list mapping
Patchman expects a subdomain to be listed separately from main domain
:return: dict with domain to list of docroots
N)r r rl itemsappend)rP doc_roots domain_pathsdoc_root domain_names r' get_domain_pathsz AbstractPanel.get_domain_paths sx ,,........ "4(( %.__%6%6 7 7 !Hk % , ,X 6 6 6 6r& c K | d {V }| d {V }| d {V }| d {V }g }|D ]}|| }|d }|d } | dd }
| dt t j } | dd } | |g }
g }|
D ]0}| |g }| ||d 1| ||| |
| | |d |S )
Nrd re r rE level suspendedF)r1 paths)r3 rd languager r r domains) r[ r r_ ri getintr r$ r )rP panel_usersr user_domains user_detailsusers user_namedetailsrd re r r r r user_domain_pathsr r s r' patchman_usersz AbstractPanel.patchman_users s NN , ,,,,,,, ! 2 2 4 4444444 ! 6 6 8 8888888 ! 2 2 4 4444444 $ I"9-GG$E X&F [[2..FKKY-C)D)DEEE K77I"&&y"55G " &
$((b99!(("-!&
LL ) " & $ "!* 0
r& r3 c " K t rI rx )rB r3 s r' get_user_domains_detailsz&AbstractPanel.get_user_domains_details/ s !###r& rI )1r r r! __doc__rL TCP_PORTS_COMMON
OPEN_PORTSr) exceptionsmtp_allow_users classmethodr rC rG rJ rM rQ rT rW r
r4 r[ r r] r_ ra ri r rm dictrv rz boolr| r r~ r r r r r r r r r r rl r/ r r% r& r' r7 r7 2 sB D ' ,,7 --
,++333
J I
^ [
[ [ [
^
^
^
c
^
4T#Y+?
^
Dd3i ,@
^
^
S$sCx.-@(A
13 1 1 1 1#4 # # # #( " " ["$
#c(
^
S T [ 7S 7Xc] 7 7 7 [7$ "3 " " " [" 8< [
T#s(^
^
t [ S$s)^(< & & &P $c $d:>N $ $ $ [$ $ $r& r7 c fd}|S )a"
Run function only if hosting panel is installed,
elsewhere raise PanelException
This method is intended to be used as a decorator on AbstractPanel instance
methods.
:raise PanelException:
:param dec_kwargs: kwargs passed to is_installed function
:return:
c fd}|S )z&
:param fn: coroutine
c K | j di s"| d| j j z | g|R i | d {V S )Nz%s is not valid!r% )rC r __class__r )rP argskwargs
dec_kwargsfns r' wrapperz;ensure_valid_panel.<locals>.real_decorator.<locals>.wrapperF sy $4$22z22
nn& )@@ D24222622222222 2r& r% )r r r s ` r' real_decoratorz*ensure_valid_panel.<locals>.real_decoratorA s)
3 3 3 3 3 3 r& r% )r r s ` r' ensure_valid_panelr 4 s$ r& c e Zd ZdZdS )ModsecVendorsErrorz9
Raises when its impossible to get modsec vendor
N)r r r! r r% r& r' r r R s Dr& r c fd}|S )zDecorator for functions on cPanel instance methods.
Calls original function if _is_dns_only() returns False, otherwise
throws cPanelException.c ~ K | r| d | g|R i | d {V S )Nz'Method is not allowed for dnsonly panel) _is_dns_onlyr )rP r r r s r' r z forbid_dns_only.<locals>.wrapper` sa L..!JKK KR.t...v.........r& r% )r r s ` r' forbid_dns_onlyr Z s# / / / / /
Nr& ) rq abcr r collectionsr dataclassesr enumr pathlibr typingr r
r r defence360agent.utils.ipechor
r r GENERIC_PANEL_NAMEr Exceptionr) r- r/ r7 r r r r% r& r' <module>r s
# # # # # # # # # # # # # # ! ! ! ! ! ! , , , , , , , , , , , , < < < < < < < < % Y I $ $ $ $ $C $ $ $D < r& defence360agent/subsys/panels/__pycache__/base.cpython-311.pyc 0000644 0000000 0000000 00000036072 00000000000 021214 0 ustar
r_jS$ D d dl Z d dlmZmZ d dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZmZmZ d dlmZmZ g d Zd
Z G d d e Z G d
de Z G d de Ze G d d Z G d de Zd Z G d de Z d Z dS ) N)ABCabstractmethod) defaultdict) dataclass)IntEnum)Path)DictListOptionalSet)APIError IPEchoAPI) 202122255380110443587993995z
generic panelc e Zd ZdZdZdZdS ) UserLevel N)__name__
__module__ __qualname__ADMINRESSELER REGULAR_USER W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/base.pyr r s
EHLLLr& r c e Zd ZdS )PanelExceptionNr r r! r% r& r' r) r) " Dr& r) c e Zd ZdS )InvalidTokenExceptionNr* r% r& r' r- r- & r+ r& r- c 8 e Zd ZU eed< eed< eed< eed< dS )
DomainDatadocrootdomaintypeusernameN)r r r! str__annotations__r% r& r' r/ r/ * s4
LLL KKK
IIIMMMMMr& r/ c f e Zd ZdZdZdgez dgez dg dg dddZeZg Z e
e d Z e
d
Z
e
d Ze
d Ze d*d Ze d*d Ze d Ze dee fd Ze deeee f fd Ze deeee f fd Ze defd Zdeeeeef f fdZdefdZ de fdZ e
d Z de fdZ!e de"e fd Z#e
d ede$fd Z%e
d ede&e fd Z'e
defd Z(e
d
d!d" Z)e deeef fd# Z*e
d$e dd
fd% Z+deeee f fd&Z,d' Z-e
d(ede.e/ fd) Z0d
S )+
AbstractPanelzTAbstract class that provides only basic hosting panel integration
functionality.MINIMAL465113)inout)r r r r )r r r r: 123)tcpudpc dS )z\
Checks if hosting panel installed on the known path
:return: bool:
Nr% clss r' is_installedzAbstractPanel.is_installedD s
r& c L t j S # t $ r Y dS w xY w)zb
Stub with external IP as currently
only implementation for cPanel needed
)r server_ipr
rA s r'
get_server_ipzAbstractPanel.get_server_ipM s8 &(( ( 22 s
##c
K d S Nr% rA s r' versionzAbstractPanel.versionX s tr& c K | j S rI )NAMErA s r' namezAbstractPanel.name\ s
xr& Nc
K dS )zM
Registers and enables Imunify360 UI plugin in hosting panel
Nr% selfrM s r' enable_imunify_pluginz#AbstractPanel.enable_imunify_plugin`
r& c
K dS )zC
UnRegisters Imunify360 UI plugin in hosting panel
Nr% rO s r' disable_imunify_pluginz$AbstractPanel.disable_imunify_pluging rR r& c
K dS )zP
Returns domains hosted via control panel
:return: list
Nr% rP s r' get_user_domainsz AbstractPanel.get_user_domainsn
r& returnc
K dS )zO
Returns system users from hosting panel
:return: list
Nr% rV s r' get_userszAbstractPanel.get_usersv rX r& c
K dS )zA
Returns dict with domain to list of users pairs
Nr% rV s r' get_domain_to_ownerz!AbstractPanel.get_domain_to_owner~ rR r& c
K dS )zA
Returns dict with user to list of domains pairs
Nr% rV s r' get_domains_per_userz"AbstractPanel.get_domains_per_user rR r& c
K dS )z#
Returns panel url
Nr% )rP r3 s r' panel_user_linkz AbstractPanel.panel_user_link rR r& c N K d | d{V D S )z7
Returns dict with user to email pairs
c i | ]}|d d d S )rE )emaillocaler% ).0users r'
<dictcomp>z2AbstractPanel.get_user_details.<locals>.<dictcomp> s2
B"--
r& N)r[ rV s r' get_user_detailsz AbstractPanel.get_user_details sC
"nn . .......
r& c n K t t | d {V S rI )lenlistr[ rV s r' users_countzAbstractPanel.users_count s8 4dnn . .......//000r& datac n d}|j dk r t j |j }|j }|j |fS )z
Performs actions to distinguish endusers from admins
:param protocol: _RpcServerProtocol
:param data: parsed params
:returns (user_type, user_name)
Nr )_uidpwdgetpwuidpw_namerg )rP protocolrn rM pws r' authenticatezAbstractPanel.authenticate s= =A hm,,B:D}d""r& c t rI NotImplementedErrorrA s r' get_modsec_config_pathz$AbstractPanel.get_modsec_config_path s !!r& c dS )z(
Return Conflict status
Fr% rV s r' get_SMTP_conflict_statusz&AbstractPanel.get_SMTP_conflict_status s ur& c d S rI r% rV s r' basedirszAbstractPanel.basedirs s r& home_dirc R t | j }|S rI )r resolveparent)rB r base_dirs r'
base_home_dirzAbstractPanel.base_home_dir s! >>))++2r& c , | | }t | }| | }n# t t
f$ r Y d S w xY wddlm} t |dd x}r|}t |dz |z S )Nr ) MalwareTuneRAPID_SCAN_BASEDIR_OVERRIDEz.rapid-scan-db)
r r r relative_to
ValueError RuntimeError defence360agent.contracts.configr getattrr4 )rB r r
resolved_hometailr rapid_scan_basedir_overrides r' get_rapid_scan_db_dirz#AbstractPanel.get_rapid_scan_db_dir s ((22H NN 2 2 4 4M ,,X66DDL) 44 A@@@@@*1 6+
+
& 3 3H8 ..5666s A A A#"A#c K t )z
Returns registration key from panel, if possible, raise
PanelException if not successful (or wrong panel key provided),
or NoImplemented if method not supported
by the panel.
rx rA s r' retrieve_keyzAbstractPanel.retrieve_key s "!r& )rg c
K dS )zD
Notify a customer using the panel internal tooling
Nr% )rB message_typeparamsrg s r' notifyzAbstractPanel.notify
tr& c
K dS )z5
:return dict with docroot to domain
Nr% rV s r'
list_docrootszAbstractPanel.list_docroots rR r& myimunify_enabledc
K dS )zK
Switch UI panel configuration between Im360 and MyImunify
Nr% )rB r s r' switch_ui_configz AbstractPanel.switch_ui_config r r& c K | d{V }t t }| D ] \ }}|| | !|S )z
Domain to docroot list mapping
Patchman expects a subdomain to be listed separately from main domain
:return: dict with domain to list of docroots
N)r r rl itemsappend)rP doc_roots domain_pathsdoc_root domain_names r' get_domain_pathsz AbstractPanel.get_domain_paths sx ,,........ "4(( %.__%6%6 7 7 !Hk % , ,X 6 6 6 6r& c K | d {V }| d {V }| d {V }| d {V }g }|D ]}|| }|d }|d } | dd }
| dt t j } | dd } | |g }
g }|
D ]0}| |g }| ||d 1| ||| |
| | |d |S )
Nrd re r rE level suspendedF)r1 paths)r3 rd languager r r domains) r[ r r_ ri getintr r$ r )rP panel_usersr user_domains user_detailsusers user_namedetailsrd re r r r r user_domain_pathsr r s r' patchman_usersz AbstractPanel.patchman_users s NN , ,,,,,,, ! 2 2 4 4444444 ! 6 6 8 8888888 ! 2 2 4 4444444 $ I"9-GG$E X&F [[2..FKKY-C)D)DEEE K77I"&&y"55G " &
$((b99!(("-!&
LL ) " & $ "!* 0
r& r3 c " K t rI rx )rB r3 s r' get_user_domains_detailsz&AbstractPanel.get_user_domains_details/ s !###r& rI )1r r r! __doc__rL TCP_PORTS_COMMON
OPEN_PORTSr) exceptionsmtp_allow_users classmethodr rC rG rJ rM rQ rT rW r
r4 r[ r r] r_ ra ri r rm dictrv rz boolr| r r~ r r r r r r r r r r rl r/ r r% r& r' r7 r7 2 sB D ' ,,7 --
,++333
J I
^ [
[ [ [
^
^
^
c
^
4T#Y+?
^
Dd3i ,@
^
^
S$sCx.-@(A
13 1 1 1 1#4 # # # #( " " ["$
#c(
^
S T [ 7S 7Xc] 7 7 7 [7$ "3 " " " [" 8< [
T#s(^
^
t [ S$s)^(< & & &P $c $d:>N $ $ $ [$ $ $r& r7 c fd}|S )a"
Run function only if hosting panel is installed,
elsewhere raise PanelException
This method is intended to be used as a decorator on AbstractPanel instance
methods.
:raise PanelException:
:param dec_kwargs: kwargs passed to is_installed function
:return:
c fd}|S )z&
:param fn: coroutine
c K | j di s"| d| j j z | g|R i | d {V S )Nz%s is not valid!r% )rC r __class__r )rP argskwargs
dec_kwargsfns r' wrapperz;ensure_valid_panel.<locals>.real_decorator.<locals>.wrapperF sy $4$22z22
nn& )@@ D24222622222222 2r& r% )r r r s ` r' real_decoratorz*ensure_valid_panel.<locals>.real_decoratorA s)
3 3 3 3 3 3 r& r% )r r s ` r' ensure_valid_panelr 4 s$ r& c e Zd ZdZdS )ModsecVendorsErrorz9
Raises when its impossible to get modsec vendor
N)r r r! r r% r& r' r r R s Dr& r c fd}|S )zDecorator for functions on cPanel instance methods.
Calls original function if _is_dns_only() returns False, otherwise
throws cPanelException.c ~ K | r| d | g|R i | d {V S )Nz'Method is not allowed for dnsonly panel) _is_dns_onlyr )rP r r r s r' r z forbid_dns_only.<locals>.wrapper` sa L..!JKK KR.t...v.........r& r% )r r s ` r' forbid_dns_onlyr Z s# / / / / /
Nr& ) rq abcr r collectionsr dataclassesr enumr pathlibr typingr r
r r defence360agent.utils.ipechor
r r GENERIC_PANEL_NAMEr Exceptionr) r- r/ r7 r r r r% r& r' <module>r s
# # # # # # # # # # # # # # ! ! ! ! ! ! , , , , , , , , , , , , < < < < < < < < % Y I $ $ $ $ $C $ $ $D < r& defence360agent/subsys/panels/__pycache__/hosting_panel.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003051 00000000000 024062 0 ustar
r_j l d dl mZ d dlmZ d dlmZ defdZ e ada deddfdZ
d defd
Z dS ) )get_hosting_panel)
AbstractPanel)importerreturnc 2 t j d rdS dS )z<Use im360 panel classes when the im360 package is installed.im360defence360agent)r exists `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/hosting_panel.py_default_panel_rootr s w w r N root_modulec | a d ad S )N) _panel_rootpanel)r s r
set_panel_rootr s K EEEr Fc J t | rt t a t S )z
Return the hosting panel singleton.
Panels are loaded from ``_panel_root`` which auto-detects the correct
package (``im360`` when installed, ``defence360agent`` otherwise).
Can be overridden via ``set_panel_root``.
)r r r )check_for_changess r
HostingPanelr s
})}!+.. Lr )F) 3defence360agent.application.determine_hosting_panelr "defence360agent.subsys.panels.baser defence360agent.utilsr strr r r r r r r r
<module>r s = < < < < < * * * * * * S "!## ] r defence360agent/subsys/panels/__pycache__/hosting_panel.cpython-311.pyc 0000644 0000000 0000000 00000003051 00000000000 023123 0 ustar
r_j l d dl mZ d dlmZ d dlmZ defdZ e ada deddfdZ
d defd
Z dS ) )get_hosting_panel)
AbstractPanel)importerreturnc 2 t j d rdS dS )z<Use im360 panel classes when the im360 package is installed.im360defence360agent)r exists `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/hosting_panel.py_default_panel_rootr s w w r N root_modulec | a d ad S )N) _panel_rootpanel)r s r
set_panel_rootr s K EEEr Fc J t | rt t a t S )z
Return the hosting panel singleton.
Panels are loaded from ``_panel_root`` which auto-detects the correct
package (``im360`` when installed, ``defence360agent`` otherwise).
Can be overridden via ``set_panel_root``.
)r r r )check_for_changess r
HostingPanelr s
})}!+.. Lr )F) 3defence360agent.application.determine_hosting_panelr "defence360agent.subsys.panels.baser defence360agent.utilsr strr r r r r r r r
<module>r s = < < < < < * * * * * * S "!## ] r defence360agent/subsys/panels/base.py 0000644 0000000 0000000 00000022123 00000000000 014644 0 ustar import pwd
from abc import ABC, abstractmethod
from collections import defaultdict
from dataclasses import dataclass
from enum import IntEnum
from pathlib import Path
from typing import Dict, List, Optional, Set
from defence360agent.utils.ipecho import APIError, IPEchoAPI
TCP_PORTS_COMMON = [
"20",
"21",
"22",
"25",
"53",
"80",
"110",
"443",
"587",
"993",
"995",
]
GENERIC_PANEL_NAME = "generic panel"
class UserLevel(IntEnum):
ADMIN = 1
RESSELER = 2
REGULAR_USER = 3
class PanelException(Exception):
pass
class InvalidTokenException(Exception):
pass
@dataclass
class DomainData:
docroot: str
domain: str
type: str
username: str
class AbstractPanel(ABC):
"""Abstract class that provides only basic hosting panel integration
functionality."""
NAME = "MINIMAL"
OPEN_PORTS = {
"tcp": {
"in": ["465"] + TCP_PORTS_COMMON,
"out": ["113"] + TCP_PORTS_COMMON,
},
"udp": {
"in": ["20", "21", "53", "443"],
"out": ["20", "21", "53", "113", "123"],
},
}
exception = PanelException
smtp_allow_users = [] # type: List[str]
@classmethod
@abstractmethod
def is_installed(cls):
"""
Checks if hosting panel installed on the known path
:return: bool:
"""
pass
@classmethod
def get_server_ip(cls):
"""
Stub with external IP as currently
only implementation for cPanel needed
"""
try:
return IPEchoAPI.server_ip()
except APIError:
return ""
@classmethod
async def version(cls):
return None
@classmethod
async def name(cls):
return cls.NAME
@abstractmethod
async def enable_imunify_plugin(self, name=None):
"""
Registers and enables Imunify360 UI plugin in hosting panel
"""
pass
@abstractmethod
async def disable_imunify_plugin(self, name=None):
"""
UnRegisters Imunify360 UI plugin in hosting panel
"""
pass
@abstractmethod
async def get_user_domains(self):
"""
Returns domains hosted via control panel
:return: list
"""
pass
@abstractmethod
async def get_users(self) -> List[str]:
"""
Returns system users from hosting panel
:return: list
"""
pass
@abstractmethod
async def get_domain_to_owner(self) -> Dict[str, List[str]]:
"""
Returns dict with domain to list of users pairs
"""
pass
@abstractmethod
async def get_domains_per_user(self) -> Dict[str, List[str]]:
"""
Returns dict with user to list of domains pairs
"""
pass
@abstractmethod
async def panel_user_link(self, username) -> str:
"""
Returns panel url
"""
pass
async def get_user_details(self) -> Dict[str, Dict[str, str]]:
"""
Returns dict with user to email pairs
"""
return {
user: {"email": "", "locale": ""}
for user in await self.get_users()
}
async def users_count(self) -> int:
return len(list(await self.get_users()))
def authenticate(self, protocol, data: dict):
"""
Performs actions to distinguish endusers from admins
:param protocol: _RpcServerProtocol
:param data: parsed params
:returns (user_type, user_name)
"""
name = None
if protocol._uid != 0:
# we can get here if a non-root web panel user visits i360 UI
# To emulate it:
# su -s /bin/bash -c
# $'echo \'{"command":["config", "show"],"params":{}}\'
# | nc -U -w1 \
# /var/run/defence360agent/non_root_simple_rpc.sock'
# fakeuser
pw = pwd.getpwuid(protocol._uid)
name = pw.pw_name
return protocol.user, name
@classmethod
def get_modsec_config_path(cls):
raise NotImplementedError
def get_SMTP_conflict_status(self) -> bool:
"""
Return Conflict status
"""
return False
@abstractmethod
def basedirs(self) -> Set[str]:
pass
@classmethod
def base_home_dir(cls, home_dir: str) -> Path:
base_dir = Path(home_dir).resolve().parent
return base_dir
@classmethod
def get_rapid_scan_db_dir(cls, home_dir: str) -> Optional[str]:
try:
base_dir = cls.base_home_dir(home_dir)
resolved_home = Path(home_dir).resolve()
tail = resolved_home.relative_to(base_dir)
# Symbolic link loop could cause runtime error
except (ValueError, RuntimeError):
return None
from defence360agent.contracts.config import MalwareTune
if rapid_scan_basedir_override := getattr(
MalwareTune, "RAPID_SCAN_BASEDIR_OVERRIDE", None
):
base_dir = rapid_scan_basedir_override
return str(base_dir / ".rapid-scan-db" / tail)
@classmethod
async def retrieve_key(cls) -> str:
"""
Returns registration key from panel, if possible, raise
PanelException if not successful (or wrong panel key provided),
or NoImplemented if method not supported
by the panel.
"""
raise NotImplementedError
@classmethod
async def notify(cls, *, message_type, params, user=None):
"""
Notify a customer using the panel internal tooling
"""
return None
@abstractmethod
async def list_docroots(self) -> Dict[str, str]:
"""
:return dict with docroot to domain
"""
pass
@classmethod
async def switch_ui_config(cls, myimunify_enabled: bool) -> None:
"""
Switch UI panel configuration between Im360 and MyImunify
"""
return None
async def get_domain_paths(self) -> Dict[str, List[str]]:
"""
Domain to docroot list mapping
Patchman expects a subdomain to be listed separately from main domain
:return: dict with domain to list of docroots
"""
doc_roots = await self.list_docroots()
domain_paths = defaultdict(list)
for doc_root, domain_name in doc_roots.items():
domain_paths[domain_name].append(doc_root)
return domain_paths
async def patchman_users(self):
panel_users = await self.get_users()
domain_paths = await self.get_domain_paths()
user_domains = await self.get_domains_per_user()
user_details = await self.get_user_details()
users = []
for user_name in panel_users:
details = user_details[user_name]
email = details["email"]
locale = details["locale"]
parent = details.get("parent", "")
level = details.get("level", int(UserLevel.REGULAR_USER))
suspended = details.get("suspended", False)
domains = user_domains.get(user_name, [])
user_domain_paths = []
for domain_name in domains:
paths = domain_paths.get(domain_name, [])
user_domain_paths.append(
{
"domain": domain_name,
"paths": paths,
}
)
users.append(
{
"username": user_name,
"email": email,
"language": locale,
"parent": parent,
"level": level,
"suspended": suspended,
"domains": user_domain_paths,
}
)
return users
@classmethod
async def get_user_domains_details(cls, username: str) -> list[DomainData]:
raise NotImplementedError()
def ensure_valid_panel(**dec_kwargs):
"""
Run function only if hosting panel is installed,
elsewhere raise PanelException
This method is intended to be used as a decorator on AbstractPanel instance
methods.
:raise PanelException:
:param dec_kwargs: kwargs passed to is_installed function
:return:
"""
def real_decorator(fn):
"""
:param fn: coroutine
"""
async def wrapper(self, *args, **kwargs):
if not self.is_installed(**dec_kwargs):
raise self.exception(
"%s is not valid!" % self.__class__.__name__
)
return await fn(self, *args, **kwargs)
return wrapper
return real_decorator
class ModsecVendorsError(Exception):
"""
Raises when its impossible to get modsec vendor
"""
pass
def forbid_dns_only(fn):
"""Decorator for functions on cPanel instance methods.
Calls original function if _is_dns_only() returns False, otherwise
throws cPanelException."""
async def wrapper(self, *args, **kwargs):
if self._is_dns_only():
raise self.exception("Method is not allowed for dnsonly panel")
return await fn(self, *args, **kwargs)
return wrapper
defence360agent/subsys/panels/cpanel/ 0000755 0000000 0000000 00000000000 00000000000 014622 5 ustar defence360agent/subsys/panels/cpanel/__init__.py 0000644 0000000 0000000 00000000060 00000000000 016727 0 ustar from .panel import cPanel
__all__ = ["cPanel"]
defence360agent/subsys/panels/cpanel/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 017032 5 ustar defence360agent/subsys/panels/cpanel/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000432 00000000000 024231 0 ustar
r_j0 d dl mZ dgZdS ) )cPanelr N)panelr __all__ b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/cpanel/__init__.py<module>r s" *r defence360agent/subsys/panels/cpanel/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000432 00000000000 023272 0 ustar
r_j0 d dl mZ dgZdS ) )cPanelr N)panelr __all__ b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/cpanel/__init__.py<module>r s" *r defence360agent/subsys/panels/cpanel/__pycache__/packages.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000014241 00000000000 024253 0 ustar
r_j L d dl Z d dlZd dlmZ d dlmZ d dlmZmZ e j e
Z G d de Z G d de
Z e ej d
d d
edefd Zddee fdZdededdfdZdededdfdZdeddfdZdeddfdZdS ) N)List) timed_cache)WHMAPIExceptionwhmapi1c e Zd ZdS )PackageNotExistErrorN)__name__
__module__ __qualname__ b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/cpanel/packages.pyr r s Dr
r c B e Zd Zdee fdZdedefdZdefdZdS )PkgInforeturnc R | dd S )N_PACKAGE_EXTENSIONS )getsplitselfs r
extensionszPkgInfo.extensions s# xx-r2288:::r
namec . || v S )N)r )r r s r
has_extensionzPkgInfo.has_extension s t((((r
c | d S )Nr r r s r r z PkgInfo.name s F|r
N) r r
r r strr boolr r r r
r r r sp ;DI ; ; ; ;)# )$ ) ) ) ) c r
r Z )secondsd )maxsizer r c K t d| d {V }n3# t $ r&}dt | v rt | d }~ww xY wt |d }| |d< |S )N
getpkginfo)pkgzNo such file or directoryr& r )r r r r r )r dataeinfos r get_package_infor* s \t444444444 &#a&& 0 0&q)) )
4; DDL Ks
A !AA allc X K t d| d {V }d |d D S )Nlistpkgs)wantc , g | ]}t | S r )r ).0items r
<listcomp>z!list_packages.<locals>.<listcomp>* s 2 2 2dGDMM 2 2 2r
r& )r )r. r' s r
list_packagesr3 ( sB $/// / / / / / /D 2 2d5k 2 2 22r
extension_name package_infoc K | }| | r6t d|| d{V t d| | dS t d| | dS )z;Removes extension from a package described by package_info. delpkgext)r _DELETE_EXTENSIONSNz$Extension %s disabled for package %sz0Extension %s was already disabled for package %sr r r loggerr) )r4 r5 r s r remove_extensionr; - s D!!.11 d~
2ND
KK: r
c K | }| | s4t d|| d| d{V t d| | dS t d| | dS )zrAdds extension to a package described by package_info.
kwargs holds extra variables to set for the extension. addpkgext)r r Nz#Extension %s enabled for package %sz/Extension %s was already enabled for package %s)r= r9 )r4 r5 kwargsr s r
add_extensionr? ? s D % %n 5 5
.
1>4
KK9>4 r
c K t d{V D ]I} t | |fi | d{V # t $ r% t d| |d Y Fw xY wdS )z+Add given extension to all cPanel packages.Nz(Unable to add extension %s to package %sr )r3 r? r r: exception)r4 r> r& s r add_extension_for_allrB V s "__$$$$$$ >>v>> > > > > > > > > : F
s /,A A c K t d{V D ]K} t | | d{V # t $ r% t d| |d Y Hw xY wt d dS )z0Remove given extension from all cPanel packages.Nz-Unable to remove extension %s from package %sr zBImunify360 package extensions have been removed from all packages.)r3 r; r r: rA r) )r4 r& s r remove_extension_from_allrD c s "__$$$$$$ ">377 7 7 7 7 7 7 7 7 ? F
KKL s 1,A A )r+ )loggingdatetimetypingr defence360agent.utilsr (defence360agent.subsys.panels.cpanel.whmr r getLoggerr r: r dictr timedeltar r* r3 r; r? rB rD r r
r <module>rM s - - - - - - M M M M M M M M 8 $ $ ? d
X
+
+
+S999
:9
3 3tG} 3 3 3 3
3 g $ $'. .
$
C
D
r
defence360agent/subsys/panels/cpanel/__pycache__/packages.cpython-311.pyc 0000644 0000000 0000000 00000014241 00000000000 023314 0 ustar
r_j L d dl Z d dlZd dlmZ d dlmZ d dlmZmZ e j e
Z G d de Z G d de
Z e ej d
d d
edefd Zddee fdZdededdfdZdededdfdZdeddfdZdeddfdZdS ) N)List) timed_cache)WHMAPIExceptionwhmapi1c e Zd ZdS )PackageNotExistErrorN)__name__
__module__ __qualname__ b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/cpanel/packages.pyr r s Dr
r c B e Zd Zdee fdZdedefdZdefdZdS )PkgInforeturnc R | dd S )N_PACKAGE_EXTENSIONS )getsplitselfs r
extensionszPkgInfo.extensions s# xx-r2288:::r
namec . || v S )N)r )r r s r
has_extensionzPkgInfo.has_extension s t((((r
c | d S )Nr r r s r r z PkgInfo.name s F|r
N) r r
r r strr boolr r r r
r r r sp ;DI ; ; ; ;)# )$ ) ) ) ) c r
r Z )secondsd )maxsizer r c K t d| d {V }n3# t $ r&}dt | v rt | d }~ww xY wt |d }| |d< |S )N
getpkginfo)pkgzNo such file or directoryr& r )r r r r r )r dataeinfos r get_package_infor* s \t444444444 &#a&& 0 0&q)) )
4; DDL Ks
A !AA allc X K t d| d {V }d |d D S )Nlistpkgs)wantc , g | ]}t | S r )r ).0items r
<listcomp>z!list_packages.<locals>.<listcomp>* s 2 2 2dGDMM 2 2 2r
r& )r )r. r' s r
list_packagesr3 ( sB $/// / / / / / /D 2 2d5k 2 2 22r
extension_name package_infoc K | }| | r6t d|| d{V t d| | dS t d| | dS )z;Removes extension from a package described by package_info. delpkgext)r _DELETE_EXTENSIONSNz$Extension %s disabled for package %sz0Extension %s was already disabled for package %sr r r loggerr) )r4 r5 r s r remove_extensionr; - s D!!.11 d~
2ND
KK: r
c K | }| | s4t d|| d| d{V t d| | dS t d| | dS )zrAdds extension to a package described by package_info.
kwargs holds extra variables to set for the extension. addpkgext)r r Nz#Extension %s enabled for package %sz/Extension %s was already enabled for package %s)r= r9 )r4 r5 kwargsr s r
add_extensionr? ? s D % %n 5 5
.
1>4
KK9>4 r
c K t d{V D ]I} t | |fi | d{V # t $ r% t d| |d Y Fw xY wdS )z+Add given extension to all cPanel packages.Nz(Unable to add extension %s to package %sr )r3 r? r r: exception)r4 r> r& s r add_extension_for_allrB V s "__$$$$$$ >>v>> > > > > > > > > : F
s /,A A c K t d{V D ]K} t | | d{V # t $ r% t d| |d Y Hw xY wt d dS )z0Remove given extension from all cPanel packages.Nz-Unable to remove extension %s from package %sr zBImunify360 package extensions have been removed from all packages.)r3 r; r r: rA r) )r4 r& s r remove_extension_from_allrD c s "__$$$$$$ ">377 7 7 7 7 7 7 7 7 ? F
KKL s 1,A A )r+ )loggingdatetimetypingr defence360agent.utilsr (defence360agent.subsys.panels.cpanel.whmr r getLoggerr r: r dictr timedeltar r* r3 r; r? rB rD r r
r <module>rM s - - - - - - M M M M M M M M 8 $ $ ? d
X
+
+
+S999
:9
3 3tG} 3 3 3 3
3 g $ $'. .
$
C
D
r
defence360agent/subsys/panels/cpanel/__pycache__/panel.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000103426 00000000000 023600 0 ustar
r_j~W ` d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlm Z m
Z
d dl m Z d dl
mZ d dlmZmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lm Z m Z m Z m Z m Z d d l!m"Z" d d l#m$Z$ d
dl%m&Z& d
dl&m'Z'm(Z( ddl%m)Z) ddl*m+Z+m,Z, ed Z- ed Z. eej/ j0 dz Z1dZ2dZ3dZ4dZ5e j6 re4ne5Z7dZ8dZ9d Z: ej; e< Z=d Z>e&j? d gz Z@d ZAd ZBi i d!ZC G d" d#e&jD ZE G d$ d%e$ ZF G d& d'e&jG ZHdS )( N) OrderedDict defaultdict)suppress)Path)DictListSet)urlparse)Versionis_cpanel_installed)config)
CheckRunErrorantivirus_modeasync_lru_cache check_runrun) IPEchoAPI)KWConfig )base)
DomainDataforbid_dns_only )packages)WHMAPIExceptionwhmapi1z /var/cpanel/packages/extensionsz/usr/local/cpanelzcpanel/packages/extensionsz/etc/userplansz6/etc/userdatadomains;/var/cpanel/userdata/{user}/cachezimunify-antivirus
imunify360z(/usr/local/cpanel/scripts/install_pluginz*/usr/local/cpanel/scripts/uninstall_pluginz!/etc/sysconfig/imunify360/cpanel/z,/etc/sysconfig/imunify360/cpanel/{name}.confz 2086-2087z/homez/etc/wwwacct.conf) userplansuserdatadomainsc e Zd ZdS )cPanelExceptionN)__name__
__module__ __qualname__ _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/cpanel/panel.pyr" r" ? s Dr' r" c e Zd ZdZdZeZdS )
AccountConfigz ^{}\s+(.*)?$z{} {}N)r# r$ r% SEARCH_PATTERN
WRITE_PATTERN WWWACT_CONFDEFAULT_FILENAMEr& r' r( r* r* C s $NM"r' r* c e Zd Zd Zg dez g dez dg dg dddZeZdgZdZ d Z
e d
Z e
d Ze
d Ze
d
Z ej d4d Z ej d4d Zed Ze
edfdee fd Zdede e fdZ de e fdZ de ee e f fdZ d Z! e"d defd Z#d e$ddfd Z%d ed eddfd!Z&d ed eddfd"Z'de ee eef f fd#Z(e
d$ Z)e
d% Z*e
edfd& Z+e d5d' Z,e
d( Z-e
d) Z.e
d*eddfd+ Z/e
d,efd- Z0e d. Z1de2e fd/Z3e
dd0d1 Z4de eef fd2Z5de ee e f fd3Z6dS )6cPanel)143465z 2077-2080z 2082-208320952096)
37431138732073208921952703627724441)inout)202153443)rA rB rC r7 123r8 r= r> )tcpudpcpanelz/var/cpanel/users.cache/z/var/cpanel/resellersc @ t j d S )Nz/var/cpanel/dnsonly)ospathisfiler& r' r( _is_dns_onlyzcPanel._is_dns_onlyg s w~~ 3444r' c d}t j | st j S t | 5 }| cd d d S # 1 swxY w Y d S )Nz/var/cpanel/mainip)rJ rK existsr get_ipopenreadstrip)clsip_conffs r(
get_server_ipzcPanel.get_server_ipk s &w~~g&& & #%% %
']] $a6688>>## $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $s &A77A;>A;c t S Nr )rT s r( is_installedzcPanel.is_installedt s "$$$r' c K t ddg d {V \ }}}| }|r|d ndS )Nz/usr/local/cpanel/cpanelz-Vr unknown)r decodesplit)rT _dataversions r( ra zcPanel.versionx s] :D ABBBBBBBB
4++--%%'' $3wqzz)3r' Nc K |pt }|t t fvrt d| t | }|dz }t j | rt j
|| t | d {V t d k rt dddd|g d {V t j d t d
|g d {V d S ) Nz/Refusing to enable plugin: invalid plugin_name namez.rpmnewz65.0z/bin/sedz-iz-ezs@^target=.*@target=_self@gz cPanel: register_appconfig...
z(/usr/local/cpanel/bin/register_appconfig) PLUGIN_NAMEAV_PLUGIN_NAMEIM360_PLUGIN_NAMEr" CONFIG_FILE_TEMPLATEformatrJ rK rO shutilmover ra r sysstdoutwrite)selfrd plugin_nameconfig_filenamenew_confs r( enable_imunify_pluginz cPanel.enable_imunify_plugin~ s^ )k ~/@ A A A!/ ;!
/55;5GG"Y.
7>>( # # 3 K/ 2 2 2 '''''' ( (76?? : : 1#
:;;;:
r' c K |pt }|t t fvrt d| t | }d}t j | sxt
d| d t
j t d t |d 5 }| d d d d n # 1 swxY w Y d}t j d
t# d |g d {V |rL t
j | d S # t& $ r(}t d | Y d }~d S d }~ww xY wd S )
Nz0Refusing to disable plugin: invalid plugin_name rc FzWarning: cpanel z6.conf missing, creating temporary config for uninstallT)exist_okwz!# Temporary config for uninstall
z cPanel: unregister_appconfig...
z*/usr/local/cpanel/bin/unregister_appconfigz#Failed to remove temporary config: )re rf rg r" rh ri rJ rK rO loggerinfomakedirs CONFIG_PATHrQ rn rl stderrr remove Exceptionerror)ro rp pluginrq config_createdrV es r( disable_imunify_pluginz cPanel.disable_imunify_plugin s + .*;< < <!/6
/5565BB w~~o.. " KK:: : :
K d 3 3 3 3os++
>q<===
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> !N
<===<
H
H /*****
H
H
H F1 F FGGGGGGGGG
H H Hs* 3CC CD1 1
E#; E E#c T K fd d{V D S )zD
:return: list: domains hosted on server via cpanel
c J g | ] } | D ]\ }}| S r& ) _userdomains).0userdomain user_pathro s r(
<listcomp>z+cPanel.get_user_domains.<locals>.<listcomp> sR
%)%6%6t%<%<
"
r' N) get_usersro s `r( get_user_domainszcPanel.get_user_domains sN
"nn . .......
r' Treturnc N K g fd}| ||| S )Nc |d }|k rd S |d }|d } t ||| d S )Nr r )docrootr typeusername)appendr )rK d domain_datauser_doc_typer domainsr s r( parserz/cPanel.get_user_domains_details.<locals>.parser si NE "1~H!!nG NN #AHx
r' quiet)_parse_userdatadomains)rT r _pathr r r s ` @r( get_user_domains_detailsz cPanel.get_user_domains_details sO
""5&">>>r' userplans_pathc K t j | sg S t d dd }|t j | k rt d d S t
|dd 5 }g }|D ]}| d s~| d d
k ret |
d k r@| | d d
d d d n # 1 swxY w Y t j | t d d< |t d d< |S ) Nr mtimer userszutf-8surrogateescape)encodingerrors#:r )
rJ rK rL _CACHEgetgetmtimerQ
startswithcountlenrS r r^ )ro r
_cached_mtimerV r lines r(
_do_get_userszcPanel._do_get_users s w~~n-- I {+//;;
BG , ,^ < < < <+&w/ /
W5F
=
E
=
= ,,=
31,,DJJLL))A--LLC !3!9!9!;!;<<<
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
= (*w'7'7'G'G{G$',{G$ s
BD55D9<D9c F K | t d {V S rY )r CPANEL_USERPLANS_PATHr s r( r zcPanel.get_users s/ ''(=>>>>>>>>>r' c K t t }| d{V D ]8}| | D ] \ }}|| | !9|S )zp
Returns dict with domain to list of users pairs
:return: dict domain to list of users:
Nr listr r r )ro domain_to_usersr r r_ s r( get_domain_to_ownerzcPanel.get_domain_to_owner s
&d++ ..******** 5 5D ! . .t 4 4
5
5 '..t4444
5 r' c K t t }| d{V D ]8}| | D ] \ }}|| | !9|S )zp
Returns dict with users to list of domains pairs
:return: dict user to list of domains
Nr )ro user_to_domainsr r r_ s r( get_domains_per_userzcPanel.get_domains_per_user s
&d++ ..******** 5 5D ! . .t 4 4
5
5 %,,V4444
5 r' )maxsizec K t d|d d{V d }t | dk rdS t | }|j d|j d S )
z8
Returns panel url
:return: str
create_user_sessioncpaneld)r serviceNurlr z://z:/cpsess0000000000/frontend/jupiter/imunify/imunify.live.pl)r r r
schemenetloc)ro r linkparseds r( panel_user_linkzcPanel.panel_user_link s %Hi
t99>>2$ -mmFMmmmmr' myimunify_enabledc K t j rdS t d sdS |rdnd}|rdnd}t j d D ]z}t | rWt j | }| || d{V |
|| d{V {dS )zK
Switch UI panel configuration between Im360 and MyImunify
Nz./var/imunify360/i360-userside-plugin.installedmyimunify_confconfz!/usr/local/cpanel/base/frontend/*) r enabledr rO globis_dirrJ rK basenamedisable_config
enable_config)ro r config_to_enableconfig_to_disable
theme_path
theme_names r( switch_ui_configzcPanel.switch_ui_config% s ! 4DEELLNN 4/@L++f&7 MFF=M )$GHH G GJJ &&((
G W - -j 9 9
))*;ZHHHHHHHHH(()9:FFFFFFFFF G Gr' r themec K t t t | d|g d {V d S # t $ r'}t d|| Y d }~d S d }~ww xY w)N--themez!Error in enabling config '%s': %s)r PLUGIN_INSTALL_SCRIPTrz r rw warningro r r r s r( r zcPanel.enable_config8 s
K)",F,,
K K K NN> J J J J J J J J J K '-
A AA c K t t t | d|g d {V d S # t $ r'}t d|| Y d }~d S d }~ww xY w)Nr z"Error in disabling config '%s': %s)r PLUGIN_UNINSTALL_SCRIPTrz r rw r r s r( r zcPanel.disable_configE s
L+",F,,
L L L NN? K K K K K K K K K Lr c V K i } d t | j D }n# t $ r d}Y nw xY w| d{V D ]}t j j }|dk r t d 5 }t j | }ddd n # 1 swxY w Y | dd }n # t t j f$ r d}Y nw xY wd}d} d}
t j j }n t t j | j | 5 }t j | }ddd n # 1 swxY w Y | dd }| d d }| d
d } | d d d k }
n$# t t j f$ r d}d}d} d}
Y nw xY w|r||v rt j j }||| |
t+ | d
||< |S )zB
Returns dict with user to email and locale pairs
c F h | ] }| d d d S )r r r )r^ )r r s r( <setcomp>z*cPanel.get_user_details.<locals>.<setcomp>[ s;
3""1% r' Nrootz/etc/wwwacct.conf.cache CONTACTEMAILr enFLOCALEOWNER SUSPENDED1)emaillocaleparent suspendedlevel)r RESELLERS_INFO read_text
splitlinesr} r r UserLevel REGULAR_USERrQ jsonloadr FileNotFoundErrorJSONDecodeErrorADMINrJ rK join
USER_INFO_DIRRESSELERint) ro user_details resellersr r rV user_infor r r r s r( get_user_detailszcPanel.get_user_detailsR s
!4 5 5 ? ? A A L L N N II III ..******** ' ' DN/Ev~~ 788 1A$(IaLL 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 %MM." = =EE)4+?@ EEE ! , & bgll4+=t D DEE 1$(IaLL 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 %MM." = =E &]]8R 8 8F &]]7B 7 7F )
k2 > ># EII)4+?@ & & & E F F %III & 4!2!2 !N 3E & U " "L s AA AAC" C 4 C" C C"C C""C=<C=2G E, G,E0 0G3E0 4A G G54G5c g }d|v r@t j t j j }| d| }| d }|D ]S}t j | r2| t j
| T|rt | ndS )z^checks mtime of userdatadomains files (including cache)
returns max mtime of all files{user};r ) pwdgetpwuidrJ getuidpw_namereplacer^ rK rO r r max)rT r _mtimes call_as_user path_listpath_s r( _get_max_mtimezcPanel._get_max_mtime s
u < 44<LMM(L99EKK$$ 8 8Ew~~e$$
8rw / / 6 6777 &-s7|||A-r' c , t d |i dd }|| | k ri t d |< dS t d |i dg S )z$check and invalidate cache if neededr r r Nr )r r r )rT cpuserr r s r( _get_from_cachezcPanel._get_from_cache s
$ % ) )&" 5 5 9 9'1 E E 3--e44 4 402F$ %f -4'(,,VR88<<YKKKr' c t | | }||S t t fd}| ||| | | dt d < S )Nc |d }|k rF|d }d|d k r ||i d S ||i d S d S )Nr r mainr )update)rK r r r
document_rootr r domains_tmps r( r z#cPanel._userdomains.<locals>.parser sp NE +A
[^++NNA}#566666 &&='9:::::
r' r )r r r )r r r r r itemsr )rT r r r cached_datar r r s ` @@r( r zcPanel._userdomains s ))&%88 " !mm -- ; ; ; ; ; ; ; ""5&">>>{###''.. }}-
-
!&) }} r' c d| v r@t j t j j }| d| } | d }|D ]i} t |d }n5# t $ r(}|s t
d|| Y d }~Bd }~ww xY w t | D ]\ }} | } n,# t $ r t
d|| Y Cw xY w| s\| d dk r |s t
d|| | d \ }
} | d } |||
| | R# | w xY wd S )
Nr r rbzCan't open file %s [%s]z-Broken %s line in file "%s"; line was ignoredz: r z2Can't parse %s line in file '%s'; line was ignoredz==)r r rJ r r
r r^ rQ r} rw r enumerater] UnicodeDecodeErrorrS r close)
r r r r r r file_r ir r domain_raw_datar s
r( r z cPanel._parse_userdatadomains s u < 44<LMM(L99EKK$$ $ $ E
UD))
HNN#<eQGGG
) / / 7 7GAt! #{{}}- ! ! ! K !
!
! ::<< ! zz$''1,, $ "NN!3 ! % !.2jj.>.>+FO"1"7"7"9"9"?"?"E"EKF5&+6666/72
I$ $ sI A11
B#; B B#'F.<CF.&C:7F.9C::B F..Gc 4 t d |D S )Nc 3 n K | ]0}t | V 1d S rY ) CPANEL_PACKAGE_EXTENSIONS_PATHjoinpathis_file)r files r( <genexpr>z0cPanel.is_extension_installed.<locals>.<genexpr> sP
+ 3 3D 9 9 A A C C
r' )all)rT pkgss r( is_extension_installedz cPanel.is_extension_installed s0
r' c v K t d d {V }t d |d D }dD ]dt fd|d D }t d |d D }t d |d
D s d S en# t t f$ r Y d S w xY wd S )
N
list_hooksc 3 2 K | ]}|d dk |V dS )categoryWhostmgrNr& )r cats r( r+ z+cPanel.is_hook_installed.<locals>.<genexpr> s= z?j00 0000 r'
categories)zAccounts::change_packagezAccounts::CreatezAccounts::Modifyc 3 4 K | ]}|d k |V dS )eventNr& )r ev
event_names r( r+ z+cPanel.is_hook_installed.<locals>.<genexpr> s> '{j00 0000 r' eventsc 3 2 K | ]}|d dk |V dS )stagepostNr& )r sts r( r+ z+cPanel.is_hook_installed.<locals>.<genexpr>
s9 BwK64I4IB4I4I4I4I r' stagesc 3 . K | ]}|d dk V dS )hookz ImunifyHook::hook_processingNr& )r actions r( r+ z+cPanel.is_hook_installed.<locals>.<genexpr> s@ 6N&DD r' actionsFT)r nextany
StopIterationr )rT hooksr2 r7 r< r9 s @r( is_hook_installedzcPanel.is_hook_installed sQ !,////////E . H
!
!
&x 0
!&x "' "2 ! !55 !
!$ / 55 ts BB! B! !B65B6extention_namec K t ddd |D ]$}t j t |z t %t j |fi | d {V t j t j
j dd t j t dz t t g d d {V d S )Ni T)modeparentsru )rK ru ImunifyHook.pm)"/usr/local/cpanel/bin/manage_hooksaddmodule ImunifyHook)r' mkdirrj copy2"PREINSTALL_PACKAGE_EXTENSIONS_PATHr add_extension_for_allrJ ry r CoreINBOX_HOOKS_DIRCPANEL_HOOKS_PATHr )rT rI extention_fileskwargsfilenames r( install_extensionzcPanel.install_extension s ',,t -
( H L2X=.
,^FFvFFFFFFFFF FK/edKKKK .1A A
r' extension_namec K t g d d {V t t 5 t dz d d d n # 1 swxY w Y t j | d {V |D ]J}t t 5 t |z d d d n # 1 swxY w Y Kd S )N)rN delrP rQ rM )r r r rX unlinkr remove_extension_from_allr' )rT r] rY r[ s r( uninstall_extensionzcPanel.uninstall_extension= s
'
(
( < <
!1
1 9 9 ; ; ; < < < < < < < < < < < < < < < 0 @@@@@@@@@' E EH+,,
E
E/(:BBDDD
E
E
E
E
E
E
E
E
E
E
E
E
E
E
E E Es# AA A B==C C c g } t dd 5 }|D ]V}| }t | dk r| |d W d d d n # 1 swxY w Y | S )Nz /proc/mountsrr )rQ rS r^ r r )mountsrV r valuess r( re z
cPanel.mountsR s
.#
&
& -!
-
- ++--v;;??MM&),,,
- - - - - - - - - - - - - - - -
s AA::A>A>c D t d }t d }|t n|}t |h}||S | D ]0}||v r*| d s| | 1|S )ae Fetch list of basedirs.
On cPanel, basedir is configured as HOMEDIR variable in
/etc/wwwacct.conf. Also, there is a way to specify additional mount
points as containing user folders, through HOMEMATCH variable. If
value from HOMEMATCH variable is contained within a mount point path,
cPanel uses this directory too.HOMEDIR HOMEMATCHNz
/home/virtfs/)r* r BASE_DIRre r rO )ro homedir homematchbasedirsmounts r( rm zcPanel.basedirs\ s **..00!+..2244 %o((7 g& O[[]] $ $EE!!%*:*:?*K*K! U###r' )r c | K t j j sdS t j | sdS |||d}t | j d| d}t j | }t |g|
d{V }t j | d S )
zG
Notify a customer using cPanel iContact Notifications
F)r ) message_typeparamsr z .notify(%s)zB/usr/local/cpanel/whostmgr/docroot/cgi/imunify/handlers/notify.cgi)inputNr )r )
r
AdminContacts ENABLE_ICONTACT_NOTIFICATIONS should_send_user_notificationsrw rx r# r dumpsr encodeloadsr] )rT rp rq r r` cmdstdinr@ s r( notifyz
cPanel.notifyr s
#A 54dCCC 5 ,MM s|000$777
+
4 se5<<>>:::::::::z#**,=*>>???r' c l K t fd}| t |d S )Nc * |d |d < d S )Nr r r& )rK r r results r( r z$cPanel.list_docroots.<locals>.parser s %0^F;q> " " "r' Tr )dictr CPANEL_USERDATADOMAINS_PATHro r r~ s @r(
list_docrootszcPanel.list_docroots sV 4 4 4 4 4
## 't $
r' c T K i fd}| t |d S )Nc |d g|< d S )Nr r& )r_ r r r~ s r( r z'cPanel.get_domain_paths.<locals>.parser s $Q (F1IIIr' Tr )r r r s @r( get_domain_pathszcPanel.get_domain_paths sR ) ) ) ) )
## 't $
r' rY )T)7r# r$ r% NAMETCP_PORTS_CPANEL
OPEN_PORTSr" exceptionsmtp_allow_usersr r staticmethodrM classmethodrW rZ ra r ensure_valid_panelrs r r r r r r r strr r r r r r r r boolr r r r r r r r r. rH r\ rb re r rm r{ r r r& r' r( r0 r0 I s D KJJ
$ ,++KKK
% J. I z.M,N5 5 \5 $ $ [$ % % [% 4 4 [4
T
> T "H "H "H "HH
_
8
j [(# $s) ,?
c? ? ? ?
4T#Y+? _S!!!n n n n "!n G G G G G G& K# Kc Kd K K K K L3 Ls Lt L L L L9 S$sCx.-@(A 9 9 9 9 v . . [ .
L
L [
L 6d [ 8 ) ) ) \) V
[
[ @
[
D Es E E E [E( \#c( , 8< @ @ @ @ [@,
T#s(^
S$s)^(<
r' r0 )Ir r loggingrJ os.pathr rj rl collectionsr r
contextlibr pathlibr typingr r r urllib.parser
packaging.versionr 3defence360agent.application.determine_hosting_panelr
defence360agent.contractsr defence360agent.utilsr r r r r defence360agent.utils.ipechor defence360agent.utils.kwconfigr r r r r r whmr r r' rX PackagingDATADIRrT r r rf rg r re r r rz getLoggerr# rw rh TCP_PORTS_COMMONr rj r- r PanelExceptionr" r*
AbstractPanelr0 r& r' r( <module>r s
0 0 0 0 0 0 0 0 " " " " " " " " " " ! ! ! ! ! ! % % % % % % - , , , , , 3 2 2 2 2 2 3 3 3 3 3 3 . . . . . . . . ) ) ) ) ) ) ) )!%&G!H!H D,-- D !""%AA # ) < % . 6Mnn<M B F 1 8 $ $E (K=8 ! b 1 1 d) # # # # #H # # # V V V V V T
V V V V V r' defence360agent/subsys/panels/cpanel/__pycache__/panel.cpython-311.pyc 0000644 0000000 0000000 00000103426 00000000000 022641 0 ustar
r_j~W ` d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlm Z m
Z
d dl m Z d dl
mZ d dlmZmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lm Z m Z m Z m Z m Z d d l!m"Z" d d l#m$Z$ d
dl%m&Z& d
dl&m'Z'm(Z( ddl%m)Z) ddl*m+Z+m,Z, ed Z- ed Z. eej/ j0 dz Z1dZ2dZ3dZ4dZ5e j6 re4ne5Z7dZ8dZ9d Z: ej; e< Z=d Z>e&j? d gz Z@d ZAd ZBi i d!ZC G d" d#e&jD ZE G d$ d%e$ ZF G d& d'e&jG ZHdS )( N) OrderedDict defaultdict)suppress)Path)DictListSet)urlparse)Versionis_cpanel_installed)config)
CheckRunErrorantivirus_modeasync_lru_cache check_runrun) IPEchoAPI)KWConfig )base)
DomainDataforbid_dns_only )packages)WHMAPIExceptionwhmapi1z /var/cpanel/packages/extensionsz/usr/local/cpanelzcpanel/packages/extensionsz/etc/userplansz6/etc/userdatadomains;/var/cpanel/userdata/{user}/cachezimunify-antivirus
imunify360z(/usr/local/cpanel/scripts/install_pluginz*/usr/local/cpanel/scripts/uninstall_pluginz!/etc/sysconfig/imunify360/cpanel/z,/etc/sysconfig/imunify360/cpanel/{name}.confz 2086-2087z/homez/etc/wwwacct.conf) userplansuserdatadomainsc e Zd ZdS )cPanelExceptionN)__name__
__module__ __qualname__ _/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/cpanel/panel.pyr" r" ? s Dr' r" c e Zd ZdZdZeZdS )
AccountConfigz ^{}\s+(.*)?$z{} {}N)r# r$ r% SEARCH_PATTERN
WRITE_PATTERN WWWACT_CONFDEFAULT_FILENAMEr& r' r( r* r* C s $NM"r' r* c e Zd Zd Zg dez g dez dg dg dddZeZdgZdZ d Z
e d
Z e
d Ze
d Ze
d
Z ej d4d Z ej d4d Zed Ze
edfdee fd Zdede e fdZ de e fdZ de ee e f fdZ d Z! e"d defd Z#d e$ddfd Z%d ed eddfd!Z&d ed eddfd"Z'de ee eef f fd#Z(e
d$ Z)e
d% Z*e
edfd& Z+e d5d' Z,e
d( Z-e
d) Z.e
d*eddfd+ Z/e
d,efd- Z0e d. Z1de2e fd/Z3e
dd0d1 Z4de eef fd2Z5de ee e f fd3Z6dS )6cPanel)143465z 2077-2080z 2082-208320952096)
37431138732073208921952703627724441)inout)202153443)rA rB rC r7 123r8 r= r> )tcpudpcpanelz/var/cpanel/users.cache/z/var/cpanel/resellersc @ t j d S )Nz/var/cpanel/dnsonly)ospathisfiler& r' r( _is_dns_onlyzcPanel._is_dns_onlyg s w~~ 3444r' c d}t j | st j S t | 5 }| cd d d S # 1 swxY w Y d S )Nz/var/cpanel/mainip)rJ rK existsr get_ipopenreadstrip)clsip_conffs r(
get_server_ipzcPanel.get_server_ipk s &w~~g&& & #%% %
']] $a6688>>## $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $s &A77A;>A;c t S Nr )rT s r( is_installedzcPanel.is_installedt s "$$$r' c K t ddg d {V \ }}}| }|r|d ndS )Nz/usr/local/cpanel/cpanelz-Vr unknown)r decodesplit)rT _dataversions r( ra zcPanel.versionx s] :D ABBBBBBBB
4++--%%'' $3wqzz)3r' Nc K |pt }|t t fvrt d| t | }|dz }t j | rt j
|| t | d {V t d k rt dddd|g d {V t j d t d
|g d {V d S ) Nz/Refusing to enable plugin: invalid plugin_name namez.rpmnewz65.0z/bin/sedz-iz-ezs@^target=.*@target=_self@gz cPanel: register_appconfig...
z(/usr/local/cpanel/bin/register_appconfig) PLUGIN_NAMEAV_PLUGIN_NAMEIM360_PLUGIN_NAMEr" CONFIG_FILE_TEMPLATEformatrJ rK rO shutilmover ra r sysstdoutwrite)selfrd plugin_nameconfig_filenamenew_confs r( enable_imunify_pluginz cPanel.enable_imunify_plugin~ s^ )k ~/@ A A A!/ ;!
/55;5GG"Y.
7>>( # # 3 K/ 2 2 2 '''''' ( (76?? : : 1#
:;;;:
r' c K |pt }|t t fvrt d| t | }d}t j | sxt
d| d t
j t d t |d 5 }| d d d d n # 1 swxY w Y d}t j d
t# d |g d {V |rL t
j | d S # t& $ r(}t d | Y d }~d S d }~ww xY wd S )
Nz0Refusing to disable plugin: invalid plugin_name rc FzWarning: cpanel z6.conf missing, creating temporary config for uninstallT)exist_okwz!# Temporary config for uninstall
z cPanel: unregister_appconfig...
z*/usr/local/cpanel/bin/unregister_appconfigz#Failed to remove temporary config: )re rf rg r" rh ri rJ rK rO loggerinfomakedirs CONFIG_PATHrQ rn rl stderrr remove Exceptionerror)ro rp pluginrq config_createdrV es r( disable_imunify_pluginz cPanel.disable_imunify_plugin s + .*;< < <!/6
/5565BB w~~o.. " KK:: : :
K d 3 3 3 3os++
>q<===
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> !N
<===<
H
H /*****
H
H
H F1 F FGGGGGGGGG
H H Hs* 3CC CD1 1
E#; E E#c T K fd d{V D S )zD
:return: list: domains hosted on server via cpanel
c J g | ] } | D ]\ }}| S r& ) _userdomains).0userdomain user_pathro s r(
<listcomp>z+cPanel.get_user_domains.<locals>.<listcomp> sR
%)%6%6t%<%<
"
r' N) get_usersro s `r( get_user_domainszcPanel.get_user_domains sN
"nn . .......
r' Treturnc N K g fd}| ||| S )Nc |d }|k rd S |d }|d } t ||| d S )Nr r )docrootr typeusername)appendr )rK d domain_datauser_doc_typer domainsr s r( parserz/cPanel.get_user_domains_details.<locals>.parser si NE "1~H!!nG NN #AHx
r' quiet)_parse_userdatadomains)rT r _pathr r r s ` @r( get_user_domains_detailsz cPanel.get_user_domains_details sO
""5&">>>r' userplans_pathc K t j | sg S t d dd }|t j | k rt d d S t
|dd 5 }g }|D ]}| d s~| d d
k ret |
d k r@| | d d
d d d n # 1 swxY w Y t j | t d d< |t d d< |S ) Nr mtimer userszutf-8surrogateescape)encodingerrors#:r )
rJ rK rL _CACHEgetgetmtimerQ
startswithcountlenrS r r^ )ro r
_cached_mtimerV r lines r(
_do_get_userszcPanel._do_get_users s w~~n-- I {+//;;
BG , ,^ < < < <+&w/ /
W5F
=
E
=
= ,,=
31,,DJJLL))A--LLC !3!9!9!;!;<<<
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
= (*w'7'7'G'G{G$',{G$ s
BD55D9<D9c F K | t d {V S rY )r CPANEL_USERPLANS_PATHr s r( r zcPanel.get_users s/ ''(=>>>>>>>>>r' c K t t }| d{V D ]8}| | D ] \ }}|| | !9|S )zp
Returns dict with domain to list of users pairs
:return: dict domain to list of users:
Nr listr r r )ro domain_to_usersr r r_ s r( get_domain_to_ownerzcPanel.get_domain_to_owner s
&d++ ..******** 5 5D ! . .t 4 4
5
5 '..t4444
5 r' c K t t }| d{V D ]8}| | D ] \ }}|| | !9|S )zp
Returns dict with users to list of domains pairs
:return: dict user to list of domains
Nr )ro user_to_domainsr r r_ s r( get_domains_per_userzcPanel.get_domains_per_user s
&d++ ..******** 5 5D ! . .t 4 4
5
5 %,,V4444
5 r' )maxsizec K t d|d d{V d }t | dk rdS t | }|j d|j d S )
z8
Returns panel url
:return: str
create_user_sessioncpaneld)r serviceNurlr z://z:/cpsess0000000000/frontend/jupiter/imunify/imunify.live.pl)r r r
schemenetloc)ro r linkparseds r( panel_user_linkzcPanel.panel_user_link s %Hi
t99>>2$ -mmFMmmmmr' myimunify_enabledc K t j rdS t d sdS |rdnd}|rdnd}t j d D ]z}t | rWt j | }| || d{V |
|| d{V {dS )zK
Switch UI panel configuration between Im360 and MyImunify
Nz./var/imunify360/i360-userside-plugin.installedmyimunify_confconfz!/usr/local/cpanel/base/frontend/*) r enabledr rO globis_dirrJ rK basenamedisable_config
enable_config)ro r config_to_enableconfig_to_disable
theme_path
theme_names r( switch_ui_configzcPanel.switch_ui_config% s ! 4DEELLNN 4/@L++f&7 MFF=M )$GHH G GJJ &&((
G W - -j 9 9
))*;ZHHHHHHHHH(()9:FFFFFFFFF G Gr' r themec K t t t | d|g d {V d S # t $ r'}t d|| Y d }~d S d }~ww xY w)N--themez!Error in enabling config '%s': %s)r PLUGIN_INSTALL_SCRIPTrz r rw warningro r r r s r( r zcPanel.enable_config8 s
K)",F,,
K K K NN> J J J J J J J J J K '-
A AA c K t t t | d|g d {V d S # t $ r'}t d|| Y d }~d S d }~ww xY w)Nr z"Error in disabling config '%s': %s)r PLUGIN_UNINSTALL_SCRIPTrz r rw r r s r( r zcPanel.disable_configE s
L+",F,,
L L L NN? K K K K K K K K K Lr c V K i } d t | j D }n# t $ r d}Y nw xY w| d{V D ]}t j j }|dk r t d 5 }t j | }ddd n # 1 swxY w Y | dd }n # t t j f$ r d}Y nw xY wd}d} d}
t j j }n t t j | j | 5 }t j | }ddd n # 1 swxY w Y | dd }| d d }| d
d } | d d d k }
n$# t t j f$ r d}d}d} d}
Y nw xY w|r||v rt j j }||| |
t+ | d
||< |S )zB
Returns dict with user to email and locale pairs
c F h | ] }| d d d S )r r r )r^ )r r s r( <setcomp>z*cPanel.get_user_details.<locals>.<setcomp>[ s;
3""1% r' Nrootz/etc/wwwacct.conf.cache CONTACTEMAILr enFLOCALEOWNER SUSPENDED1)emaillocaleparent suspendedlevel)r RESELLERS_INFO read_text
splitlinesr} r r UserLevel REGULAR_USERrQ jsonloadr FileNotFoundErrorJSONDecodeErrorADMINrJ rK join
USER_INFO_DIRRESSELERint) ro user_details resellersr r rV user_infor r r r s r( get_user_detailszcPanel.get_user_detailsR s
!4 5 5 ? ? A A L L N N II III ..******** ' ' DN/Ev~~ 788 1A$(IaLL 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 %MM." = =EE)4+?@ EEE ! , & bgll4+=t D DEE 1$(IaLL 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 %MM." = =E &]]8R 8 8F &]]7B 7 7F )
k2 > ># EII)4+?@ & & & E F F %III & 4!2!2 !N 3E & U " "L s AA AAC" C 4 C" C C"C C""C=<C=2G E, G,E0 0G3E0 4A G G54G5c g }d|v r@t j t j j }| d| }| d }|D ]S}t j | r2| t j
| T|rt | ndS )z^checks mtime of userdatadomains files (including cache)
returns max mtime of all files{user};r ) pwdgetpwuidrJ getuidpw_namereplacer^ rK rO r r max)rT r _mtimes call_as_user path_listpath_s r( _get_max_mtimezcPanel._get_max_mtime s
u < 44<LMM(L99EKK$$ 8 8Ew~~e$$
8rw / / 6 6777 &-s7|||A-r' c , t d |i dd }|| | k ri t d |< dS t d |i dg S )z$check and invalidate cache if neededr r r Nr )r r r )rT cpuserr r s r( _get_from_cachezcPanel._get_from_cache s
$ % ) )&" 5 5 9 9'1 E E 3--e44 4 402F$ %f -4'(,,VR88<<YKKKr' c t | | }||S t t fd}| ||| | | dt d < S )Nc |d }|k rF|d }d|d k r ||i d S ||i d S d S )Nr r mainr )update)rK r r r
document_rootr r domains_tmps r( r z#cPanel._userdomains.<locals>.parser sp NE +A
[^++NNA}#566666 &&='9:::::
r' r )r r r )r r r r r itemsr )rT r r r cached_datar r r s ` @@r( r zcPanel._userdomains s ))&%88 " !mm -- ; ; ; ; ; ; ; ""5&">>>{###''.. }}-
-
!&) }} r' c d| v r@t j t j j }| d| } | d }|D ]i} t |d }n5# t $ r(}|s t
d|| Y d }~Bd }~ww xY w t | D ]\ }} | } n,# t $ r t
d|| Y Cw xY w| s\| d dk r |s t
d|| | d \ }
} | d } |||
| | R# | w xY wd S )
Nr r rbzCan't open file %s [%s]z-Broken %s line in file "%s"; line was ignoredz: r z2Can't parse %s line in file '%s'; line was ignoredz==)r r rJ r r
r r^ rQ r} rw r enumerater] UnicodeDecodeErrorrS r close)
r r r r r r file_r ir r domain_raw_datar s
r( r z cPanel._parse_userdatadomains s u < 44<LMM(L99EKK$$ $ $ E
UD))
HNN#<eQGGG
) / / 7 7GAt! #{{}}- ! ! ! K !
!
! ::<< ! zz$''1,, $ "NN!3 ! % !.2jj.>.>+FO"1"7"7"9"9"?"?"E"EKF5&+6666/72
I$ $ sI A11
B#; B B#'F.<CF.&C:7F.9C::B F..Gc 4 t d |D S )Nc 3 n K | ]0}t | V 1d S rY ) CPANEL_PACKAGE_EXTENSIONS_PATHjoinpathis_file)r files r( <genexpr>z0cPanel.is_extension_installed.<locals>.<genexpr> sP
+ 3 3D 9 9 A A C C
r' )all)rT pkgss r( is_extension_installedz cPanel.is_extension_installed s0
r' c v K t d d {V }t d |d D }dD ]dt fd|d D }t d |d D }t d |d
D s d S en# t t f$ r Y d S w xY wd S )
N
list_hooksc 3 2 K | ]}|d dk |V dS )categoryWhostmgrNr& )r cats r( r+ z+cPanel.is_hook_installed.<locals>.<genexpr> s= z?j00 0000 r'
categories)zAccounts::change_packagezAccounts::CreatezAccounts::Modifyc 3 4 K | ]}|d k |V dS )eventNr& )r ev
event_names r( r+ z+cPanel.is_hook_installed.<locals>.<genexpr> s> '{j00 0000 r' eventsc 3 2 K | ]}|d dk |V dS )stagepostNr& )r sts r( r+ z+cPanel.is_hook_installed.<locals>.<genexpr>
s9 BwK64I4IB4I4I4I4I r' stagesc 3 . K | ]}|d dk V dS )hookz ImunifyHook::hook_processingNr& )r actions r( r+ z+cPanel.is_hook_installed.<locals>.<genexpr> s@ 6N&DD r' actionsFT)r nextany
StopIterationr )rT hooksr2 r7 r< r9 s @r( is_hook_installedzcPanel.is_hook_installed sQ !,////////E . H
!
!
&x 0
!&x "' "2 ! !55 !
!$ / 55 ts BB! B! !B65B6extention_namec K t ddd |D ]$}t j t |z t %t j |fi | d {V t j t j
j dd t j t dz t t g d d {V d S )Ni T)modeparentsru )rK ru ImunifyHook.pm)"/usr/local/cpanel/bin/manage_hooksaddmodule ImunifyHook)r' mkdirrj copy2"PREINSTALL_PACKAGE_EXTENSIONS_PATHr add_extension_for_allrJ ry r CoreINBOX_HOOKS_DIRCPANEL_HOOKS_PATHr )rT rI extention_fileskwargsfilenames r( install_extensionzcPanel.install_extension s ',,t -
( H L2X=.
,^FFvFFFFFFFFF FK/edKKKK .1A A
r' extension_namec K t g d d {V t t 5 t dz d d d n # 1 swxY w Y t j | d {V |D ]J}t t 5 t |z d d d n # 1 swxY w Y Kd S )N)rN delrP rQ rM )r r r rX unlinkr remove_extension_from_allr' )rT r] rY r[ s r( uninstall_extensionzcPanel.uninstall_extension= s
'
(
( < <
!1
1 9 9 ; ; ; < < < < < < < < < < < < < < < 0 @@@@@@@@@' E EH+,,
E
E/(:BBDDD
E
E
E
E
E
E
E
E
E
E
E
E
E
E
E E Es# AA A B==C C c g } t dd 5 }|D ]V}| }t | dk r| |d W d d d n # 1 swxY w Y | S )Nz /proc/mountsrr )rQ rS r^ r r )mountsrV r valuess r( re z
cPanel.mountsR s
.#
&
& -!
-
- ++--v;;??MM&),,,
- - - - - - - - - - - - - - - -
s AA::A>A>c D t d }t d }|t n|}t |h}||S | D ]0}||v r*| d s| | 1|S )ae Fetch list of basedirs.
On cPanel, basedir is configured as HOMEDIR variable in
/etc/wwwacct.conf. Also, there is a way to specify additional mount
points as containing user folders, through HOMEMATCH variable. If
value from HOMEMATCH variable is contained within a mount point path,
cPanel uses this directory too.HOMEDIR HOMEMATCHNz
/home/virtfs/)r* r BASE_DIRre r rO )ro homedir homematchbasedirsmounts r( rm zcPanel.basedirs\ s **..00!+..2244 %o((7 g& O[[]] $ $EE!!%*:*:?*K*K! U###r' )r c | K t j j sdS t j | sdS |||d}t | j d| d}t j | }t |g|
d{V }t j | d S )
zG
Notify a customer using cPanel iContact Notifications
F)r ) message_typeparamsr z .notify(%s)zB/usr/local/cpanel/whostmgr/docroot/cgi/imunify/handlers/notify.cgi)inputNr )r )
r
AdminContacts ENABLE_ICONTACT_NOTIFICATIONS should_send_user_notificationsrw rx r# r dumpsr encodeloadsr] )rT rp rq r r` cmdstdinr@ s r( notifyz
cPanel.notifyr s
#A 54dCCC 5 ,MM s|000$777
+
4 se5<<>>:::::::::z#**,=*>>???r' c l K t fd}| t |d S )Nc * |d |d < d S )Nr r r& )rK r r results r( r z$cPanel.list_docroots.<locals>.parser s %0^F;q> " " "r' Tr )dictr CPANEL_USERDATADOMAINS_PATHro r r~ s @r(
list_docrootszcPanel.list_docroots sV 4 4 4 4 4
## 't $
r' c T K i fd}| t |d S )Nc |d g|< d S )Nr r& )r_ r r r~ s r( r z'cPanel.get_domain_paths.<locals>.parser s $Q (F1IIIr' Tr )r r r s @r( get_domain_pathszcPanel.get_domain_paths sR ) ) ) ) )
## 't $
r' rY )T)7r# r$ r% NAMETCP_PORTS_CPANEL
OPEN_PORTSr" exceptionsmtp_allow_usersr r staticmethodrM classmethodrW rZ ra r ensure_valid_panelrs r r r r r r r strr r r r r r r r boolr r r r r r r r r. rH r\ rb re r rm r{ r r r& r' r( r0 r0 I s D KJJ
$ ,++KKK
% J. I z.M,N5 5 \5 $ $ [$ % % [% 4 4 [4
T
> T "H "H "H "HH
_
8
j [(# $s) ,?
c? ? ? ?
4T#Y+? _S!!!n n n n "!n G G G G G G& K# Kc Kd K K K K L3 Ls Lt L L L L9 S$sCx.-@(A 9 9 9 9 v . . [ .
L
L [
L 6d [ 8 ) ) ) \) V
[
[ @
[
D Es E E E [E( \#c( , 8< @ @ @ @ [@,
T#s(^
S$s)^(<
r' r0 )Ir r loggingrJ os.pathr rj rl collectionsr r
contextlibr pathlibr typingr r r urllib.parser
packaging.versionr 3defence360agent.application.determine_hosting_panelr
defence360agent.contractsr defence360agent.utilsr r r r r defence360agent.utils.ipechor defence360agent.utils.kwconfigr r r r r r whmr r r' rX PackagingDATADIRrT r r rf rg r re r r rz getLoggerr# rw rh TCP_PORTS_COMMONr rj r- r PanelExceptionr" r*
AbstractPanelr0 r& r' r( <module>r s
0 0 0 0 0 0 0 0 " " " " " " " " " " ! ! ! ! ! ! % % % % % % - , , , , , 3 2 2 2 2 2 3 3 3 3 3 3 . . . . . . . . ) ) ) ) ) ) ) )!%&G!H!H D,-- D !""%AA # ) < % . 6Mnn<M B F 1 8 $ $E (K=8 ! b 1 1 d) # # # # #H # # # V V V V V T
V V V V V r' defence360agent/subsys/panels/cpanel/__pycache__/whm.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000014464 00000000000 023277 0 ustar
r_jG d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZ d dl m
Z
ej e Z
dZg dZ G d de
Z G d d
e Zdd Zd
Zd Zd Zd ZdS ) N)quote) check_run
CheckRunError)PanelExceptionz/usr/sbin/whmapi1)zno certificatezno key with the idzcannot read license filezinvalid license filezlicense file expiredc e Zd ZdZdS )WHMAPIExceptionz5Got broken output or other problem during WHMAPI callN__name__
__module__ __qualname____doc__ ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/cpanel/whm.pyr r s ??Dr r c e Zd ZdZdS )WHMAPILicenseErrorz$Raises when cannot Read License FileNr r r r r r s ..Dr r Fc K |rdgng }| t d| g d | D } t ||z d {V }nS# t
$ rF}|j t j k r)t
| t | |d }~ww xY w t j
| }n-# t j $ r}t d|d| |d }~ww xY w |d d r|d S t d |d d
|d d # t $ r_}d | v r!t
d
t" t d || d }~ww xY w)Nsudo
--output=jsonc Z g | ](\ }}d |t | )S )z{}={})formatr ).0kvs r
<listcomp>zwhmapi1.<locals>.<listcomp>' s0
E
E
EdagnnQa))
E
E
Er z Broken output from whmapi1: z
, reason: metadataresultdataz whmapi {} command failed: {}commandreason) statusmsgzCannot Read License Filez Cannot Read CPanel License Filez/Broken output from whmapi1 (KeyError: {}): {!r})extend WHMAPI1_CMDitemsr decoder
returncodesignalSIGTERMloggerwarningr jsonloadsJSONDecodeErrorr KeyErrorr )functionr kwargscmdparams
raw_outputeoutputs r whmapi1r6 $ s
"6((CJJ _h7888
E
Efllnn
E
E
EF %cFl 3 3333333;;==
<FN? * * NN1 !!$$ $G J'' F: F F1 F F
* h ' &> !!.55:&y16*3Eh3O
4 F F NN< = = =$ $!AHHv
sP *A1 1
C;AB<<CC D)C??DE ;E
G#AF==Gc t g| d} t d| t j |dt j }n*# t j $ r}t d|z |d }~ww xY w|rt j |j
}g }t | D ]l\ }} |} |D ]
}
| |
} |
| +# t $ r5}|dk rt d ||
d Y d }~ed }~ww xY wnd S t | dk r|d S |S ) Nr zsubprocess.run(%r)T)checkstdoutzFailed to run whmapi1: %sr z Could not parse whmapi1 output )r# r) debug
subprocessrunPIPECalledProcessErrorr r+ r, r9 r% enumerateappendr. len) args path_listr1 resr4 decoded_outputr i element_pathitemkeys r
run_whmapirK L s
/
/
/CF )3///nSZ_EEE ( F F F 9A =>>AEF CJ$5$5$7$788 ( 3 3 ( (OA|
(%' % %C 9DD
d####
(
(
(66 *8
MM$''''''''
(
("
6{{aay
s/ <A A2A--A29$C
D (+DD c & t | ddg S )Nr r rK )rC s r run_whmapi_resultrN s s dZ 2 3 33r c : t | ddgddg \ }}||fS )Nr r r rM )rC r r s r run_whmapi_result_and_reasonrP w s2 z8$z8&< NFF 6>r c fd}|S )Nc K d } | i | d {V }nZ# t $ r1}t t | Y d }~n$d }~w t d Y nxY w|S )NzSomething went wrong)r r) errorstr exception)rC r0 rvswwfuncs r wrapperz catch_exception.<locals>.wrapper s
5tT,V,,,,,,,,BB # # #
LLS " " " " " " " " 5 3 4 4 4 4 4 s
A-'A A-r )rX rY s ` r catch_exceptionrZ s# Nr )F)r+ loggingr< r' urllib.parser defence360agent.utilsr r "defence360agent.subsys.panels.baser getLoggerr
r) r# WHMAPI_CERT_ERROR_LISTr r r6 rK rN rP rZ r r r <module>ra sC
: : : : : : : : = = = = = = 8 $ $ " n % % % %P$ $ $N4 4 4 r defence360agent/subsys/panels/cpanel/__pycache__/whm.cpython-311.pyc 0000644 0000000 0000000 00000014464 00000000000 022340 0 ustar
r_jG d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZ d dl m
Z
ej e Z
dZg dZ G d de
Z G d d
e Zdd Zd
Zd Zd Zd ZdS ) N)quote) check_run
CheckRunError)PanelExceptionz/usr/sbin/whmapi1)zno certificatezno key with the idzcannot read license filezinvalid license filezlicense file expiredc e Zd ZdZdS )WHMAPIExceptionz5Got broken output or other problem during WHMAPI callN__name__
__module__ __qualname____doc__ ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/cpanel/whm.pyr r s ??Dr r c e Zd ZdZdS )WHMAPILicenseErrorz$Raises when cannot Read License FileNr r r r r r s ..Dr r Fc K |rdgng }| t d| g d | D } t ||z d {V }nS# t
$ rF}|j t j k r)t
| t | |d }~ww xY w t j
| }n-# t j $ r}t d|d| |d }~ww xY w |d d r|d S t d |d d
|d d # t $ r_}d | v r!t
d
t" t d || d }~ww xY w)Nsudo
--output=jsonc Z g | ](\ }}d |t | )S )z{}={})formatr ).0kvs r
<listcomp>zwhmapi1.<locals>.<listcomp>' s0
E
E
EdagnnQa))
E
E
Er z Broken output from whmapi1: z
, reason: metadataresultdataz whmapi {} command failed: {}commandreason) statusmsgzCannot Read License Filez Cannot Read CPanel License Filez/Broken output from whmapi1 (KeyError: {}): {!r})extend WHMAPI1_CMDitemsr decoder
returncodesignalSIGTERMloggerwarningr jsonloadsJSONDecodeErrorr KeyErrorr )functionr kwargscmdparams
raw_outputeoutputs r whmapi1r6 $ s
"6((CJJ _h7888
E
Efllnn
E
E
EF %cFl 3 3333333;;==
<FN? * * NN1 !!$$ $G J'' F: F F1 F F
* h ' &> !!.55:&y16*3Eh3O
4 F F NN< = = =$ $!AHHv
sP *A1 1
C;AB<<CC D)C??DE ;E
G#AF==Gc t g| d} t d| t j |dt j }n*# t j $ r}t d|z |d }~ww xY w|rt j |j
}g }t | D ]l\ }} |} |D ]
}
| |
} |
| +# t $ r5}|dk rt d ||
d Y d }~ed }~ww xY wnd S t | dk r|d S |S ) Nr zsubprocess.run(%r)T)checkstdoutzFailed to run whmapi1: %sr z Could not parse whmapi1 output )r# r) debug
subprocessrunPIPECalledProcessErrorr r+ r, r9 r% enumerateappendr. len) args path_listr1 resr4 decoded_outputr i element_pathitemkeys r
run_whmapirK L s
/
/
/CF )3///nSZ_EEE ( F F F 9A =>>AEF CJ$5$5$7$788 ( 3 3 ( (OA|
(%' % %C 9DD
d####
(
(
(66 *8
MM$''''''''
(
("
6{{aay
s/ <A A2A--A29$C
D (+DD c & t | ddg S )Nr r rK )rC s r run_whmapi_resultrN s s dZ 2 3 33r c : t | ddgddg \ }}||fS )Nr r r rM )rC r r s r run_whmapi_result_and_reasonrP w s2 z8$z8&< NFF 6>r c fd}|S )Nc K d } | i | d {V }nZ# t $ r1}t t | Y d }~n$d }~w t d Y nxY w|S )NzSomething went wrong)r r) errorstr exception)rC r0 rvswwfuncs r wrapperz catch_exception.<locals>.wrapper s
5tT,V,,,,,,,,BB # # #
LLS " " " " " " " " 5 3 4 4 4 4 4 s
A-'A A-r )rX rY s ` r catch_exceptionrZ s# Nr )F)r+ loggingr< r' urllib.parser defence360agent.utilsr r "defence360agent.subsys.panels.baser getLoggerr
r) r# WHMAPI_CERT_ERROR_LISTr r r6 rK rN rP rZ r r r <module>ra sC
: : : : : : : : = = = = = = 8 $ $ " n % % % %P$ $ $N4 4 4 r defence360agent/subsys/panels/cpanel/packages.py 0000644 0000000 0000000 00000006376 00000000000 016766 0 ustar import logging
import datetime
from typing import List
from defence360agent.utils import timed_cache
from defence360agent.subsys.panels.cpanel.whm import WHMAPIException, whmapi1
logger = logging.getLogger(__name__)
class PackageNotExistError(WHMAPIException):
pass
class PkgInfo(dict):
def extensions(self) -> List[str]:
return self.get("_PACKAGE_EXTENSIONS", "").split()
def has_extension(self, name: str) -> bool:
return name in self.extensions()
def name(self) -> str:
return self["name"]
@timed_cache(datetime.timedelta(seconds=90), maxsize=100)
async def get_package_info(name: str) -> PkgInfo:
try:
data = await whmapi1("getpkginfo", pkg=name)
except WHMAPIException as e:
if "No such file or directory" in str(e):
raise PackageNotExistError(e)
else:
raise
info = PkgInfo(data["pkg"])
info["name"] = name
return info
async def list_packages(want="all") -> List[PkgInfo]:
data = await whmapi1("listpkgs", want=want)
return [PkgInfo(item) for item in data["pkg"]]
async def remove_extension(extension_name: str, package_info: PkgInfo) -> None:
"""Removes extension from a package described by package_info."""
name = package_info.name()
if package_info.has_extension(extension_name):
await whmapi1(
"delpkgext", name=name, _DELETE_EXTENSIONS=extension_name
)
logger.info(
"Extension %s disabled for package %s", extension_name, name
)
return
logger.info(
"Extension %s was already disabled for package %s",
extension_name,
name,
)
async def add_extension(
extension_name: str, package_info: PkgInfo, **kwargs
) -> None:
"""Adds extension to a package described by package_info.
kwargs holds extra variables to set for the extension."""
name = package_info.name()
if not package_info.has_extension(extension_name):
await whmapi1(
"addpkgext",
name=name,
_PACKAGE_EXTENSIONS=extension_name,
**kwargs
)
logger.info(
"Extension %s enabled for package %s", extension_name, name
)
return
logger.info(
"Extension %s was already enabled for package %s", extension_name, name
)
async def add_extension_for_all(extension_name: str, **kwargs) -> None:
"""Add given extension to all cPanel packages."""
for pkg in await list_packages():
try:
await add_extension(extension_name, pkg, **kwargs)
except WHMAPIException:
logger.exception(
"Unable to add extension %s to package %s",
extension_name,
pkg["name"],
)
async def remove_extension_from_all(extension_name: str) -> None:
"""Remove given extension from all cPanel packages."""
for pkg in await list_packages():
try:
await remove_extension(extension_name, pkg)
except WHMAPIException:
logger.exception(
"Unable to remove extension %s from package %s",
extension_name,
pkg["name"],
)
logger.info(
"Imunify360 package extensions have been removed from all packages."
)
defence360agent/subsys/panels/cpanel/panel.py 0000644 0000000 0000000 00000053576 00000000000 016313 0 ustar import glob
import json
import logging
import os
import os.path
import pwd
import shutil
import sys
from collections import OrderedDict, defaultdict
from contextlib import suppress
from pathlib import Path
from typing import Dict, List, Set
from urllib.parse import urlparse
from packaging.version import Version
from defence360agent.application.determine_hosting_panel import (
is_cpanel_installed,
)
from defence360agent.contracts import config
from defence360agent.utils import (
CheckRunError,
antivirus_mode,
async_lru_cache,
check_run,
run,
)
from defence360agent.utils.ipecho import IPEchoAPI
from defence360agent.utils.kwconfig import KWConfig
from .. import base
from ..base import DomainData, forbid_dns_only
from . import packages
from .whm import WHMAPIException, whmapi1
CPANEL_PACKAGE_EXTENSIONS_PATH = Path("/var/cpanel/packages/extensions")
CPANEL_HOOKS_PATH = Path("/usr/local/cpanel")
PREINSTALL_PACKAGE_EXTENSIONS_PATH = (
Path(config.Packaging.DATADIR) / "cpanel/packages/extensions"
)
CPANEL_USERPLANS_PATH = "/etc/userplans"
CPANEL_USERDATADOMAINS_PATH = (
"/etc/userdatadomains;/var/cpanel/userdata/{user}/cache"
)
AV_PLUGIN_NAME = "imunify-antivirus"
IM360_PLUGIN_NAME = "imunify360"
PLUGIN_NAME = AV_PLUGIN_NAME if antivirus_mode.enabled else IM360_PLUGIN_NAME
PLUGIN_INSTALL_SCRIPT = "/usr/local/cpanel/scripts/install_plugin"
PLUGIN_UNINSTALL_SCRIPT = "/usr/local/cpanel/scripts/uninstall_plugin"
CONFIG_PATH = "/etc/sysconfig/imunify360/cpanel/"
logger = logging.getLogger(__name__)
CONFIG_FILE_TEMPLATE = "/etc/sysconfig/imunify360/cpanel/{name}.conf"
TCP_PORTS_CPANEL = base.TCP_PORTS_COMMON + ["2086-2087"]
BASE_DIR = "/home"
WWWACT_CONF = "/etc/wwwacct.conf"
_CACHE = {"userplans": {}, "userdatadomains": {}}
class cPanelException(base.PanelException):
pass
class AccountConfig(KWConfig):
SEARCH_PATTERN = r"^{}\s+(.*)?$"
WRITE_PATTERN = "{} {}"
DEFAULT_FILENAME = WWWACT_CONF
class cPanel(base.AbstractPanel):
NAME = "cPanel"
OPEN_PORTS = {
"tcp": {
"in": ["143", "465", "2077-2080", "2082-2083", "2095", "2096"]
+ TCP_PORTS_CPANEL,
"out": [
"37",
"43",
"113",
"873",
"2073",
"2089",
"2195",
"2703",
"6277",
"24441",
]
+ TCP_PORTS_CPANEL,
},
"udp": {
"in": ["20", "21", "53", "443"],
"out": ["20", "21", "53", "113", "123", "873", "6277", "24441"],
},
}
exception = cPanelException
smtp_allow_users = ["cpanel"] # type: List[str]
USER_INFO_DIR = "/var/cpanel/users.cache/"
RESELLERS_INFO = "/var/cpanel/resellers"
@staticmethod
def _is_dns_only():
return os.path.isfile("/var/cpanel/dnsonly")
@classmethod
def get_server_ip(cls):
ip_conf = "/var/cpanel/mainip"
# fallback: in case there is not ip file
if not os.path.exists(ip_conf):
return IPEchoAPI.get_ip()
with open(ip_conf) as f:
return f.read().strip()
@classmethod
def is_installed(cls):
return is_cpanel_installed()
@classmethod
async def version(cls):
_, data, _ = await run(["/usr/local/cpanel/cpanel", "-V"])
version = data.decode().split()
return version[0] if version else "unknown"
@base.ensure_valid_panel()
async def enable_imunify_plugin(self, name=None):
plugin_name = name or PLUGIN_NAME
# Allowlist (RPC-supplied); raise — assert is stripped under -O.
if plugin_name not in (AV_PLUGIN_NAME, IM360_PLUGIN_NAME):
raise cPanelException(
"Refusing to enable plugin: invalid plugin_name %r"
% (plugin_name,)
)
config_filename = CONFIG_FILE_TEMPLATE.format(name=plugin_name)
new_conf = config_filename + ".rpmnew"
if os.path.exists(new_conf):
shutil.move(new_conf, config_filename)
if Version(await self.version()) > Version("65.0"):
await run(
[
"/bin/sed",
"-i",
"-e",
"s@^target=.*@target=_self@g",
config_filename,
]
)
# (re-) register plugin
sys.stdout.write("cPanel: register_appconfig...\n")
await run(
[
"/usr/local/cpanel/bin/register_appconfig",
config_filename,
]
)
@base.ensure_valid_panel()
async def disable_imunify_plugin(self, plugin_name=None):
plugin = plugin_name or PLUGIN_NAME
# Allowlist (RPC-supplied); raise — assert is stripped under -O.
if plugin not in (AV_PLUGIN_NAME, IM360_PLUGIN_NAME):
raise cPanelException(
"Refusing to disable plugin: invalid plugin_name %r"
% (plugin,)
)
config_filename = CONFIG_FILE_TEMPLATE.format(name=plugin)
config_created = False
if not os.path.exists(config_filename):
logger.info(
"Warning: cpanel "
f"{plugin}.conf missing, "
"creating temporary config for uninstall"
)
os.makedirs(CONFIG_PATH, exist_ok=True)
with open(config_filename, "w") as f:
f.write("# Temporary config for uninstall\n")
config_created = True
sys.stderr.write("cPanel: unregister_appconfig...\n")
await run(
[
"/usr/local/cpanel/bin/unregister_appconfig",
config_filename,
]
)
if config_created:
try:
os.remove(config_filename)
except Exception as e:
logger.error(f"Failed to remove temporary config: {e}")
@forbid_dns_only
async def get_user_domains(self):
"""
:return: list: domains hosted on server via cpanel
"""
return [
domain
for user in await self.get_users()
for domain, user_path in self._userdomains(user)
]
@classmethod
async def get_user_domains_details(
cls, username, _path=CPANEL_USERDATADOMAINS_PATH, quiet=True
) -> list[DomainData]:
domains = []
def parser(path, d, domain_data):
user_ = domain_data[0]
if user_ != username:
return
doc_type = domain_data[2]
docroot = domain_data[4]
domains.append(
DomainData(
docroot=docroot, domain=d, type=doc_type, username=username
)
)
cls._parse_userdatadomains(_path, parser, quiet=quiet)
return domains
async def _do_get_users(self, userplans_path: str) -> List[str]:
if not os.path.isfile(userplans_path):
return []
_cached_mtime = _CACHE["userplans"].get("mtime", 0)
if _cached_mtime == os.path.getmtime(userplans_path):
return _CACHE["userplans"]["users"]
with open(
userplans_path, encoding="utf-8", errors="surrogateescape"
) as f:
users = []
for line in f:
if (
not line.startswith("#")
and line.count(":") == 1
and len(line.strip()) > 3
):
users.append(line.split(":")[0].strip())
_CACHE["userplans"]["mtime"] = os.path.getmtime(userplans_path)
_CACHE["userplans"]["users"] = users
return users
async def get_users(
self,
) -> List[str]:
return await self._do_get_users(CPANEL_USERPLANS_PATH)
async def get_domain_to_owner(self) -> Dict[str, List[str]]:
"""
Returns dict with domain to list of users pairs
:return: dict domain to list of users:
"""
domain_to_users = defaultdict(list) # type: Dict[str, List[str]]
for user in await self.get_users():
for domain, _ in self._userdomains(user):
domain_to_users[domain].append(user)
return domain_to_users
async def get_domains_per_user(self):
"""
Returns dict with users to list of domains pairs
:return: dict user to list of domains
"""
user_to_domains = defaultdict(list)
for user in await self.get_users():
for domain, _ in self._userdomains(user):
user_to_domains[user].append(domain)
return user_to_domains
@async_lru_cache(maxsize=128)
async def panel_user_link(self, username) -> str:
"""
Returns panel url
:return: str
"""
link = (
await whmapi1(
"create_user_session", user=username, service="cpaneld"
)
)["url"]
if len(link) == 0:
return ""
parsed = urlparse(link)
return f"{parsed.scheme}://{parsed.netloc}/cpsess0000000000/frontend/jupiter/imunify/imunify.live.pl"
async def switch_ui_config(self, myimunify_enabled: bool) -> None:
"""
Switch UI panel configuration between Im360 and MyImunify
"""
if antivirus_mode.enabled:
return None
if not Path("/var/imunify360/i360-userside-plugin.installed").exists():
return None
config_to_enable = "myimunify_conf" if myimunify_enabled else "conf"
config_to_disable = "conf" if myimunify_enabled else "myimunify_conf"
for theme_path in glob.glob("/usr/local/cpanel/base/frontend/*"):
if Path(theme_path).is_dir():
theme_name = os.path.basename(theme_path)
await self.disable_config(config_to_disable, theme_name)
await self.enable_config(config_to_enable, theme_name)
async def enable_config(self, config: str, theme: str) -> None:
try:
await check_run(
[
PLUGIN_INSTALL_SCRIPT,
f"{CONFIG_PATH}{config}",
"--theme",
theme,
]
)
except CheckRunError as e:
logger.warning("Error in enabling config '%s': %s", config, e)
async def disable_config(self, config: str, theme: str) -> None:
try:
await check_run(
[
PLUGIN_UNINSTALL_SCRIPT,
f"{CONFIG_PATH}{config}",
"--theme",
theme,
]
)
except CheckRunError as e:
logger.warning("Error in disabling config '%s': %s", config, e)
async def get_user_details(self) -> Dict[str, Dict[str, str]]:
"""
Returns dict with user to email and locale pairs
"""
user_details = {}
# noinspection PyBroadException
try:
resellers = {
line.split(":", 1)[0]
for line in Path(self.RESELLERS_INFO).read_text().splitlines()
}
except Exception:
resellers = None
for user in await self.get_users():
level = base.UserLevel.REGULAR_USER
if user == "root":
try:
with open("/etc/wwwacct.conf.cache") as f:
user_info = json.load(f)
email = user_info.get("CONTACTEMAIL", "")
except (FileNotFoundError, json.JSONDecodeError):
email = ""
locale = "en"
parent = "root"
suspended = False
level = base.UserLevel.ADMIN
else:
try:
with open(os.path.join(self.USER_INFO_DIR, user)) as f:
user_info = json.load(f)
email = user_info.get("CONTACTEMAIL", "")
locale = user_info.get("LOCALE", "")
parent = user_info.get("OWNER", "")
suspended = user_info.get("SUSPENDED", "") == "1"
except (FileNotFoundError, json.JSONDecodeError):
email = ""
locale = ""
parent = ""
suspended = False
if resellers and user in resellers:
# 1 for the root (see above)
# 2 for a reseller
# 3 for a regular customer
level = base.UserLevel.RESSELER
user_details[user] = {
"email": email,
"locale": locale,
"parent": parent,
"suspended": suspended,
"level": int(level),
}
return user_details
@classmethod
def _get_max_mtime(cls, _path):
"""checks mtime of userdatadomains files (including cache)
returns max mtime of all files"""
_mtimes = []
if "{user}" in _path:
call_as_user = pwd.getpwuid(os.getuid()).pw_name
_path = _path.replace("{user}", call_as_user)
path_list = _path.split(";")
for path_ in path_list:
if os.path.exists(path_):
_mtimes.append(os.path.getmtime(path_))
return max(_mtimes) if _mtimes else 0
@classmethod
def _get_from_cache(cls, cpuser, _path):
"""check and invalidate cache if needed"""
_cached_mtime = (
_CACHE["userdatadomains"].get(cpuser, {}).get("mtime", 0)
)
if _cached_mtime < cls._get_max_mtime(_path):
_CACHE["userdatadomains"][cpuser] = {}
return None
return _CACHE["userdatadomains"].get(cpuser, {}).get("domains", [])
@classmethod
def _userdomains(
cls, cpuser, _path=CPANEL_USERDATADOMAINS_PATH, quiet=True
):
cached_data = cls._get_from_cache(cpuser, _path)
if cached_data is not None:
return cached_data
# use dict to avoid duplicates
domains_tmp = OrderedDict()
domains = OrderedDict()
def parser(path, d, domain_data):
user_ = domain_data[0]
if user_ == cpuser:
document_root = domain_data[4]
if "main" == domain_data[2]:
# main domain must be first in list
domains.update({d: document_root})
else:
domains_tmp.update({d: document_root})
cls._parse_userdatadomains(_path, parser, quiet=quiet)
domains.update(domains_tmp)
_CACHE["userdatadomains"][cpuser] = {
"mtime": cls._get_max_mtime(_path),
"domains": domains.items(),
}
return domains.items()
@staticmethod
def _parse_userdatadomains(_path, parser, quiet=True):
if "{user}" in _path:
call_as_user = pwd.getpwuid(os.getuid()).pw_name
_path = _path.replace("{user}", call_as_user)
path_list = _path.split(";")
for path_ in path_list:
try:
file_ = open(path_, "rb")
except Exception as e:
if not quiet:
logger.warning("Can't open file %s [%s]", path_, e)
continue
try:
# example line:
# test.russianguns.ru: russianguns==root==sub==russianguns.ru==
# /home/russianguns/fla==192.168.122.40:80======0
for i, line in enumerate(file_):
try:
line = line.decode()
except UnicodeDecodeError:
logger.warning(
'Broken %s line in file "%s"; line was ignored',
i,
path_,
)
continue
if not line.strip(): # ignore the empty string
continue
if line.count(": ") != 1:
if not quiet:
logger.warning(
"Can't parse %s line in file '%s'; "
"line was ignored",
i,
path_,
)
continue
domain, domain_raw_data = line.split(": ")
domain_data = domain_raw_data.strip().split("==")
parser(path_, domain, domain_data)
finally:
file_.close()
@classmethod
def is_extension_installed(cls, pkgs):
return all(
CPANEL_PACKAGE_EXTENSIONS_PATH.joinpath(file).is_file()
for file in pkgs
)
@classmethod
async def is_hook_installed(cls):
try:
hooks = await whmapi1("list_hooks")
category = next(
cat
for cat in hooks["categories"]
if cat["category"] == "Whostmgr"
)
for event_name in (
"Accounts::change_package",
"Accounts::Create",
"Accounts::Modify",
):
event = next(
ev
for ev in category["events"]
if ev["event"] == event_name
)
stage = next(
st for st in event["stages"] if st["stage"] == "post"
)
if not any(
action["hook"] == "ImunifyHook::hook_processing"
for action in stage["actions"]
):
return False
except (StopIteration, WHMAPIException):
return False
return True
@classmethod
async def install_extension(
cls,
extention_name: str,
extention_files,
**kwargs,
) -> None:
# copy cpanel's package extension files
CPANEL_PACKAGE_EXTENSIONS_PATH.mkdir(
mode=0o700, parents=True, exist_ok=True
)
for filename in extention_files:
shutil.copy2(
PREINSTALL_PACKAGE_EXTENSIONS_PATH / filename,
CPANEL_PACKAGE_EXTENSIONS_PATH,
)
# enable extension for all packages
await packages.add_extension_for_all(extention_name, **kwargs)
# add hooks for native feature management
os.makedirs(config.Core.INBOX_HOOKS_DIR, mode=0o700, exist_ok=True)
shutil.copy2(
PREINSTALL_PACKAGE_EXTENSIONS_PATH / "ImunifyHook.pm",
CPANEL_HOOKS_PATH,
)
await check_run(
[
"/usr/local/cpanel/bin/manage_hooks",
"add",
"module",
"ImunifyHook",
]
)
@classmethod
async def uninstall_extension(cls, extension_name: str, extention_files):
# remove the hook
await check_run(
[
"/usr/local/cpanel/bin/manage_hooks",
"del",
"module",
"ImunifyHook",
]
)
with suppress(FileNotFoundError):
(CPANEL_HOOKS_PATH / "ImunifyHook.pm").unlink()
# remove the package extension from all packages
await packages.remove_extension_from_all(extension_name)
# remove cpanel's package extension files
for filename in extention_files:
with suppress(FileNotFoundError):
(CPANEL_PACKAGE_EXTENSIONS_PATH / filename).unlink()
@staticmethod
def mounts():
mounts = []
with open("/proc/mounts", "r") as f:
for line in f:
values = line.strip().split()
if len(values) > 1:
mounts.append(values[1])
return mounts
def basedirs(self) -> Set[str]:
"""Fetch list of basedirs.
On cPanel, basedir is configured as HOMEDIR variable in
/etc/wwwacct.conf. Also, there is a way to specify additional mount
points as containing user folders, through HOMEMATCH variable. If
value from HOMEMATCH variable is contained within a mount point path,
cPanel uses this directory too."""
homedir = AccountConfig("HOMEDIR").get()
homematch = AccountConfig("HOMEMATCH").get()
homedir = BASE_DIR if homedir is None else homedir
basedirs = {BASE_DIR, homedir}
if homematch is None:
return basedirs
for mount in self.mounts():
# exclude virtfs from basedirs (DEF-14266)
if homematch in mount and not mount.startswith("/home/virtfs/"):
basedirs.add(mount)
return basedirs
@classmethod
async def notify(cls, *, message_type, params, user=None):
"""
Notify a customer using cPanel iContact Notifications
"""
if not config.AdminContacts.ENABLE_ICONTACT_NOTIFICATIONS:
return False
if not config.should_send_user_notifications(username=user):
return False
data = {"message_type": message_type, "params": params, "user": user}
logger.info(f"{cls.__name__}.notify(%s)", data)
cmd = (
"/usr/local/cpanel/whostmgr/docroot/cgi"
"/imunify/handlers/notify.cgi"
)
stdin = json.dumps(data)
out = await check_run([cmd], input=stdin.encode())
return json.loads(out.decode(errors="surrogateescape"))
async def list_docroots(self) -> Dict[str, str]:
result = dict()
def parser(path, d, domain_data):
result[domain_data[4]] = domain_data[3]
self._parse_userdatadomains(
CPANEL_USERDATADOMAINS_PATH, parser, quiet=True
)
return result
async def get_domain_paths(self) -> Dict[str, List[str]]:
result = {}
def parser(_, d, domain_data):
result[d] = [domain_data[4]]
self._parse_userdatadomains(
CPANEL_USERDATADOMAINS_PATH, parser, quiet=True
)
return result
defence360agent/subsys/panels/cpanel/whm.py 0000644 0000000 0000000 00000010107 00000000000 015766 0 ustar import json
import logging
import subprocess
import signal
from urllib.parse import quote
from defence360agent.utils import check_run, CheckRunError
from defence360agent.subsys.panels.base import PanelException
logger = logging.getLogger(__name__)
# use complete path as recommended by cPanel docs
# https://documentation.cpanel.net/display/DD/WHM+API+1+Functions+-+modsec_is_installed
WHMAPI1_CMD = "/usr/sbin/whmapi1"
WHMAPI_CERT_ERROR_LIST = [
"no certificate",
"no key with the id",
"cannot read license file",
"invalid license file",
"license file expired",
]
class WHMAPIException(PanelException):
"""Got broken output or other problem during WHMAPI call"""
pass
class WHMAPILicenseError(WHMAPIException):
"""Raises when cannot Read License File"""
pass
async def whmapi1(function, sudo=False, **kwargs):
cmd = ["sudo"] if sudo else []
cmd.extend([WHMAPI1_CMD, "--output=json", function])
params = ["{}={}".format(k, quote(v)) for k, v in kwargs.items()]
try:
raw_output = (await check_run(cmd + params)).decode()
except CheckRunError as e:
if e.returncode == -signal.SIGTERM:
logger.warning(e)
raise WHMAPIException(e)
else:
raise e
try:
output = json.loads(raw_output)
except json.JSONDecodeError as e:
raise WHMAPIException(
f"Broken output from whmapi1: {raw_output!r}, reason: {e}"
) from e
try:
if output["metadata"]["result"]:
return output["data"]
else:
raise WHMAPIException(
"whmapi {} command failed: {}".format(
output["metadata"]["command"], output["metadata"]["reason"]
)
)
except KeyError as e:
if ("statusmsg", "Cannot Read License File") in output.items():
logger.warning("Cannot Read CPanel License File")
raise WHMAPILicenseError
else:
raise WHMAPIException(
"Broken output from whmapi1 (KeyError: {}): {!r}".format(
e, output
)
)
def run_whmapi(args, *path_list):
# FIXME: this script partly copypaste 'whmapi1' function
cmd = [WHMAPI1_CMD, *args, "--output=json"]
try:
logger.debug("subprocess.run(%r)", cmd)
res = subprocess.run(cmd, check=True, stdout=subprocess.PIPE)
except subprocess.CalledProcessError as e:
raise WHMAPIException("Failed to run whmapi1: %s" % e) from e
if path_list:
decoded_output = json.loads(res.stdout.decode())
result = []
for i, element_path in enumerate(path_list):
try:
item = decoded_output
for key in element_path:
item = item[key]
result.append(item)
except KeyError as e:
if i == 0:
# we guarantee to *always* return first element from
# path_list
raise WHMAPIException(
"Could not parse whmapi1 output"
) from e
else:
# and have no guarantee for the rest of path_list
result.append(None)
else:
return
if len(result) == 1:
return result[0]
else:
return result
def run_whmapi_result(args):
return run_whmapi(args, ["metadata", "result"])
def run_whmapi_result_and_reason(args):
result, reason = run_whmapi(
args, ["metadata", "result"], ["metadata", "reason"]
)
# explicit is better than implicit!
return result, reason
def catch_exception(func):
async def wrapper(*args, **kwargs):
rv = None
try:
rv = await func(*args, **kwargs)
except WHMAPIException as sww:
# Do not mess the output with stacktrace,
# more details can be found in sentry.
logger.error(str(sww))
except: # noqa
# do not left unreported
logger.exception("Something went wrong")
return rv
return wrapper
defence360agent/subsys/panels/directadmin/ 0000755 0000000 0000000 00000000000 00000000000 015643 5 ustar defence360agent/subsys/panels/directadmin/__init__.py 0000644 0000000 0000000 00000000072 00000000000 017753 0 ustar from .panel import DirectAdmin
__all__ = ["DirectAdmin"]
defence360agent/subsys/panels/directadmin/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 020053 5 ustar defence360agent/subsys/panels/directadmin/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000444 00000000000 025255 0 ustar
r_j: d dl mZ dgZdS ) ) DirectAdminr N)panelr __all__ g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/directadmin/__init__.py<module>r s" /r defence360agent/subsys/panels/directadmin/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000444 00000000000 024316 0 ustar
r_j: d dl mZ dgZdS ) ) DirectAdminr N)panelr __all__ g/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/directadmin/__init__.py<module>r s" /r defence360agent/subsys/panels/directadmin/__pycache__/config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001457 00000000000 024770 0 ustar
r_j : d dl Z d dlmZ dZ G d de ZdS ) N)KWConfigz/usr/local/directadmin/confc L e Zd ZdZdZej ed Z dS )
ConfigOptionsz^\s*{}\s*=\s*(.*?)\s*$z{}={}zdirectadmin.confN)
__name__
__module__ __qualname__SEARCH_PATTERN
WRITE_PATTERNospathjoinBASEDIRDEFAULT_FILENAME e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/directadmin/config.pyr r s1 .NMw||G-?@@r r )r defence360agent.utils.kwconfigr r r r r r <module>r sc 3 3 3 3 3 3
'A A A A AH A A A A Ar defence360agent/subsys/panels/directadmin/__pycache__/config.cpython-311.pyc 0000644 0000000 0000000 00000001457 00000000000 024031 0 ustar
r_j : d dl Z d dlmZ dZ G d de ZdS ) N)KWConfigz/usr/local/directadmin/confc L e Zd ZdZdZej ed Z dS )
ConfigOptionsz^\s*{}\s*=\s*(.*?)\s*$z{}={}zdirectadmin.confN)
__name__
__module__ __qualname__SEARCH_PATTERN
WRITE_PATTERNospathjoinBASEDIRDEFAULT_FILENAME e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/directadmin/config.pyr r s1 .NMw||G-?@@r r )r defence360agent.utils.kwconfigr r r r r r <module>r sc 3 3 3 3 3 3
'A A A A AH A A A A Ar defence360agent/subsys/panels/directadmin/__pycache__/panel.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000073314 00000000000 024623 0 ustar
r_j&G R d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
mZ d dlmZ d dlmZmZmZmZ d dlmZ d dlmZmZ d dlm Z d dl m Z m Z m Z m!Z!m"Z"m#Z# d d l$m%Z%m&Z& d
d l'm(Z( d
d l(m)Z) ej* e+ Z,d
Z-dZ.dZ/dZ0d1 e0e. Z2dZ3dZ4e(j5 ddgz Z6dZ7 e j8 d Z9 G d de(j) Z: G d de% Z;d efd Z<d e=fd Z>e4fd ee=e=f fd Z?d efd Z@ G d! d"e(jA ZBdS )# N) defaultdict)Path)AnyDictListSet)Version)DA_FILEis_directadmin_installed)Core)HTTP_REQUEST_RETRY_TIMEOUTasync_lru_cache
backoff_sleepretry_onruntimeit) IpChooser UrlTransport )base)PanelExceptionz/homez#/usr/bin/imunify360-command-wrapperz%/usr/local/directadmin/scripts/customzimunify360-sudousersz%{0} ALL=NOPASSWD: {1}z9Defaults!/usr/bin/imunify360-command-wrapper !requirettyz/etc/virtual/domainowners2222 35000-35999z"/usr/local/directadmin/data/users/z^[a-z_][a-z0-9_-]{0,31}\Zc e Zd ZdS )DirectAdminExceptionN)__name__
__module__ __qualname__ d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/directadmin/panel.pyr r 4 s Dr r c " e Zd ZdededefdZdS )_LoopbackIpChooserhostnameportreturnc dS )Nz 127.0.0.1r )selfr$ r% s r! choosez_LoopbackIpChooser.choose9 s {r N)r r r strintr) r r r! r# r# 8 s= s # # r r# r& c T t | t st d| | S )Nz$Unexpected document roots response: )
isinstancedictr )payloads r! _valid_docroots_payloadr0 = s8 gt $ $
>7 > >
Nr c t | t rt | st d| | S )zGReturn ``user`` if safe; otherwise raise :class:`DirectAdminException`.z.Refusing to manage sudouser: invalid username )r- r* _SUDOUSER_NAME_REmatchr )users r! _validate_sudouserr5 E sN dC
(9(?(?(E(E
""BF$ H
Kr c i }t | d 5 }|D ]} | }n4# t $ r'}t d| || Y d}~Dd}~ww xY w| d }|dk r<||dz d ||d| < ddd n # 1 swxY w Y |S )zBReturn a mapping from domain name to user name owning this domain.rbzBroken line in %s: %r (%s)N: )opendecodeUnicodeDecodeErrorloggerwarningfindstrip)pathdomainsfblinelineeposs r! get_user_domainsrI N s? G
dD FQ F FE
||~~%
;T5!LLL
))C..Cbyy.23799o.C.C.E.ETcT
((**+ F F F F F F F F F F F F F F F F Ns7 C.C
A ACA ACC C c J K ddg} t | d {V \ }}} d}t j ||t j }t | d S # t t f$ r t d|d|d| w xY w) N"/usr/local/directadmin/directadminvs& ^(Version: )?DirectAdmin (v.)?([\d.]+))flags z-Failed to parse directadmin version. retcode=z , stdout= , stderr=)
r research MULTILINEr groupr<
ValueErrorAttributeErrorr )cmdretcodestdoutstderrversion_patternresults r! get_directadmin_versionr\ ^ s /
5C$'HHnnnnnnGVV
D?F",GGGv||A--//000 '
1
1
1 "
1
1'-
1
1
s AA8 8*B"c e Zd Zd ZeZdgez dgez dg dg dddZeZ e
d Z e
d Z e
j d Z e
j d
Zed Zed Zd
Zd Zd Zd Z e
j d-d Z e
j d-d Zdee fdZ d Z d Z d Z de e fdZ!de"fdZ#de"fdZ$de"fd Z%ede"fd Z&de"eef fd Z'de"ee"eef f fd Z(de"eef fd Z) e*e+e,e-! d"e.j/ j0 de1fd# Z2ed"e.j/ j0 de1fd$ Z3d"e.j/ j0 de1fd%Z4defd&Z5 e6d'd() de"eee
j7 f fd* Z8d+ede9e
j7 fd,Z:dS ). DirectAdmin465113)inout)202153443r 80)rc rd re r` 123r )tcpudpc t S N)r clss r! is_installedzDirectAdmin.is_installed{ s ')))r c H K t t d {V S rl )r* r\ rm s r! versionzDirectAdmin.version s/ 022222222333r c , K t | || v s#t j d dk rGt dd|t g d {V \ }}}|dk r!t d||| d S d S d S )Nusertypeadmingpasswdz-ar z&gpasswd -a failed for %r: rc=%s err=%r) r5 _get_adminsosenvirongetr
SUDO_GROUPr> r? r( r4 rW _outerrs r! add_sudouserzDirectAdmin.add_sudouser s 4 4##%% % %
)C)Cw)N)N'*ItT:+N'O'O!O!O!O!O!O!O GT3!|| < *O)N|r c K t | || v rGt dd|t g d {V \ }}}|dk r!t d||| d S d S d S )Nru z-dr z&gpasswd -d failed for %r: rc=%s err=%r)r5 rv r rz r> r? r{ s r! delete_sudouserzDirectAdmin.delete_sudouser s 4 4##%% % %'*ItT:+N'O'O!O!O!O!O!O!O GT3!||< & %|r c t | d 5 }|dz
}|| vr| | d d d d S # 1 swxY w Y d S )Nr+
)r; readlineswrite)rB contentrD s r! _add_linezDirectAdmin._add_line s
$
! tOGakkmm++ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !s 1AAAc t | d 5 }d fd|D }| d | d | | d d d d S # 1 swxY w Y d S )Nr c 3 H K | ] }| v|V d S rl )rA ).0rF r s r! <genexpr>z+DirectAdmin._remove_line.<locals>.<genexpr> s5 MMD
1L1L41L1L1L1LMMr r )r; joinseektruncater )rB r rD datas ` r! _remove_linezDirectAdmin._remove_line s
$
77MMMMAMMMMMD
FF1III
JJqMMM
GGDMMM s A!B BBc t dd 5 }| }d d d n # 1 swxY w Y |S )Nz,/usr/local/directadmin/data/admin/admin.listrr; readsplit)r( rD
admin_lists r! rv zDirectAdmin._get_admins s
@#
F
F *! ))J * * * * * * * * * * * * * * * 'AA Ac t dd 5 }| }d d d n # 1 swxY w Y |S )Nz//usr/local/directadmin/data/admin/reseller.listr r )r( rD
reseller_lists r! _get_resellerszDirectAdmin._get_resellers s
CS
I
I -Q FFHHNN , ,M - - - - - - - - - - - - - - - r c t j t | }t j | st |d | |d t j d j
}t j d j
}t j ||| t j |d | || d S )Nwz #!/bin/shdiradmini )
rw rB r HOOKS_DIRexistsr; closer pwdgetpwnampw_uidchownchmod)r( hookr rB uidgids r! _create_hookzDirectAdmin._create_hook s w||It,,w~~d## " sOO ! ! # # # NN4 - - -,z**1C,z**1C HT3 $ $ $ HT5 ! ! ! tW%%%%%r c t j t | }t j | r| || d S d S rl )rw rB r r r r )r( r r rB s r! _delete_hookzDirectAdmin._delete_hook sS w||It,,
7>>$ - dG , , , , , - -r Nc K t j d t | dt
| dt | D ]Q} | | d {V # t $ r&}t d|| Y d }~Jd }~ww xY w| dd | dd | dd d S ) Nz/usr/sbin/groupadd -f {} /etc/sudoers&Skipping invalid sudouser entry %r: %suser_create_post.sh9/usr/bin/imunify360-agent add-sudouser --user "$username"user_destroy_pre.sh</usr/bin/imunify360-agent delete-sudouser --user "$username"user_restore_post.sh)
rw systemformatrz r SUDO_LINE
SUDO_TTY_LINErv r~ r r> r? r )r( namer4 excs r! enable_imunify_pluginz!DirectAdmin.enable_imunify_plugin sU
,33J??@@@ ~y111 ~}555$$&& D
''----------'
<dC
! G
! J
" G
s <B
C" CCc K | dt | dt | D ]Q} | | d {V # t
$ r&}t d|| Y d }~Jd }~ww xY wt j d
t | dd | dd | dd d S ) Nr r z/usr/sbin/groupdel {}r r r r r )
r r r rv r r r> r? rw r r rz r )r( plugin_namer4 r s r! disable_imunify_pluginz"DirectAdmin.disable_imunify_plugin sY .)444 .-888$$&& D
**40000000000'
<dC
)00<<=== ! G
! J
" G
s A,,
B 6 BB r& c z K t t t S )z:
:return: list: list of directadmin users
)listsetrI valuesr( s r! get_userszDirectAdmin.get_users s1 C(**113344555r c ` K t t S )zI
:return: list: domains hosted on server via directadmin
)r rI keysr s r! rI z DirectAdmin.get_user_domains s) $&&++--...r c Z K d t D S )z8
:return: domain to list of users pairs
c i | ] \ }}||g
S r r )r domainr4 s r!
<dictcomp>z3DirectAdmin.get_domain_to_owner.<locals>.<dictcomp> s NNN<64NNNr )rI itemsr s r! get_domain_to_ownerz DirectAdmin.get_domain_to_owner s0 ON3C3E3E3K3K3M3MNNNNr c K t t }t D ] \ }}|| | !|S )z8
:return: user to list of domains pairs
)r r rI r append)r( user_to_domainsr r4 s r! get_domains_per_userz DirectAdmin.get_domains_per_user s\ &d++ , . . 4 4 6 6 1 1LFD D ! ( ( 0 0 0 0 r c t hS rl )BASE_DIRr s r! basedirszDirectAdmin.basedirs s
zr c K t d {V t d k r| d {V S | d {V S )Nz1.62.8)r\ r docroots_info_newdocroots_info_legacyr s r!
docroots_infozDirectAdmin.docroots_info sy (** * * * * * *gh.?.? ? ? //11111111 1..000000000r c K ddg}t dt 5 t | d {V \ }}}d d d n # 1 swxY w Y |dk rt d| d|d| t j | }|j
d \ }}t j |
}d | |
d g }t d | t% j } t j |d
d| id }
t- | d | j |
d {V S # t2 $ r } t d } | | _ Y d } ~ n d } ~ wt $ r } | } Y d } ~ nd } ~ ww xY w|j dk r| t d| t- | d | j |
d {V S # t $ r | w xY w)NrK z--root-auth-urlz!Call DA binary to obtain auth URLr z2Failed to obtain auth URL. Unexpected return code . stdout=rO @/)netlocz0CMD_API_DOMAIN?json=yes&action=document_root_allzDocument roots URL: %s
AuthorizationzBasic GET)headersmethodz5Timed out obtaining document roots from the panel APIhttpszDPanel API document roots request failed (%s), retrying over loopback) r r> r r urllibparseurlparser< rA r r base64standard_b64encodeencoder _replacegeturlinfoasyncioget_event_looprequestRequestr0 run_in_executor _do_request TimeoutError __cause__schemer? _do_loopback_request)
r( rV rW rX rY
parsed_url
basic_authr document_roots_urlloopr rG
primary_errors
r! r z DirectAdmin.docroots_info_new# s= 35FG
7
@
@ 5 5,/HHnnnnnn #GVV 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 a<< 9W 9 9!9 9.49 9
\**6==??+@+@+B+BCC
' . 4 4S 9 9
F.z/@/@/B/BCCJJLL
XX##6#2299;;B
,.@AAA%''.(( $&;z&;&;< )
***41A7KKKKKKKK
( ( ( -;G- -M '(M # # # # # # MMMMMM ' '
&
***$3W
sA AA A.G
HG**
H7G>>H/.I
I+c K ddg}t dt 5 t | d {V \ }}}d d d n # 1 swxY w Y |dk r |dk rt d| d|d| t j | }n*# t j $ r}t d | d
d }~ww xY wt | S ) NrK z--DocumentRootz%Call DA binary to obtain all docrootsr r: z8Failed to obtain document roots. Unexpected return code r rO z7Failed to obtain document roots. Failed to decode json .) r r> r r jsonloadsr< JSONDecodeErrorr0 )r( rV retrb r} outputrG s r! r z DirectAdmin.docroots_info_legacyb sW 0
;V
D
D + +"%c((NNNNNNMCc + + + + + + + + + + + + + + + !88q :: :"%: :25: :
Z
--FF# N!NNN
'v...s) AA A2&B C (B;;C c ~ t }| d D ]\ }}|d D ]s\ }}| d r |||d < | di D ]%\ }}| d r |||d < &t|S )NusersrC public_html
subdomains)r. r ry )r r usernameuserdata
domainname
domaindata_sub_datas r! parse_document_root_outputz&DirectAdmin.parse_document_root_outputw s ff"(/"7"7"9"9 B B Hh*29*=*C*C*E*E
B
B&
J >>-00 @5?C
=12#->>,#C#C#I#I#K#K B BKAx ||M22 B7AH] 34B
B
r c d K | d {V }| | S rl )r r )r( r s r!
list_docrootszDirectAdmin.list_docroots s= ''))))))))..t444r c K i }| d {V }t | }t | }|D ]} | | }t
j j }||v rt
j j }||v rt
j j }|
dd |
dd |
dd |
d dk t | d||< # t $ r.}ddd||< t d || Y d }~d }~ww xY w|S )
Nlanguager emailcreator suspendedyes)localer parentr level)r r z!Failed to get_user_details: %s %s)r r rv r get_user_details_for_usernamer UserLevel REGULAR_USERRESSELERADMINry r+ Exceptionr> r? ) r( res usernamesadmins resellersr
parsed_configr rG s r! get_user_detailsz DirectAdmin.get_user_details s ..******** T%%''((++--.. ! H
$ B B8 L L
3y(( N 3Ev%% N 0E + / /
B ? ? * . .w ; ; + / / 2 > >!.!2!2;!?!?5!H ZZ ! !H
! !H
71
s &B;D""
E,$EEc t t | d }t j }d|z }| | |d }|S )z
Implementation taken from
https://github.com/patchman-cloudlinux/patchman2-client/blob/05f54db63639b939c055a9543e82bc9690559965/src/platform/platforms/directadmin.cpp#L315
directadmin::get_user_details
z
/user.confz[top]
top)r USERS_CONF_DIR read_text configparser ConfigParser read_string)r( r
user_conf_strr! s r! r z)DirectAdmin.get_user_details_for_username sk x 3 3 3
)++ %133
!M1
!!-000%e,
r )on_errortimeoutr c L | |t j j S rl ) _fetch_jsonr r urlopen)r( r s r! r zDirectAdmin._do_request s )?@@@r c || t j 5 }|j dk r't d |j t j | cd d d S # 1 swxY w Y d S # t t j j t
j
t j t j j f$ r
}t |d }~ww xY w)N)r, zstatus code is {})r DEFAULT_SOCKET_TIMEOUTstatusr r r r r r< r= httpclient
HTTPExceptionr socketr, r errorURLError)r open_funcresponserG s r! r. zDirectAdmin._fetch_json s( (!<
<?c))(+228?CC z(--//"8"8":":;;
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
K % N L !
( ( ( !a ' (s< B A*B B BB BB AC+ C&&C+c r t t d }| ||j S )NF)
ip_chooser use_proxies)r r# r. r; )r( r transports r! r z DirectAdmin._do_loopback_request s; )++
888r c
K dS )z8
Returns panel url
:return: str
r r )r( r s r! panel_user_linkzDirectAdmin.panel_user_link s
rr r: < )maxsizettlc K | d {V }t t }| di D ]\ }}| di D ]\ }}| d }|r1|| t
j ||d| | d pi D ]R\ }} | d }
|
r6|| t
j |
| d| d| Sʌ|S ) Nr rC r main)docrootr typer r r sub)r r r ry r r r
DomainData) r( r r[ r4 r r domain_datar rI r
sub_public_htmls r! _get_domains_details_per_userz)DirectAdmin._get_domains_details_per_user s ''))))))))3>t3D3D "hhw 3 3 9 9 ; ; ND('/||Ir'B'B'H'H'J'J
# )oom < < 4L'' $/#)!'%) OOL117R%'' MC '/ll=&A&AO& t ++ O(7*-'8'8'8'8%*)-
0
r r c K | d {V }t | |g S rl )rM r ry )r( r detailss r! get_user_domains_detailsz$DirectAdmin.get_user_domains_details sG ::<<<<<<<<GKK"--...r rl );r r r NAMEr
DA_BINARY TCP_PORTS_DA
OPEN_PORTSr exception classmethodro rq r ensure_valid_panelr~ r staticmethodr r rv r r r r r r r* r rI r r r r r r r r r r
r" r r r r r
r r r r r r. r rA r rJ rM r rP r r r! r^ r^ l sV DI 'L(7\)
A@@BBB
J %I* * [* 4 4 [4 T T ! ! \! \
& & &- - -
T
4 T
46c 6 6 6 6 / / / O O O #c( 1T 1 1 1 1
= = = = = ~/D / / / /* d \ 5T#s(^ 5 5 5 5 S$sCx.-@(A <
c3h
X *
A6>#9 Ac A A A
A (V^ 3 (3 ( ( ( \(&9FN,B 9s 9 9 9 9 _QB'''
c4(( ) (' @//
do / / / / / /r r^ )Cr r r' http.clientr4 r loggingrw r rP r7 r urllib.parse collectionsr pathlibr typingr r r r packaging.versionr 3defence360agent.application.determine_hosting_panelr
r defence360agent.contracts.configr defence360agent.utilsr
r r r r r #defence360agent.utils.net_transportr r r r r getLoggerr r> r CMDr rz r r r _VIRTUAL_DOMAINOWNERSTCP_PORTS_COMMONrS r% compiler2 r r# r0 r* r5 rI r\
AbstractPanelr^ r r r! <module>rj s%
# # # # # # ' ' ' ' ' ' ' ' ' ' ' ' % % % % % % 2 1 1 1 1 1 H G G G G G G G ! ! ! ! ! ! 8 $ $ + 3
#
$ + +J < < K
3 $
'>> 5 BJ ;<< 4.
0
DcN
w
V/ V/ V/ V/ V/$$ V/ V/ V/ V/ V/r defence360agent/subsys/panels/directadmin/__pycache__/panel.cpython-311.pyc 0000644 0000000 0000000 00000073314 00000000000 023664 0 ustar
r_j&G R d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
mZ d dlmZ d dlmZmZmZmZ d dlmZ d dlmZmZ d dlm Z d dl m Z m Z m Z m!Z!m"Z"m#Z# d d l$m%Z%m&Z& d
d l'm(Z( d
d l(m)Z) ej* e+ Z,d
Z-dZ.dZ/dZ0d1 e0e. Z2dZ3dZ4e(j5 ddgz Z6dZ7 e j8 d Z9 G d de(j) Z: G d de% Z;d efd Z<d e=fd Z>e4fd ee=e=f fd Z?d efd Z@ G d! d"e(jA ZBdS )# N) defaultdict)Path)AnyDictListSet)Version)DA_FILEis_directadmin_installed)Core)HTTP_REQUEST_RETRY_TIMEOUTasync_lru_cache
backoff_sleepretry_onruntimeit) IpChooser UrlTransport )base)PanelExceptionz/homez#/usr/bin/imunify360-command-wrapperz%/usr/local/directadmin/scripts/customzimunify360-sudousersz%{0} ALL=NOPASSWD: {1}z9Defaults!/usr/bin/imunify360-command-wrapper !requirettyz/etc/virtual/domainowners2222 35000-35999z"/usr/local/directadmin/data/users/z^[a-z_][a-z0-9_-]{0,31}\Zc e Zd ZdS )DirectAdminExceptionN)__name__
__module__ __qualname__ d/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/directadmin/panel.pyr r 4 s Dr r c " e Zd ZdededefdZdS )_LoopbackIpChooserhostnameportreturnc dS )Nz 127.0.0.1r )selfr$ r% s r! choosez_LoopbackIpChooser.choose9 s {r N)r r r strintr) r r r! r# r# 8 s= s # # r r# r& c T t | t st d| | S )Nz$Unexpected document roots response: )
isinstancedictr )payloads r! _valid_docroots_payloadr0 = s8 gt $ $
>7 > >
Nr c t | t rt | st d| | S )zGReturn ``user`` if safe; otherwise raise :class:`DirectAdminException`.z.Refusing to manage sudouser: invalid username )r- r* _SUDOUSER_NAME_REmatchr )users r! _validate_sudouserr5 E sN dC
(9(?(?(E(E
""BF$ H
Kr c i }t | d 5 }|D ]} | }n4# t $ r'}t d| || Y d}~Dd}~ww xY w| d }|dk r<||dz d ||d| < ddd n # 1 swxY w Y |S )zBReturn a mapping from domain name to user name owning this domain.rbzBroken line in %s: %r (%s)N: )opendecodeUnicodeDecodeErrorloggerwarningfindstrip)pathdomainsfblinelineeposs r! get_user_domainsrI N s? G
dD FQ F FE
||~~%
;T5!LLL
))C..Cbyy.23799o.C.C.E.ETcT
((**+ F F F F F F F F F F F F F F F F Ns7 C.C
A ACA ACC C c J K ddg} t | d {V \ }}} d}t j ||t j }t | d S # t t f$ r t d|d|d| w xY w) N"/usr/local/directadmin/directadminvs& ^(Version: )?DirectAdmin (v.)?([\d.]+))flags z-Failed to parse directadmin version. retcode=z , stdout= , stderr=)
r research MULTILINEr groupr<
ValueErrorAttributeErrorr )cmdretcodestdoutstderrversion_patternresults r! get_directadmin_versionr\ ^ s /
5C$'HHnnnnnnGVV
D?F",GGGv||A--//000 '
1
1
1 "
1
1'-
1
1
s AA8 8*B"c e Zd Zd ZeZdgez dgez dg dg dddZeZ e
d Z e
d Z e
j d Z e
j d
Zed Zed Zd
Zd Zd Zd Z e
j d-d Z e
j d-d Zdee fdZ d Z d Z d Z de e fdZ!de"fdZ#de"fdZ$de"fd Z%ede"fd Z&de"eef fd Z'de"ee"eef f fd Z(de"eef fd Z) e*e+e,e-! d"e.j/ j0 de1fd# Z2ed"e.j/ j0 de1fd$ Z3d"e.j/ j0 de1fd%Z4defd&Z5 e6d'd() de"eee
j7 f fd* Z8d+ede9e
j7 fd,Z:dS ). DirectAdmin465113)inout)202153443r 80)rc rd re r` 123r )tcpudpc t S N)r clss r! is_installedzDirectAdmin.is_installed{ s ')))r c H K t t d {V S rl )r* r\ rm s r! versionzDirectAdmin.version s/ 022222222333r c , K t | || v s#t j d dk rGt dd|t g d {V \ }}}|dk r!t d||| d S d S d S )Nusertypeadmingpasswdz-ar z&gpasswd -a failed for %r: rc=%s err=%r) r5 _get_adminsosenvirongetr
SUDO_GROUPr> r? r( r4 rW _outerrs r! add_sudouserzDirectAdmin.add_sudouser s 4 4##%% % %
)C)Cw)N)N'*ItT:+N'O'O!O!O!O!O!O!O GT3!|| < *O)N|r c K t | || v rGt dd|t g d {V \ }}}|dk r!t d||| d S d S d S )Nru z-dr z&gpasswd -d failed for %r: rc=%s err=%r)r5 rv r rz r> r? r{ s r! delete_sudouserzDirectAdmin.delete_sudouser s 4 4##%% % %'*ItT:+N'O'O!O!O!O!O!O!O GT3!||< & %|r c t | d 5 }|dz
}|| vr| | d d d d S # 1 swxY w Y d S )Nr+
)r; readlineswrite)rB contentrD s r! _add_linezDirectAdmin._add_line s
$
! tOGakkmm++ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !s 1AAAc t | d 5 }d fd|D }| d | d | | d d d d S # 1 swxY w Y d S )Nr c 3 H K | ] }| v|V d S rl )rA ).0rF r s r! <genexpr>z+DirectAdmin._remove_line.<locals>.<genexpr> s5 MMD
1L1L41L1L1L1LMMr r )r; joinseektruncater )rB r rD datas ` r! _remove_linezDirectAdmin._remove_line s
$
77MMMMAMMMMMD
FF1III
JJqMMM
GGDMMM s A!B BBc t dd 5 }| }d d d n # 1 swxY w Y |S )Nz,/usr/local/directadmin/data/admin/admin.listrr; readsplit)r( rD
admin_lists r! rv zDirectAdmin._get_admins s
@#
F
F *! ))J * * * * * * * * * * * * * * * 'AA Ac t dd 5 }| }d d d n # 1 swxY w Y |S )Nz//usr/local/directadmin/data/admin/reseller.listr r )r( rD
reseller_lists r! _get_resellerszDirectAdmin._get_resellers s
CS
I
I -Q FFHHNN , ,M - - - - - - - - - - - - - - - r c t j t | }t j | st |d | |d t j d j
}t j d j
}t j ||| t j |d | || d S )Nwz #!/bin/shdiradmini )
rw rB r HOOKS_DIRexistsr; closer pwdgetpwnampw_uidchownchmod)r( hookr rB uidgids r! _create_hookzDirectAdmin._create_hook s w||It,,w~~d## " sOO ! ! # # # NN4 - - -,z**1C,z**1C HT3 $ $ $ HT5 ! ! ! tW%%%%%r c t j t | }t j | r| || d S d S rl )rw rB r r r r )r( r r rB s r! _delete_hookzDirectAdmin._delete_hook sS w||It,,
7>>$ - dG , , , , , - -r Nc K t j d t | dt
| dt | D ]Q} | | d {V # t $ r&}t d|| Y d }~Jd }~ww xY w| dd | dd | dd d S ) Nz/usr/sbin/groupadd -f {} /etc/sudoers&Skipping invalid sudouser entry %r: %suser_create_post.sh9/usr/bin/imunify360-agent add-sudouser --user "$username"user_destroy_pre.sh</usr/bin/imunify360-agent delete-sudouser --user "$username"user_restore_post.sh)
rw systemformatrz r SUDO_LINE
SUDO_TTY_LINErv r~ r r> r? r )r( namer4 excs r! enable_imunify_pluginz!DirectAdmin.enable_imunify_plugin sU
,33J??@@@ ~y111 ~}555$$&& D
''----------'
<dC
! G
! J
" G
s <B
C" CCc K | dt | dt | D ]Q} | | d {V # t
$ r&}t d|| Y d }~Jd }~ww xY wt j d
t | dd | dd | dd d S ) Nr r z/usr/sbin/groupdel {}r r r r r )
r r r rv r r r> r? rw r r rz r )r( plugin_namer4 r s r! disable_imunify_pluginz"DirectAdmin.disable_imunify_plugin sY .)444 .-888$$&& D
**40000000000'
<dC
)00<<=== ! G
! J
" G
s A,,
B 6 BB r& c z K t t t S )z:
:return: list: list of directadmin users
)listsetrI valuesr( s r! get_userszDirectAdmin.get_users s1 C(**113344555r c ` K t t S )zI
:return: list: domains hosted on server via directadmin
)r rI keysr s r! rI z DirectAdmin.get_user_domains s) $&&++--...r c Z K d t D S )z8
:return: domain to list of users pairs
c i | ] \ }}||g
S r r )r domainr4 s r!
<dictcomp>z3DirectAdmin.get_domain_to_owner.<locals>.<dictcomp> s NNN<64NNNr )rI itemsr s r! get_domain_to_ownerz DirectAdmin.get_domain_to_owner s0 ON3C3E3E3K3K3M3MNNNNr c K t t }t D ] \ }}|| | !|S )z8
:return: user to list of domains pairs
)r r rI r append)r( user_to_domainsr r4 s r! get_domains_per_userz DirectAdmin.get_domains_per_user s\ &d++ , . . 4 4 6 6 1 1LFD D ! ( ( 0 0 0 0 r c t hS rl )BASE_DIRr s r! basedirszDirectAdmin.basedirs s
zr c K t d {V t d k r| d {V S | d {V S )Nz1.62.8)r\ r docroots_info_newdocroots_info_legacyr s r!
docroots_infozDirectAdmin.docroots_info sy (** * * * * * *gh.?.? ? ? //11111111 1..000000000r c K ddg}t dt 5 t | d {V \ }}}d d d n # 1 swxY w Y |dk rt d| d|d| t j | }|j
d \ }}t j |
}d | |
d g }t d | t% j } t j |d
d| id }
t- | d | j |
d {V S # t2 $ r } t d } | | _ Y d } ~ n d } ~ wt $ r } | } Y d } ~ nd } ~ ww xY w|j dk r| t d| t- | d | j |
d {V S # t $ r | w xY w)NrK z--root-auth-urlz!Call DA binary to obtain auth URLr z2Failed to obtain auth URL. Unexpected return code . stdout=rO @/)netlocz0CMD_API_DOMAIN?json=yes&action=document_root_allzDocument roots URL: %s
AuthorizationzBasic GET)headersmethodz5Timed out obtaining document roots from the panel APIhttpszDPanel API document roots request failed (%s), retrying over loopback) r r> r r urllibparseurlparser< rA r r base64standard_b64encodeencoder _replacegeturlinfoasyncioget_event_looprequestRequestr0 run_in_executor _do_request TimeoutError __cause__schemer? _do_loopback_request)
r( rV rW rX rY
parsed_url
basic_authr document_roots_urlloopr rG
primary_errors
r! r z DirectAdmin.docroots_info_new# s= 35FG
7
@
@ 5 5,/HHnnnnnn #GVV 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 a<< 9W 9 9!9 9.49 9
\**6==??+@+@+B+BCC
' . 4 4S 9 9
F.z/@/@/B/BCCJJLL
XX##6#2299;;B
,.@AAA%''.(( $&;z&;&;< )
***41A7KKKKKKKK
( ( ( -;G- -M '(M # # # # # # MMMMMM ' '
&
***$3W
sA AA A.G
HG**
H7G>>H/.I
I+c K ddg}t dt 5 t | d {V \ }}}d d d n # 1 swxY w Y |dk r |dk rt d| d|d| t j | }n*# t j $ r}t d | d
d }~ww xY wt | S ) NrK z--DocumentRootz%Call DA binary to obtain all docrootsr r: z8Failed to obtain document roots. Unexpected return code r rO z7Failed to obtain document roots. Failed to decode json .) r r> r r jsonloadsr< JSONDecodeErrorr0 )r( rV retrb r} outputrG s r! r z DirectAdmin.docroots_info_legacyb sW 0
;V
D
D + +"%c((NNNNNNMCc + + + + + + + + + + + + + + + !88q :: :"%: :25: :
Z
--FF# N!NNN
'v...s) AA A2&B C (B;;C c ~ t }| d D ]\ }}|d D ]s\ }}| d r |||d < | di D ]%\ }}| d r |||d < &t|S )NusersrC public_html
subdomains)r. r ry )r r usernameuserdata
domainname
domaindata_sub_datas r! parse_document_root_outputz&DirectAdmin.parse_document_root_outputw s ff"(/"7"7"9"9 B B Hh*29*=*C*C*E*E
B
B&
J >>-00 @5?C
=12#->>,#C#C#I#I#K#K B BKAx ||M22 B7AH] 34B
B
r c d K | d {V }| | S rl )r r )r( r s r!
list_docrootszDirectAdmin.list_docroots s= ''))))))))..t444r c K i }| d {V }t | }t | }|D ]} | | }t
j j }||v rt
j j }||v rt
j j }|
dd |
dd |
dd |
d dk t | d||< # t $ r.}ddd||< t d || Y d }~d }~ww xY w|S )
Nlanguager emailcreator suspendedyes)localer parentr level)r r z!Failed to get_user_details: %s %s)r r rv r get_user_details_for_usernamer UserLevel REGULAR_USERRESSELERADMINry r+ Exceptionr> r? ) r( res usernamesadmins resellersr
parsed_configr rG s r! get_user_detailsz DirectAdmin.get_user_details s ..******** T%%''((++--.. ! H
$ B B8 L L
3y(( N 3Ev%% N 0E + / /
B ? ? * . .w ; ; + / / 2 > >!.!2!2;!?!?5!H ZZ ! !H
! !H
71
s &B;D""
E,$EEc t t | d }t j }d|z }| | |d }|S )z
Implementation taken from
https://github.com/patchman-cloudlinux/patchman2-client/blob/05f54db63639b939c055a9543e82bc9690559965/src/platform/platforms/directadmin.cpp#L315
directadmin::get_user_details
z
/user.confz[top]
top)r USERS_CONF_DIR read_text configparser ConfigParser read_string)r( r
user_conf_strr! s r! r z)DirectAdmin.get_user_details_for_username sk x 3 3 3
)++ %133
!M1
!!-000%e,
r )on_errortimeoutr c L | |t j j S rl ) _fetch_jsonr r urlopen)r( r s r! r zDirectAdmin._do_request s )?@@@r c || t j 5 }|j dk r't d |j t j | cd d d S # 1 swxY w Y d S # t t j j t
j
t j t j j f$ r
}t |d }~ww xY w)N)r, zstatus code is {})r DEFAULT_SOCKET_TIMEOUTstatusr r r r r r< r= httpclient
HTTPExceptionr socketr, r errorURLError)r open_funcresponserG s r! r. zDirectAdmin._fetch_json s( (!<
<?c))(+228?CC z(--//"8"8":":;;
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
K % N L !
( ( ( !a ' (s< B A*B B BB BB AC+ C&&C+c r t t d }| ||j S )NF)
ip_chooser use_proxies)r r# r. r; )r( r transports r! r z DirectAdmin._do_loopback_request s; )++
888r c
K dS )z8
Returns panel url
:return: str
r r )r( r s r! panel_user_linkzDirectAdmin.panel_user_link s
rr r: < )maxsizettlc K | d {V }t t }| di D ]\ }}| di D ]\ }}| d }|r1|| t
j ||d| | d pi D ]R\ }} | d }
|
r6|| t
j |
| d| d| Sʌ|S ) Nr rC r main)docrootr typer r r sub)r r r ry r r r
DomainData) r( r r[ r4 r r domain_datar rI r
sub_public_htmls r! _get_domains_details_per_userz)DirectAdmin._get_domains_details_per_user s ''))))))))3>t3D3D "hhw 3 3 9 9 ; ; ND('/||Ir'B'B'H'H'J'J
# )oom < < 4L'' $/#)!'%) OOL117R%'' MC '/ll=&A&AO& t ++ O(7*-'8'8'8'8%*)-
0
r r c K | d {V }t | |g S rl )rM r ry )r( r detailss r! get_user_domains_detailsz$DirectAdmin.get_user_domains_details sG ::<<<<<<<<GKK"--...r rl );r r r NAMEr
DA_BINARY TCP_PORTS_DA
OPEN_PORTSr exception classmethodro rq r ensure_valid_panelr~ r staticmethodr r rv r r r r r r r* r rI r r r r r r r r r r
r" r r r r r
r r r r r r. r rA r rJ rM r rP r r r! r^ r^ l sV DI 'L(7\)
A@@BBB
J %I* * [* 4 4 [4 T T ! ! \! \
& & &- - -
T
4 T
46c 6 6 6 6 / / / O O O #c( 1T 1 1 1 1
= = = = = ~/D / / / /* d \ 5T#s(^ 5 5 5 5 S$sCx.-@(A <
c3h
X *
A6>#9 Ac A A A
A (V^ 3 (3 ( ( ( \(&9FN,B 9s 9 9 9 9 _QB'''
c4(( ) (' @//
do / / / / / /r r^ )Cr r r' http.clientr4 r loggingrw r rP r7 r urllib.parse collectionsr pathlibr typingr r r r packaging.versionr 3defence360agent.application.determine_hosting_panelr
r defence360agent.contracts.configr defence360agent.utilsr
r r r r r #defence360agent.utils.net_transportr r r r r getLoggerr r> r CMDr rz r r r _VIRTUAL_DOMAINOWNERSTCP_PORTS_COMMONrS r% compiler2 r r# r0 r* r5 rI r\
AbstractPanelr^ r r r! <module>rj s%
# # # # # # ' ' ' ' ' ' ' ' ' ' ' ' % % % % % % 2 1 1 1 1 1 H G G G G G G G ! ! ! ! ! ! 8 $ $ + 3
#
$ + +J < < K
3 $
'>> 5 BJ ;<< 4.
0
DcN
w
V/ V/ V/ V/ V/$$ V/ V/ V/ V/ V/r defence360agent/subsys/panels/directadmin/config.py 0000644 0000000 0000000 00000000425 00000000000 017463 0 ustar import os
from defence360agent.utils.kwconfig import KWConfig
BASEDIR = "/usr/local/directadmin/conf"
class ConfigOptions(KWConfig):
SEARCH_PATTERN = r"^\s*{}\s*=\s*(.*?)\s*$"
WRITE_PATTERN = "{}={}"
DEFAULT_FILENAME = os.path.join(BASEDIR, "directadmin.conf")
defence360agent/subsys/panels/directadmin/panel.py 0000644 0000000 0000000 00000043446 00000000000 017327 0 ustar import asyncio
import base64
import configparser
import http.client
import json
import logging
import os
import pwd
import re
import socket
import urllib
import urllib.parse
from collections import defaultdict
from pathlib import Path
from typing import Any, Dict, List, Set
from packaging.version import Version
from defence360agent.application.determine_hosting_panel import (
DA_FILE,
is_directadmin_installed,
)
from defence360agent.contracts.config import Core
from defence360agent.utils import (
HTTP_REQUEST_RETRY_TIMEOUT,
async_lru_cache,
backoff_sleep,
retry_on,
run,
timeit,
)
from defence360agent.utils.net_transport import IpChooser, UrlTransport
from .. import base
from ..base import PanelException
logger = logging.getLogger(__name__)
BASE_DIR = "/home"
CMD = "/usr/bin/imunify360-command-wrapper"
HOOKS_DIR = "/usr/local/directadmin/scripts/custom"
SUDO_GROUP = "imunify360-sudousers"
SUDO_LINE = "%{0} ALL=NOPASSWD: {1}".format(SUDO_GROUP, CMD)
SUDO_TTY_LINE = "Defaults!/usr/bin/imunify360-command-wrapper !requiretty"
_VIRTUAL_DOMAINOWNERS = "/etc/virtual/domainowners"
TCP_PORTS_DA = base.TCP_PORTS_COMMON + ["2222", "35000-35999"]
USERS_CONF_DIR = "/usr/local/directadmin/data/users/"
_SUDOUSER_NAME_RE = re.compile(r"^[a-z_][a-z0-9_-]{0,31}\Z")
class DirectAdminException(base.PanelException):
pass
class _LoopbackIpChooser(IpChooser):
def choose(self, hostname: str, port: int) -> str:
return "127.0.0.1"
def _valid_docroots_payload(payload) -> Dict:
if not isinstance(payload, dict):
raise PanelException(
f"Unexpected document roots response: {payload!r}"
)
return payload
def _validate_sudouser(user) -> str:
"""Return ``user`` if safe; otherwise raise :class:`DirectAdminException`."""
if not isinstance(user, str) or not _SUDOUSER_NAME_RE.match(user):
raise DirectAdminException(
"Refusing to manage sudouser: invalid username %r" % (user,)
)
return user
def get_user_domains(path=_VIRTUAL_DOMAINOWNERS) -> Dict[str, str]:
"""Return a mapping from domain name to user name owning this domain."""
domains = {}
with open(path, "rb") as f:
for bline in f:
try:
line = bline.decode()
except UnicodeDecodeError as e:
logger.warning("Broken line in %s: %r (%s)", path, bline, e)
continue
pos = line.find(":")
if pos != -1:
domains[line[:pos].strip()] = line[pos + 1 :].strip()
return domains
async def get_directadmin_version() -> Version:
cmd = ["/usr/local/directadmin/directadmin", "v"]
retcode, stdout, stderr = await run(cmd)
try:
version_pattern = rb"^(Version: )?DirectAdmin (v.)?([\d.]+)"
result = re.search(version_pattern, stdout, flags=re.MULTILINE)
return Version(result.group(3).decode())
except (ValueError, AttributeError):
raise PanelException(
"Failed to parse directadmin version."
f" {retcode=}, {stdout=}, {stderr=}"
)
class DirectAdmin(base.AbstractPanel):
NAME = "DirectAdmin"
DA_BINARY = DA_FILE
OPEN_PORTS = {
"tcp": {
"in": ["465"] + TCP_PORTS_DA,
"out": ["113"] + TCP_PORTS_DA,
},
"udp": {
"in": ["20", "21", "53", "443", "35000-35999", "80"],
"out": ["20", "21", "53", "113", "123", "35000-35999"],
},
}
exception = DirectAdminException
@classmethod
def is_installed(cls):
return is_directadmin_installed()
@classmethod
async def version(cls):
# example output 'Version: DirectAdmin v.1.53.0'
return str(await get_directadmin_version())
@base.ensure_valid_panel()
async def add_sudouser(self, user):
_validate_sudouser(user)
if user in self._get_admins() or os.environ.get("usertype") == "admin":
retcode, _out, err = await run(["gpasswd", "-a", user, SUDO_GROUP])
if retcode != 0:
# Tolerate non-zero exit (matches prior os.system behaviour);
# batch callers rely on this, e.g. gpasswd -d on absent users.
logger.warning(
"gpasswd -a failed for %r: rc=%s err=%r",
user,
retcode,
err,
)
@base.ensure_valid_panel()
async def delete_sudouser(self, user):
_validate_sudouser(user)
if user in self._get_admins():
retcode, _out, err = await run(["gpasswd", "-d", user, SUDO_GROUP])
if retcode != 0:
# See add_sudouser; tolerate non-zero exit.
logger.warning(
"gpasswd -d failed for %r: rc=%s err=%r",
user,
retcode,
err,
)
@staticmethod
def _add_line(path, content):
with open(path, "r+") as f:
content += "\n"
if content not in f.readlines():
f.write(content)
@staticmethod
def _remove_line(path, content):
with open(path, "r+") as f:
data = "".join(line for line in f if content not in line.strip())
f.seek(0)
f.truncate(0)
f.write(data)
def _get_admins(self):
with open("/usr/local/directadmin/data/admin/admin.list", "r") as f:
admin_list = f.read().split()
return admin_list
def _get_resellers(self):
with open("/usr/local/directadmin/data/admin/reseller.list", "r") as f:
reseller_list = f.read().split()
return reseller_list
def _create_hook(self, hook, content):
path = os.path.join(HOOKS_DIR, hook)
if not os.path.exists(path):
open(path, "w").close()
self._add_line(path, "#!/bin/sh")
uid = pwd.getpwnam("diradmin").pw_uid
gid = pwd.getpwnam("diradmin").pw_uid
os.chown(path, uid, gid)
os.chmod(path, 0o700)
self._add_line(path, content)
def _delete_hook(self, hook, content):
path = os.path.join(HOOKS_DIR, hook)
if os.path.exists(path):
self._remove_line(path, content)
@base.ensure_valid_panel()
async def enable_imunify_plugin(self, name=None):
os.system("/usr/sbin/groupadd -f {}".format(SUDO_GROUP))
self._add_line("/etc/sudoers", SUDO_LINE)
self._add_line("/etc/sudoers", SUDO_TTY_LINE)
for user in self._get_admins():
try:
await self.add_sudouser(user)
except DirectAdminException as exc:
logger.warning(
"Skipping invalid sudouser entry %r: %s", user, exc
)
self._create_hook(
"user_create_post.sh",
'/usr/bin/imunify360-agent add-sudouser --user "$username"',
)
self._create_hook(
"user_destroy_pre.sh",
'/usr/bin/imunify360-agent delete-sudouser --user "$username"',
)
self._create_hook(
"user_restore_post.sh",
'/usr/bin/imunify360-agent add-sudouser --user "$username"',
)
@base.ensure_valid_panel()
async def disable_imunify_plugin(self, plugin_name=None):
self._remove_line("/etc/sudoers", SUDO_LINE)
self._remove_line("/etc/sudoers", SUDO_TTY_LINE)
for user in self._get_admins():
try:
await self.delete_sudouser(user)
except DirectAdminException as exc:
logger.warning(
"Skipping invalid sudouser entry %r: %s", user, exc
)
os.system("/usr/sbin/groupdel {}".format(SUDO_GROUP))
self._delete_hook(
"user_create_post.sh",
'/usr/bin/imunify360-agent add-sudouser --user "$username"',
)
self._delete_hook(
"user_destroy_pre.sh",
'/usr/bin/imunify360-agent delete-sudouser --user "$username"',
)
self._delete_hook(
"user_restore_post.sh",
'/usr/bin/imunify360-agent add-sudouser --user "$username"',
)
async def get_users(self) -> List[str]:
"""
:return: list: list of directadmin users
"""
return list(set(get_user_domains().values()))
async def get_user_domains(self):
"""
:return: list: domains hosted on server via directadmin
"""
return list(get_user_domains().keys())
async def get_domain_to_owner(self):
"""
:return: domain to list of users pairs
"""
return {domain: [user] for domain, user in get_user_domains().items()}
async def get_domains_per_user(self):
"""
:return: user to list of domains pairs
"""
user_to_domains = defaultdict(list)
for domain, user in get_user_domains().items():
user_to_domains[user].append(domain)
return user_to_domains
def basedirs(self) -> Set[str]:
return {BASE_DIR}
async def docroots_info(self) -> Dict:
if await get_directadmin_version() >= Version("1.62.8"):
return await self.docroots_info_new()
return await self.docroots_info_legacy()
async def docroots_info_new(self) -> Dict:
cmd = ["/usr/local/directadmin/directadmin", "--root-auth-url"]
with timeit("Call DA binary to obtain auth URL", logger):
retcode, stdout, stderr = await run(cmd)
if retcode != 0:
raise PanelException(
f"Failed to obtain auth URL. Unexpected return code {retcode}."
f" stdout={stdout!r}, stderr={stderr!r}"
)
parsed_url = urllib.parse.urlparse(stdout.decode().strip())
basic_auth, domain = parsed_url.netloc.split("@")
basic_auth = base64.standard_b64encode(basic_auth.encode()).decode()
document_roots_url = "/".join(
[
parsed_url._replace(netloc=domain).geturl(),
"CMD_API_DOMAIN?json=yes&action=document_root_all",
]
)
logger.info("Document roots URL: %s", document_roots_url)
loop = asyncio.get_event_loop()
request = urllib.request.Request(
document_roots_url,
headers={"Authorization": f"Basic {basic_auth}"},
method="GET",
)
try:
return _valid_docroots_payload(
await loop.run_in_executor(None, self._do_request, request)
)
except TimeoutError as e:
# retry_on raises a bare TimeoutError, not PanelException, once
# its overall budget is exhausted
primary_error: PanelException = PanelException(
"Timed out obtaining document roots from the panel API"
)
primary_error.__cause__ = e
except PanelException as e:
primary_error = e
# the URL host is the panel's servername; when it does not resolve
# back to this host (NAT, proxied DNS, firewalled port) the panel is
# still reachable over loopback with the same one-time token, but
# only over TLS -- the token must not be sent to a peer we cannot
# authenticate (a local user could hijack a plaintext loopback port)
if parsed_url.scheme != "https":
raise primary_error
logger.warning(
"Panel API document roots request failed (%s),"
" retrying over loopback",
primary_error,
)
try:
return _valid_docroots_payload(
await loop.run_in_executor(
None, self._do_loopback_request, request
)
)
except PanelException:
raise primary_error
async def docroots_info_legacy(self) -> Dict:
cmd = [
"/usr/local/directadmin/directadmin",
"--DocumentRoot",
]
with timeit("Call DA binary to obtain all docroots", logger):
ret, out, err = await run(cmd)
if ret != 0 and ret != 1:
raise PanelException(
"Failed to obtain document roots. Unexpected return code"
f" {ret}. stdout={out!r}, stderr={err!r}"
)
try:
output = json.loads(out.decode())
except json.JSONDecodeError as e:
raise PanelException(
f"Failed to obtain document roots. Failed to decode json {e}."
)
return _valid_docroots_payload(output)
@staticmethod
def parse_document_root_output(output) -> Dict:
ret = dict()
for username, userdata in output["users"].items():
for domainname, domaindata in userdata["domains"].items():
if domaindata.get("public_html"):
ret[domaindata["public_html"]] = domainname
for _, sub_data in domaindata.get("subdomains", {}).items():
if sub_data.get("public_html"):
ret[sub_data["public_html"]] = domainname
return ret
async def list_docroots(self) -> Dict[str, str]:
info = await self.docroots_info()
return self.parse_document_root_output(info)
async def get_user_details(self) -> Dict[str, Dict[str, str]]:
res = {}
usernames = await self.get_users()
admins = set(self._get_admins())
resellers = set(self._get_resellers())
for username in usernames:
try:
parsed_config = self.get_user_details_for_username(username)
level = base.UserLevel.REGULAR_USER
if username in resellers:
level = base.UserLevel.RESSELER
if username in admins:
level = base.UserLevel.ADMIN
res[username] = {
"locale": parsed_config.get("language", ""),
"email": parsed_config.get("email", ""),
"parent": parsed_config.get("creator", ""),
"suspended": parsed_config.get("suspended") == "yes",
"level": int(level),
}
except Exception as e:
res[username] = {
"email": "",
"locale": "",
}
logger.warning(
"Failed to get_user_details: %s %s", username, e
)
return res
def get_user_details_for_username(self, username) -> Dict[str, str]:
"""
Implementation taken from
https://github.com/patchman-cloudlinux/patchman2-client/blob/05f54db63639b939c055a9543e82bc9690559965/src/platform/platforms/directadmin.cpp#L315
directadmin::get_user_details
"""
user_conf_str = Path(
USERS_CONF_DIR, f"{username}/user.conf"
).read_text()
parsed_config = configparser.ConfigParser()
user_conf_str = "[top]\n" + user_conf_str
parsed_config.read_string(user_conf_str)
parsed_config = parsed_config["top"]
return parsed_config
@retry_on(
PanelException,
on_error=backoff_sleep,
timeout=HTTP_REQUEST_RETRY_TIMEOUT,
)
def _do_request(self, request: urllib.request.Request) -> Any:
return self._fetch_json(request, urllib.request.urlopen)
@staticmethod
def _fetch_json(request: urllib.request.Request, open_func) -> Any:
try:
with open_func(
request, timeout=Core.DEFAULT_SOCKET_TIMEOUT
) as response:
if response.status != 200:
raise PanelException(
"status code is {}".format(response.status)
)
return json.loads(response.read().decode())
except (
UnicodeDecodeError,
http.client.HTTPException,
json.JSONDecodeError,
socket.timeout,
urllib.error.URLError,
) as e:
raise PanelException from e
def _do_loopback_request(self, request: urllib.request.Request) -> Any:
transport = UrlTransport(
ip_chooser=_LoopbackIpChooser(), use_proxies=False
)
return self._fetch_json(request, transport.open)
async def panel_user_link(self, username) -> str:
"""
Returns panel url
:return: str
"""
return ""
@async_lru_cache(maxsize=1, ttl=60)
async def _get_domains_details_per_user(
self,
) -> Dict[str, List[base.DomainData]]:
info = await self.docroots_info()
result: Dict[str, List[base.DomainData]] = defaultdict(list)
for user, userdata in info.get("users", {}).items():
for domain, domain_data in userdata.get("domains", {}).items():
public_html = domain_data.get("public_html")
if public_html:
result[user].append(
base.DomainData(
docroot=public_html,
domain=domain,
type="main",
username=user,
)
)
for sub, sub_data in (
domain_data.get("subdomains") or {}
).items():
sub_public_html = sub_data.get("public_html")
if sub_public_html:
result[user].append(
base.DomainData(
docroot=sub_public_html,
domain=f"{sub}.{domain}",
type="sub",
username=user,
)
)
return result
async def get_user_domains_details(
self, username: str
) -> list[base.DomainData]:
details = await self._get_domains_details_per_user()
return list(details.get(username, []))
defence360agent/subsys/panels/generic/ 0000755 0000000 0000000 00000000000 00000000000 014774 5 ustar defence360agent/subsys/panels/generic/__init__.py 0000644 0000000 0000000 00000000074 00000000000 017106 0 ustar from .panel import GenericPanel
__all__ = ["GenericPanel"]
defence360agent/subsys/panels/generic/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 017204 5 ustar defence360agent/subsys/panels/generic/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000442 00000000000 024404 0 ustar
r_j< d dl mZ dgZdS ) ) GenericPanelr N)panelr __all__ c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/generic/__init__.py<module>r s#
r defence360agent/subsys/panels/generic/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000442 00000000000 023445 0 ustar
r_j< d dl mZ dgZdS ) ) GenericPanelr N)panelr __all__ c/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/generic/__init__.py<module>r s#
r defence360agent/subsys/panels/generic/__pycache__/panel.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000054011 00000000000 023745 0 ustar
r_j. d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl m
Z
m Z m Z d dl
Z
d dlZd dlmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d d lmZm Z m Z m Z d
d l m Z ej! e" Z#ej$ % e& d z Z'd
Z(dZ) ej* edd Z+ ej, d
de-de
j. fd Z/d Z0d Z1 e e+d de-fd Z2de-de-de e- fd Z3de-de-fd Z4d Z5d Z6d Z7de e- fd!Z8 G d" d#e j9 Z: G d$ d%e j; Z<dS )& N) defaultdict)DictListSet)ClIntegrationConfigIntegrationConfig) JWTIssueris_generic_panel_installed)int_from_envvar)UserType)
CheckRunError check_runget_non_system_users timed_cache )basez$/users_script_schemas/schema-{}.yamlz$/etc/sysconfig/imunify360/auth.adminmetadata-IMUNIFY360_EXPIRATION_FOR_INTEGRATION_SCRIPTSZ )seconds)maxsizescriptreturnc t t | 5 }t j | }| t
ur ddi|t
< t
j | cddd S # 1 swxY w Y dS )z%Returns a validator for given script.requiredTN)open_SCHEMA_PATH_TMPLformatyaml safe_loadMETADATAcerberus Validator)r schema_fileschemas `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/generic/panel.py_get_validatorr( / s
&&v.. / / *; ,, ! ! *D 1F8 !&)) * * * * * * * * * * * * * * * * * *s =A22A69A6c 2 d t D S )Nc 8 g | ]}t |j S )name)dictpw_name).0pws r'
<listcomp>z*get_users_default_impl.<locals>.<listcomp>: s% C C CbDbj ! ! ! C C C )r r2 r' get_users_default_implr4 9 s C C,@,B,B C C CCr2 c f | }d|v r||d v r|d | S d S )Nintegration_scripts)to_dict)clr ds r' _get_conf_pathr: = s@
A !!f2G0H&H&H&'// 4r2
)
expirationr c K t t | }|s t t | }|st d| z t | | d {V S )Nzl%s not found neither in /etc/sysconfig/imunify360/integration.conf nor in /opt/cpvendor/etc/integration.ini.)r: r r IntegrationScriptError_get_integration_data)r paths r' get_integration_datarA D s +--v 6 6D = 1 3 3V<<
$
8:@
A
'vt44 4 4 4 4 4 44r2 r@ c @ |r| st d| z t j | }n'# t $ r}t d| d| d}~ww xY w|st d| z |d }t
j | st d| d| t
j | st d| d | t j |t
j
st d| d
| |S ) z?Tokenize a config-supplied script command into argv (no shell).z$Empty integration script path for %sz$Invalid integration script path for z: Nr z Integration script path for z must be absolute: zIntegration script for z does not exist: z is not executable: ) stripr> shlexsplit
ValueErrorosr@ isabsisfileaccessX_OK)r r@ argve
executables r' _build_integration_argvrO S sv
tzz||
$ 2V ;
{4
$$<BFFAA F
$ 2V ;
aJ
7== $ $
$$vvzz
#
7>>* % %
$$vvzz
#
9Z ) )
$$vvzz
#
Ks ?
A# A A#c K t | | } t | d {V }n6# t $ r)}t d | | d }~ww xY w t j | }n1# t t
j f$ r}t d|z |d }~ww xY wt |t st d|z t t }| | st d| d|j |t d dk rJ|t d }d |t v r|d
|t d z z
}t | t | }| | st d | d|j |d S )
NzMIntegrations script {script} failed with exit code {e.returncode}
{e.stderr})r rM z"Cannot decode output of %s as JSONz%s should return dictz Validation error in metadata of z script: resultokmessagez: %szValidation error in data)rO r r r> r jsonloadsdecodeUnicodeDecodeErrorJSONDecodeError
isinstancer- r( r" validateerrors) r r@ rL stdoutrM rT metadata_validatormetadata_error validators r' r? r? x s "64 0 0D
&&&&&&
$
v33
z&--//** 4 5 $ 04 7
dD ! ! E$%<t%CDDD'11 & &t , ,
$$vv)00
2
H~h 4'' h 1 X & & ftH~i'@ @ @N$^444 v&&I d # #
$$39669;K;K L
<s, *
A $AA !&B B6 B11B6c K t d {V } t d d {V }| D ]M\ }}|rF| d r1| |d g }| | Nd | D S # t $ r+ t d t cY S w xY w)Ndomainsownerc g | ]
\ }}||d S )r, rb r3 )r/ kvs r' r1 z$_get_client_data.<locals>.<listcomp> s$ DDDdaq))DDDr2 z:Applying default implementation of users and domains lists)
get_users_integration_datarA itemsget
setdefaultappendr> loggerwarningr4 )usersrb rf rg user_domainss r' _get_client_datarq s
(022222222,Y77777777MMOO ' 'DAq
'QUU7^^
' $ / /'
B ? ? ##A&&&DDekkmmDDDD ! ( ( ( H
&''''' (s B(B- -2C"!C"c K t d d {V } i }| D ]B}|r| d s t d| 7g ||d < C|S )Nro usernamez#Found user with an empty username: )rA rj rm rn )ro
users_dictusers r' rh rh s &w// / / / / / /EJ . . .488J// . NNGGG H H H H+-JtJ' ( ( r2 c K t d d {V S # t $ r t d i cY S w xY w)Nrb z Could not parse domains lists)rA r> rm rn r3 r2 r' get_domain_datarw sb ))444444444 ! 6777 s &AAc
K d} dh}t j t | t t | t | t t | d d {V }d |D }|st d| ||z } t t 5 }|
| d d d n # 1 swxY w Y n0# t $ r# t dt Y nw xY wt | S )NadminsrootT)return_exceptionsc R h | ]$}t |t |D ]
}|d %S r+ )rZ list)r/ ry admins r' <setcomp>z!get_admin_list.<locals>.<setcomp> sW fd # #
f
r2 zDError occurred during extracting admins from integration configs: %sz&Failed to retrieve admins list from %s)asynciogatherr? r: r r rm rn r ADMIN_LIST_FILE_PATHupdateread
splitlinesOSErrorr} ) script_name
admins_set admins_from_integration_scripts
custom_adminsadmin_list_files r' get_admin_listr s KJ,3N !##
#%%
- - - ' ' ' ' ' '#" 5 M
+ +
- J
&
'
' C? o 2 2 4 4 ? ? A A B B B C C C C C C C C C C C C C C C
46J
s6 $D
8:C>2 D
>DD
DD
*D76D7c e Zd Z fdZ xZS )r> c h t j | t | d S N)super__init__rm rn )selfargskwargs __class__s r' r z IntegrationScriptError.__init__ s/ $ t r2 )__name__
__module__ __qualname__r
__classcell__r s @r' r> r> s8 r2 r> c e Zd ZdZej ZeZe d Z
ddZ ddZ e d Z
e d Zd Zd ee fd
Zd eeee f fd Zd eeeeef f f fd Zd eeee f fd
ZdefdZd ee fdZd eeef fdZd eeee f fdZ d efdZ e ded e ej fd Z xZ!S ) GenericPanelzb
Panel, UI to which is provided by
imunify{-antivirus,360-firewall}-generic.{rpm,deb}
c t S r r
)clss r' is_installedzGenericPanel.is_installed s )+++r2 Nc
K d S r r3 )r r, s r' enable_imunify_pluginz"GenericPanel.enable_imunify_plugin r2 c
K d S r r3 )r plugin_names r' disable_imunify_pluginz#GenericPanel.disable_imunify_plugin r r2 c n K t d d {V } dj di |S # t $ r Y dS w xY w)N
panel_infoz{name} {version}0r3 )rA r r> r infos r' versionzGenericPanel.version sf -l;;;;;;;;D,%,44t44 4% 33 s !&
44c z K t d d {V } dj di |S # t $ r
| j cY S w xY w)Nr z{name}r3 )rA r r> NAMEr s r' r, zGenericPanel.name sh -l;;;;;;;;D"8?**T** *% 8OOO s !& ::c K t d {V }g }|D ]7}| | dt 8|S )Nrb )rq extendrj tuple)r ro rQ ru s r' get_user_domainsz GenericPanel.get_user_domains sc &(((((((( 8 8D MM$((9egg66 7 7 7 7
r2 r c F K t d {V }d |D S )Nc g | ]
}|d S r+ r3 r/ ru s r' r1 z*GenericPanel.get_users.<locals>.<listcomp>' s ///V ///r2 rq r ro s r' get_userszGenericPanel.get_users% s7 &((((((((//////r2 c K t d {V }t t }|D ]<}| dg D ]#}|| |d $=|S )Nrb r, )rq r r} rj rl )r ro rQ ru domains r' get_domain_to_ownerz GenericPanel.get_domain_to_owner) s &(((((((( T"" 4 4D ((9b11
4
4v%%d6l3333
4
r2 c < K t d d {V }n6# t $ r) t d {V cY S w xY w| d {V t d {V dt ffd fd|D S )Nro user_infoc | d dk rt j j S | d v rt j j S t j j S )Nrs rz )rj r UserLevelADMINRESSELER REGULAR_USER)r ry s r' user_info_to_levelz9GenericPanel.get_user_details.<locals>.user_info_to_level9 sR }}Z((F22~++}}Z((F22~..>. .r2 c
i | ]s}|ro| d v | d | dd | dd t | dtS )rs email locale_code)r localelevel)rj int)r/ r r usernamess r'
<dictcomp>z1GenericPanel.get_user_details.<locals>.<dictcomp>B s
,, 99
HHZ '2.. ((="55 / / 5 566# # :99r2 )rA r> r get_user_detailsr r r )r user_datary r r r s @@@r' r z GenericPanel.get_user_details1 s 4 27 ; ;;;;;;;II% 4 4 4 1133333333 3 3 3 4 ..******** %'''''''' /$ / / / / / /
"
s 0AAc F K t d {V }d |D S )Nc H i | ] }|d | dg S re rj r s r' r z5GenericPanel.get_domains_per_user.<locals>.<dictcomp>O s, HHH$V dhhy" 5 5HHHr2 r r s r' get_domains_per_userz!GenericPanel.get_domains_per_userL s7 &((((((((HH%HHHHr2 rT c |j dk rf|d ddgk rX|d dd }t j | }|d |d t j k r|d nd fS |j d fS ) Nr commandloginpamparamsjwt user_type user_name)_uidpopr parse_tokenr
NON_ROOTru )r protocolrT token parsed_tokens r' authenticatezGenericPanel.authenticateQ s =A $y/gu5E"E"EN&&ud33E$077L , ,0AAA [))
=$& &r2 c t }d|v r7d|d v r-t |d d S t S )Nmalwarebasedir)r r7 setrE )r confs r' basedirszGenericPanel.basedirs] s^ ""**,, d9o!=!=tIy17799:: :uu r2 c j K t d {V }d | D S )Nc T i | ]%\ }}|| d |d |&S
document_rootr r/ r rg s r' r z.GenericPanel.list_docroots.<locals>.<dictcomp>e sO
UU?++
o
r2 rw ri r rb s r'
list_docrootszGenericPanel.list_docrootsc L '))))))))
$]]__
r2 c j K t d {V }d | D S )Nc V i | ]&\ }}|| d ||d g'S r r r s r' r z1GenericPanel.get_domain_paths.<locals>.<dictcomp>m sR
UU?++
Q'(
r2 r r s r' get_domain_pathsz GenericPanel.get_domain_pathsk r r2 c
K dS )z8
Returns panel url
:return: str
r r3 )r rs s r' panel_user_linkz GenericPanel.panel_user_links s
rr2 rs c p K t d {V }fd| D S )Nc g | ]d\ }}|r]| d k t j | d pd|| d rdnd eS )rc r r is_mainmainaddon)docrootr typers )rj r
DomainData)r/ r rg rs s r' r1 z9GenericPanel.get_user_domains_details.<locals>.<listcomp> s
UU7^^x//
Oo..4" uuY / /<VVW!
0//r2 r )r rs rb s ` r' get_user_domains_detailsz%GenericPanel.get_user_domains_detailsz s[ ())))))))
%]]__
r2 r )"r r r __doc__r GENERIC_PANEL_NAMEr r> exception classmethodr r r r r, r r strr r r r r r- r r r r r r r} r r r r s @r' r r s@
"D&I, , [,
[ [ 0c 0 0 0 04T#Y+?
S$sCx.-@(A
6IDd3i ,@ I I I I
'4
'
'
'
'#c(
T#s(^
S$s)^(<
do
[
r2 r )=r datetime functoolsrU loggingrG rD collectionsr typingr r r r# r $defence360agent.api.integration_confr r defence360agent.api.jwt_issuerr 3defence360agent.application.determine_hosting_panelr defence360agent.contracts.configr defence360agent.rpc_tools.lookupr
defence360agent.utilsr r r r r r getLoggerr rm r@ dirname__file__r r r" timedelta'EXPIRATION_TIME_FOR_INTEGRATION_SCRIPTS lru_cacher r$ r( r4 r: rA rO r? rq rh rw r PanelExceptionr>
AbstractPanelr r3 r2 r' <module>r sj # # # # # # " " " " " " " " " " 5 4 4 4 4 4 = < < < < < 5 5 5 5 5 5 8 $ $GOOH FF > *<(*< O7
+ + + ' Q *3 *8#5 * * * *D D D
?LLL 5s 5 5 5 ML 5 "C "s "tCy " " " "J' '3 ' ' ' 'T( ( ("
* d3i * * * * Z T 0 M
M
M
M
M
4% M
M
M
M
M
r2 defence360agent/subsys/panels/generic/__pycache__/panel.cpython-311.pyc 0000644 0000000 0000000 00000054011 00000000000 023006 0 ustar
r_j. d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl m
Z
m Z m Z d dl
Z
d dlZd dlmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d d lmZm Z m Z m Z d
d l m Z ej! e" Z#ej$ % e& d z Z'd
Z(dZ) ej* edd Z+ ej, d
de-de
j. fd Z/d Z0d Z1 e e+d de-fd Z2de-de-de e- fd Z3de-de-fd Z4d Z5d Z6d Z7de e- fd!Z8 G d" d#e j9 Z: G d$ d%e j; Z<dS )& N) defaultdict)DictListSet)ClIntegrationConfigIntegrationConfig) JWTIssueris_generic_panel_installed)int_from_envvar)UserType)
CheckRunError check_runget_non_system_users timed_cache )basez$/users_script_schemas/schema-{}.yamlz$/etc/sysconfig/imunify360/auth.adminmetadata-IMUNIFY360_EXPIRATION_FOR_INTEGRATION_SCRIPTSZ )seconds)maxsizescriptreturnc t t | 5 }t j | }| t
ur ddi|t
< t
j | cddd S # 1 swxY w Y dS )z%Returns a validator for given script.requiredTN)open_SCHEMA_PATH_TMPLformatyaml safe_loadMETADATAcerberus Validator)r schema_fileschemas `/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/generic/panel.py_get_validatorr( / s
&&v.. / / *; ,, ! ! *D 1F8 !&)) * * * * * * * * * * * * * * * * * *s =A22A69A6c 2 d t D S )Nc 8 g | ]}t |j S )name)dictpw_name).0pws r'
<listcomp>z*get_users_default_impl.<locals>.<listcomp>: s% C C CbDbj ! ! ! C C C )r r2 r' get_users_default_implr4 9 s C C,@,B,B C C CCr2 c f | }d|v r||d v r|d | S d S )Nintegration_scripts)to_dict)clr ds r' _get_conf_pathr: = s@
A !!f2G0H&H&H&'// 4r2
)
expirationr c K t t | }|s t t | }|st d| z t | | d {V S )Nzl%s not found neither in /etc/sysconfig/imunify360/integration.conf nor in /opt/cpvendor/etc/integration.ini.)r: r r IntegrationScriptError_get_integration_data)r paths r' get_integration_datarA D s +--v 6 6D = 1 3 3V<<
$
8:@
A
'vt44 4 4 4 4 4 44r2 r@ c @ |r| st d| z t j | }n'# t $ r}t d| d| d}~ww xY w|st d| z |d }t
j | st d| d| t
j | st d| d | t j |t
j
st d| d
| |S ) z?Tokenize a config-supplied script command into argv (no shell).z$Empty integration script path for %sz$Invalid integration script path for z: Nr z Integration script path for z must be absolute: zIntegration script for z does not exist: z is not executable: ) stripr> shlexsplit
ValueErrorosr@ isabsisfileaccessX_OK)r r@ argve
executables r' _build_integration_argvrO S sv
tzz||
$ 2V ;
{4
$$<BFFAA F
$ 2V ;
aJ
7== $ $
$$vvzz
#
7>>* % %
$$vvzz
#
9Z ) )
$$vvzz
#
Ks ?
A# A A#c K t | | } t | d {V }n6# t $ r)}t d | | d }~ww xY w t j | }n1# t t
j f$ r}t d|z |d }~ww xY wt |t st d|z t t }| | st d| d|j |t d dk rJ|t d }d |t v r|d
|t d z z
}t | t | }| | st d | d|j |d S )
NzMIntegrations script {script} failed with exit code {e.returncode}
{e.stderr})r rM z"Cannot decode output of %s as JSONz%s should return dictz Validation error in metadata of z script: resultokmessagez: %szValidation error in data)rO r r r> r jsonloadsdecodeUnicodeDecodeErrorJSONDecodeError
isinstancer- r( r" validateerrors) r r@ rL stdoutrM rT metadata_validatormetadata_error validators r' r? r? x s "64 0 0D
&&&&&&
$
v33
z&--//** 4 5 $ 04 7
dD ! ! E$%<t%CDDD'11 & &t , ,
$$vv)00
2
H~h 4'' h 1 X & & ftH~i'@ @ @N$^444 v&&I d # #
$$39669;K;K L
<s, *
A $AA !&B B6 B11B6c K t d {V } t d d {V }| D ]M\ }}|rF| d r1| |d g }| | Nd | D S # t $ r+ t d t cY S w xY w)Ndomainsownerc g | ]
\ }}||d S )r, rb r3 )r/ kvs r' r1 z$_get_client_data.<locals>.<listcomp> s$ DDDdaq))DDDr2 z:Applying default implementation of users and domains lists)
get_users_integration_datarA itemsget
setdefaultappendr> loggerwarningr4 )usersrb rf rg user_domainss r' _get_client_datarq s
(022222222,Y77777777MMOO ' 'DAq
'QUU7^^
' $ / /'
B ? ? ##A&&&DDekkmmDDDD ! ( ( ( H
&''''' (s B(B- -2C"!C"c K t d d {V } i }| D ]B}|r| d s t d| 7g ||d < C|S )Nro usernamez#Found user with an empty username: )rA rj rm rn )ro
users_dictusers r' rh rh s &w// / / / / / /EJ . . .488J// . NNGGG H H H H+-JtJ' ( ( r2 c K t d d {V S # t $ r t d i cY S w xY w)Nrb z Could not parse domains lists)rA r> rm rn r3 r2 r' get_domain_datarw sb ))444444444 ! 6777 s &AAc
K d} dh}t j t | t t | t | t t | d d {V }d |D }|st d| ||z } t t 5 }|
| d d d n # 1 swxY w Y n0# t $ r# t dt Y nw xY wt | S )NadminsrootT)return_exceptionsc R h | ]$}t |t |D ]
}|d %S r+ )rZ list)r/ ry admins r' <setcomp>z!get_admin_list.<locals>.<setcomp> sW fd # #
f
r2 zDError occurred during extracting admins from integration configs: %sz&Failed to retrieve admins list from %s)asynciogatherr? r: r r rm rn r ADMIN_LIST_FILE_PATHupdateread
splitlinesOSErrorr} ) script_name
admins_set admins_from_integration_scripts
custom_adminsadmin_list_files r' get_admin_listr s KJ,3N !##
#%%
- - - ' ' ' ' ' '#" 5 M
+ +
- J
&
'
' C? o 2 2 4 4 ? ? A A B B B C C C C C C C C C C C C C C C
46J
s6 $D
8:C>2 D
>DD
DD
*D76D7c e Zd Z fdZ xZS )r> c h t j | t | d S N)super__init__rm rn )selfargskwargs __class__s r' r z IntegrationScriptError.__init__ s/ $ t r2 )__name__
__module__ __qualname__r
__classcell__r s @r' r> r> s8 r2 r> c e Zd ZdZej ZeZe d Z
ddZ ddZ e d Z
e d Zd Zd ee fd
Zd eeee f fd Zd eeeeef f f fd Zd eeee f fd
ZdefdZd ee fdZd eeef fdZd eeee f fdZ d efdZ e ded e ej fd Z xZ!S ) GenericPanelzb
Panel, UI to which is provided by
imunify{-antivirus,360-firewall}-generic.{rpm,deb}
c t S r r
)clss r' is_installedzGenericPanel.is_installed s )+++r2 Nc
K d S r r3 )r r, s r' enable_imunify_pluginz"GenericPanel.enable_imunify_plugin r2 c
K d S r r3 )r plugin_names r' disable_imunify_pluginz#GenericPanel.disable_imunify_plugin r r2 c n K t d d {V } dj di |S # t $ r Y dS w xY w)N
panel_infoz{name} {version}0r3 )rA r r> r infos r' versionzGenericPanel.version sf -l;;;;;;;;D,%,44t44 4% 33 s !&
44c z K t d d {V } dj di |S # t $ r
| j cY S w xY w)Nr z{name}r3 )rA r r> NAMEr s r' r, zGenericPanel.name sh -l;;;;;;;;D"8?**T** *% 8OOO s !& ::c K t d {V }g }|D ]7}| | dt 8|S )Nrb )rq extendrj tuple)r ro rQ ru s r' get_user_domainsz GenericPanel.get_user_domains sc &(((((((( 8 8D MM$((9egg66 7 7 7 7
r2 r c F K t d {V }d |D S )Nc g | ]
}|d S r+ r3 r/ ru s r' r1 z*GenericPanel.get_users.<locals>.<listcomp>' s ///V ///r2 rq r ro s r' get_userszGenericPanel.get_users% s7 &((((((((//////r2 c K t d {V }t t }|D ]<}| dg D ]#}|| |d $=|S )Nrb r, )rq r r} rj rl )r ro rQ ru domains r' get_domain_to_ownerz GenericPanel.get_domain_to_owner) s &(((((((( T"" 4 4D ((9b11
4
4v%%d6l3333
4
r2 c < K t d d {V }n6# t $ r) t d {V cY S w xY w| d {V t d {V dt ffd fd|D S )Nro user_infoc | d dk rt j j S | d v rt j j S t j j S )Nrs rz )rj r UserLevelADMINRESSELER REGULAR_USER)r ry s r' user_info_to_levelz9GenericPanel.get_user_details.<locals>.user_info_to_level9 sR }}Z((F22~++}}Z((F22~..>. .r2 c
i | ]s}|ro| d v | d | dd | dd t | dtS )rs email locale_code)r localelevel)rj int)r/ r r usernamess r'
<dictcomp>z1GenericPanel.get_user_details.<locals>.<dictcomp>B s
,, 99
HHZ '2.. ((="55 / / 5 566# # :99r2 )rA r> r get_user_detailsr r r )r user_datary r r r s @@@r' r z GenericPanel.get_user_details1 s 4 27 ; ;;;;;;;II% 4 4 4 1133333333 3 3 3 4 ..******** %'''''''' /$ / / / / / /
"
s 0AAc F K t d {V }d |D S )Nc H i | ] }|d | dg S re rj r s r' r z5GenericPanel.get_domains_per_user.<locals>.<dictcomp>O s, HHH$V dhhy" 5 5HHHr2 r r s r' get_domains_per_userz!GenericPanel.get_domains_per_userL s7 &((((((((HH%HHHHr2 rT c |j dk rf|d ddgk rX|d dd }t j | }|d |d t j k r|d nd fS |j d fS ) Nr commandloginpamparamsjwt user_type user_name)_uidpopr parse_tokenr
NON_ROOTru )r protocolrT token parsed_tokens r' authenticatezGenericPanel.authenticateQ s =A $y/gu5E"E"EN&&ud33E$077L , ,0AAA [))
=$& &r2 c t }d|v r7d|d v r-t |d d S t S )Nmalwarebasedir)r r7 setrE )r confs r' basedirszGenericPanel.basedirs] s^ ""**,, d9o!=!=tIy17799:: :uu r2 c j K t d {V }d | D S )Nc T i | ]%\ }}|| d |d |&S
document_rootr r/ r rg s r' r z.GenericPanel.list_docroots.<locals>.<dictcomp>e sO
UU?++
o
r2 rw ri r rb s r'
list_docrootszGenericPanel.list_docrootsc L '))))))))
$]]__
r2 c j K t d {V }d | D S )Nc V i | ]&\ }}|| d ||d g'S r r r s r' r z1GenericPanel.get_domain_paths.<locals>.<dictcomp>m sR
UU?++
Q'(
r2 r r s r' get_domain_pathsz GenericPanel.get_domain_pathsk r r2 c
K dS )z8
Returns panel url
:return: str
r r3 )r rs s r' panel_user_linkz GenericPanel.panel_user_links s
rr2 rs c p K t d {V }fd| D S )Nc g | ]d\ }}|r]| d k t j | d pd|| d rdnd eS )rc r r is_mainmainaddon)docrootr typers )rj r
DomainData)r/ r rg rs s r' r1 z9GenericPanel.get_user_domains_details.<locals>.<listcomp> s
UU7^^x//
Oo..4" uuY / /<VVW!
0//r2 r )r rs rb s ` r' get_user_domains_detailsz%GenericPanel.get_user_domains_detailsz s[ ())))))))
%]]__
r2 r )"r r r __doc__r GENERIC_PANEL_NAMEr r> exception classmethodr r r r r, r r strr r r r r r- r r r r r r r} r r r r s @r' r r s@
"D&I, , [,
[ [ 0c 0 0 0 04T#Y+?
S$sCx.-@(A
6IDd3i ,@ I I I I
'4
'
'
'
'#c(
T#s(^
S$s)^(<
do
[
r2 r )=r datetime functoolsrU loggingrG rD collectionsr typingr r r r# r $defence360agent.api.integration_confr r defence360agent.api.jwt_issuerr 3defence360agent.application.determine_hosting_panelr defence360agent.contracts.configr defence360agent.rpc_tools.lookupr
defence360agent.utilsr r r r r r getLoggerr rm r@ dirname__file__r r r" timedelta'EXPIRATION_TIME_FOR_INTEGRATION_SCRIPTS lru_cacher r$ r( r4 r: rA rO r? rq rh rw r PanelExceptionr>
AbstractPanelr r3 r2 r' <module>r sj # # # # # # " " " " " " " " " " 5 4 4 4 4 4 = < < < < < 5 5 5 5 5 5 8 $ $GOOH FF > *<(*< O7
+ + + ' Q *3 *8#5 * * * *D D D
?LLL 5s 5 5 5 ML 5 "C "s "tCy " " " "J' '3 ' ' ' 'T( ( ("
* d3i * * * * Z T 0 M
M
M
M
M
4% M
M
M
M
M
r2 defence360agent/subsys/panels/generic/panel.py 0000644 0000000 0000000 00000027372 00000000000 016460 0 ustar import asyncio
import datetime
import functools
import json
import logging
import os
import shlex
from collections import defaultdict
from typing import Dict, List, Set
import cerberus
import yaml
from defence360agent.api.integration_conf import (
ClIntegrationConfig,
IntegrationConfig,
)
from defence360agent.api.jwt_issuer import JWTIssuer
from defence360agent.application.determine_hosting_panel import (
is_generic_panel_installed,
)
from defence360agent.contracts.config import int_from_envvar
from defence360agent.rpc_tools.lookup import UserType
from defence360agent.utils import (
CheckRunError,
check_run,
get_non_system_users,
timed_cache,
)
from .. import base
logger = logging.getLogger(__name__)
_SCHEMA_PATH_TMPL = (
os.path.dirname(__file__) + "/users_script_schemas/schema-{}.yaml"
)
ADMIN_LIST_FILE_PATH = "/etc/sysconfig/imunify360/auth.admin"
METADATA = "metadata"
EXPIRATION_TIME_FOR_INTEGRATION_SCRIPTS = datetime.timedelta(
seconds=int_from_envvar(
"IMUNIFY360_EXPIRATION_FOR_INTEGRATION_SCRIPTS", 90
)
)
@functools.lru_cache(maxsize=2)
def _get_validator(script: str) -> cerberus.Validator:
"""Returns a validator for given script."""
with open(_SCHEMA_PATH_TMPL.format(script)) as schema_file:
schema = yaml.safe_load(schema_file)
if script is not METADATA:
schema[METADATA] = {"required": True}
return cerberus.Validator(schema)
def get_users_default_impl():
return [dict(name=pw.pw_name) for pw in get_non_system_users()]
def _get_conf_path(cl, script):
d = cl.to_dict()
if "integration_scripts" in d and script in d["integration_scripts"]:
return d["integration_scripts"][script]
return None
@timed_cache(expiration=EXPIRATION_TIME_FOR_INTEGRATION_SCRIPTS, maxsize=10)
async def get_integration_data(script: str):
path = _get_conf_path(IntegrationConfig(), script)
if not path:
path = _get_conf_path(ClIntegrationConfig(), script)
if not path:
raise IntegrationScriptError(
"%s not found neither in "
"/etc/sysconfig/imunify360/integration.conf "
"nor in /opt/cpvendor/etc/integration.ini." % script
)
return await _get_integration_data(script, path)
def _build_integration_argv(script: str, path: str) -> List[str]:
"""Tokenize a config-supplied script command into argv (no shell)."""
if not path or not path.strip():
raise IntegrationScriptError(
"Empty integration script path for %s" % script
)
try:
argv = shlex.split(path)
except ValueError as e:
raise IntegrationScriptError(
"Invalid integration script path for %s: %s" % (script, e)
)
if not argv:
raise IntegrationScriptError(
"Empty integration script path for %s" % script
)
executable = argv[0]
if not os.path.isabs(executable):
raise IntegrationScriptError(
"Integration script path for %s must be absolute: %s"
% (script, executable)
)
if not os.path.isfile(executable):
raise IntegrationScriptError(
"Integration script for %s does not exist: %s"
% (script, executable)
)
if not os.access(executable, os.X_OK):
raise IntegrationScriptError(
"Integration script for %s is not executable: %s"
% (script, executable)
)
return argv
async def _get_integration_data(script: str, path: str):
argv = _build_integration_argv(script, path)
try:
stdout = await check_run(argv)
except CheckRunError as e:
raise IntegrationScriptError(
"Integrations script {script} "
"failed with exit code {e.returncode} \n"
"{e.stderr}".format(script=script, e=e)
)
try:
data = json.loads(stdout.decode())
except (UnicodeDecodeError, json.JSONDecodeError) as e:
raise IntegrationScriptError(
"Cannot decode output of %s as JSON" % path
) from e
if not isinstance(data, dict):
raise IntegrationScriptError("%s should return dict" % path)
metadata_validator = _get_validator(METADATA)
if not metadata_validator.validate(data):
raise IntegrationScriptError(
"Validation error in metadata of %s script: %s"
% (script, metadata_validator.errors)
)
if data[METADATA]["result"] != "ok":
metadata_error = data[METADATA]["result"]
if "message" in data[METADATA]:
metadata_error += ": %s" % data[METADATA]["message"]
raise IntegrationScriptError(metadata_error)
validator = _get_validator(script)
if not validator.validate(data):
raise IntegrationScriptError(
"Validation error in %s script: %s" % (script, validator.errors)
)
return data["data"]
async def _get_client_data():
try:
users = await get_users_integration_data()
domains = await get_integration_data("domains")
for k, v in domains.items():
if v and v.get("owner"):
user_domains = users.setdefault(v["owner"], [])
user_domains.append(k)
return [{"name": k, "domains": v} for k, v in users.items()]
except IntegrationScriptError:
logger.warning(
"Applying default implementation of users and domains lists"
)
return get_users_default_impl()
async def get_users_integration_data():
users = await get_integration_data("users")
users_dict = {}
for user in users:
if not user or not user.get("username"):
logger.warning(f"Found user with an empty username: {user}")
else:
users_dict[user["username"]] = []
return users_dict
async def get_domain_data():
try:
return await get_integration_data("domains")
except IntegrationScriptError:
logger.warning("Could not parse domains lists")
return {}
async def get_admin_list() -> List[str]:
script_name = "admins"
admins_set = {"root"}
admins_from_integration_scripts = await asyncio.gather(
_get_integration_data(
script_name,
_get_conf_path(
IntegrationConfig(),
script_name,
),
),
_get_integration_data(
script_name,
_get_conf_path(
ClIntegrationConfig(),
script_name,
),
),
return_exceptions=True,
)
custom_admins = {
admin["name"]
for admins in admins_from_integration_scripts
if isinstance(admins, list) # skip exceptions
for admin in admins
}
if not custom_admins:
logger.warning(
"Error occurred during extracting admins "
"from integration configs: %s",
admins_from_integration_scripts,
)
admins_set |= custom_admins
try:
with open(ADMIN_LIST_FILE_PATH) as admin_list_file:
admins_set.update(admin_list_file.read().splitlines())
except OSError:
logger.warning(
"Failed to retrieve admins list from %s", ADMIN_LIST_FILE_PATH
)
return list(admins_set)
class IntegrationScriptError(base.PanelException):
def __init__(self, *args, **kwargs):
super().__init__(*args)
logger.warning(self)
class GenericPanel(base.AbstractPanel):
"""
Panel, UI to which is provided by
imunify{-antivirus,360-firewall}-generic.{rpm,deb}
"""
NAME = base.GENERIC_PANEL_NAME
exception = IntegrationScriptError
@classmethod
def is_installed(cls):
return is_generic_panel_installed() # pragma: no cover
async def enable_imunify_plugin(self, name=None):
pass
async def disable_imunify_plugin(self, plugin_name=None):
pass
@classmethod
async def version(cls):
try:
info = await get_integration_data("panel_info")
return "{name} {version}".format(**info)
except IntegrationScriptError:
return "0"
@classmethod
async def name(cls):
try:
info = await get_integration_data("panel_info")
return "{name}".format(**info)
except IntegrationScriptError:
return cls.NAME
async def get_user_domains(self):
users = await _get_client_data()
result = []
for user in users:
result.extend(user.get("domains", tuple()))
return result
async def get_users(self) -> List[str]:
users = await _get_client_data()
return [user["name"] for user in users]
async def get_domain_to_owner(self) -> Dict[str, List[str]]:
users = await _get_client_data()
result = defaultdict(list)
for user in users:
for domain in user.get("domains", []):
result[domain].append(user["name"])
return result
async def get_user_details(self) -> Dict[str, Dict[str, str]]:
try:
user_data = await get_integration_data("users")
except IntegrationScriptError:
return await super().get_user_details()
usernames = await self.get_users()
admins = await get_admin_list()
def user_info_to_level(user_info: Dict):
if user_info.get("username") == "root":
return base.UserLevel.ADMIN
if user_info.get("username") in admins:
return base.UserLevel.RESSELER
return base.UserLevel.REGULAR_USER
return {
info.get("username"): {
"email": info.get("email", ""),
"locale": info.get("locale_code", ""),
"level": int(user_info_to_level(info)),
}
for info in user_data
if info and info.get("username") in usernames
}
async def get_domains_per_user(self) -> Dict[str, List[str]]:
users = await _get_client_data()
return {user["name"]: user.get("domains", []) for user in users}
def authenticate(self, protocol, data: dict):
if protocol._uid != 0 and data["command"] != ["login", "pam"]:
token = data["params"].pop("jwt", None)
parsed_token = JWTIssuer.parse_token(token)
return parsed_token["user_type"], (
parsed_token["user_name"]
if parsed_token["user_type"] == UserType.NON_ROOT
else None
)
else:
return protocol.user, None
def basedirs(self) -> Set[str]:
conf = IntegrationConfig().to_dict()
if "malware" in conf and "basedir" in conf["malware"]:
return set(conf["malware"]["basedir"].split())
return set()
async def list_docroots(self) -> Dict[str, str]:
domains = await get_domain_data()
return {
v["document_root"]: domain
for domain, v in domains.items()
if v and v.get("document_root")
}
async def get_domain_paths(self) -> Dict[str, List[str]]:
domains = await get_domain_data()
return {
domain: [v["document_root"]]
for domain, v in domains.items()
if v and v.get("document_root")
}
async def panel_user_link(self, username) -> str:
"""
Returns panel url
:return: str
"""
return ""
@classmethod
async def get_user_domains_details(
cls, username: str
) -> list[base.DomainData]:
domains = await get_domain_data()
return [
base.DomainData(
docroot=v.get("document_root") or "",
domain=domain,
type="main" if v.get("is_main") else "addon",
username=username,
)
for domain, v in domains.items()
if v and v.get("owner") == username
]
defence360agent/subsys/panels/generic/users_script_schemas/ 0000755 0000000 0000000 00000000000 00000000000 021224 5 ustar defence360agent/subsys/panels/generic/users_script_schemas/schema-admins.yaml 0000644 0000000 0000000 00000000460 00000000000 024621 0 ustar # Cerberus (http://docs.python-cerberus.org/en/stable/) schema for site
# information API
data:
type: list
required: true
schema:
type: dict
allow_unknown: true
schema:
name:
type: string
required: true
is_main:
type: boolean
required: true
defence360agent/subsys/panels/generic/users_script_schemas/schema-domains.yaml 0000644 0000000 0000000 00000000522 00000000000 024777 0 ustar # Cerberus (http://docs.python-cerberus.org/en/stable/) schema for site
# information API
data:
type: dict
required: false
valuesrules:
type: dict
required: true
nullable: true
allow_unknown: true
schema:
owner:
type: string
required: true
keysrules:
type: string
required: true
defence360agent/subsys/panels/generic/users_script_schemas/schema-metadata.yaml 0000644 0000000 0000000 00000000437 00000000000 025132 0 ustar # Cerberus (http://docs.python-cerberus.org/en/stable/) schema for site
# information API
data:
required: true
nullable: true
metadata:
type: dict
required: true
schema:
result:
type: string
required: true
message:
type: string
required: false
defence360agent/subsys/panels/generic/users_script_schemas/schema-panel_info.yaml 0000644 0000000 0000000 00000000407 00000000000 025461 0 ustar # Cerberus (http://docs.python-cerberus.org/en/stable/) schema for site
# information API
data:
type: dict
allow_unknown: true
schema:
name:
type: string
required: true
version:
type: string
required: true
defence360agent/subsys/panels/generic/users_script_schemas/schema-users.yaml 0000644 0000000 0000000 00000000413 00000000000 024505 0 ustar # Cerberus (http://docs.python-cerberus.org/en/stable/) schema for site
# information API
data:
type: list
required: true
schema:
type: dict
nullable: true
allow_unknown: true
schema:
username:
type: string
required: true
defence360agent/subsys/panels/hosting_panel.py 0000644 0000000 0000000 00000002031 00000000000 016560 0 ustar from defence360agent.application.determine_hosting_panel import (
get_hosting_panel,
)
from defence360agent.subsys.panels.base import AbstractPanel
from defence360agent.utils import importer
def _default_panel_root() -> str:
"""Use im360 panel classes when the im360 package is installed."""
if importer.exists("im360"):
return "im360"
return "defence360agent"
_panel_root = _default_panel_root()
panel = None
def set_panel_root(root_module: str) -> None:
global _panel_root, panel
_panel_root = root_module
panel = None # reset so next HostingPanel() call uses new root
def HostingPanel(check_for_changes=False) -> AbstractPanel:
"""
Return the hosting panel singleton.
Panels are loaded from ``_panel_root`` which auto-detects the correct
package (``im360`` when installed, ``defence360agent`` otherwise).
Can be overridden via ``set_panel_root``.
"""
global panel
if panel is None or check_for_changes:
panel = get_hosting_panel(_panel_root)
return panel
defence360agent/subsys/panels/no_cp/ 0000755 0000000 0000000 00000000000 00000000000 014456 5 ustar defence360agent/subsys/panels/no_cp/__init__.py 0000644 0000000 0000000 00000000054 00000000000 016566 0 ustar from .panel import NoCP
__all__ = ["NoCP"]
defence360agent/subsys/panels/no_cp/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 016666 5 ustar defence360agent/subsys/panels/no_cp/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000427 00000000000 024071 0 ustar
r_j, d dl mZ dgZdS ) )NoCPr N)panelr __all__ a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/no_cp/__init__.py<module>r s" (r defence360agent/subsys/panels/no_cp/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000427 00000000000 023132 0 ustar
r_j, d dl mZ dgZdS ) )NoCPr N)panelr __all__ a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/no_cp/__init__.py<module>r s" (r defence360agent/subsys/panels/no_cp/__pycache__/panel.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000017571 00000000000 023441 0 ustar
r_j5 R d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZm Z m
Z
d dl Z d dl Z d dl
mZ d dlmZmZ ddlmZ ej e ZdZ ej d d
ed e j fd Z d e e fd
Z G d dej Z G d dej! ZdS ) N) defaultdict)DictListOptionalSet)NoCP)get_non_system_usersrun )basez;/opt/imunify360/venv/share/imunify360/no_cp/schema-v{}.yaml)maxsizeversionreturnc t t | 5 }t j | }t j | cddd S # 1 swxY w Y dS )z*Returns a validator for given API version.N)open_SCHEMA_PATH_TMPLformatyaml safe_loadcerberus Validator)r schema_fileschemas ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/no_cp/panel.py_get_validatorr s
&&w// 0 0 *K ,,!&))* * * * * * * * * * * * * * * * * *s (A A!$A!c D K t t j t t j g d{V } n=# t
$ r Y dS t j $ r t $ r}t d |d}~ww xY w| \ }}}|dk r"t d
| t j |
}n"# t $ r}t d |d}~ww xY w| d }|t d t |t r|dk r|t" j k s"t d
| t% | }| | }|st d
|j |S ) z8Runs a script, validates its JSON output and returns it.Nzfailed to run scriptr zexited with code: {}z Cannot decode output as JSONr z#output does not have`version` field zinvalid API version: {}zvalidation error: {})r
Config
CLIENT_SCRIPTstrLATEST_VERSIONFileNotFoundErrorasyncioCancelledError Exception ScriptErrorr jsonloadsdecodeget
isinstanceintr r validateerrors) resultexccodestdout_datar validatoroks r _get_client_datar7 s ;F 0#f6K2L2LMNNNNNNNN tt !
; ; ;011s:; OD&! qyy077==>>>Cz&--//** C C C899sBChhy!!G?@@@7C E qLL t* * *3::7CCDDD w''I D ! !B
D0)2BCCC Ks3 8=
A7
A7"A22A7)&C
C/C**C/c e Zd ZdS )r& N)__name__
__module__ __qualname__ r r& r& ? s Dr= r& c 6 e Zd ZdZeZed ZddZddZ ed Z
d Z de e
fd Zdee
e e
f fd
Zdee
e e
f fd Zdee
fd Zdee
e
f fd
Zde
fdZede
deej fd ZdS )r zno panelc dS )NFr< clss r is_installedzNoCP.is_installedG s ur= Nc
K d S Nr< )selfnames r enable_imunify_pluginzNoCP.enable_imunify_pluginK r= c
K d S rD r< )rE plugin_names r disable_imunify_pluginzNoCP.disable_imunify_pluginN rH r= c
K dS )N0r< r@ s r r z NoCP.versionQ s sr= c Z K t d {V }|g S d |d D S )Nc g | ]
}|d S )rF r< .0domains r
<listcomp>z)NoCP.get_user_domains.<locals>.<listcomp>Y s ===6v===r= domainsr7 rE r4 s r get_user_domainszNoCP.get_user_domainsU sE %'''''''' <I==T)_====r= r c 6 K d t D S )Nc g | ] }|j
S r< )pw_name)rQ pws r rS z"NoCP.get_users.<locals>.<listcomp>\ s <<<r
<<<r= )r rE s r get_userszNoCP.get_users[ s! <<%9%;%;<<<<r= c Z K t d {V }|i S d |d D S )Nc . i | ]}|d |d gS )rF ownerr< rP s r
<dictcomp>z,NoCP.get_domain_to_owner.<locals>.<dictcomp>b s2
28F6NVG_ -
r= rT rU rV s r get_domain_to_ownerzNoCP.get_domain_to_owner^ sR %'''''''' <I
<@O
r= c K t d {V }|i S t t }|d D ])}||d |d *t | S )NrT r` rF )r7 r listappenddict)rE r4 user_to_domainsrR s r get_domains_per_userzNoCP.get_domains_per_userf s %'''''''' <I%d++9o D DF F7O , 3 3F6N C C C CO$$$r= c t S rD )setr\ s r basedirsz
NoCP.basedirsq s uu r= c " K t S rD )rf r\ s r
list_docrootszNoCP.list_docrootst s vv
r= c
K dS )z8
Returns panel url
:return: str
r< )rE usernames r panel_user_linkzNoCP.panel_user_linkw s
rr= rp c
K g S rD r< )rA rp s r get_user_domains_detailsz NoCP.get_user_domains_details~ s
r= rD )r9 r: r; NAMEr& exception classmethodrB rG rK r rW r r r] r rb rh r rk rm rq rd r
DomainDatars r< r= r r r C s DI [
[> > > =c = = = =
4T#Y+?
%Dd3i ,@ % % % %#c( T#s(^
do [ r= r )"r# functoolsr' logging collectionsr typingr r r r r r defence360agent.contracts.configr r defence360agent.utilsr r
ro r getLoggerr9 loggerr lru_cacher, r r rf r7 PanelExceptionr&
AbstractPanelr< r= r <module>r s # # # # # # , , , , , , , , , , , , ; ; ; ; ; ; ; ; ; ; ; ; ; ; 8 $ $A
Q *C *H$6 * * * * B $% ? ? ? ? ?4 ? ? ? ? ?r= defence360agent/subsys/panels/no_cp/__pycache__/panel.cpython-311.pyc 0000644 0000000 0000000 00000017571 00000000000 022502 0 ustar
r_j5 R d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZm Z m
Z
d dl Z d dl Z d dl
mZ d dlmZmZ ddlmZ ej e ZdZ ej d d
ed e j fd Z d e e fd
Z G d dej Z G d dej! ZdS ) N) defaultdict)DictListOptionalSet)NoCP)get_non_system_usersrun )basez;/opt/imunify360/venv/share/imunify360/no_cp/schema-v{}.yaml)maxsizeversionreturnc t t | 5 }t j | }t j | cddd S # 1 swxY w Y dS )z*Returns a validator for given API version.N)open_SCHEMA_PATH_TMPLformatyaml safe_loadcerberus Validator)r schema_fileschemas ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/no_cp/panel.py_get_validatorr s
&&w// 0 0 *K ,,!&))* * * * * * * * * * * * * * * * * *s (A A!$A!c D K t t j t t j g d{V } n=# t
$ r Y dS t j $ r t $ r}t d |d}~ww xY w| \ }}}|dk r"t d
| t j |
}n"# t $ r}t d |d}~ww xY w| d }|t d t |t r|dk r|t" j k s"t d
| t% | }| | }|st d
|j |S ) z8Runs a script, validates its JSON output and returns it.Nzfailed to run scriptr zexited with code: {}z Cannot decode output as JSONr z#output does not have`version` field zinvalid API version: {}zvalidation error: {})r
Config
CLIENT_SCRIPTstrLATEST_VERSIONFileNotFoundErrorasyncioCancelledError Exception ScriptErrorr jsonloadsdecodeget
isinstanceintr r validateerrors) resultexccodestdout_datar validatoroks r _get_client_datar7 s ;F 0#f6K2L2LMNNNNNNNN tt !
; ; ;011s:; OD&! qyy077==>>>Cz&--//** C C C899sBChhy!!G?@@@7C E qLL t* * *3::7CCDDD w''I D ! !B
D0)2BCCC Ks3 8=
A7
A7"A22A7)&C
C/C**C/c e Zd ZdS )r& N)__name__
__module__ __qualname__ r r& r& ? s Dr= r& c 6 e Zd ZdZeZed ZddZddZ ed Z
d Z de e
fd Zdee
e e
f fd
Zdee
e e
f fd Zdee
fd Zdee
e
f fd
Zde
fdZede
deej fd ZdS )r zno panelc dS )NFr< clss r is_installedzNoCP.is_installedG s ur= Nc
K d S Nr< )selfnames r enable_imunify_pluginzNoCP.enable_imunify_pluginK r= c
K d S rD r< )rE plugin_names r disable_imunify_pluginzNoCP.disable_imunify_pluginN rH r= c
K dS )N0r< r@ s r r z NoCP.versionQ s sr= c Z K t d {V }|g S d |d D S )Nc g | ]
}|d S )rF r< .0domains r
<listcomp>z)NoCP.get_user_domains.<locals>.<listcomp>Y s ===6v===r= domainsr7 rE r4 s r get_user_domainszNoCP.get_user_domainsU sE %'''''''' <I==T)_====r= r c 6 K d t D S )Nc g | ] }|j
S r< )pw_name)rQ pws r rS z"NoCP.get_users.<locals>.<listcomp>\ s <<<r
<<<r= )r rE s r get_userszNoCP.get_users[ s! <<%9%;%;<<<<r= c Z K t d {V }|i S d |d D S )Nc . i | ]}|d |d gS )rF ownerr< rP s r
<dictcomp>z,NoCP.get_domain_to_owner.<locals>.<dictcomp>b s2
28F6NVG_ -
r= rT rU rV s r get_domain_to_ownerzNoCP.get_domain_to_owner^ sR %'''''''' <I
<@O
r= c K t d {V }|i S t t }|d D ])}||d |d *t | S )NrT r` rF )r7 r listappenddict)rE r4 user_to_domainsrR s r get_domains_per_userzNoCP.get_domains_per_userf s %'''''''' <I%d++9o D DF F7O , 3 3F6N C C C CO$$$r= c t S rD )setr\ s r basedirsz
NoCP.basedirsq s uu r= c " K t S rD )rf r\ s r
list_docrootszNoCP.list_docrootst s vv
r= c
K dS )z8
Returns panel url
:return: str
r< )rE usernames r panel_user_linkzNoCP.panel_user_linkw s
rr= rp c
K g S rD r< )rA rp s r get_user_domains_detailsz NoCP.get_user_domains_details~ s
r= rD )r9 r: r; NAMEr& exception classmethodrB rG rK r rW r r r] r rb rh r rk rm rq rd r
DomainDatars r< r= r r r C s DI [
[> > > =c = = = =
4T#Y+?
%Dd3i ,@ % % % %#c( T#s(^
do [ r= r )"r# functoolsr' logging collectionsr typingr r r r r r defence360agent.contracts.configr r defence360agent.utilsr r
ro r getLoggerr9 loggerr lru_cacher, r r rf r7 PanelExceptionr&
AbstractPanelr< r= r <module>r s # # # # # # , , , , , , , , , , , , ; ; ; ; ; ; ; ; ; ; ; ; ; ; 8 $ $A
Q *C *H$6 * * * * B $% ? ? ? ? ?4 ? ? ? ? ?r= defence360agent/subsys/panels/no_cp/panel.py 0000644 0000000 0000000 00000007065 00000000000 016137 0 ustar import asyncio
import functools
import json
import logging
from collections import defaultdict
from typing import Dict, List, Optional, Set
import cerberus
import yaml
from defence360agent.contracts.config import NoCP as Config
from defence360agent.utils import get_non_system_users, run
from .. import base
logger = logging.getLogger(__name__)
_SCHEMA_PATH_TMPL = (
"/opt/imunify360/venv/share/imunify360/no_cp/schema-v{}.yaml"
)
@functools.lru_cache(maxsize=2)
def _get_validator(version: int) -> cerberus.Validator:
"""Returns a validator for given API version."""
with open(_SCHEMA_PATH_TMPL.format(version)) as schema_file:
schema = yaml.safe_load(schema_file)
return cerberus.Validator(schema)
async def _get_client_data() -> Optional[dict]:
"""Runs a script, validates its JSON output and returns it."""
try:
result = await run([Config.CLIENT_SCRIPT, str(Config.LATEST_VERSION)])
except FileNotFoundError:
return None
except asyncio.CancelledError:
raise
except Exception as exc:
raise ScriptError("failed to run script") from exc
code, stdout, _ = result
if code != 0:
raise ScriptError("exited with code: {}".format(code))
try:
data = json.loads(stdout.decode())
except Exception as exc:
raise ScriptError("Cannot decode output as JSON") from exc
version = data.get("version")
if version is None:
raise ScriptError("output does not have`version` field")
if not (
isinstance(version, int)
and version >= 1
and version <= NoCP.LATEST_VERSION
):
raise ScriptError("invalid API version: {}".format(version))
validator = _get_validator(version)
ok = validator.validate(data)
if not ok:
raise ScriptError("validation error: {}", validator.errors)
return data
class ScriptError(base.PanelException):
pass
class NoCP(base.AbstractPanel):
NAME = "no panel"
exception = ScriptError
@classmethod
def is_installed(cls):
return False
async def enable_imunify_plugin(self, name=None):
pass
async def disable_imunify_plugin(self, plugin_name=None):
pass
@classmethod
async def version(cls):
return "0"
async def get_user_domains(self):
data = await _get_client_data()
if data is None:
return []
return [domain["name"] for domain in data["domains"]]
async def get_users(self) -> List[str]:
return [pw.pw_name for pw in get_non_system_users()]
async def get_domain_to_owner(self) -> Dict[str, List[str]]:
data = await _get_client_data()
if data is None:
return {}
return {
domain["name"]: [domain["owner"]] for domain in data["domains"]
}
async def get_domains_per_user(self) -> Dict[str, List[str]]:
data = await _get_client_data()
if data is None:
return {}
user_to_domains = defaultdict(list) # type: Dict[str, List[str]]
for domain in data["domains"]:
user_to_domains[domain["owner"]].append(domain["name"])
return dict(user_to_domains)
def basedirs(self) -> Set[str]:
return set()
async def list_docroots(self) -> Dict[str, str]: # pragma: no cover
return dict()
async def panel_user_link(self, username) -> str:
"""
Returns panel url
:return: str
"""
return ""
@classmethod
async def get_user_domains_details(
cls, username: str
) -> list[base.DomainData]:
return []
defence360agent/subsys/panels/plesk/ 0000755 0000000 0000000 00000000000 00000000000 014476 5 ustar defence360agent/subsys/panels/plesk/__init__.py 0000644 0000000 0000000 00000000056 00000000000 016610 0 ustar from .panel import Plesk
__all__ = ["Plesk"]
defence360agent/subsys/panels/plesk/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 016706 5 ustar defence360agent/subsys/panels/plesk/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000000430 00000000000 024103 0 ustar
r_j. d dl mZ dgZdS ) )Pleskr N)panelr __all__ a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/plesk/__init__.py<module>r s" )r defence360agent/subsys/panels/plesk/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000000430 00000000000 023144 0 ustar
r_j. d dl mZ dgZdS ) )Pleskr N)panelr __all__ a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/plesk/__init__.py<module>r s" )r defence360agent/subsys/panels/plesk/__pycache__/api.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000027073 00000000000 023131 0 ustar
r_j$ d Z ddlZddlmZ ddlmZmZmZ ddlm Z m
Z
ddl m Z m
Z
mZmZ ej e Zd Z ee de d
ed efd Zd eeee f fd
Zd eeee f fdZd eeeeef f fdZd ee fdZd ee fdZd eee fdZ d e fdZ d efdZ d ee fdZ d Z! e
dd d ee fd Z"dS )z.Gather information from Plesk via DB querries. N) defaultdict)DictListSequence)
DomainDataPanelException)
CheckRunErrorasync_lru_cache check_runretry_onc K t | i |)N)r )argskwargss \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/plesk/api.pyraise_panel_exceptionr s
$
)&
)
)) ) max_trieson_errorqueryreturnc ^ K t dddd| g d {V S )Npleskdbz-Nz-e)r decoder s r
_run_queryr s= WdD$ >?? ? ? ? ? ? ? G G I IIr c K t d d{V } t t }t | ddd | ddd D ]&\ }}|dk r|| | '|S )z'Return mapping: user -> user's domains.zselect login, name from domains left join hosting on dom_id = domains.id right join sys_users on hosting.sys_user_id = sys_users.idNr NULL)r splitr listzipappend)resultresult_mappinguserdomains r get_user_to_domainr* s
L
egg
!&&NF14a4L&A,77 0 0 f V 4 ' ' / / / r c K t d d{V } d t | ddd | ddd D S )z Return mapping: domain -> user.zselect name, login from domains left join hosting on dom_id = domains.id left join sys_users on hosting.sys_user_id = sys_users.idNc i | ] \ }}||g
S r- ).0r) r( s r
<dictcomp>z&get_domain_to_user.<locals>.<dictcomp>7 s O O O|vtFTF O O Or r r r )r r" r$ )r& s r get_domain_to_userr0 , s~
K
egg P Os6!$Q$<1 /N/N O O OOr c K i } t d d{V }| d D ]:}|s| d \ }}}|| dd d| |< ;| S )z{
Returns dict with user to email and locale pairs
Not used, because MyImunify implemented for cPanel only yet
z9SELECT CONCAT(login, ';',email, ';',locale) FROM clients;N
;-_)emaillocale)r r" replace) user_detailsresultsrecordr( r6 r7 s r get_user_detailsr< : s L C G --%%
$ll3 / /eV nnS#..
T
r c T K t d d{V S )zReturn: list of domainszselect name from domainsNr r" r- r r get_domainsr? Q s5 788 8 8 8 8 8 8 ? ? A AAr c T K t d d{V S )z#Return: users that created by PleskzSELECT sys_users.login FROM sys_users JOIN hosting ON hosting.sys_user_id=sys_users.id JOIN domains ON hosting.dom_id=domains.id AND domains.webspace_id=0Nr> r- r r get_usersrA W sI
C
egg
r c r K t d d{V } d | d D }|S )a
Returns
[
['admin', 'john.smith@tardis.gal', 'NULL', 'en-US', 'admin', 'NULL', 'NULL', 'NULL', '0'],
['user0', 'NULL', 'admin', 'en-US', 'client', '1', 'user0.com', '/var/www/vhosts/user0.com/httpdocs', '1']
]
There is only 1 return type. NULL is converted to 'NULL'
Each possible empty string should be covered with
IF(clients.email='', NULL, clients.email)
or it will break data structure
ar
SELECT clients.login, IF(clients.email='', NULL, clients.email), parent.login,
IF(clients.locale='', NULL, clients.locale), clients.type, domains.name,
hosting.www_root, clients.status=16 suspended
FROM clients
LEFT JOIN clients parent ON parent.id=clients.parent_id
LEFT JOIN domains ON domains.cl_id=clients.id
LEFT JOIN hosting ON domains.id=hosting.dom_id;
Nc : g | ]}|| S r- r" r. strings r
<listcomp>z*get_users_for_patchman.<locals>.<listcomp>z s%
J
J
J6
Jfllnn
J
J
Jr r2 r> )raw_datatupless r get_users_for_patchmanrJ c sa
H K
J8>>$+?+?
J
J
JF Mr c J K t t d d{V S )z=Return: count active customers with at least one (any) domainz_select count(distinct cl_id) from clients c join domains d on d.cl_id = c.id where c.status = 0N)intr r- r r "count_customers_with_subscriptionsrM ~ sJ
0
r c n K t d d {V } d | d D S )Nz-SELECT email FROM clients WHERE type='admin';c g | ]}||S r- r- )r. r6 s r rG z$get_admin_emails.<locals>.<listcomp> s ; ; ;eU ;E ; ; ;r r2 r> )emailss r get_admin_emailsrQ sF MNN
N
N
N
N
N
NF ; ;v||D 1 1 ; ; ;;r c X K d} t | d {V S )Nz.SELECT DISTINCT hosting.www_root FROM hosting;r> r s r
list_docrootsrS s7 <E U## # # # # # # * * , ,,r c v K d} t | d {V }d | d D }|S )Nzselect hosting.www_root, domains.name, sys_users.login from hosting inner join domains on hosting.dom_id = domains.id inner join sys_users on hosting.sys_user_id=sys_users.idc : g | ]}|| S r- rD rE s r rG z/list_docroots_domains_users.<locals>.<listcomp> s%
F
F
Fv
Ffllnn
F
F
Fr r2 r> )sqldataretvals r list_docroots_domains_usersrY sT D C D
F
F4::d+;+;
F
F
FF Mr r < )maxsizettlc K d} t | d {V }d | d D }d |D S )Na
SELECT
'domain' AS object_type,
d.id AS object_id,
d.name AS domain_name,
NULL AS target_domain_name,
c.id AS client_id,
c.login AS client_login,
CASE
WHEN d.parentDomainId != 0 THEN 'subdomain'
WHEN EXISTS (
SELECT 1 FROM `Subscriptions` s
WHERE s.object_type = 'domain' AND s.object_id = d.id
) THEN 'primary'
WHEN d.parentDomainId = 0 THEN 'addon'
ELSE 'unknown'
END AS domain_type,
h.www_root AS docroot,
su.login AS sys_user_login
FROM domains d
LEFT JOIN clients c ON d.cl_id = c.id
LEFT JOIN hosting h ON d.id = h.dom_id
LEFT JOIN sys_users su ON h.sys_user_id = su.id
UNION ALL
SELECT
'subdomain' AS object_type,
sd.id AS object_id,
CONCAT(sd.name, '.', pd.name) AS domain_name,
NULL AS target_domain_name,
c.id AS client_id,
c.login AS client_login,
'subdomain' AS domain_type,
h.www_root AS docroot,
su.login AS sys_user_login
FROM subdomains sd
JOIN domains pd ON sd.dom_id = pd.id
LEFT JOIN hosting h ON pd.id = h.dom_id
LEFT JOIN clients c ON pd.cl_id = c.id
LEFT JOIN sys_users su ON h.sys_user_id = su.id
UNION ALL
SELECT
'alias' AS object_type,
da.id AS object_id,
da.name AS domain_name,
pd.name AS target_domain_name,
c.id AS client_id,
c.login AS client_login,
'alias' AS domain_type,
h.www_root AS docroot,
su.login AS sys_user_login
FROM domain_aliases da
JOIN domains pd ON da.dom_id = pd.id
LEFT JOIN hosting h ON pd.id = h.dom_id
LEFT JOIN clients c ON pd.cl_id = c.id
LEFT JOIN sys_users su ON h.sys_user_id = su.id
ORDER BY client_login, domain_type, domain_name;
c : g | ]}|| S r- rD rE s r rG z,get_user_domains_details.<locals>.<listcomp> s% HHH6H HHHr r2 c d g | ]-}t |d |d |d |d .S ) r )docrootr) typeusername)r )r. rows r rG z,get_user_domains_details.<locals>.<listcomp> sI 3q6#a&s1vAOOO r r> )rV rW rH s r get_user_domains_detailsrg sm = C| C DHHTZZ-=-=HHHH r )#__doc__logging collectionsr typingr r r "defence360agent.subsys.panels.baser r defence360agent.utilsr r
r r getLogger__name__loggerr strr r* r0 r< r? rA r# rJ rL rM rQ rS rY rg r- r r <module>rr s 4 4 # # # # # # ' ' ' ' ' ' ' ' ' ' I I I I I I I I
8 $ $* * *
-1/DEEEJC JC J J J FEJ$sDI~"6 " P$sDI~"6 P P P P S$sCx.%8 9 .B49 B B B B c d49o 6# < < < < <
-Xc] - - - -
###DZ(8 D D D $#D D Dr defence360agent/subsys/panels/plesk/__pycache__/api.cpython-311.pyc 0000644 0000000 0000000 00000027073 00000000000 022172 0 ustar
r_j$ d Z ddlZddlmZ ddlmZmZmZ ddlm Z m
Z
ddl m Z m
Z
mZmZ ej e Zd Z ee de d
ed efd Zd eeee f fd
Zd eeee f fdZd eeeeef f fdZd ee fdZd ee fdZd eee fdZ d e fdZ d efdZ d ee fdZ d Z! e
dd d ee fd Z"dS )z.Gather information from Plesk via DB querries. N) defaultdict)DictListSequence)
DomainDataPanelException)
CheckRunErrorasync_lru_cache check_runretry_onc K t | i |)N)r )argskwargss \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/plesk/api.pyraise_panel_exceptionr s
$
)&
)
)) ) max_trieson_errorqueryreturnc ^ K t dddd| g d {V S )Npleskdbz-Nz-e)r decoder s r
_run_queryr s= WdD$ >?? ? ? ? ? ? ? G G I IIr c K t d d{V } t t }t | ddd | ddd D ]&\ }}|dk r|| | '|S )z'Return mapping: user -> user's domains.zselect login, name from domains left join hosting on dom_id = domains.id right join sys_users on hosting.sys_user_id = sys_users.idNr NULL)r splitr listzipappend)resultresult_mappinguserdomains r get_user_to_domainr* s
L
egg
!&&NF14a4L&A,77 0 0 f V 4 ' ' / / / r c K t d d{V } d t | ddd | ddd D S )z Return mapping: domain -> user.zselect name, login from domains left join hosting on dom_id = domains.id left join sys_users on hosting.sys_user_id = sys_users.idNc i | ] \ }}||g
S r- ).0r) r( s r
<dictcomp>z&get_domain_to_user.<locals>.<dictcomp>7 s O O O|vtFTF O O Or r r r )r r" r$ )r& s r get_domain_to_userr0 , s~
K
egg P Os6!$Q$<1 /N/N O O OOr c K i } t d d{V }| d D ]:}|s| d \ }}}|| dd d| |< ;| S )z{
Returns dict with user to email and locale pairs
Not used, because MyImunify implemented for cPanel only yet
z9SELECT CONCAT(login, ';',email, ';',locale) FROM clients;N
;-_)emaillocale)r r" replace) user_detailsresultsrecordr( r6 r7 s r get_user_detailsr< : s L C G --%%
$ll3 / /eV nnS#..
T
r c T K t d d{V S )zReturn: list of domainszselect name from domainsNr r" r- r r get_domainsr? Q s5 788 8 8 8 8 8 8 ? ? A AAr c T K t d d{V S )z#Return: users that created by PleskzSELECT sys_users.login FROM sys_users JOIN hosting ON hosting.sys_user_id=sys_users.id JOIN domains ON hosting.dom_id=domains.id AND domains.webspace_id=0Nr> r- r r get_usersrA W sI
C
egg
r c r K t d d{V } d | d D }|S )a
Returns
[
['admin', 'john.smith@tardis.gal', 'NULL', 'en-US', 'admin', 'NULL', 'NULL', 'NULL', '0'],
['user0', 'NULL', 'admin', 'en-US', 'client', '1', 'user0.com', '/var/www/vhosts/user0.com/httpdocs', '1']
]
There is only 1 return type. NULL is converted to 'NULL'
Each possible empty string should be covered with
IF(clients.email='', NULL, clients.email)
or it will break data structure
ar
SELECT clients.login, IF(clients.email='', NULL, clients.email), parent.login,
IF(clients.locale='', NULL, clients.locale), clients.type, domains.name,
hosting.www_root, clients.status=16 suspended
FROM clients
LEFT JOIN clients parent ON parent.id=clients.parent_id
LEFT JOIN domains ON domains.cl_id=clients.id
LEFT JOIN hosting ON domains.id=hosting.dom_id;
Nc : g | ]}|| S r- r" r. strings r
<listcomp>z*get_users_for_patchman.<locals>.<listcomp>z s%
J
J
J6
Jfllnn
J
J
Jr r2 r> )raw_datatupless r get_users_for_patchmanrJ c sa
H K
J8>>$+?+?
J
J
JF Mr c J K t t d d{V S )z=Return: count active customers with at least one (any) domainz_select count(distinct cl_id) from clients c join domains d on d.cl_id = c.id where c.status = 0N)intr r- r r "count_customers_with_subscriptionsrM ~ sJ
0
r c n K t d d {V } d | d D S )Nz-SELECT email FROM clients WHERE type='admin';c g | ]}||S r- r- )r. r6 s r rG z$get_admin_emails.<locals>.<listcomp> s ; ; ;eU ;E ; ; ;r r2 r> )emailss r get_admin_emailsrQ sF MNN
N
N
N
N
N
NF ; ;v||D 1 1 ; ; ;;r c X K d} t | d {V S )Nz.SELECT DISTINCT hosting.www_root FROM hosting;r> r s r
list_docrootsrS s7 <E U## # # # # # # * * , ,,r c v K d} t | d {V }d | d D }|S )Nzselect hosting.www_root, domains.name, sys_users.login from hosting inner join domains on hosting.dom_id = domains.id inner join sys_users on hosting.sys_user_id=sys_users.idc : g | ]}|| S r- rD rE s r rG z/list_docroots_domains_users.<locals>.<listcomp> s%
F
F
Fv
Ffllnn
F
F
Fr r2 r> )sqldataretvals r list_docroots_domains_usersrY sT D C D
F
F4::d+;+;
F
F
FF Mr r < )maxsizettlc K d} t | d {V }d | d D }d |D S )Na
SELECT
'domain' AS object_type,
d.id AS object_id,
d.name AS domain_name,
NULL AS target_domain_name,
c.id AS client_id,
c.login AS client_login,
CASE
WHEN d.parentDomainId != 0 THEN 'subdomain'
WHEN EXISTS (
SELECT 1 FROM `Subscriptions` s
WHERE s.object_type = 'domain' AND s.object_id = d.id
) THEN 'primary'
WHEN d.parentDomainId = 0 THEN 'addon'
ELSE 'unknown'
END AS domain_type,
h.www_root AS docroot,
su.login AS sys_user_login
FROM domains d
LEFT JOIN clients c ON d.cl_id = c.id
LEFT JOIN hosting h ON d.id = h.dom_id
LEFT JOIN sys_users su ON h.sys_user_id = su.id
UNION ALL
SELECT
'subdomain' AS object_type,
sd.id AS object_id,
CONCAT(sd.name, '.', pd.name) AS domain_name,
NULL AS target_domain_name,
c.id AS client_id,
c.login AS client_login,
'subdomain' AS domain_type,
h.www_root AS docroot,
su.login AS sys_user_login
FROM subdomains sd
JOIN domains pd ON sd.dom_id = pd.id
LEFT JOIN hosting h ON pd.id = h.dom_id
LEFT JOIN clients c ON pd.cl_id = c.id
LEFT JOIN sys_users su ON h.sys_user_id = su.id
UNION ALL
SELECT
'alias' AS object_type,
da.id AS object_id,
da.name AS domain_name,
pd.name AS target_domain_name,
c.id AS client_id,
c.login AS client_login,
'alias' AS domain_type,
h.www_root AS docroot,
su.login AS sys_user_login
FROM domain_aliases da
JOIN domains pd ON da.dom_id = pd.id
LEFT JOIN hosting h ON pd.id = h.dom_id
LEFT JOIN clients c ON pd.cl_id = c.id
LEFT JOIN sys_users su ON h.sys_user_id = su.id
ORDER BY client_login, domain_type, domain_name;
c : g | ]}|| S r- rD rE s r rG z,get_user_domains_details.<locals>.<listcomp> s% HHH6H HHHr r2 c d g | ]-}t |d |d |d |d .S ) r )docrootr) typeusername)r )r. rows r rG z,get_user_domains_details.<locals>.<listcomp> sI 3q6#a&s1vAOOO r r> )rV rW rH s r get_user_domains_detailsrg sm = C| C DHHTZZ-=-=HHHH r )#__doc__logging collectionsr typingr r r "defence360agent.subsys.panels.baser r defence360agent.utilsr r
r r getLogger__name__loggerr strr r* r0 r< r? rA r# rJ rL rM rQ rS rY rg r- r r <module>rr s 4 4 # # # # # # ' ' ' ' ' ' ' ' ' ' I I I I I I I I
8 $ $* * *
-1/DEEEJC JC J J J FEJ$sDI~"6 " P$sDI~"6 P P P P S$sCx.%8 9 .B49 B B B B c d49o 6# < < < < <
-Xc] - - - -
###DZ(8 D D D $#D D Dr defence360agent/subsys/panels/plesk/__pycache__/panel.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000036256 00000000000 023462 0 ustar
r_j$ d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
d dl m Z m
Z
mZmZmZ d dlmZ d dlmZ d dlmZ d d lmZmZ d d
lmZ d d l m Z d
dl m Z d
dl m Z dZ!dZ"e j# g dz Z$dZ%dZ& ej' e( Z)de*fdZ+dee*e*f fdZ, G d de j- Z. G d de j/ Z0dS ) N)Error) defaultdict)Path)DictListSetTupleUnion) ElementTreeis_plesk_installed)config)
OsReleaseInfo check_run) get_hostname )base )api) PleskConfigz
/etc/sw/keys/zext-imunify360)95399084438447zK/usr/local/psa/admin/plib/modules/imunify360/scripts/send-notifications.phpz@/opt/imunify360/venv/share/imunify360/scripts/send-notificationsreturnc B | | }||j S dS )z%Avoid AttributeError if tag not foundN )findtext)nodetag_nodes ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/plesk/panel.py_safe_get_textr$ " s&
IIcNNE z
2 c d}d}| d D ]J}t |d dk rt |d }t |d dk rt |d }K||fS )z.Return product name and filename from key datar value/struct/membernamefilenamez value/stringkey_product_name)findallr$ )keyr) r* datas r#
_get_key_datar. + s H 122 D D $ ' ': 5 5%dN;;H $ ' '+= = = -dN C C X %%r% c e Zd ZdS )PleskExceptionN)__name__
__module__ __qualname__ r% r# r0 r0 8 s Dr% r0 c & e Zd Zd Zg dez ddgez dg dg dddZeZed Z e
d Z e j
d d Z e j
d d Zd
ee fdZd Zd Zd Zd
eeef fdZd Zd
efdZed Zd
e e fdZ ed
e fd Z ed
e ed
f fd Z!ed
efd Z"d Z#d
efdZ$ed
d d Z%ed ed
e&e j' fd Z(d
S )!Plesk)1434658880z 49152-655351135224)inout)202153443)r> r? r@ r: 123)tcpudpc t S Nr clss r# is_installedzPlesk.is_installedJ s !###r% c K t dd 5 } | d cd d d S # 1 swxY w Y d S )Nz/usr/local/psa/versionrr )openreadsplit)fs r# versionz
Plesk.versionN s
*C
0
0 'A6688>>##A& ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' 's ,A AANc
K d S rF r4 )selfr( s r# enable_imunify_pluginzPlesk.enable_imunify_pluginS r% c
K d S rF r4 )rR plugin_names r# disable_imunify_pluginz Plesk.disable_imunify_pluginW rT r% r c K t j d{V S # t j $ r'}t d| g cY d}~S d}~ww xY w)z$Returns a list of Plesk system usersNzFailed to get users: %s)r get_usersr PanelExceptionloggererror)rR es r# rY zPlesk.get_users[ so (((((( (" LL2A 6 6 6IIIIII s A AAAc K t j d {V }t t }t d }| t
j j t
j j t
j j d |D ]\ }}}}}} }
} |dk rdn||| d< |dk rdn||| d< ||| d< |dk rdn||| d< t || || d < t t | || d
< || d g || d < | dk r%|| d
| |
gd t | S )
Nc $ t j j S rF )r UserLevel REGULAR_USERr4 r% r# <lambda>z&Plesk.patchman_users.<locals>.<lambda>g s 4>3N r% )adminresellerclientNULLr emaillanguageusernameparentlevel suspendeddomains)domainpaths)r get_users_for_patchmanr dictupdater r` ADMINRESSELERra intboolgetappendlistvalues) rR tuplesresclient_type_to_levelri rg rj locale client_typern homedirrl s r# patchman_userszPlesk.patchman_usersc s 133333333$ *+N+N O O ## - N 3 .5
+0F??RRCM' ".4.>.>FCM* %(0CM* %,2f,<,<bb&CM( #%()=k)J%K%KCM' ")-c)nn)=)=CM+ &8} ++3+-H
i( H
i(//"(") CJJLL!!!r% c 8 K t j d{V S )zC
:return: list: domains hosted on server via plesk
N)r get_domainsrR s r# get_user_domainszPlesk.get_user_domains s( _&&&&&&&&&r% c 8 K t j d{V S )z8
:return: domain to list of users pairs
N)r get_domain_to_userr s r# get_domain_to_ownerzPlesk.get_domain_to_owner ) +---------r% c 8 K t j d{V S )z7
Returns dict with user to email pairs
N)r get_user_to_emailr s r# r zPlesk.get_user_to_email s) *,,,,,,,,,r% c 8 K t j d{V S )z8
:return: user to list of domains pairs
N)r get_user_to_domainr s r# get_domains_per_userzPlesk.get_domains_per_user r r% c 8 K t j d {V S rF )r "count_customers_with_subscriptionsr s r# users_countzPlesk.users_count s' ;=========r% c J t j t j z rdS dS )Nz*/etc/apache2/mods-available/security2.confz /etc/httpd/conf.d/security2.conf)r id_likeDEBIANrG s r# get_modsec_config_pathz Plesk.get_modsec_config_path s' " "]%9 9 6??55r% c j t d }|r|hn
t S )NHTTPD_VHOSTS_D)r rw set)rR basedirs r# basedirszPlesk.basedirs s1 .//3355 #.yy.r% c ddl m} t d 5 }d| z }d d d n # 1 swxY w Y |ddg } |j | t |d d d
}|S ) Nr ) ConfigParserz/etc/psa/psa.confz[dummy section]
)
delimitersz
dummy sectionr z/var/www/vhosts) configparserr rL rM read_stringr rw )rH _r cr r base_dirs r#
base_home_dirzPlesk.base_home_dir s .-----
%
&
& 2!&1D 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 #t5554 ? # ' '(8:K L L
s
:>>c ^ t j t j t
d }| d D ]}t |d dk r| d D ]}t | \ }}|t k rt t j t j t
d| d }t j |
c c S dS ) zParse xml of registry and corresponding key file to retrive
product key.
return: str key or None if not found.
z registry.xmlz
struct/memberr( activer' keysz1{http://parallels.com/schemas/keys/aps/3}key-bodyN)r parseospathjoinPLESK_KEY_REGISTRYgetrootr+ r$ r. PLESK_IMUNIFY360_PRODUCT_NAMEbase64 b64decodeencodedecode)rH registrymemberr, r* r) key_values r#
_retrieve_keyzPlesk._retrieve_key s, $ GLL+^ < <
&&((00 AA M MF ff--99!>>*?@@ M MC1>s1C1C.$h'+HHH$2 ' - " $6!" !"
'
% % & / 0@0@0B0B C C J J L LLLLLL I tr% c K | }n6# t j t t f$ r}t d|z d}~ww xY w|r t d| |S t d )zkReturns registration key from registered keys, if possible, raise
PleskException if not successful.z$failed to retrieve key with error %sNzkey retrieved %szThe key not found)r r
ParseError base64ErrorFileNotFoundErrorr0 r[ info)rH resultr] s r# retrieve_keyzPlesk.retrieve_key s
M&&((FF& 5FG M M M !G!!KLL L M KK*F 3 3 3M 0111s A AA c P K t j d{V }d |D S )z1
:return: dict docroot to domain
Nc i | ] \ }}}||
S r4 r4 ).0docrootrn r s r#
<dictcomp>z'Plesk.list_docroots.<locals>.<dictcomp> s-
2GV
r% )r list_docroots_domains_users)rR docroot_domains_userss r#
list_docrootszPlesk.list_docroots sJ '*&E&G&G G G G G G G
6K
r% c
K dS )z8
Returns panel url
:return: str
r r4 )rR ri s r# panel_user_linkzPlesk.panel_user_link s
rr% )userc K t t sdS t j j sdS t j | sdS |||d}t | j d| t j | }t t g| d{V || dt! |du |dS ) zB
Notify a customer using Plesk Notifications Hook
Fri ) message_typeparamsr z .notify(%s))inputNr )r mainipbase_url host_server sent_to_rootr )r PLESK_NOTIFICATION_SCRIPT_PATHexistsr
AdminContacts ENABLE_ICONTACT_NOTIFICATIONS should_send_user_notificationsr[ r r1 jsondumpsr PLESK_NOTIFICATION_HOOK_PATHr
get_server_ipr )rH r r r r- stdins r# notifyz Plesk.notify s
233::<< 5#A 54dCCC 5 ,MM s|000$777
4 56ellnnMMMMMMMMMM )''))'>> DL
r% ri c V K t j d {V }fd|D S )Nc * g | ]}|j k
|S r4 r )r rn ri s r#
<listcomp>z2Plesk.get_user_domains_details.<locals>.<listcomp> s,
80K0KF0K0K0Kr% )r get_user_domains_details)rH ri all_domainss ` r# r z Plesk.get_user_domains_details sT 8 : :::::::
!,
r% rF ))r1 r2 r3 NAMETCP_PORTS_PLESK
OPEN_PORTSr0 exception classmethodrI staticmethodrP r ensure_valid_panelrS rW r strrY r r r r r r ru r r r r r r r
r r r r r ry
DomainDatar r4 r% r# r6 r6 < s D 877/I6?_4
,++333
J I$ $ [$ ' ' \' T
T
c &" &" &"P' ' ' . . . -c3h - - - - . . . >3 > > > > 6 6 [6 /#c( / / / / [ eCI . [6 23 2 2 2 [ 2
8<
[
6
do
[
r% r6 )1r r loggingr binasciir r collectionsr pathlibr typingr r r r r
xml.etreer 3defence360agent.application.determine_hosting_panelr
defence360agent.contractsr defence360agent.utilsr r defence360agent.utils.commonr r r r utilsr r r TCP_PORTS_COMMONr r r getLoggerr1 r[ r r$ r. rZ r0
AbstractPanelr6 r4 r% r# <module>r s
) ) ) ) ) ) # # # # # # 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ! ! ! ! ! ! - , , , , , : : : : : : : : 5 5 5 5 5 5 $ 0 '*H*H*HH!n F
8 $ $
&%S/
&
&
&
& T( `
`
`
`
`
D `
`
`
`
`
r% defence360agent/subsys/panels/plesk/__pycache__/panel.cpython-311.pyc 0000644 0000000 0000000 00000036256 00000000000 022523 0 ustar
r_j$ d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
d dl m Z m
Z
mZmZmZ d dlmZ d dlmZ d dlmZ d d lmZmZ d d
lmZ d d l m Z d
dl m Z d
dl m Z dZ!dZ"e j# g dz Z$dZ%dZ& ej' e( Z)de*fdZ+dee*e*f fdZ, G d de j- Z. G d de j/ Z0dS ) N)Error) defaultdict)Path)DictListSetTupleUnion) ElementTreeis_plesk_installed)config)
OsReleaseInfo check_run) get_hostname )base )api) PleskConfigz
/etc/sw/keys/zext-imunify360)95399084438447zK/usr/local/psa/admin/plib/modules/imunify360/scripts/send-notifications.phpz@/opt/imunify360/venv/share/imunify360/scripts/send-notificationsreturnc B | | }||j S dS )z%Avoid AttributeError if tag not foundN )findtext)nodetag_nodes ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/plesk/panel.py_safe_get_textr$ " s&
IIcNNE z
2 c d}d}| d D ]J}t |d dk rt |d }t |d dk rt |d }K||fS )z.Return product name and filename from key datar value/struct/membernamefilenamez value/stringkey_product_name)findallr$ )keyr) r* datas r#
_get_key_datar. + s H 122 D D $ ' ': 5 5%dN;;H $ ' '+= = = -dN C C X %%r% c e Zd ZdS )PleskExceptionN)__name__
__module__ __qualname__ r% r# r0 r0 8 s Dr% r0 c & e Zd Zd Zg dez ddgez dg dg dddZeZed Z e
d Z e j
d d Z e j
d d Zd
ee fdZd Zd Zd Zd
eeef fdZd Zd
efdZed Zd
e e fdZ ed
e fd Z ed
e ed
f fd Z!ed
efd Z"d Z#d
efdZ$ed
d d Z%ed ed
e&e j' fd Z(d
S )!Plesk)1434658880z 49152-655351135224)inout)202153443)r> r? r@ r: 123)tcpudpc t S Nr clss r# is_installedzPlesk.is_installedJ s !###r% c K t dd 5 } | d cd d d S # 1 swxY w Y d S )Nz/usr/local/psa/versionrr )openreadsplit)fs r# versionz
Plesk.versionN s
*C
0
0 'A6688>>##A& ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' 's ,A AANc
K d S rF r4 )selfr( s r# enable_imunify_pluginzPlesk.enable_imunify_pluginS r% c
K d S rF r4 )rR plugin_names r# disable_imunify_pluginz Plesk.disable_imunify_pluginW rT r% r c K t j d{V S # t j $ r'}t d| g cY d}~S d}~ww xY w)z$Returns a list of Plesk system usersNzFailed to get users: %s)r get_usersr PanelExceptionloggererror)rR es r# rY zPlesk.get_users[ so (((((( (" LL2A 6 6 6IIIIII s A AAAc K t j d {V }t t }t d }| t
j j t
j j t
j j d |D ]\ }}}}}} }
} |dk rdn||| d< |dk rdn||| d< ||| d< |dk rdn||| d< t || || d < t t | || d
< || d g || d < | dk r%|| d
| |
gd t | S )
Nc $ t j j S rF )r UserLevel REGULAR_USERr4 r% r# <lambda>z&Plesk.patchman_users.<locals>.<lambda>g s 4>3N r% )adminresellerclientNULLr emaillanguageusernameparentlevel suspendeddomains)domainpaths)r get_users_for_patchmanr dictupdater r` ADMINRESSELERra intboolgetappendlistvalues) rR tuplesresclient_type_to_levelri rg rj locale client_typern homedirrl s r# patchman_userszPlesk.patchman_usersc s 133333333$ *+N+N O O ## - N 3 .5
+0F??RRCM' ".4.>.>FCM* %(0CM* %,2f,<,<bb&CM( #%()=k)J%K%KCM' ")-c)nn)=)=CM+ &8} ++3+-H
i( H
i(//"(") CJJLL!!!r% c 8 K t j d{V S )zC
:return: list: domains hosted on server via plesk
N)r get_domainsrR s r# get_user_domainszPlesk.get_user_domains s( _&&&&&&&&&r% c 8 K t j d{V S )z8
:return: domain to list of users pairs
N)r get_domain_to_userr s r# get_domain_to_ownerzPlesk.get_domain_to_owner ) +---------r% c 8 K t j d{V S )z7
Returns dict with user to email pairs
N)r get_user_to_emailr s r# r zPlesk.get_user_to_email s) *,,,,,,,,,r% c 8 K t j d{V S )z8
:return: user to list of domains pairs
N)r get_user_to_domainr s r# get_domains_per_userzPlesk.get_domains_per_user r r% c 8 K t j d {V S rF )r "count_customers_with_subscriptionsr s r# users_countzPlesk.users_count s' ;=========r% c J t j t j z rdS dS )Nz*/etc/apache2/mods-available/security2.confz /etc/httpd/conf.d/security2.conf)r id_likeDEBIANrG s r# get_modsec_config_pathz Plesk.get_modsec_config_path s' " "]%9 9 6??55r% c j t d }|r|hn
t S )NHTTPD_VHOSTS_D)r rw set)rR basedirs r# basedirszPlesk.basedirs s1 .//3355 #.yy.r% c ddl m} t d 5 }d| z }d d d n # 1 swxY w Y |ddg } |j | t |d d d
}|S ) Nr ) ConfigParserz/etc/psa/psa.confz[dummy section]
)
delimitersz
dummy sectionr z/var/www/vhosts) configparserr rL rM read_stringr rw )rH _r cr r base_dirs r#
base_home_dirzPlesk.base_home_dir s .-----
%
&
& 2!&1D 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 #t5554 ? # ' '(8:K L L
s
:>>c ^ t j t j t
d }| d D ]}t |d dk r| d D ]}t | \ }}|t k rt t j t j t
d| d }t j |
c c S dS ) zParse xml of registry and corresponding key file to retrive
product key.
return: str key or None if not found.
z registry.xmlz
struct/memberr( activer' keysz1{http://parallels.com/schemas/keys/aps/3}key-bodyN)r parseospathjoinPLESK_KEY_REGISTRYgetrootr+ r$ r. PLESK_IMUNIFY360_PRODUCT_NAMEbase64 b64decodeencodedecode)rH registrymemberr, r* r) key_values r#
_retrieve_keyzPlesk._retrieve_key s, $ GLL+^ < <
&&((00 AA M MF ff--99!>>*?@@ M MC1>s1C1C.$h'+HHH$2 ' - " $6!" !"
'
% % & / 0@0@0B0B C C J J L LLLLLL I tr% c K | }n6# t j t t f$ r}t d|z d}~ww xY w|r t d| |S t d )zkReturns registration key from registered keys, if possible, raise
PleskException if not successful.z$failed to retrieve key with error %sNzkey retrieved %szThe key not found)r r
ParseError base64ErrorFileNotFoundErrorr0 r[ info)rH resultr] s r# retrieve_keyzPlesk.retrieve_key s
M&&((FF& 5FG M M M !G!!KLL L M KK*F 3 3 3M 0111s A AA c P K t j d{V }d |D S )z1
:return: dict docroot to domain
Nc i | ] \ }}}||
S r4 r4 ).0docrootrn r s r#
<dictcomp>z'Plesk.list_docroots.<locals>.<dictcomp> s-
2GV
r% )r list_docroots_domains_users)rR docroot_domains_userss r#
list_docrootszPlesk.list_docroots sJ '*&E&G&G G G G G G G
6K
r% c
K dS )z8
Returns panel url
:return: str
r r4 )rR ri s r# panel_user_linkzPlesk.panel_user_link s
rr% )userc K t t sdS t j j sdS t j | sdS |||d}t | j d| t j | }t t g| d{V || dt! |du |dS ) zB
Notify a customer using Plesk Notifications Hook
Fri ) message_typeparamsr z .notify(%s))inputNr )r mainipbase_url host_server sent_to_rootr )r PLESK_NOTIFICATION_SCRIPT_PATHexistsr
AdminContacts ENABLE_ICONTACT_NOTIFICATIONS should_send_user_notificationsr[ r r1 jsondumpsr PLESK_NOTIFICATION_HOOK_PATHr
get_server_ipr )rH r r r r- stdins r# notifyz Plesk.notify s
233::<< 5#A 54dCCC 5 ,MM s|000$777
4 56ellnnMMMMMMMMMM )''))'>> DL
r% ri c V K t j d {V }fd|D S )Nc * g | ]}|j k
|S r4 r )r rn ri s r#
<listcomp>z2Plesk.get_user_domains_details.<locals>.<listcomp> s,
80K0KF0K0K0Kr% )r get_user_domains_details)rH ri all_domainss ` r# r z Plesk.get_user_domains_details sT 8 : :::::::
!,
r% rF ))r1 r2 r3 NAMETCP_PORTS_PLESK
OPEN_PORTSr0 exception classmethodrI staticmethodrP r ensure_valid_panelrS rW r strrY r r r r r r ru r r r r r r r
r r r r r ry
DomainDatar r4 r% r# r6 r6 < s D 877/I6?_4
,++333
J I$ $ [$ ' ' \' T
T
c &" &" &"P' ' ' . . . -c3h - - - - . . . >3 > > > > 6 6 [6 /#c( / / / / [ eCI . [6 23 2 2 2 [ 2
8<
[
6
do
[
r% r6 )1r r loggingr binasciir r collectionsr pathlibr typingr r r r r
xml.etreer 3defence360agent.application.determine_hosting_panelr
defence360agent.contractsr defence360agent.utilsr r defence360agent.utils.commonr r r r utilsr r r TCP_PORTS_COMMONr r r getLoggerr1 r[ r r$ r. rZ r0
AbstractPanelr6 r4 r% r# <module>r s
) ) ) ) ) ) # # # # # # 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ! ! ! ! ! ! - , , , , , : : : : : : : : 5 5 5 5 5 5 $ 0 '*H*H*HH!n F
8 $ $
&%S/
&
&
&
& T( `
`
`
`
`
D `
`
`
`
`
r% defence360agent/subsys/panels/plesk/__pycache__/upgrade_urls.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000010557 00000000000 025053 0 ustar
r_j d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z ej
e Z ed Z
ed ZdZd Zd
ee fd Zd
efd ZdS )
a* Fetch Plesk buyUrl/upgradeLicenseUrl via extension context.
Plesk resellers configure buyUrl through pm_Context, which is only
accessible from within the Plesk extension runtime. This module
dynamically creates a PHP script, runs it via
``plesk bin extension --exec``, and parses the JSON output.
N)Path)Optional)is_plesk_installedz%/var/imunify360/plesk-ext-marketplacez4/usr/local/psa/admin/plib/modules/imunify360/scriptszget-upgrade-urls.phpz<?php
echo json_encode([
'buyUrl' => pm_Context::getBuyUrl(),
'upgradeLicenseUrl' => pm_Context::getUpgradeLicenseUrl(),
]);
returnc H t t z } | t | d t j dddddt gdd }|j d
k rYt d |j |j
d d
| d d S # t $ r Y d S w xY wt j |j | d S # t $ r Y S w xY w# t t
j t j f$ rN}t d| Y d }~ | d d S # t $ r Y d S w xY wd }~ww xY w# | d w # t $ r Y w w xY wxY w)zBCreate a temporary PHP script, execute it, and return parsed JSON.i pleskbin extensionz--exec
imunify360T )capture_outputtimeoutr z)plesk extension --exec failed (rc=%d): %sNi )
missing_okz&Failed to fetch Plesk upgrade URLs: %s)PLESK_EXT_SCRIPTS_DIR _SCRIPT_NAME
write_text_SCRIPT_CONTENTchmod
subprocessrun
returncodeloggerwarningstderrunlinkOSErrorjsonloadsstdoutTimeoutExpiredJSONDecodeError) script_pathresultexcs e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/plesk/upgrade_urls.py_run_plesk_scriptr& # s ',6K! /// %
! ! NN;!
dsd#
$ / / / / / DD z&-((
$ / / / / D
Z.0D E ?EEEttt $ / / / / / DD
$ / / / / D s B
D B5 5
CCD C66
DD!E5'E0E8 E
E-,E-0E55E8 8F!:FF!
F F! F F!c ( ddd} t rt s| S t }|s| S | d pd | d pd dS )a% Return Plesk buyUrl and upgradeLicenseUrl, or empty strings.
Only runs when Plesk is installed and the extension was installed
from the Plesk marketplace.
Returns:
dict with keys ``buy_url`` and ``upgrade_license_url``,
both empty strings when not available.
)buy_urlupgrade_license_urlbuyUrlupgradeLicenseUrl)r PLESK_MARKETPLACE_FLAGexistsr& getstrip)emptydatas r% get_plesk_upgrade_urlsr3 J s 2 6 6E '='D'D'F'F D HHX&&,"3355 $)< = = C J J L L )__doc__r loggingr pathlibr typingr 3defence360agent.application.determine_hosting_panelr getLogger__name__r r- r r r dictr& r3 r4 r% <module>r> s
8 $ $ EFF : & $8D> $ $ $ $N r4 defence360agent/subsys/panels/plesk/__pycache__/upgrade_urls.cpython-311.pyc 0000644 0000000 0000000 00000010557 00000000000 024114 0 ustar
r_j d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z ej
e Z ed Z
ed ZdZd Zd
ee fd Zd
efd ZdS )
a* Fetch Plesk buyUrl/upgradeLicenseUrl via extension context.
Plesk resellers configure buyUrl through pm_Context, which is only
accessible from within the Plesk extension runtime. This module
dynamically creates a PHP script, runs it via
``plesk bin extension --exec``, and parses the JSON output.
N)Path)Optional)is_plesk_installedz%/var/imunify360/plesk-ext-marketplacez4/usr/local/psa/admin/plib/modules/imunify360/scriptszget-upgrade-urls.phpz<?php
echo json_encode([
'buyUrl' => pm_Context::getBuyUrl(),
'upgradeLicenseUrl' => pm_Context::getUpgradeLicenseUrl(),
]);
returnc H t t z } | t | d t j dddddt gdd }|j d
k rYt d |j |j
d d
| d d S # t $ r Y d S w xY wt j |j | d S # t $ r Y S w xY w# t t
j t j f$ rN}t d| Y d }~ | d d S # t $ r Y d S w xY wd }~ww xY w# | d w # t $ r Y w w xY wxY w)zBCreate a temporary PHP script, execute it, and return parsed JSON.i pleskbin extensionz--exec
imunify360T )capture_outputtimeoutr z)plesk extension --exec failed (rc=%d): %sNi )
missing_okz&Failed to fetch Plesk upgrade URLs: %s)PLESK_EXT_SCRIPTS_DIR _SCRIPT_NAME
write_text_SCRIPT_CONTENTchmod
subprocessrun
returncodeloggerwarningstderrunlinkOSErrorjsonloadsstdoutTimeoutExpiredJSONDecodeError) script_pathresultexcs e/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/plesk/upgrade_urls.py_run_plesk_scriptr& # s ',6K! /// %
! ! NN;!
dsd#
$ / / / / / DD z&-((
$ / / / / D
Z.0D E ?EEEttt $ / / / / / DD
$ / / / / D s B
D B5 5
CCD C66
DD!E5'E0E8 E
E-,E-0E55E8 8F!:FF!
F F! F F!c ( ddd} t rt s| S t }|s| S | d pd | d pd dS )a% Return Plesk buyUrl and upgradeLicenseUrl, or empty strings.
Only runs when Plesk is installed and the extension was installed
from the Plesk marketplace.
Returns:
dict with keys ``buy_url`` and ``upgrade_license_url``,
both empty strings when not available.
)buy_urlupgrade_license_urlbuyUrlupgradeLicenseUrl)r PLESK_MARKETPLACE_FLAGexistsr& getstrip)emptydatas r% get_plesk_upgrade_urlsr3 J s 2 6 6E '='D'D'F'F D HHX&&,"3355 $)< = = C J J L L )__doc__r loggingr pathlibr typingr 3defence360agent.application.determine_hosting_panelr getLogger__name__r r- r r r dictr& r3 r4 r% <module>r> s
8 $ $ EFF : & $8D> $ $ $ $N r4 defence360agent/subsys/panels/plesk/__pycache__/utils.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001166 00000000000 023513 0 ustar
r_j . d dl mZ G d de ZdS ) )KWConfigc e Zd ZdZdZdZdS ) PleskConfigz ^{}\s+(.*)?$z{} {}z/etc/psa/psa.confN)__name__
__module__ __qualname__SEARCH_PATTERN
WRITE_PATTERNDEFAULT_FILENAME ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/plesk/utils.pyr r s $NM*r
r N) defence360agent.utils.kwconfigr r r r
r <module>r sK 3 3 3 3 3 3+ + + + +( + + + + +r
defence360agent/subsys/panels/plesk/__pycache__/utils.cpython-311.pyc 0000644 0000000 0000000 00000001166 00000000000 022554 0 ustar
r_j . d dl mZ G d de ZdS ) )KWConfigc e Zd ZdZdZdZdS ) PleskConfigz ^{}\s+(.*)?$z{} {}z/etc/psa/psa.confN)__name__
__module__ __qualname__SEARCH_PATTERN
WRITE_PATTERNDEFAULT_FILENAME ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/panels/plesk/utils.pyr r s $NM*r
r N) defence360agent.utils.kwconfigr r r r
r <module>r sK 3 3 3 3 3 3+ + + + +( + + + + +r
defence360agent/subsys/panels/plesk/api.py 0000644 0000000 0000000 00000016444 00000000000 015632 0 ustar """Gather information from Plesk via DB querries."""
import logging
from collections import defaultdict
from typing import Dict, List, Sequence
from defence360agent.subsys.panels.base import DomainData, PanelException
from defence360agent.utils import (
CheckRunError,
async_lru_cache,
check_run,
retry_on,
)
logger = logging.getLogger(__name__)
async def raise_panel_exception(*args, **kwargs):
raise PanelException(*args, **kwargs)
@retry_on(CheckRunError, max_tries=3, on_error=raise_panel_exception)
async def _run_query(query: str) -> str:
return (await check_run(["plesk", "db", "-N", "-e", query])).decode()
async def get_user_to_domain() -> Dict[str, List[str]]:
"""Return mapping: user -> user's domains."""
result = (
await _run_query(
"select login, name from domains "
" left join hosting on dom_id = domains.id "
" right join sys_users on hosting.sys_user_id = sys_users.id"
)
).split()
result_mapping = defaultdict(list)
for user, domain in zip(result[0::2], result[1::2]):
if domain != "NULL":
result_mapping[user].append(domain)
return result_mapping
async def get_domain_to_user() -> Dict[str, List[str]]:
"""Return mapping: domain -> user."""
result = (
await _run_query(
"select name, login "
"from domains "
" left join hosting on dom_id = domains.id "
" left join sys_users on hosting.sys_user_id = sys_users.id"
)
).split()
return {domain: [user] for domain, user in zip(result[0::2], result[1::2])}
async def get_user_details() -> Dict[str, Dict[str, str]]:
"""
Returns dict with user to email and locale pairs
Not used, because MyImunify implemented for cPanel only yet
"""
user_details = {}
results = await _run_query(
"SELECT CONCAT(login, ';',email, ';',locale) FROM clients;"
)
for record in results.split("\n"):
if not record:
continue
user, email, locale = record.split(";")
user_details[user] = {
"email": email,
"locale": locale.replace("-", "_"),
}
return user_details
async def get_domains() -> List[str]:
"""Return: list of domains"""
return (await _run_query("select name from domains")).split()
async def get_users() -> List[str]:
"""Return: users that created by Plesk"""
return (
await _run_query(
"SELECT sys_users.login FROM sys_users JOIN hosting ON"
" hosting.sys_user_id=sys_users.id JOIN domains ON"
" hosting.dom_id=domains.id AND domains.webspace_id=0"
)
).split()
async def get_users_for_patchman() -> list[list[str]]:
"""
Returns
[
['admin', 'john.smith@tardis.gal', 'NULL', 'en-US', 'admin', 'NULL', 'NULL', 'NULL', '0'],
['user0', 'NULL', 'admin', 'en-US', 'client', '1', 'user0.com', '/var/www/vhosts/user0.com/httpdocs', '1']
]
There is only 1 return type. NULL is converted to 'NULL'
Each possible empty string should be covered with
IF(clients.email='', NULL, clients.email)
or it will break data structure
"""
raw_data = await _run_query(
"""
SELECT clients.login, IF(clients.email='', NULL, clients.email), parent.login,
IF(clients.locale='', NULL, clients.locale), clients.type, domains.name,
hosting.www_root, clients.status=16 suspended
FROM clients
LEFT JOIN clients parent ON parent.id=clients.parent_id
LEFT JOIN domains ON domains.cl_id=clients.id
LEFT JOIN hosting ON domains.id=hosting.dom_id;
"""
)
tuples = [string.split() for string in raw_data.split("\n") if string]
return tuples
async def count_customers_with_subscriptions() -> int: # pragma: no cover
"""Return: count active customers with at least one (any) domain"""
return int(
await _run_query(
"select count(distinct cl_id) from clients c join domains d on "
"d.cl_id = c.id where c.status = 0"
)
)
async def get_admin_emails() -> list:
emails = await _run_query("SELECT email FROM clients WHERE type='admin';")
return [email for email in emails.split("\n") if email]
async def list_docroots() -> Sequence[str]:
query = "SELECT DISTINCT hosting.www_root FROM hosting;"
return (await _run_query(query)).split()
async def list_docroots_domains_users():
sql = (
"select hosting.www_root, domains.name, sys_users.login"
" from hosting"
" inner join domains on hosting.dom_id = domains.id"
" inner join sys_users on hosting.sys_user_id=sys_users.id"
)
data = await _run_query(sql)
retval = [string.split() for string in data.split("\n") if string]
return retval
@async_lru_cache(maxsize=1, ttl=60)
async def get_user_domains_details() -> list[DomainData]:
sql = """
SELECT
'domain' AS object_type,
d.id AS object_id,
d.name AS domain_name,
NULL AS target_domain_name,
c.id AS client_id,
c.login AS client_login,
CASE
WHEN d.parentDomainId != 0 THEN 'subdomain'
WHEN EXISTS (
SELECT 1 FROM `Subscriptions` s
WHERE s.object_type = 'domain' AND s.object_id = d.id
) THEN 'primary'
WHEN d.parentDomainId = 0 THEN 'addon'
ELSE 'unknown'
END AS domain_type,
h.www_root AS docroot,
su.login AS sys_user_login
FROM domains d
LEFT JOIN clients c ON d.cl_id = c.id
LEFT JOIN hosting h ON d.id = h.dom_id
LEFT JOIN sys_users su ON h.sys_user_id = su.id
UNION ALL
SELECT
'subdomain' AS object_type,
sd.id AS object_id,
CONCAT(sd.name, '.', pd.name) AS domain_name,
NULL AS target_domain_name,
c.id AS client_id,
c.login AS client_login,
'subdomain' AS domain_type,
h.www_root AS docroot,
su.login AS sys_user_login
FROM subdomains sd
JOIN domains pd ON sd.dom_id = pd.id
LEFT JOIN hosting h ON pd.id = h.dom_id
LEFT JOIN clients c ON pd.cl_id = c.id
LEFT JOIN sys_users su ON h.sys_user_id = su.id
UNION ALL
SELECT
'alias' AS object_type,
da.id AS object_id,
da.name AS domain_name,
pd.name AS target_domain_name,
c.id AS client_id,
c.login AS client_login,
'alias' AS domain_type,
h.www_root AS docroot,
su.login AS sys_user_login
FROM domain_aliases da
JOIN domains pd ON da.dom_id = pd.id
LEFT JOIN hosting h ON pd.id = h.dom_id
LEFT JOIN clients c ON pd.cl_id = c.id
LEFT JOIN sys_users su ON h.sys_user_id = su.id
ORDER BY client_login, domain_type, domain_name;
"""
data = await _run_query(sql)
raw_data = [string.split() for string in data.split("\n") if string]
return [
DomainData(docroot=row[7], domain=row[2], type=row[6], username=row[8])
for row in raw_data
]
defence360agent/subsys/panels/plesk/panel.py 0000644 0000000 0000000 00000022010 00000000000 016142 0 ustar import base64
import json
import logging
import os
from binascii import Error as base64Error
from collections import defaultdict
from pathlib import Path
from typing import Dict, List, Set, Tuple, Union
from xml.etree import ElementTree
from defence360agent.application.determine_hosting_panel import (
is_plesk_installed,
)
from defence360agent.contracts import config
from defence360agent.utils import OsReleaseInfo, check_run
from defence360agent.utils.common import get_hostname
from .. import base
from . import api
from .utils import PleskConfig
PLESK_KEY_REGISTRY = "/etc/sw/keys/"
PLESK_IMUNIFY360_PRODUCT_NAME = "ext-imunify360"
TCP_PORTS_PLESK = base.TCP_PORTS_COMMON + ["953", "990", "8443", "8447"]
PLESK_NOTIFICATION_SCRIPT_PATH = "/usr/local/psa/admin/plib/modules/imunify360/scripts/send-notifications.php"
PLESK_NOTIFICATION_HOOK_PATH = (
"/opt/imunify360/venv/share/imunify360/scripts/send-notifications"
)
logger = logging.getLogger(__name__)
def _safe_get_text(node, tag) -> str:
"""Avoid AttributeError if tag not found"""
_node = node.find(tag)
if _node is not None:
return _node.text
return ""
def _get_key_data(key) -> Tuple[str, str]:
"""Return product name and filename from key data"""
filename = ""
key_product_name = ""
for data in key.findall("value/struct/member"):
if _safe_get_text(data, "name") == "filename":
filename = _safe_get_text(data, "value/string")
if _safe_get_text(data, "name") == "key_product_name":
key_product_name = _safe_get_text(data, "value/string")
return key_product_name, filename
class PleskException(base.PanelException):
pass
class Plesk(base.AbstractPanel):
NAME = "Plesk"
OPEN_PORTS = {
"tcp": {
"in": ["143", "465", "8880", "49152-65535"] + TCP_PORTS_PLESK,
"out": ["113", "5224"] + TCP_PORTS_PLESK,
},
"udp": {
"in": ["20", "21", "53", "443"],
"out": ["20", "21", "53", "113", "123"],
},
}
exception = PleskException
@classmethod
def is_installed(cls):
return is_plesk_installed()
@staticmethod
async def version():
with open("/usr/local/psa/version", "r") as f:
return f.read().split()[0]
@base.ensure_valid_panel()
async def enable_imunify_plugin(self, name=None):
pass
@base.ensure_valid_panel()
async def disable_imunify_plugin(self, plugin_name=None):
pass
async def get_users(self) -> List[str]:
"""Returns a list of Plesk system users"""
try:
return await api.get_users()
except base.PanelException as e:
logger.error("Failed to get users: %s", e)
return []
async def patchman_users(self):
tuples = await api.get_users_for_patchman()
res = defaultdict(dict)
# https://cloudlinux.slite.com/app/docs/nrQKL-Raf_3ps4#e0bf3d51
client_type_to_level = defaultdict(lambda: base.UserLevel.REGULAR_USER)
client_type_to_level.update(
{
"admin": base.UserLevel.ADMIN,
"reseller": base.UserLevel.RESSELER,
"client": base.UserLevel.REGULAR_USER,
}
)
for (
username,
email,
parent,
locale,
client_type,
domain,
homedir,
suspended,
) in tuples:
res[username]["email"] = "" if email == "NULL" else email
res[username]["language"] = "" if locale == "NULL" else locale
res[username]["username"] = username
res[username]["parent"] = "" if parent == "NULL" else parent
res[username]["level"] = int(client_type_to_level[client_type])
res[username]["suspended"] = bool(int(suspended))
if res[username].get("domains") is None:
res[username]["domains"] = []
if domain != "NULL":
res[username]["domains"].append(
{
"domain": domain,
"paths": [homedir],
}
)
return list(res.values())
async def get_user_domains(self):
"""
:return: list: domains hosted on server via plesk
"""
return await api.get_domains()
async def get_domain_to_owner(self):
"""
:return: domain to list of users pairs
"""
return await api.get_domain_to_user()
async def get_user_to_email(self) -> Dict[str, str]:
"""
Returns dict with user to email pairs
"""
return await api.get_user_to_email()
async def get_domains_per_user(self):
"""
:return: user to list of domains pairs
"""
return await api.get_user_to_domain()
async def users_count(self) -> int:
return await api.count_customers_with_subscriptions()
@classmethod
def get_modsec_config_path(cls):
if OsReleaseInfo.id_like() & OsReleaseInfo.DEBIAN:
return "/etc/apache2/mods-available/security2.conf"
else:
return "/etc/httpd/conf.d/security2.conf"
def basedirs(self) -> Set[str]:
basedir = PleskConfig("HTTPD_VHOSTS_D").get()
return {basedir} if basedir else set()
@classmethod
def base_home_dir(cls, _) -> Path:
# Local import to save memory on other panels
from configparser import ConfigParser
with open("/etc/psa/psa.conf") as c:
text = "[dummy section]\n" + c.read()
config = ConfigParser(delimiters=[" ", "\t"])
config.read_string(text)
base_dir = Path(
config["dummy section"].get("HTTPD_VHOSTS_D", "/var/www/vhosts")
)
return base_dir
@classmethod
def _retrieve_key(cls) -> Union[str, None]:
"""Parse xml of registry and corresponding key file to retrive
product key.
return: str key or None if not found.
"""
registry = ElementTree.parse(
os.path.join(PLESK_KEY_REGISTRY, "registry.xml")
)
for member in registry.getroot().findall("struct/member"):
if _safe_get_text(member, "name") == "active":
for key in member.findall("value/struct/member"):
key_product_name, filename = _get_key_data(key)
if key_product_name == PLESK_IMUNIFY360_PRODUCT_NAME:
key_value = _safe_get_text(
ElementTree.parse(
os.path.join(
PLESK_KEY_REGISTRY, "keys", filename
)
),
"{http://parallels.com/schemas/keys/aps/3}"
"key-body",
)
return base64.b64decode(key_value.encode()).decode()
return None
@classmethod
async def retrieve_key(cls) -> str:
"""Returns registration key from registered keys, if possible, raise
PleskException if not successful."""
try:
result = cls._retrieve_key()
except (ElementTree.ParseError, base64Error, FileNotFoundError) as e:
raise PleskException("failed to retrieve key with error %s" % e)
if result:
logger.info("key retrieved %s", result)
return result
raise PleskException("The key not found")
async def list_docroots(self):
"""
:return: dict docroot to domain
"""
docroot_domains_users = await api.list_docroots_domains_users()
return {
docroot: domain for docroot, domain, _ in docroot_domains_users
}
async def panel_user_link(self, username) -> str:
"""
Returns panel url
:return: str
"""
return ""
@classmethod
async def notify(cls, *, message_type, params, user=None):
"""
Notify a customer using Plesk Notifications Hook
"""
if not Path(PLESK_NOTIFICATION_SCRIPT_PATH).exists():
return False
if not config.AdminContacts.ENABLE_ICONTACT_NOTIFICATIONS:
return False
if not config.should_send_user_notifications(username=user):
return False
data = {"message_type": message_type, "params": params, "user": user}
logger.info(f"{cls.__name__}.notify(%s)", data)
stdin = json.dumps(data)
await check_run([PLESK_NOTIFICATION_HOOK_PATH], input=stdin.encode())
return {
"message_type": message_type,
"mainip": cls.get_server_ip(),
"base_url": "",
"host_server": get_hostname(),
"sent_to_root": user is None,
"params": params,
}
@classmethod
async def get_user_domains_details(
cls, username: str
) -> list[base.DomainData]:
all_domains = await api.get_user_domains_details()
return [
domain for domain in all_domains if domain.username == username
]
defence360agent/subsys/panels/plesk/upgrade_urls.py 0000644 0000000 0000000 00000005577 00000000000 017562 0 ustar """Fetch Plesk buyUrl/upgradeLicenseUrl via extension context.
Plesk resellers configure buyUrl through pm_Context, which is only
accessible from within the Plesk extension runtime. This module
dynamically creates a PHP script, runs it via
``plesk bin extension --exec``, and parses the JSON output.
"""
import json
import logging
import subprocess
from pathlib import Path
from typing import Optional
from defence360agent.application.determine_hosting_panel import (
is_plesk_installed,
)
logger = logging.getLogger(__name__)
PLESK_MARKETPLACE_FLAG = Path("/var/imunify360/plesk-ext-marketplace")
PLESK_EXT_SCRIPTS_DIR = Path(
"/usr/local/psa/admin/plib/modules/imunify360/scripts"
)
_SCRIPT_NAME = "get-upgrade-urls.php"
_SCRIPT_CONTENT = """\
<?php
echo json_encode([
'buyUrl' => pm_Context::getBuyUrl(),
'upgradeLicenseUrl' => pm_Context::getUpgradeLicenseUrl(),
]);
"""
def _run_plesk_script() -> Optional[dict]:
"""Create a temporary PHP script, execute it, and return parsed JSON."""
script_path = PLESK_EXT_SCRIPTS_DIR / _SCRIPT_NAME
try:
script_path.write_text(_SCRIPT_CONTENT)
# The daemon runs with umask 0o007, so write_text creates the file
# as 0o660 — unreadable by the non-root account Plesk uses to run
# ``plesk bin extension --exec``. Force world-readable.
script_path.chmod(0o644)
result = subprocess.run(
[
"plesk",
"bin",
"extension",
"--exec",
"imunify360",
_SCRIPT_NAME,
],
capture_output=True,
timeout=30,
)
if result.returncode != 0:
logger.warning(
"plesk extension --exec failed (rc=%d): %s",
result.returncode,
result.stderr[:500],
)
return None
return json.loads(result.stdout)
except (OSError, subprocess.TimeoutExpired, json.JSONDecodeError) as exc:
logger.warning("Failed to fetch Plesk upgrade URLs: %s", exc)
return None
finally:
try:
script_path.unlink(missing_ok=True)
except OSError:
pass
def get_plesk_upgrade_urls() -> dict:
"""Return Plesk buyUrl and upgradeLicenseUrl, or empty strings.
Only runs when Plesk is installed and the extension was installed
from the Plesk marketplace.
Returns:
dict with keys ``buy_url`` and ``upgrade_license_url``,
both empty strings when not available.
"""
empty = {"buy_url": "", "upgrade_license_url": ""}
if not is_plesk_installed() or not PLESK_MARKETPLACE_FLAG.exists():
return empty
data = _run_plesk_script()
if not data:
return empty
return {
"buy_url": (data.get("buyUrl") or "").strip(),
"upgrade_license_url": (data.get("upgradeLicenseUrl") or "").strip(),
}
defence360agent/subsys/panels/plesk/utils.py 0000644 0000000 0000000 00000000277 00000000000 016216 0 ustar from defence360agent.utils.kwconfig import KWConfig
class PleskConfig(KWConfig):
SEARCH_PATTERN = r"^{}\s+(.*)?$"
WRITE_PATTERN = "{} {}"
DEFAULT_FILENAME = "/etc/psa/psa.conf"
defence360agent/subsys/persistent_state.py 0000644 0000000 0000000 00000003605 00000000000 016054 0 ustar import json
from logging import getLogger
from pathlib import Path
from typing import Literal
from defence360agent.contracts.config import ANTIVIRUS_MODE
from defence360agent.contracts.plugins import Scope
logger = getLogger(__name__)
BASE_DIR = Path("/var/imunify360")
PERSISTENT_STATE_DIR = BASE_DIR / ".persistent_state"
LOCK_FILES = set()
def register_lock_file(
lock_file: str, scope: Literal[Scope.AV, Scope.IM360, Scope.AV_IM360]
) -> Path:
"""Register lock file for further usage."""
_lock_file = PERSISTENT_STATE_DIR / f".{lock_file}.lock"
if scope == Scope.AV_IM360:
LOCK_FILES.add(_lock_file)
elif scope == Scope.AV and ANTIVIRUS_MODE:
LOCK_FILES.add(_lock_file)
elif scope == Scope.IM360 and not ANTIVIRUS_MODE:
LOCK_FILES.add(_lock_file)
return _lock_file
def save_state(class_name: str, values: dict):
"""Save state to a file in .persistent_state folder."""
folder_path = PERSISTENT_STATE_DIR
try:
folder_path.mkdir(parents=True, exist_ok=True)
file_path = folder_path / f"{class_name}.state"
json.dump(values, file_path.open("w"))
except (AttributeError, OSError) as e:
logger.error("Failed to save state: %s %s", class_name, e)
def load_state(class_name) -> dict:
"""Load state from a file in .persistent_state folder."""
folder_path = PERSISTENT_STATE_DIR
file_path = folder_path / f"{class_name}.state"
if file_path.exists():
try:
return json.load(file_path.open("r"))
except (json.JSONDecodeError, OSError, UnicodeDecodeError) as e:
logger.error("Failed to load state: %s %s", class_name, e)
return dict()
def remove_unused_locks():
"""Remove all unused lock files from .persistent_state folder."""
for lock_file in PERSISTENT_STATE_DIR.glob("*.lock"):
if lock_file not in LOCK_FILES:
lock_file.unlink()
defence360agent/subsys/svcctl.py 0000644 0000000 0000000 00000013406 00000000000 013752 0 ustar import asyncio
import logging
import os
import subprocess as su
from typing import Iterable
from defence360agent.contracts.config import Core
from defence360agent.utils import check_run, CheckRunError, run, OsReleaseInfo
logger = logging.getLogger(__name__)
DOS_PROTECTOR_SERVICE_NAME = "imunify360-dos-protection"
UAL_SERVICE_NAME = "imunify360-unified-access-logger"
PAM_SERVICE_NAME = "imunify360-pam"
AUDITD_SERVICE_NAME = "imunify-auditd-log-reader"
SCANLOGD_SERVICE_NAME = "imunify360-scanlogd"
AGENT_SERVICE_NAME = "imunify360-agent"
def _apply_cmd(func):
async def wrapper(*args, **kwargs):
cmd = func(*args, **kwargs)
logger.debug("check_call(%r)", cmd)
await check_run(cmd)
return wrapper
async def _reset_failed_state(
services: Iterable["_SystemctlBased"],
):
for s in services:
try:
await s.reset_failed()
await s.restart()
except CheckRunError as e:
logger.warning(
"Failed to reset failed state for service %s: %s", s, e
)
return
for _ in range(10):
if await s.is_active():
break
logger.warning(
"Service %s is still not active, sleep for %s seconds", s, 1
)
await asyncio.sleep(1)
class _SystemctlBased:
SVC_CTL_BIN = "systemctl"
def __init__(self, service_name):
self._service_name = service_name
@_apply_cmd
def start(self):
return [self.SVC_CTL_BIN, "start", self._service_name]
@_apply_cmd
def stop(self):
return [self.SVC_CTL_BIN, "stop", self._service_name]
@_apply_cmd
def restart(self):
return [self.SVC_CTL_BIN, "restart", self._service_name]
@_apply_cmd
def _enable_now(self, *, now: bool):
return [
self.SVC_CTL_BIN,
"enable",
*(["--now"] if now else []),
self._service_name,
]
async def enable(self, *, now: bool):
await self._enable_now(now=now)
# WARN: Ubuntu 16.04 demonstrates very special behavior of the
# `systemcl enable --now` command - if the unit is stopped it
# wouldn't be started. We need to handle that case.
# TODO: Remove this case on dropping support for Ubuntu 16.04.
osinfo = {}
try:
OsReleaseInfo.dict_from_file(osinfo)
except (FileNotFoundError, PermissionError):
return
if osinfo.get("ID", "").lower() != "ubuntu":
return
if osinfo.get("VERSION_ID", "") == "16.04":
await self.restart()
async def is_enabled(self):
cmd = [self.SVC_CTL_BIN, "is-enabled", self._service_name]
proc = await asyncio.create_subprocess_exec(
*cmd, stdout=su.DEVNULL, stderr=su.DEVNULL
)
await proc.communicate()
rc = await proc.wait()
return rc == 0
def is_enabled_sync(self):
cmd = [self.SVC_CTL_BIN, "is-enabled", self._service_name]
rc = su.call(cmd, stdout=su.DEVNULL, stderr=su.DEVNULL)
return rc == 0
@_apply_cmd
def disable(self, *, now: bool):
return [
self.SVC_CTL_BIN,
"disable",
*(["--now"] if now else []),
self._service_name,
]
@_apply_cmd
def reload(self):
return [self.SVC_CTL_BIN, "reload", self._service_name]
async def is_active(self):
cmd = [self.SVC_CTL_BIN, "is-active", self._service_name]
exit_code, _, _ = await run(cmd)
return exit_code == 0
@_apply_cmd
def reset_failed(self):
return [self.SVC_CTL_BIN, "reset-failed", self._service_name]
def unit_exists(self):
cp = su.run(
[self.SVC_CTL_BIN, "cat", self._service_name],
stdout=su.DEVNULL,
stderr=su.DEVNULL,
)
return cp.returncode == 0
class _CentOs7(_SystemctlBased):
SVC_CTL_BIN = "/usr/bin/systemctl"
class _DebianUbuntu(_SystemctlBased):
SVC_CTL_BIN = "/bin/systemctl"
def adaptor(service_name):
for a in (_DebianUbuntu, _CentOs7):
if os.path.exists(a.SVC_CTL_BIN):
return a(service_name)
raise RuntimeError("Cannot instantiate appropriate adaptor.")
async def activate_socket_service(service_name):
agent_service = adaptor(service_name)
agent_service_socket = adaptor(f"{service_name}.socket")
if (
await agent_service_socket.is_enabled()
and not await agent_service_socket.is_active()
):
# reset the main service, which will trigger socket activation
await agent_service_socket.reset_failed()
await _reset_failed_state((agent_service,))
# wait some times until socket activates
for _ in range(5):
await asyncio.sleep(1)
if await agent_service_socket.is_active():
return
logger.error(
f"Failed to await active {service_name}.socket after reseting"
f" {service_name}"
)
def imunify360_service():
return adaptor(Core.SVC_NAME)
def imunify360_dos_protector_service():
try:
return adaptor(DOS_PROTECTOR_SERVICE_NAME)
except RuntimeError:
logger.info("DOS Protector service is not available on this system")
return None
def imunify360_ual_service():
return adaptor(UAL_SERVICE_NAME)
def imunify360_pam_service():
return adaptor(PAM_SERVICE_NAME)
def imunify360_scanlogd_service():
return adaptor(SCANLOGD_SERVICE_NAME)
def imunify360_agent_service():
return adaptor(AGENT_SERVICE_NAME)
def imunify360_auditd_service():
unit = adaptor(AUDITD_SERVICE_NAME)
if unit.unit_exists():
return adaptor(AUDITD_SERVICE_NAME)
logger.info("Auditd-log-reader service is not available on this system")
return None
defence360agent/subsys/sysctl.py 0000644 0000000 0000000 00000000573 00000000000 013776 0 ustar import os
def _build_path(name):
return os.path.join(os.sep, "proc", "sys", *name.split("."))
def read(name):
with open(_build_path(name)) as f:
data = f.read().strip()
if data.isdigit:
return int(data)
else:
return data
def write(name, value):
with open(_build_path(name), "w") as f:
f.write(str(value))
defence360agent/subsys/systemd_notifier.py 0000644 0000000 0000000 00000003360 00000000000 016041 0 ustar """Notify systemd about process state"""
import logging
import os
import socket
from defence360agent.contracts.config import ANTIVIRUS_MODE
logger = logging.getLogger(__name__)
_notify_socket_addr = None
_socket_detached = False
class AgentState(object):
"""Allowed agent state for notifying systemd."""
READY = "READY=1"
STARTING = "STATUS=Starting main process"
MIGRATING = "STATUS=Applying database migrations"
DAEMONIZED = "STATUS=Demonized"
def _take_notify_socket():
# Capture $NOTIFY_SOCKET once and drop it from the environment, so child
# processes (systemctl and other libsystemd-aware tools) do not inherit it
# and emit sd_notify datagrams systemd cannot attribute to this unit.
global _notify_socket_addr, _socket_detached
if not _socket_detached:
_notify_socket_addr = os.environ.pop("NOTIFY_SOCKET", None)
_socket_detached = True
return _notify_socket_addr
def notify(state):
"""
Send notification to systemd, allowed formats described here
https://www.freedesktop.org/software/systemd/man/sd_notify.html
For example:
notify("STATUS=Almost ready")
"""
if ANTIVIRUS_MODE:
return
addr = _take_notify_socket()
if not addr:
return
# systemd uses the abstract socket namespace when the path begins with '@'.
connect_addr = "\0" + addr[1:] if addr.startswith("@") else addr
try:
with socket.socket(
socket.AF_UNIX, socket.SOCK_DGRAM | socket.SOCK_CLOEXEC
) as sock:
sock.connect(connect_addr)
sock.sendall(state.encode())
except OSError as e:
logger.exception(
"some problem has occurred during notifying of systemd: %s",
e,
)
defence360agent/subsys/web_server.py 0000644 0000000 0000000 00000065735 00000000000 014633 0 ustar import asyncio
import functools
import inspect
import io
import logging
import os
import re
import shlex
import shutil
import string
import xml.etree.ElementTree as ET
from contextlib import suppress
from contextvars import ContextVar
from datetime import timedelta
from packaging.version import Version
from pathlib import Path
from subprocess import CalledProcessError, check_call, check_output, DEVNULL
from typing import Any, Callable, List, Optional, Set, Tuple, Iterable
import psutil
from defence360agent.api.integration_conf import IntegrationConfig
from defence360agent.application.determine_hosting_panel import (
is_generic_panel_installed,
is_plesk_installed,
)
from defence360agent.internals.global_scope import g
from defence360agent.utils import (
async_lru_cache,
atomic_rewrite,
check_run,
get_system_user_names,
OsReleaseInfo,
CheckRunError,
TimedCache,
BACKUP_EXTENSION,
)
from defence360agent.utils.common import webserver_gracefull_restart
GRACEFUL_RESTART_MIN_PERIOD = int(
os.environ.get("IM360_GRACEFUL_RESTART_MIN_PERIOD", 5 * 60)
) # seconds
"""
how many seconds should pass minimum between web server restarts.
"""
CPANEL_RESTART_APACHE_SCRIPT = "/usr/local/cpanel/scripts/restartsrv_httpd"
# according to LS docs https://www.litespeedtech.com/docs/webserver/admin
LITESPEED_PID_FILE_PATH = Path("/tmp/lshttpd/lshttpd.pid")
LITESPEED_RESTART_CMD = ("/usr/local/lsws/bin/lswsctrl", "condrestart")
# Recovery needs an unconditional restart: condrestart is a no-op when the
# server is down, which is exactly when the hard restart runs.
LITESPEED_HARD_RESTART_CMD = ("/usr/local/lsws/bin/lswsctrl", "restart")
LITESPEED_CONF_PATH = "/usr/local/lsws/conf/httpd_config.xml"
LITESPEED_BIN_PATH = "/usr/local/lsws/bin/litespeed"
APACHE2_BIN_PATH = "/usr/sbin/apache2"
HTTPD_BIN_PATH = "/usr/sbin/httpd"
apache_version_regexp = re.compile(r"Server version:.*(\d+\.\d+\.\d+)")
BYTE_SPACES = tuple(x.encode() for x in list(string.whitespace))
APACHE = "apache"
logger = logging.getLogger(__name__)
class NotRunningError(RuntimeError):
"""
Error for cases when the web server is expected to be running but it
is not.
"""
class ConfigInvalidError(RuntimeError):
"""
Error used to indicate that the web server config is having error(s).
"""
class LiteSpeedConfig:
CLIENT_IP_IN_HEADER_TAG = "useIpInProxyHeader"
SECURITY_TAG = "security"
ACCESS_CONTROL_TAG = "accessControl"
ACCESS_CONTROL_ALLOWED_TAG = "allow"
ACCESS_CONTROL_DENIED_TAG = "deny"
CLIENT_IP_IN_HEADER_DISABLED = 0
CLIENT_IP_IN_HEADER_ENABLED = 1
CLIENT_IP_IN_HEADER_TRUSTED_IP_ONLY = 2
def __init__(self, content):
self.config = ET.fromstring(content)
def client_ip_in_header(self) -> int:
element = self.config.find(self.CLIENT_IP_IN_HEADER_TAG)
if element is None or not element.text:
return self.CLIENT_IP_IN_HEADER_DISABLED
return int(element.text)
def set_client_ip_in_header(self, value: int):
element = self.config.find(self.CLIENT_IP_IN_HEADER_TAG)
if element is None:
element = ET.Element(self.CLIENT_IP_IN_HEADER_TAG)
self.config.append(element)
element.text = str(value)
def access_control_allowed_list(self) -> Set[Tuple[str, bool]]:
element = self.config.find(
"/".join(
[
".",
self.SECURITY_TAG,
self.ACCESS_CONTROL_TAG,
self.ACCESS_CONTROL_ALLOWED_TAG,
]
)
)
if element is not None and element.text:
return {
(item[:-1] if item.endswith("T") else item, item.endswith("T"))
for s in element.text.split()
for item in s.split(",")
if item
}
return set()
def set_access_control_allowed_list(self, allowed):
items = [item[0] + "T" if item[1] else item[0] for item in allowed]
value = ",".join(items)
element = self.config.find(
"/".join(
[
".",
self.SECURITY_TAG,
self.ACCESS_CONTROL_TAG,
self.ACCESS_CONTROL_ALLOWED_TAG,
]
)
)
if element is None:
element = ET.Element(self.ACCESS_CONTROL_ALLOWED_TAG)
access_control = self.config.find(
"/".join(
[
".",
self.SECURITY_TAG,
self.ACCESS_CONTROL_TAG,
]
)
)
if access_control is None:
access_control = ET.Element(self.ACCESS_CONTROL_TAG)
security = self.config.find(self.SECURITY_TAG)
if security is None:
security = ET.Element(self.SECURITY_TAG)
self.config.append(security)
security.append(access_control)
access_control.append(element)
element.text = value
def tostring(self) -> bytes:
buf = io.BytesIO()
tree = ET.ElementTree(self.config)
tree.write(buf, encoding="utf-8", xml_declaration=True)
return buf.getvalue()
def _get_litespeed_pid():
"""Return LiteSpeed's pid or None if it can't be read."""
with suppress(OSError, ValueError):
return int(LITESPEED_PID_FILE_PATH.read_bytes())
def litespeed_running():
"""
Litespeed use constant PID file path, so using it to determinate status
:return bool
"""
pid = _get_litespeed_pid()
try:
return bool(pid and psutil.pid_exists(pid))
except OverflowError:
return False
def _litespeed_bin() -> str:
# /usr/local/lsws/bin is not on the agent service PATH, so which() misses
# it there; fall back to the documented install location.
return shutil.which("litespeed") or LITESPEED_BIN_PATH
def apache_running() -> Optional[str]:
"""
Finding process with name 'httpd' which belongs to system user.
:return str: path to the apache binary if it is running
:return None: if apache is not running
"""
info = _apache_running_process()
return info["httpd_bin"] if info else None
async def apache_binary_call(*args) -> bytes:
httpd_bin = apache_running()
if not httpd_bin:
raise NotRunningError("Apache is not running")
try:
if (
OsReleaseInfo.id_like() & OsReleaseInfo.DEBIAN
and Path("/etc/apache2/envvars").exists()
):
# on Debian OS apache requires some env variables
# that are set in /etc/apache2/envvars (see DEF-6844)
stdout = await check_run(
". /etc/apache2/envvars && {} {}".format(
shlex.quote(httpd_bin), shlex.join(args)
),
shell=True,
)
else:
stdout = await check_run([httpd_bin, *args])
except CheckRunError:
logger.warning("Apache doesn't work properly")
return b""
return stdout
def _apache_running_process(*, exclude_users=frozenset()):
"""
Finding process with name 'httpd' which belongs to system user.
Return process info for the apache binary if it is running.
Return None if apache is not running
"""
# Cpanel works on rpm based os and uses packages
# according documentation https://documentation.cpanel.net/display/EA4/Apache # noqa
# httpd binary is /usr/sbin/httpd
# Plesk/Generic uses pkgs from os
# so it has /usr/sbin/httpd on rpm based os and /usr/sbin/apache2 on debian
# DirectAdmin uses custombuild
# It's httpd binary is /usr/sbib/httpd
def is_generic_panel_on_apache():
if is_generic_panel_installed():
return IntegrationConfig.get("web_server", "server_type") == APACHE
return False
if (OsReleaseInfo.id_like() & OsReleaseInfo.DEBIAN) and (
is_plesk_installed() or is_generic_panel_on_apache()
):
httpd_bin = APACHE2_BIN_PATH
else:
httpd_bin = HTTPD_BIN_PATH
sys_users = set(get_system_user_names()) - exclude_users
info = _apache_running_process_info(sys_users)
if info:
assert info["exe"] is not None
info["httpd_bin"] = httpd_bin
try:
httpd_process_exe = info["exe"]
if os.path.samefile(httpd_bin, httpd_process_exe):
return info
except OSError as exc:
logger.info("Can't determine apache bin path: %s", exc)
return None
def _apache_running_process_info(sys_users):
"""Retry process_iter() on IndexError."""
for _ in range(2): # retry
with suppress(IndexError):
return next(
(
p.info
for p in psutil.process_iter(
attrs=["name", "username", "exe", "uids", "gids"]
)
if (
p.info["exe"] is not None # non ad_value
and p.info["exe"].endswith(("/httpd", "/apache2"))
and p.info["username"] in sys_users
)
),
None,
)
def chown(path):
"""Make web server user/group own *path*."""
info = _apache_running_process(exclude_users={"root"})
if not info:
raise NotRunningError(
"Can't find running apache process without root owner."
)
os.chown(path, info["uids"][0], info["gids"][0])
def find_running_nginx():
"""Return path to a running nginx binary or None if not found."""
return next(
(
p.info["exe"]
for p in psutil.process_iter(attrs=["name", "username", "exe"])
if (
p.info["name"] is not None # non ad_value
and p.info["name"].endswith("nginx")
and p.info["exe"] is not None # non ad_value
and "nginx" in p.info["exe"]
and p.info["username"] in ("nginx", "www-data")
)
),
None,
)
async def check_with_timeout(
webserver_running_cb: Callable[[], Any],
timeout_sec=10,
granularity: int = 10,
):
assert granularity > 0
for _ in range(granularity):
result = webserver_running_cb()
if result:
return result
await asyncio.sleep(timeout_sec / granularity)
else:
return result
def is_EA4_available():
"""
though, available != running
:return bool:
"""
return os.path.isfile("/etc/cpanel/ea4/is_ea4")
def _apache_graceful_restart_cmd(apachectl) -> List[str]:
"""
:return list: command which can be passed to check_call(..., shell=False)
'apache2 -k graceful' will not work for Ubuntu
and will produce
'Invalid Mutex directory in argument file:${APACHE_LOCK_DIR}' error.
https://serverfault.com/questions/558283/apache2-config-variable-is-not-defined
That is why this specialization for Ubuntu graceful restart.
""" # noqa
restartsrv_httpd = shutil.which(CPANEL_RESTART_APACHE_SCRIPT)
if restartsrv_httpd: # use cpanel specific script if found
return [restartsrv_httpd]
if OsReleaseInfo.id_like() & OsReleaseInfo.DEBIAN:
# see DEF-16795 for details
return [
"systemctl",
"reload",
"--job-mode=replace-irreversibly",
os.path.basename(apachectl),
]
else:
return [apachectl, "-k", "graceful"]
def _graceful_restart_cmd_from_integration_conf() -> Optional[Iterable[str]]:
if IntegrationConfig.exists():
# Fallback on regular restart techniques
# in case of missing restart script.
try:
restart_script = IntegrationConfig.to_dict()["web_server"][
"graceful_restart_script"
]
except KeyError:
logger.warning(
"Integration config is missing graceful_restart_script field"
)
else:
if not restart_script:
logger.warning(
"graceful_restart_script option is empty",
)
return None
cmd = restart_script.split()
if os.path.exists(cmd[0]):
return cmd
logger.warning(
"Web server restart script does not exist: %s",
restart_script,
)
return None
# systemd-run gained --wait (synchronous transient units that propagate the
# child's exit code) in v232. CL7/CentOS7 ship systemd 219 and lack it, so
# reload confirmation falls back to a config test there.
_SYSTEMD_RUN_WAIT_MIN_VERSION = 232
@functools.lru_cache(maxsize=1)
def _systemd_run_supports_wait() -> bool:
systemd_run = shutil.which("systemd-run")
if not systemd_run:
return False
try:
out = check_output([systemd_run, "--version"], stderr=DEVNULL).decode()
except (OSError, CalledProcessError):
return False
match = re.search(r"systemd\s+(\d+)", out)
return match is not None and (
int(match.group(1)) >= _SYSTEMD_RUN_WAIT_MIN_VERSION
)
def _systemd_run_prefix(wait: bool) -> List[str]:
# Do not restart web server in the agent cgroup
# (to avoid attaching its processes to it).
prefix: List[str] = []
if systemd_run := shutil.which("systemd-run"):
prefix += [
systemd_run,
"-p",
"SendSIGKILL=no",
"--slice=graceful_restart",
]
if wait and _systemd_run_supports_wait():
prefix.append("--wait")
prefix.append("--")
return prefix
def _graceful_restart_cmd(wait: bool = False) -> Iterable[str]:
"""Gracefully restart a web server."""
prefix = _systemd_run_prefix(wait)
cmd = _graceful_restart_cmd_from_integration_conf()
if cmd is not None:
return prefix + list(cmd)
if litespeed_running():
return prefix + list(LITESPEED_RESTART_CMD)
if apachectl := apache_running():
return prefix + _apache_graceful_restart_cmd(apachectl)
raise RuntimeError("Could not detect a web server")
def _litespeed_installed() -> bool:
return os.path.exists(LITESPEED_CONF_PATH)
def _apache_systemd_unit() -> Optional[str]:
"""systemd unit for this host's Apache, or None when the host is not
Apache-based. Derived from OS/panel, not a running process — recovery
runs precisely when the server is not alive."""
on_generic_apache = False
if is_generic_panel_installed():
try:
server_type = IntegrationConfig.get("web_server", "server_type")
except KeyError:
return None
if server_type != APACHE:
return None
on_generic_apache = True
if (OsReleaseInfo.id_like() & OsReleaseInfo.DEBIAN) and (
is_plesk_installed() or on_generic_apache
):
return os.path.basename(APACHE2_BIN_PATH)
return os.path.basename(HTTPD_BIN_PATH)
def _hard_restart_cmd(wait: bool = True) -> Iterable[str]:
"""Full (non-graceful) restart to bring a web server back up after a
reload left it down. Detects the server by install/config presence (not a
running process, which may be down) and raises when no safe command is
known (e.g. generic nginx, which has only a graceful integration script).
"""
prefix = _systemd_run_prefix(wait)
if _litespeed_installed():
return prefix + list(LITESPEED_HARD_RESTART_CMD)
if restartsrv_httpd := shutil.which(CPANEL_RESTART_APACHE_SCRIPT):
return prefix + [restartsrv_httpd, "--restart"]
unit = _apache_systemd_unit()
if unit is None:
raise RuntimeError("No safe hard-restart command for this web server")
return prefix + ["systemctl", "restart", unit]
def _configtest_cmd() -> Iterable[str]:
if is_generic_panel_installed():
try:
cmd = IntegrationConfig.get("web_server", "config_test_script")
if cmd:
return cmd.split()
except KeyError:
# if setting is not present, fall back to default detection
pass
if apache_bin := apache_running():
if OsReleaseInfo.id_like() & OsReleaseInfo.DEBIAN:
return ["apachectl", "configtest"]
return [apache_bin, "-t"]
elif litespeed_running():
return [_litespeed_bin(), "-t"]
elif nginx_bin := find_running_nginx():
return [nginx_bin, "-t"]
raise RuntimeError("Could not detect a web server")
_graceful_restart_caller = ContextVar("graceful_restart_caller")
async def safe_update_config(config_path, new_config: str) -> bool:
"""
Update Web-server config with fallback in case of an error happens.
It tries to do all the best but because of graceful_restart() the
faulty config might still be applied but in practice it is barely
probable (because of premature config check).
1. The new config is checked before to be applied.
2. The new config (if checked valid) is atomically applied.
3. The graceful Web-server restart is scheduled. It may hold the actual
restart for some time, but it is a required workaround
of a litespeed issue.
4. If the Web-server failed to restart the config is reverted.
Return value: True if no errors (at least up to the server restart),
False if There was an error and config was reverted.
Note: It is possible that the config may be reverted even when return
value is True. It is because the graceful_restart may delay the actual
restart and config may be reverted on that (delayed) stage.
"""
config_backup_path = os.fspath(config_path) + BACKUP_EXTENSION
def remove_backup():
with suppress(FileNotFoundError):
os.unlink(config_backup_path)
make_backup = os.path.exists(config_path)
if not atomic_rewrite(config_path, new_config, backup=make_backup):
# nothing has changed => no need to restart
return True
def revert():
try:
os.rename(config_backup_path, config_path)
except FileNotFoundError:
# truncate file if backup does not exist
open(config_path, "w").close()
try:
await configtest(raise_exception=True)
except ConfigInvalidError as e:
logger.error("Web server config is invalid: %s", e)
revert()
else:
try:
restart_cmd = _graceful_restart_cmd()
except RuntimeError as e:
logger.error("Failed to get graceful restart command: %s", e)
revert()
return False
loop = asyncio.get_running_loop()
def restart_callback(task):
def log_config_error(fut):
if not fut.cancelled() and fut.exception() is not None:
logger.critical(
"The reverted config seems to be invalid",
exc_info=fut.exception(),
)
def log_uncaught_exception(fut):
if not fut.cancelled() and fut.exception() is not None:
logger.critical(
"uncaught exception", exc_info=fut.exception()
)
if not task.cancelled() and task.exception() is not None:
logger.error(
"Web server failed to start... Revert changes back. (%s)",
task.exception(),
)
revert()
task = loop.create_task(configtest(raise_exception=True))
task.add_done_callback(log_config_error)
# the least we can do is to try to restart
task = loop.create_task(_graceful_restart(restart_cmd))
task.add_done_callback(log_uncaught_exception)
else:
remove_backup()
graceful_restart = webserver_gracefull_restart.coalesce_calls(
GRACEFUL_RESTART_MIN_PERIOD, done_callback=restart_callback
)(_graceful_restart)
caller_frame = inspect.stack()[1]
context_token = _graceful_restart_caller.set(caller_frame.function)
try:
await graceful_restart(restart_cmd)
finally:
_graceful_restart_caller.reset(context_token)
logger.info("Successfully scheduled web server restart")
return True
return False
async def _graceful_restart(restart_cmd=None):
"""
Gracefully restart a web server.
If web server cannot be detected, do nothing.
"""
_log_graceful_restart_start()
try:
await check_run(restart_cmd or _graceful_restart_cmd())
except RuntimeError as err:
logger.warning("Could not restart a Web server: %s", err)
else:
logger.info("Successfully restarted web server")
@webserver_gracefull_restart.coalesce_calls(GRACEFUL_RESTART_MIN_PERIOD)
async def _graceful_restart_coalesced(restart_cmd=None):
task = _graceful_restart(restart_cmd)
g.web_server_restart_task = task
try:
return await task
finally:
g.pop("web_server_restart_task")
async def graceful_restart(restart_cmd=None):
"""
Gracefully restart a web server.
If web server cannot be detected, do nothing.
"""
caller_frame = inspect.stack()[1]
context_token = _graceful_restart_caller.set(caller_frame.function)
try:
result = await _graceful_restart_coalesced(restart_cmd)
finally:
_graceful_restart_caller.reset(context_token)
return result
def _log_graceful_restart_start():
caller = _graceful_restart_caller.get("unknown")
logger.info("Performing web server graceful restart, from %s", caller)
def graceful_restart_sync():
"""
Gracefully restart a web server synchronously.
If web server cannot be detected, do nothing.
"""
caller_frame = inspect.stack()[1]
context_token = _graceful_restart_caller.set(caller_frame.function)
try:
_log_graceful_restart_start()
finally:
_graceful_restart_caller.reset(context_token)
try:
check_call(_graceful_restart_cmd(), stdout=DEVNULL, stderr=DEVNULL)
except RuntimeError as err:
logger.warning("Could not restart a Web server: %s", err)
else:
logger.info("Successfully restarted web server")
async def graceful_restart_confirmed() -> bool:
"""Graceful web-server restart that confirms the reload actually completed
and recovers the server if it did not.
Unlike graceful_restart() it bypasses the coalesce throttle (the
post-update reload must never be dropped); unlike graceful_restart_sync()
it observes the reload outcome instead of returning as soon as systemd-run
queues the transient unit.
"""
caller_frame = inspect.stack()[1]
context_token = _graceful_restart_caller.set(caller_frame.function)
try:
_log_graceful_restart_start()
finally:
_graceful_restart_caller.reset(context_token)
try:
cmd = _graceful_restart_cmd(wait=True)
except RuntimeError as err:
logger.warning("Could not restart a Web server: %s", err)
return False
if await _reload_confirmed(cmd):
logger.info("Successfully restarted web server")
return True
logger.error(
"Web server reload after update did not complete cleanly;"
" attempting recovery"
)
await _log_failed_configtest()
if await _reload_confirmed(cmd):
logger.info("Web server recovered on graceful reload retry")
return True
return await _hard_restart()
async def _reload_confirmed(cmd) -> bool:
"""Run *cmd* and report whether the reload truly succeeded.
With systemd-run --wait the exit code already reflects completion; on
older systemd (no --wait) the reload is fire-and-forget, so fall back to
a config test to detect a broken reload.
"""
try:
await check_run(cmd)
except (CheckRunError, RuntimeError) as err:
logger.warning("Web server reload returned an error: %s", err)
return False
if _systemd_run_supports_wait():
return True
try:
await configtest(raise_exception=True)
except ConfigInvalidError:
return False
return True
async def _log_failed_configtest() -> None:
# The crash is otherwise invisible in the agent log — only Apache's own
# error_log records the failed graceful reload.
try:
await configtest(raise_exception=True)
except ConfigInvalidError as err:
logger.error("Web server config test failed after update: %s", err)
async def _hard_restart() -> bool:
try:
cmd = _hard_restart_cmd(wait=True)
except RuntimeError as err:
logger.error("Cannot recover web server: %s", err)
return False
try:
await check_run(cmd)
except (CheckRunError, RuntimeError) as err:
logger.error("Web server hard restart failed: %s", err)
return False
logger.info("Web server hard-restarted after failed reload")
return True
async def configtest(raise_exception=False):
"""
Check web server's config file.
If web server cannot be detected, do nothing.
"""
logger.info("Performing web server config test")
try:
await check_run(_configtest_cmd(), raise_exc=ConfigInvalidError)
except RuntimeError as err:
logger.warning("Could not run configtest: %s", err)
if raise_exception:
raise ConfigInvalidError("Failed to check config") from err
def _parse_apache_version_output(output):
match = apache_version_regexp.search(output)
if match is not None:
return Version(match.group(1))
else:
raise ValueError(
"Failed to parse apache version string: {}".format(output)
)
def _parse_apache_module_list(output: bytes) -> List[bytes]:
"""
Parse response of httpd -M
:param output: stdout of httpd -M (with spaces before module name)
Output example:
Loaded Modules:
core_module (static)
so_module (static)
http_module (static)
mpm_prefork_module (shared)
:return: list with installed modules
"""
return [
line.strip().split()[0]
for line in output.splitlines()
if line.startswith(BYTE_SPACES)
]
def _parse_includes(dump):
includes = []
for line in dump.decode().split("\n"):
index = line.find("/")
if index > 0:
includes.append(line[index:].strip())
return includes
async def dump_includes():
try:
return _parse_includes(
await check_run(["apachectl", "-t", "-D", "DUMP_INCLUDES"])
)
except FileNotFoundError:
return []
@async_lru_cache(maxsize=1)
async def apache_version():
apache_bin = apache_running()
if apache_bin is None:
raise NotRunningError("Apache is not running")
out = await check_run([apache_bin, "-v"])
version = _parse_apache_version_output(out.decode())
logger.info("Apache %s version detected", version)
return version
@TimedCache(
expiration=timedelta(
seconds=int(
os.environ.get("IMUNIFY360_APACHE_MODULES_CACHE_TIMEOUT", 600)
)
)
)
async def apache_modules():
stdout = await apache_binary_call("-M")
return _parse_apache_module_list(stdout)
defence360agent/utils/ 0000755 0000000 0000000 00000000000 00000000000 011706 5 ustar defence360agent/utils/__init__.py 0000644 0000000 0000000 00000202325 00000000000 014023 0 ustar import asyncio
import base64
import errno
import functools
import hashlib
import itertools
import logging
import os
import pwd
import re
import shlex
import shutil
import signal
import stat
import subprocess as _subprocess
import time
import urllib.request
from asyncio import Future
from collections import OrderedDict, deque
from collections.abc import Generator, Iterable
from contextlib import ExitStack, contextmanager, suppress
from datetime import timedelta
from enum import Enum
from fcntl import LOCK_EX, LOCK_NB, LOCK_UN, flock
from functools import wraps
from itertools import islice
from pathlib import Path
from tempfile import NamedTemporaryFile
from typing import (
Any,
Awaitable,
Callable,
Dict,
FrozenSet,
List,
Tuple,
TypeVar,
)
import async_lru
import distro
import psutil
from peewee import OperationalError
from ._shutil import is_safe_subdir_name, rmtree # noqa: F401
from .fd_ops import atomic_rewrite_fd
F = TypeVar("F", bound=Callable)
logger = logging.getLogger(__name__)
USER_IDENTITY_FIELD = "user_id"
USER_IDENTITY_HEADERS = (
"User-Agent",
"Accept-Language",
"Accept-Encoding",
"Connection",
"DNT",
)
_MIN_UID = -1
BACKUP_EXTENSION = ".i360bak"
_SYSTEMD_BOOTED_DIR = Path("/run/systemd/system")
_CL_SOLO_EDITION_FILE = "/etc/cloudlinux-edition-solo"
AV_PID_PATH = Path("/var/run/imunify-antivirus.pid")
IM360_NON_RESIDENT_PID_PATH = Path("/var/run/imunify360-agent.pid")
IM360_RESIDENT_PID_PATH = Path("/var/run/imunify360.pid")
HTTP_REQUEST_RETRY_TIMEOUT = int(
os.environ.get("IMUNIFY360_HTTP_REQUEST_RETRY_TIMEOUT", 60) # 1 minute
)
class Scope(Enum):
AV = "AV only"
AV_IM360 = "AV and IM360"
IM360 = "IM360 only"
IM360_RESIDENT = "IM360 resident only"
@functools.lru_cache(maxsize=1)
def is_systemd_boot():
"""Return True if /run/systemd/system folder exists:
[sd_booted]
(https://www.freedesktop.org/software/systemd/man/sd_booted.html)
"""
return (
_SYSTEMD_BOOTED_DIR.exists()
and _SYSTEMD_BOOTED_DIR.is_dir()
and not _SYSTEMD_BOOTED_DIR.is_symlink()
)
@contextmanager
def timeit(action, logger_=None, log=None):
"""
:param str: action name to log
:param logging.Logger: logger you want action name and timing
to be logged with
:param func: log function to use (`log` has preference over `logger_`)
"""
assert logger_ or log
start = time.monotonic()
(log or logger_.debug)("%s started", action)
yield
stop = time.monotonic()
(log or logger_.debug)("%s took %.2f second(s)", action, stop - start)
def timefun(logger_=logger, action=None, log=None):
def decorator(fun):
@functools.wraps(fun)
async def wrapper(*args, **kwargs):
with timeit(action or fun.__name__, logger_=logger_, log=log):
return await fun(*args, **kwargs)
return wrapper
return decorator
class sync:
"""
the same timefun decorator variation but without async/await
"""
@staticmethod
def timefun(logger_=logger, action=None, log=None):
"""
:param logging.Logger: logger you want action name and timing
to be logged with
:param str: action name to log
"""
def decorator(fun):
@functools.wraps(fun)
def wrapper(*args, **kwargs):
with timeit(action or fun.__name__, logger_=logger_, log=log):
return fun(*args, **kwargs)
return wrapper
return decorator
async def run(
command,
stdin=None,
stdout=_subprocess.PIPE,
stderr=_subprocess.PIPE,
shell=False,
input=None,
**kwargs,
) -> Tuple[int, bytes, bytes]:
"""Asynchronous command executor.
Returns a tuple (exit_code, stdout_data, stderr_data)."""
if input is not None:
if stdin is not None: # pragma: no cover
raise ValueError("stdin and input arguments may not both be used.")
stdin = _subprocess.PIPE
if shell:
assert isinstance(command, str)
command = [command]
create_subprocess = asyncio.create_subprocess_shell
else:
assert isinstance(command, (list, tuple))
create_subprocess = asyncio.create_subprocess_exec # type: ignore
proc = await retry_on(
BlockingIOError, max_tries=2, on_error=await_for(seconds=1)
)(
create_subprocess
)( # type: ignore
*command,
stdin=stdin,
stdout=stdout,
stderr=stderr,
start_new_session=True,
**kwargs,
)
out, err = await proc.communicate(input)
exit_code = await proc.wait()
logger.debug(
"run(%s, stdin=%s, shell=%s) = %s",
command,
stdin,
shell,
(exit_code, out, err),
)
return exit_code, out, err
def run_coro(coro, *, loop=None, timeout=None):
"""Run coroutine from a blocking code (outside the event loop).
Coroutine will be wrapped in Task.
"""
if loop is None:
for _ in range(2):
try:
loop = asyncio.get_event_loop()
except RuntimeError: # no loop in the main thread
pass
else:
if not loop.is_closed():
break
asyncio.set_event_loop(asyncio.new_event_loop())
return loop.run_until_complete(
asyncio.wait_for(
coro if isinstance(coro, asyncio.Future) else asyncio.Task(coro),
timeout=timeout,
)
)
class CheckRunError(_subprocess.CalledProcessError):
def __str__(self):
_MESSAGE = (
"Command {cmd!r} returned non-zero code {returncode},\n"
"\t\tStdout: {output},\n"
"\t\tStderr: {error}\n"
)
return _MESSAGE.format(
cmd=self.cmd,
returncode=self.returncode,
output=self.output.decode() or None,
error=self.stderr.decode() or None,
)
async def check_run(command, raise_exc=CheckRunError, **kwargs) -> bytes:
"""
Asynchronous command executor.
Returns output as bytestring.
"""
returncode, out, err = await run(command, **kwargs)
if returncode != 0:
raise raise_exc(returncode, command, out, err)
return out
async def check_exit_code(command, raise_exc=CheckRunError) -> None:
"""
Asynchronous command executor. Raises raise_exc if exit code is nonzero.
Stdin, stdout and stderr of command are connected to /dev/null.
"""
code, _, _ = await run(
command,
stdin=_subprocess.DEVNULL,
stdout=_subprocess.DEVNULL,
stderr=_subprocess.DEVNULL,
)
if code != 0:
raise raise_exc(code, command)
async def safe_run(command, check_returncode=True, **kwargs) -> str:
"""Safe run command.
Returns stdout as string or empty string on error"""
try:
rc, out, err = await run(command, **kwargs)
except OSError:
logger.warning("Command %s failed with OSError", command)
return ""
if check_returncode and rc != 0:
logger.warning(
"Command %s failed with exit code %s: %s", command, rc, err
)
return ""
try:
result = out.strip().decode()
except UnicodeDecodeError:
logger.warning("Command %s returned non-utf8 output", command)
return ""
return result
def plainold_lazy_init(decorated_f):
"""non asyncio vesion of lazy init"""
placeholder = None
def wrapper():
nonlocal placeholder
if placeholder is None:
placeholder = decorated_f()
return placeholder
return wrapper
class PeriodicCheck:
"""
Invoke a callback with a certain period
and return cached result in between.
Raising an exception from the callback does not
affect the next check schedule.
"""
def __init__(self, cb_coro, check_every_n_seconds):
self._cb_coro = cb_coro
self._check_every_n_seconds = check_every_n_seconds
self._last_check_timestamp = time.monotonic() - check_every_n_seconds
self._last_check_result = None
self._lock = plainold_lazy_init(asyncio.Lock)
async def __call__(self, *args, **kwargs):
async with self._lock():
delta = time.monotonic() - self._last_check_timestamp
if delta >= self._check_every_n_seconds:
logger.debug(
"Timeout %d seconds has expired, doing the check: %s",
self._check_every_n_seconds,
self._cb_coro,
)
self._last_check_timestamp = time.monotonic()
self._last_check_result = await self._cb_coro(*args, **kwargs)
return self._last_check_result
def cache_result(nsec):
def decorate(coro):
return PeriodicCheck(coro, nsec)
return decorate
class RecurringCheckStop(Exception):
"""
raised by coroutine to stop recurring_check loop
"""
pass
async def wait_for_period(period, **period_kwargs):
try:
if callable(period):
await asyncio.sleep(period(**period_kwargs))
else:
await asyncio.sleep(period)
return False
except asyncio.CancelledError:
return True
async def should_stop_after_period_passed(check, period, **period_kwargs):
return (
await wait_for_period(period, **period_kwargs)
if period and check
else False
)
def recurring_check(
period, consecutive_err_limit=10, check_period_first=False, **period_kwargs
):
"""
run decorated corotine in a loop every :period: seconds.
If more then consecutive_err_limit error occured, exit loop.
:param period:
:param consecutive_err_limit:
:param check_period_first: default false
:return:
"""
def decorator(fun):
@wraps(fun)
async def wrapped(*args, **kwargs):
consecutive_err_cnt = 0
while True:
if await should_stop_after_period_passed(
check_period_first, period, **period_kwargs
):
break
try:
await fun(*args, **kwargs)
except RecurringCheckStop:
if "lock_file" in kwargs:
try:
if isinstance(kwargs["lock_file"], Path):
kwargs["lock_file"].unlink()
except FileNotFoundError:
pass
break
except asyncio.CancelledError:
break
except Exception as exc:
consecutive_err_cnt += 1
if consecutive_err_cnt > consecutive_err_limit:
logger.exception(
"Error count exceeded limit,exiting check loop"
)
break
if isinstance(exc, _subprocess.CalledProcessError):
logger.exception(
"Failed to run %s (%s). stdout=%s, stderr=%s",
exc.cmd,
exc.returncode,
exc.output,
exc.stderr,
)
else:
logger.exception("Error executing %s", fun)
else:
consecutive_err_cnt = 0
if await should_stop_after_period_passed(
not check_period_first, period, **period_kwargs
):
break
return wrapped
return decorator
def atomic_rewrite(
filename,
data,
/, # ^^ positional-only for backward compatibility
*,
backup: bool | str | os.PathLike = True,
uid=None,
gid=None,
allow_empty_content=True,
permissions=None,
dir_fd: int | None = None,
) -> bool:
"""Atomically rewrites *filename* with given *data*.
If *filename*'s content is *data* already, do nothing.
If both *uid* and *gid* are given then resulting file is chowned
to given user id and group id.
Skip rewrite with empty content if *allow_empty_content* is False.
Chmod to given access *permissions* else preserve *filename* 's
permissions.
Return True if *filename* file was updated, False otherwise
When *dir_fd* is provided it must be an O_NOFOLLOW-opened file
descriptor for the parent directory of *filename*. All file I/O is
then performed relative to that descriptor, closing the TOCTOU
symlink-attack window. *backup* is not supported with *dir_fd*.
"""
if isinstance(data, str):
data = data.encode()
if dir_fd is not None:
if backup:
raise ValueError("backup is not supported when dir_fd is provided")
return atomic_rewrite_fd(
filename,
data,
uid=uid,
gid=gid,
allow_empty_content=allow_empty_content,
permissions=permissions,
dir_fd=dir_fd,
)
with suppress(FileNotFoundError):
with open(filename, "rb") as file:
old_content = file.read(len(data) + 1)
if old_content == data:
return False
if not allow_empty_content and not data:
logger.error("empty content: %r for file: %s", data, filename)
return False
if backup:
if isinstance(backup, (str, os.PathLike)):
backup_filename = backup
else:
backup_filename = os.fspath(filename) + BACKUP_EXTENSION
# First-write case: nothing to back up if the target doesn't exist yet.
with suppress(FileNotFoundError):
shutil.copy(filename, backup_filename)
if permissions is None: # get filename's access permissions
try:
permissions = stat.S_IMODE(os.stat(filename).st_mode)
except FileNotFoundError: # input file doesn't exists
# derive permissions from umask
current_umask = os.umask(0) # can't get it without setting
os.umask(current_umask)
permissions = 0o666 & ~current_umask
dirpath, basename = os.path.split(filename)
if not Path(dirpath).exists():
raise FileNotFoundError(f"Parent dir is missing: {dirpath!r}")
with ExitStack() as stack:
with NamedTemporaryFile(
mode="wb",
dir=dirpath,
suffix=".i360edit",
prefix=basename + "_",
buffering=0,
delete=False,
) as tf:
def cleanup():
with suppress(FileNotFoundError):
os.remove(tf.name)
stack.callback(cleanup) # clean it up in case of any error
tf.write(data)
tf.flush()
if uid is not None and gid is not None:
os.chown(tf.fileno(), uid, gid)
# note: NamedTemporaryFile always sets 0b600
os.chmod(tf.fileno(), permissions)
# avoid partial/empty data on crash
os.fsync(tf.fileno())
os.rename(tf.name, filename)
stack.pop_all() # success, don't call cleanup
# no attempt to ensure that filename is written to disk
# (dir is not fsync-ed)
return True
@functools.lru_cache(1)
def os_release_and_version():
try:
return Path("/etc/system-release").read_text().rstrip()
except OSError:
return None
def os_version(release_and_version=None) -> str:
"""Return os version, if can't get it raise ValueError"""
rv = release_and_version or os_release_and_version()
if rv:
match = re.search(r"\s*(\d+\.\d+\S*)(\s|$)", rv)
if match:
return match.group(1)
else:
os_release_and_version.cache_clear()
raise ValueError("Can't discover os version from %r" % rv)
class OsReleaseInfo:
ETC_OS_RELEASE = "/etc/os-release"
DEBIAN = frozenset(("debian",))
RHEL_FEDORA_CENTOS = frozenset(("rhel", "fedora", "centos"))
UNKNOWN = frozenset(("unknown",))
dict_ = None
@classmethod
def dict_from_file(cls, dict_):
with open(cls.ETC_OS_RELEASE) as f:
for line in f:
try:
k, v = line.rstrip().split("=")
dict_[k] = v.strip('"')
except ValueError:
pass
if "ID_LIKE" in dict_:
dict_["ID_LIKE"] = frozenset(dict_["ID_LIKE"].split())
else:
# https://www.freedesktop.org/software/systemd/man/os-release.html#ID=
dict_["ID_LIKE"] = frozenset((dict_.get("ID", "linux"),))
@classmethod
def to_dict(cls) -> Dict[str, Any]:
if cls.dict_ is None:
dict_: Dict[str, Any] = dict()
if os.path.exists(cls.ETC_OS_RELEASE):
cls.dict_from_file(dict_)
else:
# centos and cl 6 does not have /etc/os-release file
# this will need to move to distro package in python 3.8
d = distro.linux_distribution()
if d and d[0]:
osid = d[0].lower().split()[0]
if osid == "red" and "Red Hat Enterprise Linux" in d[0]:
osid = "rhel"
dict_["ID"] = osid
dict_["PRETTY_NAME"] = "{} {} ({})".format(
d[0], d[1], d[2]
)
if osid in ("cloudlinux", "centos", "rhel"):
dict_["ID_LIKE"] = cls.RHEL_FEDORA_CENTOS
elif osid in ("ubuntu", "debian"):
dict_["ID_LIKE"] = cls.DEBIAN
else:
dict_["ID_LIKE"] = cls.UNKNOWN
else:
dict_["ID"] = "unknown"
dict_["ID_LIKE"] = cls.UNKNOWN
dict_["PRETTY_NAME"] = "unknown"
cls.dict_ = dict_
return cls.dict_
@classmethod
def id_like(cls) -> FrozenSet[str]:
return cls.to_dict()["ID_LIKE"]
@classmethod
def pretty_name(cls) -> str:
return cls.to_dict()["PRETTY_NAME"]
@classmethod
def get_os(cls) -> str:
"""
:return: OS name, like centos, ubuntu, debian, cloudlinux, redhat
in lower case
"""
return cls.to_dict().get("ID", "unknown")
@classmethod
def is_rhel(cls):
return cls.get_os() == "rhel"
@classmethod
def is_centos(cls):
return cls.get_os() == "centos"
@classmethod
def is_ubuntu(cls):
return cls.get_os() == "ubuntu"
@classmethod
def is_cloudlinux(cls):
return cls.get_os() in ("cloudlinux", "cloudlinuxserver")
@classmethod
def is_cloudlinux_solo(cls):
return os.path.exists(_CL_SOLO_EDITION_FILE)
@classmethod
def is_debian(cls):
return cls.get_os() == "debian"
@classmethod
def is_oracle_linux(cls):
return cls.get_os() == "ol"
@classmethod
def is_almalinux(cls):
return cls.get_os() == "almalinux"
@classmethod
def is_rockylinux(cls):
return cls.get_os() == "rocky"
def file_hash(
filename: str, hash_func=hashlib.md5, chunksize: int = 4096
) -> str:
"""Return hash of the file `filename`, reading it in chunks.
* filename is a path to a file;
* hash_func is a function that returns hash object (one of hashlib.md5
etc);
* chunksize is a size of chunks to read, in bytes.
"""
return file_hash_and_size(filename, hash_func, chunksize)[0]
def file_hash_and_size(
filename: str,
hash_func,
chunksize: int = 4096,
) -> Tuple[str, int]:
"""Calculate hash and size of the file `filename`, reading it in chunks.
* filename is a path to a file;
* hash_func is a function that returns hash object (one of hashlib.md5
etc);
* chunksize is a size of chunks to read, in bytes.
Return tuple(hash, file size)."""
hash_ = hash_func()
size = 0
with open(filename, "rb") as f:
while True:
chunk = f.read(chunksize)
if not chunk:
break
hash_.update(chunk)
size += len(chunk)
return hash_.hexdigest(), size
def _parse_name_value(varname, defs_line):
"""Given login.defs line, return *varname*'s value."""
name, value = defs_line.split() # no end of line comments
if varname != name:
raise ValueError("Expected {varname!r}, got {name!r}".format(**vars()))
return value
def get_min_uid():
global _MIN_UID
if _MIN_UID == -1:
_MIN_UID, _ = _get_max_min_uid()
return _MIN_UID
def _get_max_min_uid(path="/etc/login.defs"):
"""Get UID_MIN, UID_MAX from the login.defs file specified as *path*.
On error, return default for the current OS values.
"""
uid_min, uid_max = 1000, 60000
try:
with open(path) as file:
for line in file:
if line.startswith("UID_MIN"):
uid_min = int(_parse_name_value("UID_MIN", line))
if line.startswith("UID_MAX"):
uid_max = int(_parse_name_value("UID_MAX", line))
except (OSError, ValueError): # use default
pass
return uid_min, uid_max
def get_non_system_users(
excludes=("imunify360-captcha", "imunify360-webshield"),
):
"""
:param excludes: users to exclude in results
:return: list: list of pwd.struct_passwd objects representing users
"""
uid_min, uid_max = _get_max_min_uid()
return [
entry
for entry in pwd.getpwall()
if uid_min <= entry.pw_uid <= uid_max and entry.pw_name not in excludes
]
def get_system_user_names():
"""
:return: list: list of str with system user names
"""
uid_min, _ = _get_max_min_uid()
return [
entry.pw_name for entry in pwd.getpwall() if uid_min >= entry.pw_uid
]
@functools.lru_cache()
def is_system_user(uid: int):
uid_min, uid_max = _get_max_min_uid()
return uid < uid_min
async_lru_cache = functools.partial(
async_lru.alru_cache,
maxsize=100,
# set tot true because of backward compatibility with previous
# implementation of async_lru_cache
typed=True,
)
def append_with_newline(filename, data):
with open(filename, "r+") as f:
# ensure we have eol at the end of file
# returns poiner position 0 if file is empty
last_char_pos = f.seek(0, 2)
if last_char_pos != 0:
f.seek(last_char_pos - 1)
if f.read(1) != "\n":
f.write("\n")
f.write(data)
if not data.endswith("\n"):
f.write("\n")
def append_with_newline_bytes(filename: os.PathLike, data: bytes) -> None:
"""Append *data* to *filename* making sure there is \n at the end."""
with open(filename, "r+b") as f:
# ensure we have eol at the end of file
# returns poiner position 0 if file is empty
last_char_pos = f.seek(0, 2)
if last_char_pos != 0:
f.seek(last_char_pos - 1)
if f.read(1) != b"\n":
f.write(b"\n")
f.write(data)
if not data.endswith(b"\n"):
f.write(b"\n")
def ensure_line_in_file(filename, line):
"""Add *line* to *filename* if it is not present in the file
Returns:
True if the file was changed, False otherwise.
"""
changed = False
with open(filename, "r") as f:
if not any(_line.strip() == line for _line in f):
changed = True
if changed:
append_with_newline(filename, line)
return changed
def ensure_line_in_file_bytes(filename: os.PathLike, line: bytes) -> bool:
"""Add *line* to *filename* if it is not present in the file.
Returns:
True if the file was changed, False otherwise.
"""
changed = False
with open(filename, "rb") as f:
if not any(_line.strip() == line for _line in f):
changed = True
if changed:
append_with_newline_bytes(filename, line)
return changed
def remove_line_from_file(filename, line):
basedir = os.path.dirname(filename)
with (
open(filename, "r") as sf,
NamedTemporaryFile(mode="w", dir=basedir, delete=False) as tf,
):
for _line in sf:
if _line.strip() != line:
tf.write(_line)
os.rename(tf.name, filename)
class FileLock:
"""
Simple context manager to enable
UNIX-specific file locking with flock system call
"""
_TIMEOUT = 10 # Default timeout to wait for lock
def __init__(self, path, timeout=_TIMEOUT):
self.path = path
self.locked = False
self.file = open(path, "w")
self.timeout = timeout
async def __aenter__(self):
start = time.time()
while True:
try:
# Trying to perform file lock
flock(self.file, LOCK_EX | LOCK_NB)
self.locked = True
return self
# Resource temporarily unavailable
except (OSError, IOError) as ex:
if ex.errno != errno.EAGAIN:
raise
# if did not succeed
# to lock file within a given timeout
# perform operation without it
elif self.timeout < time.time() - start:
logger.warning(
"Failed to lock file %s. Timeout exceeded.", self.path
)
break
# Return control to event loop and wait
await asyncio.sleep(1)
async def __aexit__(self, exc_type, exc_val, exc_tb):
# If successfully locked file at entering context
# release it
if self.locked:
flock(self.file, LOCK_UN)
self.locked = False
self.file.close()
def user_identity(attackers_ip, source, fields=USER_IDENTITY_HEADERS):
try:
# TODO: change after migtration to python3.8
# dicts in python3.5 do not keep order,
# that's why we sort items to get the same hash for the same source
uid_data = [attackers_ip]
uid_data.extend(
str(value)
for field, value in sorted(source.items())
if field in fields
)
# ModSecurity has no capability to create sha256 hashes
# using sha1 instead
hash_alg = hashlib.sha1()
hash_alg.update("".join(uid_data).encode("utf8", "surrogateescape"))
return hash_alg.hexdigest()
except (ValueError, UnicodeEncodeError) as e:
logger.error(
"Generation of user identity hash failed, invalid data: %s", e
)
return None
def is_root_user():
return os.getuid() == 0
@contextmanager
def run_with_umask(mask: int):
current_mask = os.umask(mask)
try:
yield
finally:
os.umask(current_mask)
def get_abspath_from_user_dir(username: str, relpath="") -> Path:
"""
Returns user's home dir if `relpath` is not specified.
Otherwise, returns absolute path of `relpath`
build from `username`'s home dir
:raise ValueError: when user home dir is not exists
"""
if not isinstance(username, str):
raise ValueError("Invalid type for %s, should be str!" % username)
if os.sep in username:
raise ValueError("Invalid username")
try:
pw = pwd.getpwnam(username)
except KeyError:
raise ValueError("User {!r} doesn't exist".format(username))
abs_path = os.path.join(pw.pw_dir, relpath)
return Path(abs_path)
def does_path_belong_to_user(path: str, username: str) -> bool:
status = False
try:
user_home = get_abspath_from_user_dir(username)
Path(path).relative_to(user_home)
status = True
except ValueError as e:
logger.warning(str(e))
return status
def get_path_owner(path):
if not os.path.abspath(path):
raise ValueError("Path %s should be absolute!" % path)
while True:
if os.path.exists(path):
try:
return pwd.getpwuid(os.stat(path).st_uid).pw_name
except KeyError:
return str(os.stat(path).st_uid)
path = os.path.dirname(path)
def split_for_chunk(iterable: Iterable, chunk_size: int = 500) -> Generator:
"""
Generator that splits iterable on N-parts by chunk_size items in each chunk
>>> list(split_for_chunk([0, 1, 2, 3, 4, 5, 6, 7, 8, 9], chunk_size=2))
[[0, 1], [2, 3], [4, 5], [6, 7], [8, 9]]
:param iterable:
:param int chunk_size:
:return: generator:
"""
i = iter(iterable)
piece = list(islice(i, chunk_size))
while piece:
yield piece
piece = list(islice(i, chunk_size))
def freeze(d):
if isinstance(d, dict):
return frozenset((key, freeze(value)) for key, value in d.items())
elif isinstance(d, list):
return tuple(freeze(value) for value in d)
return d
class Singleton(type):
"""
Metaclass for creating only one instance of class, when providing
the same arguments.
"""
_instances = {}
def __call__(cls, *args, **kwargs):
key = (cls, freeze(args), freeze(kwargs))
if not cls._instances.get(key):
cls._instances[key] = super(Singleton, cls).__call__(
*args, **kwargs
)
return cls._instances[key]
@functools.lru_cache(maxsize=10)
def get_external_ip():
"""
:return str: server's external IP address
"""
with urllib.request.urlopen("https://api.ipify.org", timeout=2) as r:
return r.read().decode()
def get_kernel_module_parameter(module_name, parameter):
"""
Reads parameter of kernel module
from /sys/module/{module_name}/parameters/{parameter}
:return str: value of the parameter
"""
_MOD_PAR_PATH = "/sys/module/{mod}/parameters/{parameter}"
param_file = _MOD_PAR_PATH.format(mod=module_name, parameter=parameter)
if not os.path.exists(param_file):
raise ValueError(
"Cannot find parameter %s for module %s" % (parameter, module_name)
)
with open(param_file, "r") as p:
value = p.read().strip()
return value
def dict_deep_update(dst, src, allow_overwrite=True) -> bool:
"""Performs deep update of dict dst with values from src.
Does not overwrite subdicts in dst blindly with new dicts in src, but does
a deep update of (sub)dict content recursively"""
updated = False
for k, v in src.items():
if isinstance(v, dict):
if k not in dst or not v:
dst[k] = v
updated = True
else:
updated = dict_deep_update(dst[k], v)
else:
assert (
k not in dst or allow_overwrite
), f"{k} already exists in {dst}"
dst[k] = v
updated = True
return updated
class TimedCache:
def __init__(self, expiration, maxsize=100):
assert isinstance(expiration, timedelta)
self.expiration = expiration
self.maxsize = maxsize
self.cache = OrderedDict()
self._locks = {}
def _collect(self):
"""Clear cache from expired values"""
tmp_cache = OrderedDict()
for key in self.cache:
value, added_at = self.cache[key]
if (time.time() - added_at) < self.expiration.total_seconds():
tmp_cache[key] = value, added_at
self.cache = tmp_cache
def cache_clear(self):
self.cache = OrderedDict()
self._locks = {}
def _make_key(self, args, kwargs):
"""
Generate key from call arguments
:param args: call positional args
:param kwargs: call keyword args
:return:
"""
seed = args
if kwargs:
kw = sorted(kwargs.items())
seed += tuple(kw)
return hash(seed)
def __call__(self, func: F) -> F:
"""
Use it to cache calls to decorated function
@TimedCache(expiration=timedelta(minutes=10))
async def func(*args, **kwargs):
pass
:param func: decorated function
:return:
NOTE: is not thread safe.
"""
@wraps(func)
async def wrapper_async(*args, **kwargs):
key = self._make_key(args, kwargs)
lock = self._locks.get(key)
if lock is None:
lock = self._locks[key] = asyncio.Lock()
while True:
try:
await asyncio.wait_for(
lock.acquire(), self.expiration.total_seconds()
)
break
except asyncio.TimeoutError:
# if TimeoutError occurred it means that we not able to
# acquire lock, and if it the same lock which we try to
# acquire just create a new one, otherwise it already
# recreated and we should repeat the attempt to acquire
# a lock
if lock is self._locks[key]:
lock = self._locks[key] = asyncio.Lock()
else:
lock = self._locks[key]
try:
self._collect()
try:
result, _ = self.cache[key]
except KeyError:
if len(self.cache) >= self.maxsize:
self.cache.popitem(last=False)
result = await func(*args, **kwargs)
self.cache[key] = result, time.time()
finally:
lock.release()
return result
@wraps(func)
def wrapper_sync(*args, **kwargs):
self._collect()
key = self._make_key(args, kwargs)
try:
result, _ = self.cache[key]
except KeyError:
if len(self.cache) >= self.maxsize:
self.cache.popitem(last=False)
result = func(*args, **kwargs)
self.cache[key] = result, time.time()
return result
wrapper = (
wrapper_async
if asyncio.iscoroutinefunction(func)
else wrapper_sync
)
wrapper.cache_clear = self.cache_clear # type: ignore
return wrapper # type: ignore
timed_cache = TimedCache
async def safe_cancel_task(task, *, timeout=5):
"""Cancel *task* and wait up to *timeout* seconds for it to finish.
Unlike the common ``task.cancel(); suppress(CancelledError); await task``
pattern, this function **always returns** within *timeout* seconds —
even if the task catches ``CancelledError`` and continues running
(see DEF-40570 / CPython #103486).
Uses ``asyncio.wait`` (not ``wait_for``) because ``wait_for`` also
hangs when the inner task survives cancellation.
"""
if task.done():
# Retrieve exception to suppress "Task exception was never retrieved"
if not task.cancelled():
try:
task.result()
except Exception:
pass
return
task.cancel()
done, _ = await asyncio.wait({task}, timeout=timeout)
if done:
exc = task.exception() if not task.cancelled() else None
if exc:
logger.warning("Task %r raised during cancellation: %s", task, exc)
elif not task.done():
logger.warning(
"Task %r did not finish within %ds after cancel", task, timeout
)
task.add_done_callback(
lambda t: log_future_errors(
t, message="Abandoned task failed after cancel timeout"
)
)
def fail_agent_service():
"""
Send SIGUSR2 to os.getpid() to shutdown agent process by signal (implies
exit code -12).
Agent will do failover restart then thanks to systemd (or chkservd) if it
needs.
"""
os.kill(os.getpid(), signal.SIGUSR2)
async def run_cmd_and_log(cmd, log_file_mask, **popen_kwargs):
"""
Runs command and log it's output to the log file
:param cmd:
:param log_file_mask:
:return: str path of log file
"""
live_log = log_file_mask.replace("*", str(os.getpid()))
with open(live_log, "w") as live_log_fp:
popen_kwargs.update(
dict(
stdin=asyncio.subprocess.DEVNULL,
stdout=live_log_fp,
stderr=live_log_fp,
start_new_session=True,
)
)
logger.debug("Popen(%r, %r)", cmd, popen_kwargs)
proc = await asyncio.subprocess.create_subprocess_shell(
cmd, **popen_kwargs
)
with open(live_log + ".pid", "w") as pf:
pf.write(
"{:d}\t{}\n".format(
proc.pid, psutil.Process(proc.pid).create_time().hex()
)
)
return live_log
# DEF-41613: NoNewPrivileges=true on the agent units propagates to every
# descendant and refuses execve() that would require new privileges —
# setuid bits, file capabilities, *or* an LSM (SELinux/AppArmor) domain
# transition. RPM %prein and apt postinst scriptlets routinely trip the
# LSM-transition path: exec'ing /bin/sh from imunify360_t fails with
# EPERM ("Operation not permitted") on AlmaLinux 8/9, CloudLinux 8/9
# (SELinux) and similarly on Debian (AppArmor). AmbientCapabilities=
# only compensates for the capability half of NNP, not the LSM half.
#
# To keep the MR's main security goal (NNP) while letting the few agent
# subprocesses that drive package installs/removes work, we re-launch
# those specific subprocesses as transient units via systemd-run. They
# become children of PID 1 instead of the agent, so they don't inherit
# NNP, ProtectSystem= or the rest of the agent's sandbox.
@functools.lru_cache(maxsize=1)
def _has_no_new_privs() -> bool:
"""Return True iff this process has PR_SET_NO_NEW_PRIVS=1.
Used to decide whether to wrap package-management subprocesses in
systemd-run. On systemd<231 hosts (CL7) the MR's compat drop-in
resets NoNewPrivileges=no, so the wrap is unnecessary and would
also fail (CL7 ships systemd 219, no --pipe/--wait support).
"""
try:
with open("/proc/self/status") as f:
for line in f:
if line.startswith("NoNewPrivs:"):
return line.split()[1] == "1"
except OSError:
pass
return False
_SYSTEMD_RUN_BASE = (
"systemd-run",
"--quiet",
"--wait",
"--pipe",
"--collect",
"--property=NoNewPrivileges=no",
"--property=ProtectSystem=no",
)
def _systemd_run_setenv_args(env):
if not env:
return ()
return tuple(f"--setenv={k}={v}" for k, v in env.items())
def _wrap_outside_sandbox_shell(cmd: str, env=None) -> str:
"""Wrap a shell command so it runs as a transient systemd unit
outside the agent's NoNewPrivileges= sandbox. Returns the original
command unchanged when this process is not under NNP."""
if not _has_no_new_privs():
return cmd
parts = (
_SYSTEMD_RUN_BASE
+ _systemd_run_setenv_args(env)
+ ("/bin/sh", "-c", cmd)
)
return " ".join(shlex.quote(p) for p in parts)
def _wrap_outside_sandbox_argv(argv, env=None):
"""Argv-form counterpart of _wrap_outside_sandbox_shell."""
if not _has_no_new_privs():
return list(argv)
return list(
_SYSTEMD_RUN_BASE
+ _systemd_run_setenv_args(env)
+ ("--",)
+ tuple(argv)
)
async def run_cmd_and_log_outside_sandbox(
cmd, log_file_mask, *, env=None, **popen_kwargs
):
"""run_cmd_and_log variant that escapes the agent's systemd sandbox.
Use for shell commands whose RPM/apt scriptlets perform LSM domain
transitions on exec (e.g. kernelcare install, hardened-php
groupinstall) — see the module-level NNP note above.
"""
return await run_cmd_and_log(
_wrap_outside_sandbox_shell(cmd, env=env),
log_file_mask,
**popen_kwargs,
)
async def run_outside_sandbox(argv, *, env=None, **kwargs):
"""run() variant that escapes the agent's systemd sandbox."""
return await run(_wrap_outside_sandbox_argv(argv, env=env), **kwargs)
async def check_run_outside_sandbox(argv, *, env=None, **kwargs):
"""check_run() variant that escapes the agent's systemd sandbox."""
return await check_run(_wrap_outside_sandbox_argv(argv, env=env), **kwargs)
# A package transaction left in the agent's own cgroup is charged against the
# CPUQuota= and MemoryHigh= that the unit's ExecStartPre applies to it, and a
# dnf dependency solve plus an SELinux policy rebuild runs to several hundred
# MB. Handing the command to systemd-run makes PID 1 create the unit, so it
# lands in system.slice and its usage is neither throttled by our quota nor
# counted as ours.
#
# This is a different question from the sandbox escape above and must not
# share its gate: the resource isolation is needed whether or not the unit
# currently sets NoNewPrivileges=, so it depends only on systemd-run being
# able to host the command. systemd-run gained --wait in 232, --pipe in 235
# and --collect in 236, so this is inert on EL7's systemd 219.
_SYSTEMD_RUN_MIN_VERSION = 236
@functools.lru_cache(maxsize=1)
def _systemd_run_supported() -> bool:
"""Return True iff systemd-run can host a transient unit for us."""
if not is_systemd_boot():
return False
try:
version_line = _subprocess.run(
["systemd-run", "--version"],
stdout=_subprocess.PIPE,
stderr=_subprocess.DEVNULL,
text=True,
timeout=30,
).stdout
except (OSError, _subprocess.SubprocessError):
return False
match = re.search(r"\d+", version_line)
if match is None:
return False
return int(match.group()) >= _SYSTEMD_RUN_MIN_VERSION
def _wrap_in_own_cgroup_shell(cmd: str, env=None) -> str:
"""Wrap a shell command so PID 1 owns its cgroup, keeping its CPU and
memory off the agent's. Returns the command unchanged where systemd-run
cannot host it."""
if not _systemd_run_supported():
return cmd
parts = (
_SYSTEMD_RUN_BASE
+ _systemd_run_setenv_args(env)
+ ("/bin/sh", "-c", cmd)
)
return " ".join(shlex.quote(p) for p in parts)
async def run_cmd_and_log_in_own_cgroup(
cmd, log_file_mask, *, env=None, **popen_kwargs
):
"""run_cmd_and_log variant that keeps the command's resource usage out of
the agent's cgroup. Use for package transactions heavy enough to matter
against the agent's own CPU and memory allowance.
"""
return await run_cmd_and_log(
_wrap_in_own_cgroup_shell(cmd, env=env),
log_file_mask,
**popen_kwargs,
)
# fix AttributeError: 'NoneType' object has no attribute '_PENDING' on exit
# https://github.com/python/asyncio/issues/423#issuecomment-268882753
class Task(asyncio.Task):
def __del__(self):
if self._state == "PENDING" and self._log_destroy_pending:
context = {
"task": self,
"message": "Task was destroyed but it is pending!",
}
if self._source_traceback:
context["source_traceback"] = self._source_traceback
self._loop.call_exception_handler(context)
try:
Future.__del__(self)
except AttributeError:
name = getattr(self._coro, "__qualname__", None) or getattr(
self._coro, "__name__", None
)
code = getattr(self._coro, "gi_code", None) or getattr(
self._coro, "cr_code", None
)
frame = getattr(self._coro, "gi_frame", None) or getattr(
self._coro, "cr_frame", None
)
filename = code.co_filename
lineno = (frame and frame.f_lineno) or code.co_firstlineno
print(
"!> Finalizer error in {}() {} at {} line {}".format(
name, self._state, filename, lineno
)
)
def await_for(seconds):
"""Return async callback which waits for *seconds*.
Usage:
@retry_on(Error, on_error=await_for(seconds=PAUSE_INTERVAL), timeout=T)
async def coro():
'here's something that may raise Error.'
"""
async def pause(*args):
return await asyncio.sleep(seconds)
return pause
def retry_on(
exception,
on_error=None,
max_tries=None,
timeout=None,
silent=False,
log=None,
should_retry=None,
):
"""
Retry the function call on exception (or exceptions,
if given in tuple) at most *max_tries*.
Await *on_error* (if set) for each exception.
If *timeout* is set, stop all attempts in *timeout* seconds.
If *silent* is set to True - don't raise exceptions after max
If *should_retry* is set - await it and on False, stop auto-retry cycle
tries or timeout.
"""
if not any([max_tries, timeout]):
raise ValueError("Set any of max_tries, timeout")
def decorator(func):
@functools.wraps(func)
async def wrapper_async(*args, **kwargs):
if timeout:
end_time = time.monotonic() + timeout
for i in (
itertools.count(1)
if not max_tries
else range(1, max_tries + 1)
):
try:
if timeout:
remaining_time = end_time - time.monotonic()
if remaining_time > 0:
return await asyncio.wait_for(
func(*args, **kwargs), timeout=remaining_time
)
else:
if not silent:
raise asyncio.TimeoutError
elif log:
log.error(
"Timeout exceeded when calling %s", func
)
else:
return await func(*args, **kwargs)
except (asyncio.TimeoutError, asyncio.CancelledError):
raise
except exception as exc:
if should_retry is not None:
should_retry_ret = await should_retry(exc, i)
if not should_retry_ret:
i = max_tries
if i == max_tries:
if not silent:
raise
elif log:
log.error(
"Max tries exceeded when calling %s with"
" error %s",
func,
exc,
)
if on_error is not None:
await on_error(exc, i)
@functools.wraps(func)
def wrapper_sync(*args, **kwargs):
if timeout:
end_time = time.monotonic() + timeout
for i in (
itertools.count(1)
if not max_tries
else range(1, max_tries + 1)
):
try:
if timeout:
remaining_time = end_time - time.monotonic()
if remaining_time > 0:
return func(*args, **kwargs)
else:
if not silent:
raise TimeoutError
elif log:
log.error(
"Timeout exceeded when calling %s", func
)
else:
return func(*args, **kwargs)
except exception as exc:
if should_retry is not None:
should_retry_ret = should_retry(exc, i)
if not should_retry_ret:
i = max_tries
if i == max_tries:
if not silent:
raise
elif log:
log.error(
"Max tries exceeded when calling %s with"
" error %s",
func,
exc,
)
if on_error is not None:
on_error(exc, i)
if asyncio.iscoroutinefunction(func):
return wrapper_async
else:
return wrapper_sync
return decorator
def stub_unexpected_error(func):
"""If func throws an exception it is catched, converted to a string and
returned as a result of a call."""
@functools.wraps(func)
async def wrapper_async(*args, **kwargs):
try:
return await func(*args, **kwargs)
except Exception as e: # noqa
return repr(e)
@functools.wraps(func)
def wrapper_sync(*args, **kwargs):
try:
return func(*args, **kwargs)
except Exception as e: # noqa
return repr(e)
return wrapper_async if asyncio.iscoroutinefunction(func) else wrapper_sync
def log_error_and_ignore(exception=Exception, log_handler=None):
"""A decorator that logs uncaught exceptions ignoring them otherwise.
CancelledError is not handled.
"""
if log_handler is None:
log_handler = logger.error
def decorator(coro):
@functools.wraps(coro)
async def wrapper_async(*args, **kwargs):
try:
return await coro(*args, **kwargs)
except asyncio.CancelledError:
raise
except exception as e:
log_handler(
"Ignoring exception from %s: %s",
getattr(coro, "__qualname__", "coro"),
e,
)
@functools.wraps(coro)
def wrapper_sync(*args, **kwargs):
try:
return coro(*args, **kwargs)
except exception as e:
log_handler(
"Ignoring exception from %s: %s",
getattr(coro, "__qualname__", "coro"),
e,
)
if asyncio.iscoroutinefunction(coro):
return wrapper_async
else:
return wrapper_sync
return decorator
def abort_agent_on(exception, abort=fail_agent_service):
"""Abort the agent service on *exception*."""
def decorator(coro):
@functools.wraps(coro)
async def wrapper(*args, **kwargs):
try:
return await coro(*args, **kwargs)
except exception as e:
logger.exception(e)
# do not silently stop the current task but
abort()
return wrapper
return decorator
def snake_case(string):
"""PascalCase to snake_case"""
return re.sub("([a-z])([A-Z])", r"\1_\2", string).lower()
CHUNK_SIZE_SQL_QUERY = 200
# SQLite WAL reports SQLITE_BUSY_SNAPSHOT as "database is locked"; unlike
# vanilla SQLITE_BUSY it is not covered by PRAGMA busy_timeout, so retry it.
# Backoff 50/100/200/400/800 ms (~1.5s worst case) stays under the 10s
# busy_timeout the connection is configured with.
DB_LOCK_MAX_RETRIES = 5
DB_LOCK_RETRY_BACKOFF_BASE = 0.05
DB_LOCK_RETRY_BACKOFF_MAX = 1.0
def _is_db_locked_error(exc) -> bool:
return "locked" in str(exc).lower()
def get_results_iterable_expression(
expr, iterable, *args, exec_expr_with_empty_iter=False
):
"""
Get iterator over results of sql expression expr. Given iterable will be
split for chunks and we will return iterator containing results of all
split queries. Useful for sql selects with in_() in order to avoid
too many sql variables error.
If exec_expr_with_empty_iter is True and iterable is None(empty) we will
process expression once, passing here chunk=None expr(None, *args)
:param expr:
:param iterable:
:param exec_expr_with_empty_iter: if iterable is None(empty) process
given expression once, passing here chunk=None expr(None, *args)
:return:
"""
if not iterable and exec_expr_with_empty_iter:
chunks = [None]
else:
chunks = split_for_chunk(iterable, chunk_size=CHUNK_SIZE_SQL_QUERY)
from defence360agent.model import instance
with instance.db.transaction():
for chunk in chunks:
yield from expr(chunk, *args)
def execute_iterable_expression(
expr, iterable, *args, chunk_size=CHUNK_SIZE_SQL_QUERY
):
"""
Get number of results of sql expression expr. Given iterable will be
split for chunks and we will return number of results of all
split queries. Useful for sql delete with in_() in order to avoid
too many sql variables error.
The iterable is materialized BEFORE the database transaction opens,
and the transaction is retried on transient SQLite lock errors. This
matters because callers commonly pass a generator that does its own
SELECTs (e.g. ``MalwareHit.delete_hits(get_outdated_entries(...))``):
in SQLite WAL mode, the read snapshot taken inside a transaction
becomes stale as soon as another writer commits, and the subsequent
write raises SQLITE_BUSY_SNAPSHOT, which PRAGMA busy_timeout does
*not* cover.
"""
chunks = list(split_for_chunk(iterable, chunk_size=chunk_size))
from defence360agent.model import instance
def _backoff(exc, attempt):
backoff = min(
DB_LOCK_RETRY_BACKOFF_BASE * (2 ** (attempt - 1)),
DB_LOCK_RETRY_BACKOFF_MAX,
)
logger.warning(
"SQLite lock contention, retrying in %.3fs (retry %d/%d): %s",
backoff,
attempt,
DB_LOCK_MAX_RETRIES,
exc,
)
time.sleep(backoff)
@retry_on(
OperationalError,
on_error=_backoff,
max_tries=DB_LOCK_MAX_RETRIES + 1,
should_retry=lambda exc, attempt: _is_db_locked_error(exc),
)
def _execute_all():
changed = 0
with instance.db.transaction():
for chunk in chunks:
changed += expr(chunk, *args).execute()
return changed
return _execute_all()
def encode_filename(file):
return os.fsencode(file.replace("\n", "\\n")) + b"\n"
def decode_filename(file):
return os.fsdecode(file)[:-1].replace("\\n", "\n")
def base64_encode_filename(path: Path) -> bytes:
return base64.b64encode(os.fsencode(path))
def base64_decode_filename(b64name: bytes) -> Path:
return Path(os.fsdecode(base64.b64decode(b64name)))
def getpwnam(username):
"""
Like pwd.getpwnam(username) but returns None instead of raising KeyError.
"""
try:
result = pwd.getpwnam(username)
except KeyError:
result = None
return result
def clip(value, low, high):
"""
Put the specified `value` inside the [`low`, `high`] interval.
"""
return max(min(value, high), low)
def log_future_errors(fut, log_handler=None, message="Background task failed"):
"""
Callback for asyncio.Future that logs exceptions and ignores CancelledError.
Use this as a done_callback for asyncio tasks/futures:
future.add_done_callback(log_future_errors)
Or with custom logging:
future.add_done_callback(
lambda f: log_future_errors(f, logger.warning, "Upload failed")
)
"""
if log_handler is None:
log_handler = logger.warning
try:
fut.result()
except asyncio.CancelledError:
pass
except Exception as e:
log_handler("%s: %s", message, e)
def create_task_and_log_exceptions(
loop, coro: Callable[..., Awaitable], *args, **kwargs
):
"""
Use this function in plugin initialization instead of
loop.create_task to be able to see the exceptions from the specified
coroutine.
"""
def _log_exception(task):
if not task.cancelled() and task.exception() is not None:
loop.call_exception_handler(
{
"message": (
"Unhandled exception during plugin initialization!"
),
"exception": task.exception(),
"task": task,
}
)
new_task = loop.create_task(coro(*args, **kwargs))
new_task.add_done_callback(_log_exception)
return new_task
def make_coro(function):
"""
Create coroutine from regular function
Useful to pass functions to APIs requiring coroutines
Note: coroutine will still block event loop in main thread.
For most blocking functions, run_in_executor should be considered instead
:param function:
:return: coroutine running function
"""
async def coro(*args, **kwargs):
return function(*args, **kwargs)
return coro
COPY_TO_MODSEC_MAXTRIES = 5
_MODSEC_COPY_FAILURE_TIMEOUT = 5
async def log_failed_to_copy_to_modsec(exc, i):
if i == COPY_TO_MODSEC_MAXTRIES:
log = logger.error
else:
log = logger.warning
log(
"Failed to copy data%s to modsec ruleset dir %r, try: %s",
f" ({fn})" if (fn := getattr(exc, "filename", None)) else "",
exc,
i,
)
await asyncio.sleep(_MODSEC_COPY_FAILURE_TIMEOUT)
async def readlines_from_cmd_output(
cmd: List[str], *, err_buf_size=100, **popen_kwargs
):
"""
Start *cmd*, yield its stdout line by line [b'\n']
If *cmd* return nonzero exit status, raise CheckRunError with the
last *err_buf_size* lines from stderr.
"""
async def read_pipe_into(pipe, buf):
async for line in pipe:
buf.append(line)
err_buf = deque(maxlen=err_buf_size) # keep a few last lines
proc = await asyncio.create_subprocess_exec(
*cmd,
start_new_session=True,
stdout=asyncio.subprocess.PIPE,
stderr=asyncio.subprocess.PIPE,
**popen_kwargs,
)
try:
# note: read data from stderr to avoid deadlock
# if stderr pipe buffer is full
asyncio.create_task(read_pipe_into(proc.stderr, err_buf))
async for line in proc.stdout: # type: ignore
yield line
finally:
returncode = await proc.wait()
if returncode != 0:
raise CheckRunError(returncode, cmd, b"", b"".join(err_buf))
async def finally_happened(predicate_coro, *args, max_tries=2, delay=5):
"""
Retry *predicate_coro(*args)* until it becomes true,
but no more than *max_tries* attempts.
Sleep for *delay* seconds before the next *predicate_coro()* call.
Return whether the predicate became true.
"""
for attempt in range(1, max_tries + 1):
result = await predicate_coro(*args)
if not result and attempt < max_tries:
await asyncio.sleep(delay)
continue
return result
async def nice_iterator(iterable, chunk_size=10_000):
"""Yield to the event loop every *chunk_size* iterations."""
# for chunks in zip(*[iter(iterable)]*chunk_size):
# yield from chunks # -> SyntaxError: 'yield from' inside async function
for i, item in enumerate(iterable, start=1):
yield item
if (i % chunk_size) == 0:
await asyncio.sleep(0)
class LazyLock:
"""
Descriptor object to share async Lock between client objects.
Used in order to achieve lazy evaluation of the lock and share state
between it's clients.
Using asyncio.Lock in client code directly:
>>> class Foo:
>>> lock = asyncio.Lock()
leads to an unclear error ([Errno 9] Bad file descriptor),
when trying to move this Lock during demonization process.
"""
def __init__(self):
self._lock = None
def __get__(self, instance, owner):
if not self._lock:
self._lock = asyncio.Lock()
return self._lock
def _parse_rpm_line(line: str) -> tuple[str, str] | None:
"""Parse RPM output line, return (package_name, version) or None if not installed."""
line = line.strip()
if not line or "not installed" in line.lower() or ": " not in line:
return None
pkg_name, version = line.split(": ", 1)
return pkg_name, version
def _parse_dpkg_line(line: str) -> tuple[str, str] | None:
"""Parse dpkg-query output line, return (package_name, version) or None if not installed."""
line = line.strip()
if not line or "no packages found" in line.lower() or ": " not in line:
return None
# Status format: "pkg: version desired_action current_status error_flag"
# e.g., "vim: 2:8.2 install ok installed" or "pkg: 1.0 hold ok installed"
# Only consider package installed if status ends with "ok installed"
# (not "not-installed" which also ends with "installed")
if not line.endswith(" ok installed"):
return None
pkg_name, rest = line.split(": ", 1)
# Version is the first token (rest contains "version status...")
version = rest.split()[0] if rest else ""
return pkg_name, version
@functools.lru_cache(maxsize=1)
def _get_package_query_cmd() -> (
tuple[list[str], Callable[[str], tuple[str, str] | None]]
):
if OsReleaseInfo.is_ubuntu() or OsReleaseInfo.is_debian():
return (
[
"dpkg-query",
"--show",
"--showformat",
"${Package}: ${Version} ${Status}\n",
],
_parse_dpkg_line,
)
return (
[
"rpm",
"-q",
"--queryformat=%{NAME}: %{VERSION}-%{RELEASE}.%{ARCH}\n",
],
_parse_rpm_line,
)
class FirewallDisabledException(Exception):
"""Exception in case of using firewall api, when it's disabled"""
def check_disabled_firewall(func):
@wraps(func)
async def wrapper(*args, **kwargs):
if os.path.exists("/var/imunify360/firewall_disabled"):
raise FirewallDisabledException(
"Not available in the current build"
)
return await func(*args, **kwargs)
return wrapper
IMUNIFY_PACKAGE_NAMES = frozenset(
{
"imunify-ui",
"imunify360-firewall",
"imunify-antivirus",
"imunify-core",
}
)
async def system_packages_info(
packages: Iterable[str],
) -> dict[str, str | None]:
"""
Retrieves the version of the specified system packages using
a command and regex specific to the current system.
Parameters:
packages (Iterable[str]): A set of package names to retrieve version for.
Returns:
A dictionary mapping package names
to their corresponding version strings, or None
if the package is not installed or version information
cannot be retrieved.
"""
cmd, parse_line = _get_package_query_cmd()
packages_list = list(packages)
output = await safe_run_with_timeout(
cmd + packages_list, timeout=30, check_returncode=False
)
return _parse_package_info_output(output, packages_list, parse_line)
def _parse_package_info_output(
output: str,
packages: list[str],
parse_line: Callable[[str], tuple[str, str] | None],
) -> dict[str, str | None]:
parsed = {
pkg: ver
for line in output.splitlines()
if (result := parse_line(line))
and (pkg := result[0])
and (ver := result[1])
}
return {pkg: parsed.get(pkg) for pkg in packages}
async def safe_run_with_timeout(
command, timeout, log=logger.error, **kwargs
) -> str:
try:
return await asyncio.wait_for(
safe_run(command, **kwargs), timeout=timeout
)
except asyncio.TimeoutError:
log("Command %s failed: Timeout occurred", command)
return ""
def batched(iterable, n: int):
# backported from Python 3.12, except it yields a list instead of a tuple
# https://docs.python.org/3.12/library/itertools.html#itertools.batched
#
# batched('ABCDEFG', 3) → ABC DEF G
if n < 1:
raise ValueError("n must be at least one")
it = iter(iterable)
while batch := list(islice(it, n)):
yield batch
def batched_dict(d: Dict[Any, Any], n: int):
for batch in batched(d, n):
yield {k: d[k] for k in batch}
@functools.lru_cache(maxsize=1)
def is_cloudways():
try:
hostname = _subprocess.check_output(
["hostname", "-f"], text=True
).strip()
_is_cloudways = hostname.endswith(
(".cloudwaysapps.com", ".cloudwaysstagingapps.com")
)
if not _is_cloudways and Path("/usr/local/sbin/apm").exists():
result = _subprocess.check_output(
["/usr/local/sbin/apm", "info"], text=True
)
if "Cloudways" in result:
_is_cloudways = True
return _is_cloudways
except Exception as e:
logger.error("Error while checking environment: %s", e)
return False
def write_pid_file(pid_file: Path) -> int:
pid = os.getpid()
if not pid_file or str(pid_file) == "":
return pid
try:
pid_file.write_text(f"{pid}\n")
return pid
except Exception as e:
logger.error("Error while creatin PID file: %s", e)
return pid
def cleanup_pid_file(pid_file: Path):
if not pid_file or str(pid_file) == "":
return None
try:
if pid_file.exists():
pid_file.unlink()
return
except Exception as e:
logger.error("Error while cleanup PID file: %s", e)
return
async def backoff_sleep(exception, attempt):
"""
Used with retry_on decorator as on_error handler:
Example:
```
@retry_on(
PanelException,
on_error=backoff_sleep,
timeout=_HTTP_REQUEST_RETRY_TIMEOUT,
)
def some_function():
...
```
"""
logger.warning("#%s sleep on: %s", attempt, exception)
await asyncio.sleep(2 << attempt)
defence360agent/utils/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 014116 5 ustar defence360agent/utils/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000313235 00000000000 021325 0 ustar
r_j V d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
Z
d dlZd dlZd dlZd dl mZ d dlmZmZ d dlmZmZ d dlmZm Z m Z d dl m Z d dl m!Z! d dl"m#Z#m$Z$m%Z%m&Z& d d lm'Z' d d
lm(Z( d d l)m*Z* d d l+m,Z, d d
l-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6Z6d dl7Z7d dl8Z8d dl9m:Z: ddl;m<Z<m=Z= ddl>m?Z? e5de0 Z@ ejA eB ZCdZDdZEdaFdZG e*d ZHdZI e*d ZJ e*d ZK e*d ZL eMejN O d d ZP G d d e! ZQ ejR d! d" ZSe dd# ZTeCddfd$ZU G d% d& ZVdejW ejW d'dfd(e4eMeXeXf fd)ZYddd*d+ZZ G d, d-ej[ Z\e\fd(eXfd.Z]e\fdd/Z^dd(e_fd1Z`d2 Za G d3 d4 Zbd5 Zc G d6 d7ed Zed8 Zfd9 Zg dd;Zhd0ddd0ddd<d=eie_z ejj z d>eMdz d(eifd?Zk ejR d d@ Zldd(e_fdAZm G dB dC Znejo dDfdEe_dFeMd(e_fdGZp ddEe_dFeMd(e4e_eMf fdHZqdI ZrdJ ZsddLZt ddNZudO Zv ejR dPeMfdQ Zw ejx e6jy dRd0S ZzdT Z{dEejj dUeXd(dfdVZ|dW Z}dEejj dXeXd(eifdYZ~dZ Z G d[ d\ ZeEfd]Zd^ Ze d_eMfd` Zddbe_d(e*fdcZdde_dbe_d(eifdeZdf ZddhedieMd(efdjZdk Z G dl dme Z ejR d:! dn Zdo Zdd(eifdpZ G dq dr ZeZdsdtduZdv Zdw Z ejR d! d(eifdx ZdyZdz Zdd{e_d(e_fd|Zdd}Zdd~dZdd~dZdd~dZdZ ejR d! d(eifd Zdd{e_d(e_fdZdd~dZ G d de j Zd Z ddZd ZeddfdZefdZd ZdZdsZdZdZd(eifdZd'ddZeddZd Zd Zdde*d(eXfdZdeXd(e*fdZd Zd ZddZde0de/f fdZd ZdsZdsZd ZdRdd{e3e_ fdZddsddZddZ G d d ZdXe_d(ee_e_f dz fdZdXe_d(ee_e_f dz fdZ ejR d! d(eee_ e0e_gee_e_f dz f f fd Z G d ded Zd Z eh d Zdee_ d(ee_e_dz f fdZde_dee_ de0e_gee_e_f dz f d(ee_e_dz f fdZeCj fd(e_fdZdeMfdZde1e.e.f deMfdZ ejR d! d Zde*d(eMfdZde*fdZd ZdS ) N)Future) OrderedDictdeque) GeneratorIterable) ExitStackcontextmanagersuppress) timedelta)Enum)LOCK_EXLOCK_NBLOCK_UNflockwraps)islice)Path)NamedTemporaryFile)Any AwaitableCallableDict FrozenSetListTupleTypeVar)OperationalError )is_safe_subdir_namermtree)atomic_rewrite_fdF)bounduser_id)z
User-AgentzAccept-LanguagezAccept-Encoding
ConnectionDNTz.i360bakz/run/systemd/systemz /etc/cloudlinux-edition-soloz /var/run/imunify-antivirus.pidz /var/run/imunify360-agent.pidz/var/run/imunify360.pid%IMUNIFY360_HTTP_REQUEST_RETRY_TIMEOUT< c e Zd ZdZdZdZdZdS )ScopezAV onlyz AV and IM360z
IM360 onlyzIM360 resident onlyN)__name__
__module__ __qualname__AVAV_IM360IM360IM360_RESIDENT S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/__init__.pyr, r, H s" B H E*NNNr5 r, )maxsizec t o2t ot S )zReturn True if /run/systemd/system folder exists:
[sd_booted]
(https://www.freedesktop.org/software/systemd/man/sd_booted.html)
)_SYSTEMD_BOOTED_DIRexistsis_dir
is_symlinkr4 r5 r6 is_systemd_bootr= O sC ""$$ 1 & & ( ( 1#..00 0r5 c # K |s|sJ t j } |p|j d| dV t j } |p|j d| ||z
dS )z
:param str: action name to log
:param logging.Logger: logger you want action name and timing
to be logged with
:param func: log function to use (`log` has preference over `logger_`)
z
%s startedNz%s took %.2f second(s))time monotonicdebug)actionlogger_logstartstops r6 timeitrG \ sz c> N ESGM<000 EEE > DSGM3VTE\JJJJJr5 c fd}|S )Nc N t j fd }|S )Nc K t pj 5 | i | d {V cd d d S # 1 swxY w Y d S N)rC rD rG r- argskwargsrB funrD rC s r6 wrapperz+timefun.<locals>.decorator.<locals>.wrappern s .#,SIII
2
2 S$ 1& 1 1111111
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2s 8<< functoolsr rP rQ rB rD rC s ` r6 decoratorztimefun.<locals>.decoratorm sH 2 2 2 2 2 2 2
2 r5 r4 rC rB rD rU s ``` r6 timefunrW l s0 r5 c 0 e Zd ZdZeeddfd ZdS )synczF
the same timefun decorator variation but without async/await
Nc fd}|S )z
:param logging.Logger: logger you want action name and timing
to be logged with
:param str: action name to log
c N t j fd }|S )Nc z t pj 5 | i |cd d d S # 1 swxY w Y d S rK rL rM s r6 rQ z0sync.timefun.<locals>.decorator.<locals>.wrapper s F 2clGMMM 0 0 3///0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0s 044rR rT s ` r6 rU z sync.timefun.<locals>.decorator sH
_S
!
!
0
0
0
0
0
0
0 "
!
0 Nr5 r4 rV s ``` r6 rW z sync.timefun} s0 r5 )r- r. r/ __doc__ staticmethodloggerrW r4 r5 r6 rY rY x sE t \ r5 rY Freturnc $ K | |t d t j }|r't | t sJ | g} t
j }n*t | t t f sJ t
j } t t dt d | | |||dd| d{V }|
| d{V \ } }
| d{V } t d | ||| | |
f | | |
fS )
zYAsynchronous command executor.
Returns a tuple (exit_code, stdout_data, stderr_data).Nz/stdin and input arguments may not both be used. r )seconds) max_trieson_errorTstdinstdoutstderrstart_new_sessionz run(%s, stdin=%s, shell=%s) = %s)
ValueError _subprocessPIPE
isinstancestrasynciocreate_subprocess_shelllisttuplecreate_subprocess_execretry_onBlockingIOError await_for communicatewaitr_ rA ) commandrg rh ri shellinputrO create_subprocessprocouterr exit_codes r6 runr s
NOO O ;'3''''') # ;'D%=11111 # : 1y/C/C/C
D %%e,,,,,,,,HCiikk!!!!!!I
LL*
C c3 r5 )looptimeoutc |rt d D ]b} t j }| s n7n# t $ r Y nw xY wt j t j c| t j t | t j
r| nt j | | S )zjRun coroutine from a blocking code (outside the event loop).
Coroutine will be wrapped in Task.
Nrb r ) rangerp get_event_loop is_closed RuntimeErrorset_event_loopnew_event_looprun_until_completewait_forrn r Task)coror r _s r6 run_coror s |q = =A
-// ~~'' E
"7#9#;#; < < < < " " tW^44 LDD',t:L:L
s ?
A A c e Zd Zd ZdS )
CheckRunErrorc d}| | j | j | j pd | j pd S )Nz[Command {cmd!r} returned non-zero code {returncode},
Stdout: {output},
Stderr: {error}
)cmd
returncodeoutputerror)formatr r r decoderi )self_MESSAGEs r6 __str__zCheckRunError.__str__ s_
$
;%%''/4+$$&&.$
r5 N)r- r. r/ r r4 r5 r6 r r s#
r5 r c ` K t | fi | d{V \ }}}|dk r ||| || |S )zJ
Asynchronous command executor.
Returns output as bytestring.
Nr )r )rz raise_excrO r r r s r6 check_runr sZ
"%W!7!7!7!7777777JSQi
GS#666 Jr5 c K t | t j t j t j d{V \ }}}|dk r ||| dS )z
Asynchronous command executor. Raises raise_exc if exit code is nonzero.
Stdin, stdout and stderr of command are connected to /dev/null.
)rg rh ri Nr )r rl DEVNULL)rz r coder s r6 check_exit_coder sy
!"" JD!Q qyyig&&& yr5 Tc K t | fi | d{V \ }}}n,# t $ r t d| Y dS w xY w|r%|dk r t d| || dS | }n,# t $ r t d| Y dS w xY w|S )zGSafe run command.
Returns stdout as string or empty string on errorNz Command %s failed with OSError r z'Command %s failed with exit code %s: %sz#Command %s returned non-utf8 output)r OSErrorr_ warningstripr UnicodeDecodeError)rz check_returncoderO rcr r results r6 safe_runr s 3 3F 3 3333333 C 7AAArr B!GG 5wC
r##%% <gFFFrr Ms! %AA0&B %C ?C c d fd}|S )z non asyncio vesion of lazy initNc
S Nr4 ) decorated_f placeholders r6 rQ z#plainold_lazy_init.<locals>.wrapper! s %+--Kr5 r4 )r rQ r s ` @r6 plainold_lazy_initr s. K Nr5 c e Zd ZdZd Zd ZdS )
PeriodicCheckz
Invoke a callback with a certain period
and return cached result in between.
Raising an exception from the callback does not
affect the next check schedule.
c || _ || _ t j |z
| _ d | _ t
t j | _ d S r )
_cb_coro_check_every_n_secondsr? r@ _last_check_timestamp_last_check_resultr rp Lock_lock)r cb_corocheck_every_n_secondss r6 __init__zPeriodicCheck.__init__3 sD
&;#%)^%5%58M%M""& ' 55
r5 c K | 4 d {V t j | j z
}|| j k rVt
d| j | j t j | _ | j |i | d {V | _ | j cd d d d {V S # 1 d {V swxY w Y d S )Nz3Timeout %d seconds has expired, doing the check: %s) r r? r@ r r r_ rA r r )r rN rO deltas r6 __call__zPeriodicCheck.__call__< s\ ::<<
+
+
+
+
+
+
+
+N$$t'AAE333 I/M
.2^-=-=*0=
t0Nv0N0N*N*N*N*N*N*N'*
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+s BB33
B= B=N)r- r. r/ r] r r r4 r5 r6 r r * s< 6 6 6 + + + + +r5 r c fd}|S )Nc $ t | S r )r )r nsecs r6 decoratez cache_result.<locals>.decorateK s T4(((r5 r4 )r r s ` r6 cache_resultr J s# ) ) ) ) ) Or5 c e Zd ZdZdS )RecurringCheckStopz:
raised by coroutine to stop recurring_check loop
Nr- r. r/ r] r4 r5 r6 r r Q s Dr5 r c K t | r!t j | di | d {V nt j | d {V dS # t j $ r Y dS w xY w)NFTr4 )callablerp sleepCancelledError)period
period_kwargss r6 wait_for_periodr Y s F (- 7 7 7 788 8 8 8 8 8 8 8 8-'' ' ' ' ' ' ' 'u ! tts A
A A#"A#c 8 K |r| rt |fi | d {V ndS NF)r )checkr r s r6 should_stop_after_period_passedr d sG of66
666666666
r5
c fd}|S )z
run decorated corotine in a loop every :period: seconds.
If more then consecutive_err_limit error occured, exit loop.
:param period:
:param consecutive_err_limit:
:param check_period_first: default false
:return:
c F t fd }|S )Nc K d} t fi d {V rd S | i | d {V d}n# t $ rO d|v rG t |d t r|d n# t
$ r Y nw xY wY d S t j $ r Y d S t $ r}|dz
}|k r t
d Y d }~d S t |t j r3t
d|j
|j |j |j nt
d Y d }~nd }~ww xY wt fi d {V rd S T)Nr T lock_filer z-Error count exceeded limit,exiting check loopz+Failed to run %s (%s). stdout=%s, stderr=%szError executing %s)r r rn r unlinkFileNotFoundErrorrp r Exceptionr_ exceptionrl CalledProcessErrorr r r ri ) rN rO consecutive_err_cntexccheck_period_firstconsecutive_err_limitrP r r s r6 wrappedz3recurring_check.<locals>.decorator.<locals>.wrappedy sH "# '
8& 2? E , #t.v.........: +,''9 * "f,,! )&*=t D D = &{ 3 : : < < < 0 ! ! ! D!EE - EE D D D'1,'*-BBB (( K !#{'EFF D (( I G N J J (()=sCCC!D& 9**F 6C EO'
sK 0 D?5A54D?5
B?D?BD?D? D?"%D:
A(D::D?r )rP r r r r r s ` r6 rU z"recurring_check.<locals>.decoratorx sI s) ) ) ) ) ) ) )
) V r5 r4 )r r r r rU s ```` r6 recurring_checkr l s7 - - - - - - - -^ r5 )backupuidgidallow_empty_content permissionsdir_fdr r c t |t r| }|'|rt d t | |||||| S t t 5 t | d 5 }| t | dz } ddd n # 1 swxY w Y | |k r ddd dS ddd n # 1 swxY w Y |s |s t d|| dS |rt |t t j
f r|}
n t j | t z }
t t 5 t! j | |
ddd n # 1 swxY w Y |k t% j t j | j }n># t $ r1 t j d } t j | d | z }Y nw xY wt j | \ } }
t1 | st
d
| t5 5 }t7 d | d |
d
z dd 5 fd}| | | |*|(t j || t j! | t j" ddd n # 1 swxY w Y t j# j$ | |% ddd n # 1 swxY w Y dS )a Atomically rewrites *filename* with given *data*.
If *filename*'s content is *data* already, do nothing.
If both *uid* and *gid* are given then resulting file is chowned
to given user id and group id.
Skip rewrite with empty content if *allow_empty_content* is False.
Chmod to given access *permissions* else preserve *filename* 's
permissions.
Return True if *filename* file was updated, False otherwise
When *dir_fd* is provided it must be an O_NOFOLLOW-opened file
descriptor for the parent directory of *filename*. All file I/O is
then performed relative to that descriptor, closing the TOCTOU
symlink-attack window. *backup* is not supported with *dir_fd*.
Nz/backup is not supported when dir_fd is provided)r r r r r rbr Fz empty content: %r for file: %sr i zParent dir is missing: wbz .i360editr )modedirsuffixprefix bufferingdeletec t t 5 t j j d d d d S # 1 swxY w Y d S r )r
r osremovename)tfs r6 cleanupz atomic_rewrite.<locals>.cleanup s /00 ' 'Ibg&&&' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' 's =AAT)&rn ro encoderk r" r
r openreadlenr_ r r PathLikefspathBACKUP_EXTENSIONshutilcopystatS_IMODEst_modeumaskpathsplitr r: r r callbackwriteflushchownfilenochmodfsyncrenamer pop_all)filenamedatar r r r r r file old_contentbackup_filename
current_umaskdirpathbasenamestackr r s @r6 atomic_rewriter s 6 $ {{}}
P NOO O 3#
# $ $
(D
!
! 3T ))CIIM22K 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 $ t 5tXFFFu
3 fsBK 0 1 1 E $OO i 1 14D DO
'
(
( 3 3 K/ 2 2 2 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 1 ,rwx'8'8'@AAKK 1 1 1 HQKKM H] # # # =.0KKK 1
h//GX == ! ! G E' E EFFF
c>
"
'
'
'
'
'
NN7 # # # HHTNNN HHJJJ3?c3/// HRYY[[+ . . . HRYY[[ ! ! !- " " " " " " " " " " " " " " ". "'8$$$
3 8 4s (C9&B+ C+B/ /C2B/ 3
CC CE<<F F
+F6 68G10G1M>0B=L9- M>9L= =M> L= 1M>>NNc t d S # t $ r Y d S w xY w)Nz/etc/system-release)r read_textrstripr r4 r5 r6 os_release_and_versionr" sP )**4466==??? tts 25
AAc | p
t }|r-t j d| }|r| d S nt t d|z )z3Return os version, if can't get it raise ValueErrorz\s*(\d+\.\d+\S*)(\s|$)r z!Can't discover os version from %r)r" researchgroup cache_clearrk )release_and_versionrvmatchs r6
os_versionr+ st
8 6 8 8B - 3R88 ";;q>> ! " **,,,
82=
>
>>r5 c e Zd ZdZ ed Z ed Z ed ZdZe d Z
e de e e
f fd Ze dee fd Ze de fd
Ze de fd Ze d Ze d
Ze d Ze d Ze d Ze d Ze d Ze d Ze d ZdS )
OsReleaseInfoz/etc/os-release)debian)rhelfedoracentos)unknownNc t | j 5 }|D ]U} | d \ }}| d ||< F# t
$ r Y Rw xY w d d d n # 1 swxY w Y d|v r,t
|d |d< d S t
| dd f |d< d S )N="ID_LIKEIDlinux)r ETC_OS_RELEASEr! r r rk frozensetget)clsdict_flinekvs r6 dict_from_filez OsReleaseInfo.dict_from_file. s3
#$
%
%
;;==..s33DAq wws||E!HH! D
(y)9)?)?)A)A B BE) )%))D'*B*B)D E EE) s5 A;AA A;
A+(A;*A++A;;A?A?r` c \ | j t }t j | j r| | nt j }|r|d r|d
d }|dk r d|d v rd}||d< d |d |d |d |d < |d
v r | j |d < n.|d v r | j
|d < n | j |d < nd
|d< | j |d < d
|d < || _ | j S )Nr redzRed Hat Enterprise Linuxr/ r7 z
{} {} ({})r rb PRETTY_NAME)
cloudlinuxr1 r/ r6 )ubuntur. r2 )r= dictr r
r: r9 rB distrolinux_distributionlowerr r RHEL_FEDORA_CENTOSDEBIANUNKNOWN)r< r= dosids r6 to_dictzOsReleaseInfo.to_dict= sQ 9 $(FFEw~~c 011
5""5)))) -// 51 5 Q4::<<--//2Du}})Cqt)K)K %"&E$K+7+>+>!adAaD, ,E-( ???+.+Ai(( !555+.:i((+.;i(("+E$K'*{E)$+4E-( CIyr5 c 6 | d S )Nr6 rQ r< s r6 id_likezOsReleaseInfo.id_like\ s {{}}Y''r5 c 6 | d S )NrE rS rT s r6 pretty_namezOsReleaseInfo.pretty_name` s {{}}]++r5 c R | dd S )zi
:return: OS name, like centos, ubuntu, debian, cloudlinux, redhat
in lower case
r7 r2 )rQ r; rT s r6 get_oszOsReleaseInfo.get_osd s" {{}} y111r5 c 2 | dk S )Nr/ rY rT s r6 is_rhelzOsReleaseInfo.is_rhell s zz||v%%r5 c 2 | dk S )Nr1 r[ rT s r6 is_centoszOsReleaseInfo.is_centosp zz||x''r5 c 2 | dk S )NrG r[ rT s r6 is_ubuntuzOsReleaseInfo.is_ubuntut r_ r5 c . | dv S )N)rF cloudlinuxserverr[ rT s r6
is_cloudlinuxzOsReleaseInfo.is_cloudlinuxx s zz|| AAAr5 c J t j t S r )r r
r: _CL_SOLO_EDITION_FILErT s r6 is_cloudlinux_soloz OsReleaseInfo.is_cloudlinux_solo| s w~~ 3444r5 c 2 | dk S )Nr. r[ rT s r6 is_debianzOsReleaseInfo.is_debian r_ r5 c 2 | dk S )Nolr[ rT s r6 is_oracle_linuxz OsReleaseInfo.is_oracle_linux s zz||t##r5 c 2 | dk S )N almalinuxr[ rT s r6 is_almalinuxzOsReleaseInfo.is_almalinux s zz||{**r5 c 2 | dk S )Nrockyr[ rT s r6
is_rockylinuxzOsReleaseInfo.is_rockylinux s zz||w&&r5 ) r- r. r/ r9 r: rM rL rN r= classmethodrB r ro r rQ r rU rW rY r\ r^ ra rd rg ri rl ro rr r4 r5 r6 r- r- & s &N
Y{
#
#F"#?@@i %%G E F F [ F S#X [ < ( # ( ( ( [( ,C , , , [, 2s 2 2 2 [2 & & [& ( ( [( ( ( [( B B [B 5 5 [5 ( ( [( $ $ [$ + + [+ ' ' [' ' 'r5 r- r chunksizec 0 t | || d S )zReturn hash of the file `filename`, reading it in chunks.
* filename is a path to a file;
* hash_func is a function that returns hash object (one of hashlib.md5
etc);
* chunksize is a size of chunks to read, in bytes.
r )file_hash_and_size)r hash_funcru s r6 file_hashry s h 9 = =a @@r5 c | }d}t | d 5 } | | }|sn(| | |t | z
}@ ddd n # 1 swxY w Y | |fS )a Calculate hash and size of the file `filename`, reading it in chunks.
* filename is a path to a file;
* hash_func is a function that returns hash object (one of hashlib.md5
etc);
* chunksize is a size of chunks to read, in bytes.
Return tuple(hash, file size).r r TN)r r updater hexdigest)r rx ru hash_sizer> chunks r6 rw rw s
IKKE D
h FF9%%E
LL CJJ D ?? d ""s AA,,A03A0c | \ }}| |k r&t dj di t |S )z0Given login.defs line, return *varname*'s value.z"Expected {varname!r}, got {name!r}r4 )r rk r vars)varname defs_liner values r6 _parse_name_valuer sJ //##KD%$D=DNNtvvNNOOO Lr5 c H t dk rt \ a } t S )Nr( )_MIN_UID_get_max_min_uid)r s r6 get_min_uidr s 2~~&(( ! Or5 /etc/login.defsc h d\ }} t | 5 }|D ]f}| d r t t d| }| d r t t d| }g ddd n # 1 swxY w Y n# t t
f$ r Y nw xY w||fS )zGet UID_MIN, UID_MAX from the login.defs file specified as *path*.
On error, return default for the current OS values.
)i i` UID_MINUID_MAXN)r
startswithintr r rk )r
uid_minuid_maxr r? s r6 r r s( #GW
$ZZ F4
F
F??9-- F !"3It"D"D E EG??9-- F !"3It"D"D E EG
F F F F F F F F F F F F F F F F
Z
G s5 B A*B
B
BB BB B-,B-zimunify360-captchazimunify360-webshieldc l t \ fdt j D S )z~
:param excludes: users to exclude in results
:return: list: list of pwd.struct_passwd objects representing users
c P g | ]"}|j cxk rk n n |j v |#S r4 pw_uidpw_name).0entryexcludesr r s r6
<listcomp>z(get_non_system_users.<locals>.<listcomp> sS el - - - -g - - - - -%-x2O2O 2O2O2Or5 r pwdgetpwall)r r r s `@@r6 get_non_system_usersr sR ())GW \^^ r5 c d t \ } fdt j D S )z;
:return: list: list of str with system user names
c 4 g | ]}|j k
|j S r4 r )r r r s r6 r z)get_system_user_names.<locals>.<listcomp> s. W 5L5L
5L5L5Lr5 r )r r s @r6 get_system_user_namesr sE "##JGQ #&<>> r5 r c 0 t \ }}| |k S r )r )r r r s r6 is_system_userr s '))GW =r5 d )r7 typedc t | d 5 }| dd }|dk rF| |dz
| d dk r| d | | | d s| d d d d d S # 1 swxY w Y d S )Nzr+r rb r
r seekr r
endswithr r r>
last_char_poss r6 append_with_newliner s
h
q!
A
FF=1$ % % %vvayyD
}}T""
GGDMMM
B"C CCr c t | d 5 }| dd }|dk rF| |dz
| d dk r| d | | | d s| d ddd dS # 1 swxY w Y dS )z>Append *data* to *filename* making sure there is
at the end.zr+br rb r
Nr r s r6 append_with_newline_bytesr s
h
! q!
A
FF=1$ % % %vvayyE!!
}}U##
GGENNN
r c d}t | d 5 }t fd|D sd}ddd n # 1 swxY w Y |rt | |S )zAdd *line* to *filename* if it is not present in the file
Returns:
True if the file was changed, False otherwise.
Frc 3 H K | ] }| k V d S r r r _liner? s r6 <genexpr>z&ensure_line_in_file.<locals>.<genexpr>) 0 88U5;;==D(888888r5 TN)r anyr r r? changedr> s ` r6 ensure_line_in_filer ! s G
h 8888a88888 G ,Hd+++ N >AAr? c d}t | d 5 }t fd|D sd}ddd n # 1 swxY w Y |rt | |S )zAdd *line* to *filename* if it is not present in the file.
Returns:
True if the file was changed, False otherwise.
Fr c 3 H K | ] }| k V d S r r r s r6 r z,ensure_line_in_file_bytes.<locals>.<genexpr>8 r r5 TN)r r r r s ` r6 ensure_line_in_file_bytesr 0 s G
h 8888a88888 G 2!(D111 Nr c t j | }t | d 5 }t d|d 5 }|D ]/}| |k r| | 0t j |j | d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S )Nr wF)r r r ) r r
dirnamer r r r
r r )r r? basedirsfr r s r6 remove_line_from_filer ? s5 gooh''G Xs% !???%CE E{{}}$$
"'8$$$% % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % %s6 B4A
B B4 B B4#B $B44B8;B8c , e Zd ZdZdZefdZd Zd ZdS )FileLockz`
Simple context manager to enable
UNIX-specific file locking with flock system call
r c Z || _ d| _ t |d | _ || _ d S )NFr )r
lockedr r r )r r
r s r6 r zFileLock.__init__S s* sOO r5 c K t j } t | j t t z d| _ | S # t t f$ r}|j t j k r | j
t j |z
k r&t d| j
Y d }~d S t j d d {V Y d }~nd }~ww xY w)NTz)Failed to lock file %s. Timeout exceeded.r )r? r r r
r r r IOErrorerrnoEAGAINr r_ r r
rp r )r rE exs r6
__aenter__zFileLock.__aenter__Y s '
'di7!2333 " W%
'
'
'8u|++ \DIKK%$777NNCTY EEEEE mA&&&&&&&&&&&&&&
' 's *A CAC/CCc K | j rt | j t d| _ | j d S r )r r r r close)r exc_typeexc_valexc_tbs r6 __aexit__zFileLock.__aexit__q sC ; & $)W % % % r5 N)r- r. r/ r] _TIMEOUTr r r r4 r5 r6 r r K sZ
H%- ' ' '0 r5 r c | g}| fdt | D t j }| d | dd | S # t t f$ r%}t d| Y d }~nd }~ww xY wd S )Nc 3 D K | ]\ }}|v t | V d S r )ro )r fieldr fieldss r6 r z user_identity.<locals>.<genexpr> s?
u
JJ
r5 r utf8surrogateescapez9Generation of user identity hash failed, invalid data: %s)
extendsorteditemshashlibsha1r{ joinr r| rk UnicodeEncodeErrorr_ r ) attackers_ipsourcer uid_datahash_alges ` r6
user_identityr { s
!>
&v||~~ 6 6
<>>))009JKKLLL!!### * +
G
4s B%B) )C :CC c 0 t j dk S Nr )r getuidr4 r5 r6 is_root_userr s
9;;! r5 maskc # K t j | } d V t j | d S # t j | w xY wr )r r )r current_masks r6 run_with_umaskr sM 8D>>L
s 2 Ar usernamec ~ t | t st d| z t j | v rt d t j | }n0# t $ r# t d | w xY wt j
|j | }t | S )z
Returns user's home dir if `relpath` is not specified.
Otherwise, returns absolute path of `relpath`
build from `username`'s home dir
:raise ValueError: when user home dir is not exists
z#Invalid type for %s, should be str!zInvalid usernamezUser {!r} doesn't exist)
rn ro rk r sepr getpwnamKeyErrorr r
r pw_dirr )r relpathpwabs_paths r6 get_abspath_from_user_dirr s h $ $ K>IJJJ v+,,,E
\(
#
# E E E299(CCDDDEw||BIw//H >>s A -Br
c d} t | }t | | d}n># t $ r1}t t
| Y d }~nd }~ww xY w|S )NFT)r r relative_tork r_ r ro )r
r status user_homer s r6 does_path_belong_to_userr s
F -h77 T
y))) s1vv Ms 38
A3'A..A3c t j | st d| z t j | rg t j t j | j j S # t $ r) t t j | j cY S w xY wt j | } )NzPath %s should be absolute!)
r r
abspathrk r: r getpwuidr st_uidr r ro r r
s r6 get_path_ownerr s
7??4 ?6=>>>%
7>>$ 1
1|BGDMM$899AA
1
1
1274==/00000
1wt$$
%s /B 0B65B6 iterable
chunk_sizec # K t | }t t || }|r%|V t t || }|#dS dS )a
Generator that splits iterable on N-parts by chunk_size items in each chunk
>>> list(split_for_chunk([0, 1, 2, 3, 4, 5, 6, 7, 8, 9], chunk_size=2))
[[0, 1], [2, 3], [4, 5], [6, 7], [8, 9]]
:param iterable:
:param int chunk_size:
:return: generator:
N)iterrr r )r r ipieces r6 split_for_chunkr sp
XA :&& ' 'E
, VAz**++ , , , , ,r5 c t | t r+t d | D S t | t rt d | D S | S )Nc 3 > K | ]\ }}|t | fV d S r freeze)r keyr s r6 r zfreeze.<locals>.<genexpr> s1 JJ*#u#ve}}-JJJJJJr5 c 3 4 K | ]}t | V d S r r )r r s r6 r zfreeze.<locals>.<genexpr> s( 22uVE]]222222r5 )rn rH r: r rr rs )rO s r6 r r sm !T 3JJ JJJJJJ At 322222222 Hr5 c & e Zd ZdZi Z fdZ xZS ) Singletonzc
Metaclass for creating only one instance of class, when providing
the same arguments.
c | t | t | f}| j | s( t t | j |i || j |< | j | S r )r
_instancesr; superr r )r< rN rO r __class__s r6 r zSingleton.__call__ sr F4LL&..1~!!#&& "@% 3"7"7"@# # #CN3 ~c""r5 )r- r. r/ r] r r
__classcell__)r s @r6 r r sI
J# # # # # # # # #r5 r c t j dd 5 } | cddd S # 1 swxY w Y dS )z3
:return str: server's external IP address
zhttps://api.ipify.orgrb r N)urllibrequesturlopenr r )r s r6 get_external_ipr# s
7 C C !qvvxx ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !s &AA Ac < d}| | | }t j | st d|d| t |d 5 }| }ddd n # 1 swxY w Y |S )z
Reads parameter of kernel module
from /sys/module/{module_name}/parameters/{parameter}
:return str: value of the parameter
z(/sys/module/{mod}/parameters/{parameter})mod parameterzCannot find parameter z for module r N)r r r
r: rk r r r ) module_namer&
_MOD_PAR_PATH
param_filepr s r6 get_kernel_module_parameterr+ s ?M %%+%KKJ
7>>* % %
j8A ;; O
j# !! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! Ls 'BBBc d}| D ][\ }}t |t r%|| vs|s|| |< d}(t | | | }?|| vs|sJ | d| || |< d}\|S )zPerforms deep update of dict dst with values from src.
Does not overwrite subdicts in dst blindly with new dicts in src, but does
a deep update of (sub)dict content recursivelyFTz already exists in )r rn rH dict_deep_update)dstsrcallow_overwriteupdatedr@ rA s r6 r- r- s G 1 a ||1|A *3q6155 ---- /CFGG Nr5 c 8 e Zd Zd
dZd Zd Zd ZdedefdZd S )
TimedCacher c t |t sJ || _ || _ t | _ i | _ d S r )rn r
expirationr7 r cache_locks)r r5 r7 s r6 r zTimedCache.__init__* s< *i00000$ ]]
r5 c t }| j D ]J}| j | \ }}t j |z
| j k r||f||< K|| _ dS )z Clear cache from expired valuesN)r r6 r? r5
total_seconds)r tmp_cacher r added_ats r6 _collectzTimedCache._collect1 sh MM : 1 1C "joOE8 h&$/*G*G*I*III!& #
r5 c : t | _ i | _ d S r )r r6 r7 r s r6 r' zTimedCache.cache_clear: s ]]
r5 c |}|r3t | }|t | z
}t | S )z
Generate key from call arguments
:param args: call positional args
:param kwargs: call keyword args
:return:
)r r rs hash)r rN rO seedkws r6 _make_keyzTimedCache._make_key> sB ''B E"II DDzzr5 funcr` c t fd }t fd }t j r|n|} j |_ |S )a
Use it to cache calls to decorated function
@TimedCache(expiration=timedelta(minutes=10))
async def func(*args, **kwargs):
pass
:param func: decorated function
:return:
NOTE: is not thread safe.
c h K | | }j | }| t j x}j |< t j | j d {V nP# t j $ r= |j | u r t j x}j |< n
j | }Y nw xY w
j | \ }}ns# t $ rf t j j k rj d | i | d {V }|t! j fj |< Y nw xY w| n# | w xY w|S )NTFlast)rC r7 r; rp r r acquirer5 r9 TimeoutErrorr< r6 r r r7 popitemr? release)rN rO r lockr r rD r s r6
wrapper_asyncz*TimedCache.__call__.<locals>.wrapper_asyncX s ..v..C;??3''D|*1,..8t{3'
00!* (E(E(G(G + 0 0 0 t{3 ///29,..@t{3 / / #{3 / 0
0
: $
3IFAA : : :4:$,66
***666#'4#8#8#8 8 8 8 8 8 8F&,dikk&9DJsOOO : MsE AB A C&%C&+F D F A-F>F FF F/c Z | | } j | \ }}nm# t $ r` t j j k rj d | i |}|t j fj |< Y nw xY w|S )NFrG )r< rC r6 r r r7 rK r? )rN rO r r r rD r s r6 wrapper_syncz)TimedCache.__call__.<locals>.wrapper_sync{ s MMOOO..v..C
6 JsO
6
6
6tz??dl22J&&E&222 t.v.."($)++"5
3
6
Ms > A'B('B()r rp iscoroutinefunctionr' )r rD rN rP rQ s `` r6 r zTimedCache.__call__K s
t
D
t
*400
MM
# .r5 N)r ) r- r. r/ r r< r' rC r# r r4 r5 r6 r3 r3 ) s CQ C1 C C C C C Cr5 r3 r c > K | r<| s& | n# t $ r Y nw xY wdS | t j | h| d{V \ }}|rL| s| nd}|r t d| | dS dS | s4t d| | |
d dS dS )u Cancel *task* and wait up to *timeout* seconds for it to finish.
Unlike the common ``task.cancel(); suppress(CancelledError); await task``
pattern, this function **always returns** within *timeout* seconds —
even if the task catches ``CancelledError`` and continues running
(see DEF-40570 / CPython #103486).
Uses ``asyncio.wait`` (not ``wait_for``) because ``wait_for`` also
hangs when the inner task survives cancellation.
Nr z&Task %r raised during cancellation: %sz.Task %r did not finish within %ds after cancelc $ t | d S )Nz*Abandoned task failed after cancel timeout)message)log_future_errors)ts r6 <lambda>z"safe_cancel_task.<locals>.<lambda> s 'G r5 ) done cancelledr r cancelrp ry r r_ r add_done_callback)taskr rY r r s r6 safe_cancel_taskr^ s^ yy{{ ~~
KKMMML$999999999GD!
&*nn&6&6@dnn D P NNCT3 O O O O O P P
YY[[
<dG
s A
A
Ac f t j t j t j dS )z
Send SIGUSR2 to os.getpid() to shutdown agent process by signal (implies
exit code -12).
Agent will do failover restart then thanks to systemd (or chkservd) if it
needs.
N)r killgetpidsignalSIGUSR2r4 r5 r6 fail_agent_servicerd s$ GBIKK (((((r5 c
K | dt t j }t |d 5 }| t
t j j ||d t d| | t j j | fi | d{V }t |dz d 5 }|
d |j t! j |j ddd n # 1 swxY w Y ddd n # 1 swxY w Y |S ) z
Runs command and log it's output to the log file
:param cmd:
:param log_file_mask:
:return: str path of log file
*r Trf z
Popen(%r, %r)Nz.pidz{:d} {}
)replacero r ra r r{ rH rp
subprocessr r_ rA rq r
r pidpsutilProcess create_timehex)r
log_file_mask popen_kwargslive_log live_log_fpr~ pfs r6 run_cmd_and_logrs s $$S#bikk*:*:;;H
h (0"""&
_c<888 '?
(V#S
)
) R HH ##HfnTX 6 6 B B D D H H J J
& Os8 BE A*D?3 E?E EE EE Ec t d 5 } | D ]C}| d r,| d dk c cddd S D ddd n # 1 swxY w Y n# t $ r Y nw xY wdS )aL Return True iff this process has PR_SET_NO_NEW_PRIVS=1.
Used to decide whether to wrap package-management subprocesses in
systemd-run. On systemd<231 hosts (CL7) the MR's compat drop-in
resets NoNewPrivileges=no, so the wrap is unnecessary and would
also fail (CL7 ships systemd 219, no --pipe/--wait support).
z/proc/self/statusz NoNewPrivs:r 1NF)r r r r )r> r? s r6 _has_no_new_privsrv s
%
&
& 2!
2
2??=11 2 ::<<?c111 2 2 2 2 2 2 2 22
2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2
5s@ A1 9A%
A1 A% A1 %A))A1 ,A)-A1 1
A>=A>) systemd-runz--quietz--waitz--pipez --collectz --property=NoNewPrivileges=noz--property=ProtectSystem=noc ` | sdS t d | D S )Nr4 c 3 , K | ]\ }}d | d| V dS )z --setenv=r4 Nr4 )r r@ rA s r6 r z+_systemd_run_setenv_args.<locals>.<genexpr> s7 ==A$Q$$$$======r5 )rs r envs r6 _systemd_run_setenv_argsr| s4 r ===== = ==r5 r c t s| S t t | z dd| fz }d d |D S )zWrap a shell command so it runs as a transient systemd unit
outside the agent's NoNewPrivileges= sandbox. Returns the original
command unchanged when this process is not under NNP./bin/sh-c c 3 > K | ]}t j | V d S r shlexquoter r* s r6 r z._wrap_outside_sandbox_shell.<locals>.<genexpr> * 22qEKNN222222r5 )rv _SYSTEMD_RUN_BASEr| r r r{ partss r6 _wrap_outside_sandbox_shellr sa
"3
'
' ( dC
!
8822E222 2 22r5 c t st | S t t t | z dz t | z S )z5Argv-form counterpart of _wrap_outside_sandbox_shell.)z--)rv rr r r| rs )argvr{ s r6 _wrap_outside_sandbox_argvr " sY Dzz
"3
'
' (
++ r5 rz c L K t t | | |fi | d{V S )u run_cmd_and_log variant that escapes the agent's systemd sandbox.
Use for shell commands whose RPM/apt scriptlets perform LSM domain
transitions on exec (e.g. kernelcare install, hardened-php
groupinstall) — see the module-level NNP note above.
rz N)rs r r rn r{ ro s r6 run_cmd_and_log_outside_sandboxr . sZ !#CS111 r5 c J K t t | | fi | d{V S )z7run() variant that escapes the agent's systemd sandbox.rz N)r r r r{ rO s r6 run_outside_sandboxr > s< /#>>>II&II I I I I I IIr5 c J K t t | | fi | d{V S )z=check_run() variant that escapes the agent's systemd sandbox.rz N)r r r s r6 check_run_outside_sandboxr C s< 5dDDDOOOO O O O O O OOr5 c N t sdS t j ddgt j t j dd j } n # t t j f$ r Y dS w xY wt j d| }|dS t | t k S )z=Return True iff systemd-run can host a transient unit for us.Frw z --versionT )rh ri textr z\d+)
r= rl r rm r rh r SubprocessErrorr$ r% r r& _SYSTEMD_RUN_MIN_VERSION) version_liner* s r6 _systemd_run_supportedr W s u "
K ( # &
[0 1 uu Ifl + +E }u u{{}} !9 99s 4A A! A!c t s| S t t | z dd| fz }d d |D S )zWrap a shell command so PID 1 owns its cgroup, keeping its CPU and
memory off the agent's. Returns the command unchanged where systemd-run
cannot host it.r~ r r c 3 > K | ]}t j | V d S r r r s r6 r z,_wrap_in_own_cgroup_shell.<locals>.<genexpr>w r r5 )r r r| r r s r6 _wrap_in_own_cgroup_shellr l sa " # #
"3
'
' ( dC
!
8822E222 2 22r5 c L K t t | | |fi | d{V S )zrun_cmd_and_log variant that keeps the command's resource usage out of
the agent's cgroup. Use for package transactions heavy enough to matter
against the agent's own CPU and memory allowance.
rz N)rs r r s r6 run_cmd_and_log_in_own_cgroupr z sZ !!#3/// r5 c e Zd Zd ZdS )r c ` | j dk r7| j r0| dd}| j r
| j |d< | j | t j | d S # t $ r t | j dd pt | j dd }t | j dd pt | j dd }t | j d d pt | j d
d }|j
}|r|j p|j }t d || j || Y d S w xY w) NPENDINGz%Task was destroyed but it is pending!)r] rU source_tracebackr/ r- gi_codecr_codegi_framecr_framez+!> Finalizer error in {}() {} at {} line {})_state_log_destroy_pending_source_traceback_loopcall_exception_handlerr __del__AttributeErrorgetattr_coro co_filenamef_linenoco_firstlinenoprintr )r contextr r framer linenos r6 r z Task.__del__ s{ ;) # #(A # B G %
E.2.D*+ J - -g 6 6 6 N4 4:~t<<
JA AD 4:y$77 7
It< <D DJ
D99 W
J> >E 'H.F43FF =DD$+x
s A CD-,D-N)r- r. r/ r r4 r5 r6 r r s# r5 r c fd}|S )zReturn async callback which waits for *seconds*.
Usage:
@retry_on(Error, on_error=await_for(seconds=PAUSE_INTERVAL), timeout=T)
async def coro():
'here's something that may raise Error.'
c < K t j d {V S r )rp r )rN rc s r6 pausezawait_for.<locals>.pause s) ]7+++++++++r5 r4 )rc r s ` r6 rw rw s# , , , , , Lr5 c j t g st d fd}|S )a
Retry the function call on exception (or exceptions,
if given in tuple) at most *max_tries*.
Await *on_error* (if set) for each exception.
If *timeout* is set, stop all attempts in *timeout* seconds.
If *silent* is set to True - don't raise exceptions after max
If *should_retry* is set - await it and on False, stop auto-retry cycle
tries or timeout.
z Set any of max_tries, timeoutc t j fd }t j fd }t j r|S |S )Nc ~ K rt j z }
st j d nt d
dz D ]} rg|t j z
}|dk r$t j | i || d {V c S
s t
j r d n | i | d {V c S }# t
j t
j f$ r $ rX} || d {V }|s
}|
k r
s r d| || d {V Y d }~d }~ww xY wd S )Nr r r Timeout exceeded when calling %s0Max tries exceeded when calling %s with error %s)
r? r@ itertoolscountr rp r rJ r r rN rO end_timer remaining_timer should_retry_retr rD rD rd re should_retrysilentr s r6 rN z2retry_on.<locals>.decorator.<locals>.wrapper_async s,
6 >++g5 !- """1i!m,,(
/ (
/
#/ ;)1DN4D4D)D)A--)0)9 $d 5f 5 5~* * * $ $ $ $ $ $ $* "&-&: :!$ " # $F!" !" !" &*T4%:6%:%: : : : : : :::: ,g.DE / / /#/1= c11E1E+E+E+E+E+E+E( / * )AI~~ % ! II!, $ # + &hsA . ........#//(
/ (
/s ?C
4C D:"AD55D:c rt j z }
st j d nt d
dz D ]} rH|t j z
}|dk r
| i |c S
st
r d n
| i |c S X# $ rL} || }|s
}|
k r
s r d| || Y d }~d }~ww xY wd S )Nr r r r )r? r@ r r r rJ r r s r6 rP z1retry_on.<locals>.decorator.<locals>.wrapper_sync s
6 >++g5 !- """1i!m,,$
) $
)
) 5)1DN4D4D)D)A--#'4#8#8#8 8 8 8#) "&2 2!$ " # $F!" !" !" $tT 4V 4 4444 ) ) )#/+7<Q+?+?( / * )AI~~ % ! II!, $ # + a(((#)'$
) $
)s %B.)BC, AC''C,rS r rp rQ )
rD rN rP r rD rd re r r r s
` r6 rU zretry_on.<locals>.decorator s + / + / + / + / + / + / + / + / + / + / + /
+ /Z
' ) ' ) ' ) ' ) ' ) ' ) ' ) ' ) ' ) ' ) ' )
' )R &t , , r5 )r rk )r re rd r r rD r rU s ``````` r6 ru ru sz $ 7# $ $ :8999\ \ \ \ \ \ \ \ \ \ \ | r5 c t j fd }t j fd }t j r|n|S )zhIf func throws an exception it is catched, converted to a string and
returned as a result of a call.c r K | i | d {V S # t $ r}t | cY d }~S d }~ww xY wr r reprrN rO r rD s r6 rN z,stub_unexpected_error.<locals>.wrapper_async5 sg t.v........ . 77NNNNNN s
6166c b | i |S # t $ r}t | cY d }~S d }~ww xY wr r r s r6 rP z+stub_unexpected_error.<locals>.wrapper_sync< sQ 4((( ( 77NNNNNN s
.)..r )rD rN rP s ` r6 stub_unexpected_errorr 1 s _T _T $ 7 = = O==<Or5 c 2 t j fd}|S )zkA decorator that logs uncaught exceptions ignoring them otherwise.
CancelledError is not handled.
Nc t j fd }t j fd }t j r|S |S )Nc K | i | d {V S # t j $ r $ r'} dt dd | Y d }~d S d }~ww xY wNz Ignoring exception from %s: %sr/ r )rp r r rN rO r r r log_handlers r6 rN z>log_error_and_ignore.<locals>.decorator.<locals>.wrapper_asyncO s
!T4 26 2 22222222)
4D.&99
s
A A Ac t | i |S # $ r'} dt dd | Y d }~d S d }~ww xY wr )r r s r6 rP z=log_error_and_ignore.<locals>.decorator.<locals>.wrapper_sync\ s
tT,V,,,
4D.&99
s 7 27r )r rN rP r r s ` r6 rU z'log_error_and_ignore.<locals>.decoratorN s
&t , , r5 )r_ r )r r rU s `` r6 log_error_and_ignorer F s9
l < r5 c fd}|S )z'Abort the agent service on *exception*.c L t j fd }|S )Nc K | i | d {V S # $ r/}t | Y d }~d S d }~ww xY wr )r_ r )rN rO r abortr r s r6 rQ z2abort_agent_on.<locals>.decorator.<locals>.wrappers s
!T4 26 2 22222222
###
s
A$AArR )r rQ r r s ` r6 rU z!abort_agent_on.<locals>.decoratorr sC
r5 r4 )r r rU s `` r6 abort_agent_onr o s* r5 c R t j dd| S )zPascalCase to snake_casez([a-z])([A-Z])z\1_\2)r$ subrK )strings r6
snake_caser s#
6"Hf 5 5 ; ; = ==r5 g?g ?c H dt | v S )Nr )ro rK )r s r6 _is_db_locked_errorr s s3xx~~'' ''r5 )exec_expr_with_empty_iterc ' K |s|rdg}nt |t }ddlm} |j 5 |D ]} | |g|R E d{V ddd dS # 1 swxY w Y dS )a]
Get iterator over results of sql expression expr. Given iterable will be
split for chunks and we will return iterator containing results of all
split queries. Useful for sql selects with in_() in order to avoid
too many sql variables error.
If exec_expr_with_empty_iter is True and iterable is None(empty) we will
process expression once, passing here chunk=None expr(None, *args)
:param expr:
:param iterable:
:param exec_expr_with_empty_iter: if iterable is None(empty) process
given expression once, passing here chunk=None expr(None, *args)
:return:
Nr r instance)r CHUNK_SIZE_SQL_QUERYdefence360agent.modelr db transaction)exprr r rN chunksr r s r6 get_results_iterable_expressionr s & L1 L 6JKKK...... " " * * * *EtE)D))) ) ) ) ) ) ) ) ) ** * * * * * * * * * * * * * * * * *s A##A'*A'r c t t || ddlm d }t t
|t dz d fd } | S ) a
Get number of results of sql expression expr. Given iterable will be
split for chunks and we will return number of results of all
split queries. Useful for sql delete with in_() in order to avoid
too many sql variables error.
The iterable is materialized BEFORE the database transaction opens,
and the transaction is retried on transient SQLite lock errors. This
matters because callers commonly pass a generator that does its own
SELECTs (e.g. ``MalwareHit.delete_hits(get_outdated_entries(...))``):
in SQLite WAL mode, the read snapshot taken inside a transaction
becomes stale as soon as another writer commits, and the subsequent
write raises SQLITE_BUSY_SNAPSHOT, which PRAGMA busy_timeout does
*not* cover.
r r r c t t d|dz
z z t }t d||t
| t
j | d S )Nrb r z;SQLite lock contention, retrying in %.3fs (retry %d/%d): %s)minDB_LOCK_RETRY_BACKOFF_BASEDB_LOCK_RETRY_BACKOFF_MAXr_ r DB_LOCK_MAX_RETRIESr? r )r attemptbackoffs r6 _backoffz-execute_iterable_expression.<locals>._backoff sd &!! *< = %
I
7r5 r c t | S r )r )r r s r6 rX z-execute_iterable_expression.<locals>.<lambda> s *=c*B*B r5 )re rd r c d} j 5 D ] }| |gR z
} ! d d d n # 1 swxY w Y | S r )r r execute)r r rN r r r s r6 _execute_allz1execute_iterable_expression.<locals>._execute_all s
[
$
$
&
& 8 8
8
844----55777
8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 s $AAA)rr r r r ru r r )r r r rN r r r r s ` ` @@r6 execute_iterable_expressionr s $ /(zBBB
C
CF...... %)BB
<>>r5 c X t j | dd dz S )Nr \nr )r fsencoderg r s r6 encode_filenamer s%
;t||D%00 1 1E 99r5 c b t j | d d dd S )Nr( r r )r fsdecoderg r s r6 decode_filenamer s+
;t SbS ! ) )% 6 66r5 c N t j t j | S r )base64 b64encoder r r s r6 base64_encode_filenamer
s BK - - . ..r5 b64namec h t t j t j | S r )r r r r b64decode)r s r6 base64_decode_filenamer s% F ,W 5 566 7 77r5 c V t j | }n# t $ r d}Y nw xY w|S )zS
Like pwd.getpwnam(username) but returns None instead of raising KeyError.
N)r r r )r r s r6 r r sA h'' Ms &&c > t t | | | S )zH
Put the specified `value` inside the [`low`, `high`] interval.
)maxr )r lowhighs r6 clipr s s5$ % %%r5 Background task failedc | t j } | dS # t j $ r Y dS t
$ r} |d|| Y d}~dS d}~ww xY w)a[
Callback for asyncio.Future that logs exceptions and ignores CancelledError.
Use this as a done_callback for asyncio tasks/futures:
future.add_done_callback(log_future_errors)
Or with custom logging:
future.add_done_callback(
lambda f: log_future_errors(f, logger.warning, "Upload failed")
)
Nz%s: %s)r_ r r rp r r )futr rU r s r6 rV rV s n *
!
* * * Hgq)))))))))*s & A A
AAr .c r fd} ||i | }| | |S )z
Use this function in plugin initialization instead of
loop.create_task to be able to see the exceptions from the specified
coroutine.
c | sA| / d| | d d S d S d S )Nz1Unhandled exception during plugin initialization!)rU r r] )rZ r r )r] r s r6 _log_exceptionz6create_task_and_log_exceptions.<locals>._log_exception+ sv ~~ DNN$4$4$@ ' ' L!% !1!1
$@$@r5 ) create_taskr\ )r r rN rO r new_tasks ` r6 create_task_and_log_exceptionsr " sY
d 5f 5 566H ~... Or5 c fd}|S )a5
Create coroutine from regular function
Useful to pass functions to APIs requiring coroutines
Note: coroutine will still block event loop in main thread.
For most blocking functions, run_in_executor should be considered instead
:param function:
:return: coroutine running function
c K | i |S r r4 )rN rO functions r6 r zmake_coro.<locals>.coroF s x((((r5 r4 )r# r s ` r6 make_coror$ < s# ) ) ) ) ) Kr5 c K |t k r
t j }n t j } |dt | dd x}rd| dnd| | t j t d {V d S )Nz7Failed to copy data%s to modsec ruleset dir %r, try: %sr z ()r )COPY_TO_MODSEC_MAXTRIESr_ r r r rp r _MODSEC_COPY_FAILURE_TIMEOUT)r r rD fns r6 log_failed_to_copy_to_modsecr* P s ###lnCA $S*d ; ;;rD
R
" -4
5
5555555555r5 ) err_buf_sizec
4 K d }t | }t j | dt j j t j j d| d{V } t j ||j | |j 2 3 d{V }|W V
6 | d{V }|dk r%t || dd
| dS # | d{V }|dk r%t || dd
| w xY w)z
Start *cmd*, yield its stdout line by line [b'
']
If *cmd* return nonzero exit status, raise CheckRunError with the
last *err_buf_size* lines from stderr.
c J K | 2 3 d {V }| | 6 d S r )append)pipebufr? s r6 read_pipe_intoz1readlines_from_cmd_output.<locals>.read_pipe_intoh sL $ JJt $$s ")maxlenT)rj rh ri Nr r5 ) r rp rt rh rm r ri rh ry r r )r r+ ro r1 err_bufr~ r? r s r6 readlines_from_cmd_outputr4 ^ s <(((G/ !&!&
D I NN4; @ @AAA + $JJJJJ &+ 99;;&&&&&&
??
Cchhw6G6GHH H ? 99;;&&&&&&
??
Cchhw6G6GHH H H H H Hs *C :B C ADrb )rd delayc K t d|dz D ]3} | | d{V }|s!||k rt j | d{V 0|c S dS )z
Retry *predicate_coro(*args)* until it becomes true,
but no more than *max_tries* attempts.
Sleep for *delay* seconds before the next *predicate_coro()* call.
Return whether the predicate became true.
r N)r rp r )predicate_corord r5 rN r r s r6 finally_happenedr8 s IM** %~t,,,,,,, 'I---&& & & & & & & &
r5 ' c K t | d D ]-\ }}|W V ||z dk rt j d d{V .dS )z6Yield to the event loop every *chunk_size* iterations.r )rE r N) enumeraterp r )r r r items r6
nice_iteratorr= so XQ/// # #4
Nq -"" " " " " " " "# #r5 c e Zd ZdZd Zd ZdS )LazyLocka
Descriptor object to share async Lock between client objects.
Used in order to achieve lazy evaluation of the lock and share state
between it's clients.
Using asyncio.Lock in client code directly:
>>> class Foo:
>>> lock = asyncio.Lock()
leads to an unclear error ([Errno 9] Bad file descriptor),
when trying to move this Lock during demonization process.
c d | _ d S r )r r> s r6 r zLazyLock.__init__ s
r5 c N | j st j | _ | j S r )r rp r )r r owners r6 __get__zLazyLock.__get__ s! z ( DJzr5 N)r- r. r/ r] r rC r4 r5 r6 r? r? s< r5 r? c | } | rd| v sd| vrdS | dd \ }}||fS )zOParse RPM output line, return (package_name, version) or None if not installed.z
not installed: Nr )r rK r )r? pkg_nameversions r6 _parse_rpm_linerH s[ ::<<D ?djjll22d$6F6Ft
4++Hg W r5 c
| } | rd| v sd| vrdS | d sdS | dd \ }}|r| d nd}||fS )zVParse dpkg-query output line, return (package_name, version) or None if not installed.zno packages foundrE Nz
ok installedr r r )r rK r r )r? rF restrG s r6 _parse_dpkg_linerK s ::<<D &$**,,66$d:J:Jt
== ) ) tZZa((NHd!%-djjll1oo2G W r5 c t st r g dt fS g dt fS )N)z
dpkg-queryz--showz --showformatz!${Package}: ${Version} ${Status}
)rpmz-qz5--queryformat=%{NAME}: %{VERSION}-%{RELEASE}.%{ARCH}
)r- ra ri rK rH r4 r5 r6 _get_package_query_cmdrN sg
M$;$;$=$=
r5 c e Zd ZdZdS )FirewallDisabledExceptionz;Exception in case of using firewall api, when it's disabledNr r4 r5 r6 rP rP s EEEEr5 rP c < t fd }|S )Nc K t j d rt d | i | d {V S )Nz!/var/imunify360/firewall_disabledz"Not available in the current build)r r
r: rP )rN rO rD s r6 rQ z(check_disabled_firewall.<locals>.wrapper s\
7>>= > > +4
T4*6*********r5 r )rD rQ s ` r6 check_disabled_firewallrS s3
4[[+ + + + [+ Nr5 >
imunify-ui imunify-coreimunify-antivirusimunify360-firewallpackagesc K t \ }}t | }t ||z dd d{V }t ||| S )a
Retrieves the version of the specified system packages using
a command and regex specific to the current system.
Parameters:
packages (Iterable[str]): A set of package names to retrieve version for.
Returns:
A dictionary mapping package names
to their corresponding version strings, or None
if the package is not installed or version information
cannot be retrieved.
r F)r r N)rN rr safe_run_with_timeout_parse_package_info_output)rX r
parse_line
packages_listr s r6 system_packages_infor^ st -..OCNNM( mR% F &fmZ H HHr5 r r\ c n fd| D fd|D S )Nc X i | ]&} | xd xd x#'S )r r r4 )r r? r\ pkgr vers r6
<dictcomp>z._parse_package_info_output.<locals>.<dictcomp> sf j&& &F 1I
S
1I
S S r5 c < i | ]}| | S r4 )r; )r ra parseds r6 rc z._parse_package_info_output.<locals>.<dictcomp> s% 5 5 5SCC 5 5 5r5 )
splitlines)r rX r\ re ra r rb s `@@@@r6 r[ r[ sf
%%'' F 6 5 5 5H 5 5 55r5 c K t j t | fi || d {V S # t j $ r |d| Y dS w xY w)Nr z#Command %s failed: Timeout occurredr )rp r r rJ )rz r rD rO s r6 rZ rZ # s % W ' ' ' '
17;;;rrs &+ A
A
nc # K |dk rt d t | }t t || x}r%|V t t || x}#d S d S )Nr zn must be at least one)rk r rr r )r rh itbatchs r6 batchedrl / s
1uu1222
h Br1
&&
&% r1
&&
&% r5 rO c # R K t | D ]} fd|D V d S )Nc " i | ] }|| S r4 r4 )r r@ rO s r6 rc z batched_dict.<locals>.<dictcomp>= s &&&1q!A$&&&r5 )rl )rO rh rk s ` r6 batched_dictro ; sK A ' '&&&&&&&&&&&' 'r5 c n t j ddgd } | d }|s?t d r t j ddgd }d|v rd}|S # t $ r&}t d | Y d }~d
S d }~ww xY w) Nhostnamez-fT)r )z.cloudwaysapps.comz.cloudwaysstagingapps.comz/usr/local/sbin/apminfo Cloudwaysz$Error while checking environment: %sF) rl check_outputr r r r: r r_ r )rq
_is_cloudwaysr r s r6 is_cloudwaysrv @ s +
T
%'' !)) ?
%&;!<!<!C!C!E!E % -&/d F f$$ $
;Q???uuuuus BB
B4B//B4pid_filec t j }| rt | dk r|S | | d |S # t $ r'}t
d| |cY d }~S d }~ww xY w)Nr r z Error while creatin PID file: %s)r ra ro
write_textr r_ r )rw ri r s r6 write_pid_filerz U s
)++C s8}}**
sJJJ'''
7;;;
s A
A7 A2,A72A7c | rt | dk rd S | r| d S # t $ r&}t d| Y d }~d S d }~ww xY w)Nr z Error while cleanup PID file: %s)ro r: r r r_ r )rw r s r6 cleanup_pid_filer| c s s8}}**t ?? OO 7;;;s (A
A3
A..A3c | K t d|| t j d|z d{V dS )a
Used with retry_on decorator as on_error handler:
Example:
```
@retry_on(
PanelException,
on_error=backoff_sleep,
timeout=_HTTP_REQUEST_RETRY_TIMEOUT,
)
def some_function():
...
```
z#%s sleep on: %srb N)r_ r rp r )r r s r6
backoff_sleepr~ p sK NN%w :::
-W
%
%%%%%%%%%%r5 )NN)r` N)T)r Fr )rt )r )r )r )r
)NNNFNN)Nr )r9 )rp r r rS r r loggingr r r$ r r rb r rh rl r? urllib.requestr r collectionsr r collections.abcr r
contextlibr r r
datetimer enumr fcntlr
r r r r r pathlibr tempfiler typingr r r r r r r r async_lrurI rj peeweer _shutilr r! fd_opsr" r# getLoggerr- r_ USER_IDENTITY_FIELDUSER_IDENTITY_HEADERSr r r9 rf AV_PID_PATHIM360_NON_RESIDENT_PID_PATHIM360_RESIDENT_PID_PATHr environr; HTTP_REQUEST_RETRY_TIMEOUTr, lru_cacher= rG rW rY rm bytesr r r r r r ro r r r r r r r r r boolr r r" r+ r- md5ry rw r r r r r r partial
alru_cacheasync_lru_cacher r r r r r r r r r r r r r typer r# r+ r- r3 timed_cacher^ rd rs rv r r| r r r r r r r r r r rw ru r r r r r r r r r r r r r r
r r r rV r r$ r' r( r* r4 r8 r= r? rs rH rK rr rN rP rS r: IMUNIFY_PACKAGE_NAMESrH r^ r[ r rZ rl ro rv rz r| r~ r4 r5 r6 <module>r s
* * * * * * * * / / / / / / / / : : : : : : : : : : 2 2 2 2 2 2 2 2 2 2 2 2 ' ' ' ' ' '
# # # # # # 0 0 0 0 0 0 0 0 % % % % % % GCx 8 $ $ d011 6 d344 "d#B C C $ 899 SJNN:B??
+ + + + +D + + + Q K K K K 4T 4
0 0 3u 0 0 0 0 f 0
K2
(5
5
.;
'
'
'
'
' ,
+ + + + + + + +@ :?; ; ; ;F (, d d d
3J $ d
$Jd
d d d dN Q
?
?C
?
?
?
?h' h' h' h' h' h' h' h'X %[4
A
A
A58
A
A
A
A
A # ## # 38_ # # # #2 . <
$)#
5 T 5 T % % %- - - - - - - -` 0E 6 D &3 # $ % % %
,
,h
,C
,)
,
,
,
,
# # # # # # # #" R ! ! ! ! " 2e e e e e e e eP -. !
!
!
!
!
H) ) ) Z Q 4 $ > > > 3 3S 3s 3 3 3 3 $
,0 J J J J J
26 P P P P P" Q : : : : :( 3 33 3S 3 3 3 3 $ 7< B
$ s s s slP P P* $-$ & & & &R %7 &> > >
! ( ( ( ( (
6; * * * * *@ ';1 1 1 1 1h: : :7 7 7/ /% / / / /8E 8d 8 8 8 8 & & &* * * *.i ( 4
6 6 6 %( I I I
c I I I ID =>Q
# # # # 0 # %S/D"8 3 5c?T#9 " Q $s)XseU38_t%; ;<
<= .F F F F F F F F " IsmI #sTz/I I I I, 6 63i 6 #c3h$ 667 6
#sTz/ 6 6 6 6 !, 'DcN 's ' ' ' '
Q ( T c
t
& & & & &r5 defence360agent/utils/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000313235 00000000000 020366 0 ustar
r_j V d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
Z
d dlZd dlZd dlZd dl mZ d dlmZmZ d dlmZmZ d dlmZm Z m Z d dl m Z d dl m!Z! d dl"m#Z#m$Z$m%Z%m&Z& d d lm'Z' d d
lm(Z( d d l)m*Z* d d l+m,Z, d d
l-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6Z6d dl7Z7d dl8Z8d dl9m:Z: ddl;m<Z<m=Z= ddl>m?Z? e5de0 Z@ ejA eB ZCdZDdZEdaFdZG e*d ZHdZI e*d ZJ e*d ZK e*d ZL eMejN O d d ZP G d d e! ZQ ejR d! d" ZSe dd# ZTeCddfd$ZU G d% d& ZVdejW ejW d'dfd(e4eMeXeXf fd)ZYddd*d+ZZ G d, d-ej[ Z\e\fd(eXfd.Z]e\fdd/Z^dd(e_fd1Z`d2 Za G d3 d4 Zbd5 Zc G d6 d7ed Zed8 Zfd9 Zg dd;Zhd0ddd0ddd<d=eie_z ejj z d>eMdz d(eifd?Zk ejR d d@ Zldd(e_fdAZm G dB dC Znejo dDfdEe_dFeMd(e_fdGZp ddEe_dFeMd(e4e_eMf fdHZqdI ZrdJ ZsddLZt ddNZudO Zv ejR dPeMfdQ Zw ejx e6jy dRd0S ZzdT Z{dEejj dUeXd(dfdVZ|dW Z}dEejj dXeXd(eifdYZ~dZ Z G d[ d\ ZeEfd]Zd^ Ze d_eMfd` Zddbe_d(e*fdcZdde_dbe_d(eifdeZdf ZddhedieMd(efdjZdk Z G dl dme Z ejR d:! dn Zdo Zdd(eifdpZ G dq dr ZeZdsdtduZdv Zdw Z ejR d! d(eifdx ZdyZdz Zdd{e_d(e_fd|Zdd}Zdd~dZdd~dZdd~dZdZ ejR d! d(eifd Zdd{e_d(e_fdZdd~dZ G d de j Zd Z ddZd ZeddfdZefdZd ZdZdsZdZdZd(eifdZd'ddZeddZd Zd Zdde*d(eXfdZdeXd(e*fdZd Zd ZddZde0de/f fdZd ZdsZdsZd ZdRdd{e3e_ fdZddsddZddZ G d d ZdXe_d(ee_e_f dz fdZdXe_d(ee_e_f dz fdZ ejR d! d(eee_ e0e_gee_e_f dz f f fd Z G d ded Zd Z eh d Zdee_ d(ee_e_dz f fdZde_dee_ de0e_gee_e_f dz f d(ee_e_dz f fdZeCj fd(e_fdZdeMfdZde1e.e.f deMfdZ ejR d! d Zde*d(eMfdZde*fdZd ZdS ) N)Future) OrderedDictdeque) GeneratorIterable) ExitStackcontextmanagersuppress) timedelta)Enum)LOCK_EXLOCK_NBLOCK_UNflockwraps)islice)Path)NamedTemporaryFile)Any AwaitableCallableDict FrozenSetListTupleTypeVar)OperationalError )is_safe_subdir_namermtree)atomic_rewrite_fdF)bounduser_id)z
User-AgentzAccept-LanguagezAccept-Encoding
ConnectionDNTz.i360bakz/run/systemd/systemz /etc/cloudlinux-edition-soloz /var/run/imunify-antivirus.pidz /var/run/imunify360-agent.pidz/var/run/imunify360.pid%IMUNIFY360_HTTP_REQUEST_RETRY_TIMEOUT< c e Zd ZdZdZdZdZdS )ScopezAV onlyz AV and IM360z
IM360 onlyzIM360 resident onlyN)__name__
__module__ __qualname__AVAV_IM360IM360IM360_RESIDENT S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/__init__.pyr, r, H s" B H E*NNNr5 r, )maxsizec t o2t ot S )zReturn True if /run/systemd/system folder exists:
[sd_booted]
(https://www.freedesktop.org/software/systemd/man/sd_booted.html)
)_SYSTEMD_BOOTED_DIRexistsis_dir
is_symlinkr4 r5 r6 is_systemd_bootr= O sC ""$$ 1 & & ( ( 1#..00 0r5 c # K |s|sJ t j } |p|j d| dV t j } |p|j d| ||z
dS )z
:param str: action name to log
:param logging.Logger: logger you want action name and timing
to be logged with
:param func: log function to use (`log` has preference over `logger_`)
z
%s startedNz%s took %.2f second(s))time monotonicdebug)actionlogger_logstartstops r6 timeitrG \ sz c> N ESGM<000 EEE > DSGM3VTE\JJJJJr5 c fd}|S )Nc N t j fd }|S )Nc K t pj 5 | i | d {V cd d d S # 1 swxY w Y d S N)rC rD rG r- argskwargsrB funrD rC s r6 wrapperz+timefun.<locals>.decorator.<locals>.wrappern s .#,SIII
2
2 S$ 1& 1 1111111
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2s 8<< functoolsr rP rQ rB rD rC s ` r6 decoratorztimefun.<locals>.decoratorm sH 2 2 2 2 2 2 2
2 r5 r4 rC rB rD rU s ``` r6 timefunrW l s0 r5 c 0 e Zd ZdZeeddfd ZdS )synczF
the same timefun decorator variation but without async/await
Nc fd}|S )z
:param logging.Logger: logger you want action name and timing
to be logged with
:param str: action name to log
c N t j fd }|S )Nc z t pj 5 | i |cd d d S # 1 swxY w Y d S rK rL rM s r6 rQ z0sync.timefun.<locals>.decorator.<locals>.wrapper s F 2clGMMM 0 0 3///0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0s 044rR rT s ` r6 rU z sync.timefun.<locals>.decorator sH
_S
!
!
0
0
0
0
0
0
0 "
!
0 Nr5 r4 rV s ``` r6 rW z sync.timefun} s0 r5 )r- r. r/ __doc__ staticmethodloggerrW r4 r5 r6 rY rY x sE t \ r5 rY Freturnc $ K | |t d t j }|r't | t sJ | g} t
j }n*t | t t f sJ t
j } t t dt d | | |||dd| d{V }|
| d{V \ } }
| d{V } t d | ||| | |
f | | |
fS )
zYAsynchronous command executor.
Returns a tuple (exit_code, stdout_data, stderr_data).Nz/stdin and input arguments may not both be used. r )seconds) max_trieson_errorTstdinstdoutstderrstart_new_sessionz run(%s, stdin=%s, shell=%s) = %s)
ValueError _subprocessPIPE
isinstancestrasynciocreate_subprocess_shelllisttuplecreate_subprocess_execretry_onBlockingIOError await_for communicatewaitr_ rA ) commandrg rh ri shellinputrO create_subprocessprocouterr exit_codes r6 runr s
NOO O ;'3''''') # ;'D%=11111 # : 1y/C/C/C
D %%e,,,,,,,,HCiikk!!!!!!I
LL*
C c3 r5 )looptimeoutc |rt d D ]b} t j }| s n7n# t $ r Y nw xY wt j t j c| t j t | t j
r| nt j | | S )zjRun coroutine from a blocking code (outside the event loop).
Coroutine will be wrapped in Task.
Nrb r ) rangerp get_event_loop is_closed RuntimeErrorset_event_loopnew_event_looprun_until_completewait_forrn r Task)coror r _s r6 run_coror s |q = =A
-// ~~'' E
"7#9#;#; < < < < " " tW^44 LDD',t:L:L
s ?
A A c e Zd Zd ZdS )
CheckRunErrorc d}| | j | j | j pd | j pd S )Nz[Command {cmd!r} returned non-zero code {returncode},
Stdout: {output},
Stderr: {error}
)cmd
returncodeoutputerror)formatr r r decoderi )self_MESSAGEs r6 __str__zCheckRunError.__str__ s_
$
;%%''/4+$$&&.$
r5 N)r- r. r/ r r4 r5 r6 r r s#
r5 r c ` K t | fi | d{V \ }}}|dk r ||| || |S )zJ
Asynchronous command executor.
Returns output as bytestring.
Nr )r )rz raise_excrO r r r s r6 check_runr sZ
"%W!7!7!7!7777777JSQi
GS#666 Jr5 c K t | t j t j t j d{V \ }}}|dk r ||| dS )z
Asynchronous command executor. Raises raise_exc if exit code is nonzero.
Stdin, stdout and stderr of command are connected to /dev/null.
)rg rh ri Nr )r rl DEVNULL)rz r coder s r6 check_exit_coder sy
!"" JD!Q qyyig&&& yr5 Tc K t | fi | d{V \ }}}n,# t $ r t d| Y dS w xY w|r%|dk r t d| || dS | }n,# t $ r t d| Y dS w xY w|S )zGSafe run command.
Returns stdout as string or empty string on errorNz Command %s failed with OSError r z'Command %s failed with exit code %s: %sz#Command %s returned non-utf8 output)r OSErrorr_ warningstripr UnicodeDecodeError)rz check_returncoderO rcr r results r6 safe_runr s 3 3F 3 3333333 C 7AAArr B!GG 5wC
r##%% <gFFFrr Ms! %AA0&B %C ?C c d fd}|S )z non asyncio vesion of lazy initNc
S Nr4 ) decorated_f placeholders r6 rQ z#plainold_lazy_init.<locals>.wrapper! s %+--Kr5 r4 )r rQ r s ` @r6 plainold_lazy_initr s. K Nr5 c e Zd ZdZd Zd ZdS )
PeriodicCheckz
Invoke a callback with a certain period
and return cached result in between.
Raising an exception from the callback does not
affect the next check schedule.
c || _ || _ t j |z
| _ d | _ t
t j | _ d S r )
_cb_coro_check_every_n_secondsr? r@ _last_check_timestamp_last_check_resultr rp Lock_lock)r cb_corocheck_every_n_secondss r6 __init__zPeriodicCheck.__init__3 sD
&;#%)^%5%58M%M""& ' 55
r5 c K | 4 d {V t j | j z
}|| j k rVt
d| j | j t j | _ | j |i | d {V | _ | j cd d d d {V S # 1 d {V swxY w Y d S )Nz3Timeout %d seconds has expired, doing the check: %s) r r? r@ r r r_ rA r r )r rN rO deltas r6 __call__zPeriodicCheck.__call__< s\ ::<<
+
+
+
+
+
+
+
+N$$t'AAE333 I/M
.2^-=-=*0=
t0Nv0N0N*N*N*N*N*N*N'*
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+s BB33
B= B=N)r- r. r/ r] r r r4 r5 r6 r r * s< 6 6 6 + + + + +r5 r c fd}|S )Nc $ t | S r )r )r nsecs r6 decoratez cache_result.<locals>.decorateK s T4(((r5 r4 )r r s ` r6 cache_resultr J s# ) ) ) ) ) Or5 c e Zd ZdZdS )RecurringCheckStopz:
raised by coroutine to stop recurring_check loop
Nr- r. r/ r] r4 r5 r6 r r Q s Dr5 r c K t | r!t j | di | d {V nt j | d {V dS # t j $ r Y dS w xY w)NFTr4 )callablerp sleepCancelledError)period
period_kwargss r6 wait_for_periodr Y s F (- 7 7 7 788 8 8 8 8 8 8 8 8-'' ' ' ' ' ' ' 'u ! tts A
A A#"A#c 8 K |r| rt |fi | d {V ndS NF)r )checkr r s r6 should_stop_after_period_passedr d sG of66
666666666
r5
c fd}|S )z
run decorated corotine in a loop every :period: seconds.
If more then consecutive_err_limit error occured, exit loop.
:param period:
:param consecutive_err_limit:
:param check_period_first: default false
:return:
c F t fd }|S )Nc K d} t fi d {V rd S | i | d {V d}n# t $ rO d|v rG t |d t r|d n# t
$ r Y nw xY wY d S t j $ r Y d S t $ r}|dz
}|k r t
d Y d }~d S t |t j r3t
d|j
|j |j |j nt
d Y d }~nd }~ww xY wt fi d {V rd S T)Nr T lock_filer z-Error count exceeded limit,exiting check loopz+Failed to run %s (%s). stdout=%s, stderr=%szError executing %s)r r rn r unlinkFileNotFoundErrorrp r Exceptionr_ exceptionrl CalledProcessErrorr r r ri ) rN rO consecutive_err_cntexccheck_period_firstconsecutive_err_limitrP r r s r6 wrappedz3recurring_check.<locals>.decorator.<locals>.wrappedy sH "# '
8& 2? E , #t.v.........: +,''9 * "f,,! )&*=t D D = &{ 3 : : < < < 0 ! ! ! D!EE - EE D D D'1,'*-BBB (( K !#{'EFF D (( I G N J J (()=sCCC!D& 9**F 6C EO'
sK 0 D?5A54D?5
B?D?BD?D? D?"%D:
A(D::D?r )rP r r r r r s ` r6 rU z"recurring_check.<locals>.decoratorx sI s) ) ) ) ) ) ) )
) V r5 r4 )r r r r rU s ```` r6 recurring_checkr l s7 - - - - - - - -^ r5 )backupuidgidallow_empty_content permissionsdir_fdr r c t |t r| }|'|rt d t | |||||| S t t 5 t | d 5 }| t | dz } ddd n # 1 swxY w Y | |k r ddd dS ddd n # 1 swxY w Y |s |s t d|| dS |rt |t t j
f r|}
n t j | t z }
t t 5 t! j | |
ddd n # 1 swxY w Y |k t% j t j | j }n># t $ r1 t j d } t j | d | z }Y nw xY wt j | \ } }
t1 | st
d
| t5 5 }t7 d | d |
d
z dd 5 fd}| | | |*|(t j || t j! | t j" ddd n # 1 swxY w Y t j# j$ | |% ddd n # 1 swxY w Y dS )a Atomically rewrites *filename* with given *data*.
If *filename*'s content is *data* already, do nothing.
If both *uid* and *gid* are given then resulting file is chowned
to given user id and group id.
Skip rewrite with empty content if *allow_empty_content* is False.
Chmod to given access *permissions* else preserve *filename* 's
permissions.
Return True if *filename* file was updated, False otherwise
When *dir_fd* is provided it must be an O_NOFOLLOW-opened file
descriptor for the parent directory of *filename*. All file I/O is
then performed relative to that descriptor, closing the TOCTOU
symlink-attack window. *backup* is not supported with *dir_fd*.
Nz/backup is not supported when dir_fd is provided)r r r r r rbr Fz empty content: %r for file: %sr i zParent dir is missing: wbz .i360editr )modedirsuffixprefix bufferingdeletec t t 5 t j j d d d d S # 1 swxY w Y d S r )r
r osremovename)tfs r6 cleanupz atomic_rewrite.<locals>.cleanup s /00 ' 'Ibg&&&' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' 's =AAT)&rn ro encoderk r" r
r openreadlenr_ r r PathLikefspathBACKUP_EXTENSIONshutilcopystatS_IMODEst_modeumaskpathsplitr r: r r callbackwriteflushchownfilenochmodfsyncrenamer pop_all)filenamedatar r r r r r file old_contentbackup_filename
current_umaskdirpathbasenamestackr r s @r6 atomic_rewriter s 6 $ {{}}
P NOO O 3#
# $ $
(D
!
! 3T ))CIIM22K 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 $ t 5tXFFFu
3 fsBK 0 1 1 E $OO i 1 14D DO
'
(
( 3 3 K/ 2 2 2 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 1 ,rwx'8'8'@AAKK 1 1 1 HQKKM H] # # # =.0KKK 1
h//GX == ! ! G E' E EFFF
c>
"
'
'
'
'
'
NN7 # # # HHTNNN HHJJJ3?c3/// HRYY[[+ . . . HRYY[[ ! ! !- " " " " " " " " " " " " " " ". "'8$$$
3 8 4s (C9&B+ C+B/ /C2B/ 3
CC CE<<F F
+F6 68G10G1M>0B=L9- M>9L= =M> L= 1M>>NNc t d S # t $ r Y d S w xY w)Nz/etc/system-release)r read_textrstripr r4 r5 r6 os_release_and_versionr" sP )**4466==??? tts 25
AAc | p
t }|r-t j d| }|r| d S nt t d|z )z3Return os version, if can't get it raise ValueErrorz\s*(\d+\.\d+\S*)(\s|$)r z!Can't discover os version from %r)r" researchgroup cache_clearrk )release_and_versionrvmatchs r6
os_versionr+ st
8 6 8 8B - 3R88 ";;q>> ! " **,,,
82=
>
>>r5 c e Zd ZdZ ed Z ed Z ed ZdZe d Z
e de e e
f fd Ze dee fd Ze de fd
Ze de fd Ze d Ze d
Ze d Ze d Ze d Ze d Ze d Ze d Ze d ZdS )
OsReleaseInfoz/etc/os-release)debian)rhelfedoracentos)unknownNc t | j 5 }|D ]U} | d \ }}| d ||< F# t
$ r Y Rw xY w d d d n # 1 swxY w Y d|v r,t
|d |d< d S t
| dd f |d< d S )N="ID_LIKEIDlinux)r ETC_OS_RELEASEr! r r rk frozensetget)clsdict_flinekvs r6 dict_from_filez OsReleaseInfo.dict_from_file. s3
#$
%
%
;;==..s33DAq wws||E!HH! D
(y)9)?)?)A)A B BE) )%))D'*B*B)D E EE) s5 A;AA A;
A+(A;*A++A;;A?A?r` c \ | j t }t j | j r| | nt j }|r|d r|d
d }|dk r d|d v rd}||d< d |d |d |d |d < |d
v r | j |d < n.|d v r | j
|d < n | j |d < nd
|d< | j |d < d
|d < || _ | j S )Nr redzRed Hat Enterprise Linuxr/ r7 z
{} {} ({})r rb PRETTY_NAME)
cloudlinuxr1 r/ r6 )ubuntur. r2 )r= dictr r
r: r9 rB distrolinux_distributionlowerr r RHEL_FEDORA_CENTOSDEBIANUNKNOWN)r< r= dosids r6 to_dictzOsReleaseInfo.to_dict= sQ 9 $(FFEw~~c 011
5""5)))) -// 51 5 Q4::<<--//2Du}})Cqt)K)K %"&E$K+7+>+>!adAaD, ,E-( ???+.+Ai(( !555+.:i((+.;i(("+E$K'*{E)$+4E-( CIyr5 c 6 | d S )Nr6 rQ r< s r6 id_likezOsReleaseInfo.id_like\ s {{}}Y''r5 c 6 | d S )NrE rS rT s r6 pretty_namezOsReleaseInfo.pretty_name` s {{}}]++r5 c R | dd S )zi
:return: OS name, like centos, ubuntu, debian, cloudlinux, redhat
in lower case
r7 r2 )rQ r; rT s r6 get_oszOsReleaseInfo.get_osd s" {{}} y111r5 c 2 | dk S )Nr/ rY rT s r6 is_rhelzOsReleaseInfo.is_rhell s zz||v%%r5 c 2 | dk S )Nr1 r[ rT s r6 is_centoszOsReleaseInfo.is_centosp zz||x''r5 c 2 | dk S )NrG r[ rT s r6 is_ubuntuzOsReleaseInfo.is_ubuntut r_ r5 c . | dv S )N)rF cloudlinuxserverr[ rT s r6
is_cloudlinuxzOsReleaseInfo.is_cloudlinuxx s zz|| AAAr5 c J t j t S r )r r
r: _CL_SOLO_EDITION_FILErT s r6 is_cloudlinux_soloz OsReleaseInfo.is_cloudlinux_solo| s w~~ 3444r5 c 2 | dk S )Nr. r[ rT s r6 is_debianzOsReleaseInfo.is_debian r_ r5 c 2 | dk S )Nolr[ rT s r6 is_oracle_linuxz OsReleaseInfo.is_oracle_linux s zz||t##r5 c 2 | dk S )N almalinuxr[ rT s r6 is_almalinuxzOsReleaseInfo.is_almalinux s zz||{**r5 c 2 | dk S )Nrockyr[ rT s r6
is_rockylinuxzOsReleaseInfo.is_rockylinux s zz||w&&r5 ) r- r. r/ r9 r: rM rL rN r= classmethodrB r ro r rQ r rU rW rY r\ r^ ra rd rg ri rl ro rr r4 r5 r6 r- r- & s &N
Y{
#
#F"#?@@i %%G E F F [ F S#X [ < ( # ( ( ( [( ,C , , , [, 2s 2 2 2 [2 & & [& ( ( [( ( ( [( B B [B 5 5 [5 ( ( [( $ $ [$ + + [+ ' ' [' ' 'r5 r- r chunksizec 0 t | || d S )zReturn hash of the file `filename`, reading it in chunks.
* filename is a path to a file;
* hash_func is a function that returns hash object (one of hashlib.md5
etc);
* chunksize is a size of chunks to read, in bytes.
r )file_hash_and_size)r hash_funcru s r6 file_hashry s h 9 = =a @@r5 c | }d}t | d 5 } | | }|sn(| | |t | z
}@ ddd n # 1 swxY w Y | |fS )a Calculate hash and size of the file `filename`, reading it in chunks.
* filename is a path to a file;
* hash_func is a function that returns hash object (one of hashlib.md5
etc);
* chunksize is a size of chunks to read, in bytes.
Return tuple(hash, file size).r r TN)r r updater hexdigest)r rx ru hash_sizer> chunks r6 rw rw s
IKKE D
h FF9%%E
LL CJJ D ?? d ""s AA,,A03A0c | \ }}| |k r&t dj di t |S )z0Given login.defs line, return *varname*'s value.z"Expected {varname!r}, got {name!r}r4 )r rk r vars)varname defs_liner values r6 _parse_name_valuer sJ //##KD%$D=DNNtvvNNOOO Lr5 c H t dk rt \ a } t S )Nr( )_MIN_UID_get_max_min_uid)r s r6 get_min_uidr s 2~~&(( ! Or5 /etc/login.defsc h d\ }} t | 5 }|D ]f}| d r t t d| }| d r t t d| }g ddd n # 1 swxY w Y n# t t
f$ r Y nw xY w||fS )zGet UID_MIN, UID_MAX from the login.defs file specified as *path*.
On error, return default for the current OS values.
)i i` UID_MINUID_MAXN)r
startswithintr r rk )r
uid_minuid_maxr r? s r6 r r s( #GW
$ZZ F4
F
F??9-- F !"3It"D"D E EG??9-- F !"3It"D"D E EG
F F F F F F F F F F F F F F F F
Z
G s5 B A*B
B
BB BB B-,B-zimunify360-captchazimunify360-webshieldc l t \ fdt j D S )z~
:param excludes: users to exclude in results
:return: list: list of pwd.struct_passwd objects representing users
c P g | ]"}|j cxk rk n n |j v |#S r4 pw_uidpw_name).0entryexcludesr r s r6
<listcomp>z(get_non_system_users.<locals>.<listcomp> sS el - - - -g - - - - -%-x2O2O 2O2O2Or5 r pwdgetpwall)r r r s `@@r6 get_non_system_usersr sR ())GW \^^ r5 c d t \ } fdt j D S )z;
:return: list: list of str with system user names
c 4 g | ]}|j k
|j S r4 r )r r r s r6 r z)get_system_user_names.<locals>.<listcomp> s. W 5L5L
5L5L5Lr5 r )r r s @r6 get_system_user_namesr sE "##JGQ #&<>> r5 r c 0 t \ }}| |k S r )r )r r r s r6 is_system_userr s '))GW =r5 d )r7 typedc t | d 5 }| dd }|dk rF| |dz
| d dk r| d | | | d s| d d d d d S # 1 swxY w Y d S )Nzr+r rb r
r seekr r
endswithr r r>
last_char_poss r6 append_with_newliner s
h
q!
A
FF=1$ % % %vvayyD
}}T""
GGDMMM
B"C CCr c t | d 5 }| dd }|dk rF| |dz
| d dk r| d | | | d s| d ddd dS # 1 swxY w Y dS )z>Append *data* to *filename* making sure there is
at the end.zr+br rb r
Nr r s r6 append_with_newline_bytesr s
h
! q!
A
FF=1$ % % %vvayyE!!
}}U##
GGENNN
r c d}t | d 5 }t fd|D sd}ddd n # 1 swxY w Y |rt | |S )zAdd *line* to *filename* if it is not present in the file
Returns:
True if the file was changed, False otherwise.
Frc 3 H K | ] }| k V d S r r r _liner? s r6 <genexpr>z&ensure_line_in_file.<locals>.<genexpr>) 0 88U5;;==D(888888r5 TN)r anyr r r? changedr> s ` r6 ensure_line_in_filer ! s G
h 8888a88888 G ,Hd+++ N >AAr? c d}t | d 5 }t fd|D sd}ddd n # 1 swxY w Y |rt | |S )zAdd *line* to *filename* if it is not present in the file.
Returns:
True if the file was changed, False otherwise.
Fr c 3 H K | ] }| k V d S r r r s r6 r z,ensure_line_in_file_bytes.<locals>.<genexpr>8 r r5 TN)r r r r s ` r6 ensure_line_in_file_bytesr 0 s G
h 8888a88888 G 2!(D111 Nr c t j | }t | d 5 }t d|d 5 }|D ]/}| |k r| | 0t j |j | d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S )Nr wF)r r r ) r r
dirnamer r r r
r r )r r? basedirsfr r s r6 remove_line_from_filer ? s5 gooh''G Xs% !???%CE E{{}}$$
"'8$$$% % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % %s6 B4A
B B4 B B4#B $B44B8;B8c , e Zd ZdZdZefdZd Zd ZdS )FileLockz`
Simple context manager to enable
UNIX-specific file locking with flock system call
r c Z || _ d| _ t |d | _ || _ d S )NFr )r
lockedr r r )r r
r s r6 r zFileLock.__init__S s* sOO r5 c K t j } t | j t t z d| _ | S # t t f$ r}|j t j k r | j
t j |z
k r&t d| j
Y d }~d S t j d d {V Y d }~nd }~ww xY w)NTz)Failed to lock file %s. Timeout exceeded.r )r? r r r
r r r IOErrorerrnoEAGAINr r_ r r
rp r )r rE exs r6
__aenter__zFileLock.__aenter__Y s '
'di7!2333 " W%
'
'
'8u|++ \DIKK%$777NNCTY EEEEE mA&&&&&&&&&&&&&&
' 's *A CAC/CCc K | j rt | j t d| _ | j d S r )r r r r close)r exc_typeexc_valexc_tbs r6 __aexit__zFileLock.__aexit__q sC ; & $)W % % % r5 N)r- r. r/ r] _TIMEOUTr r r r4 r5 r6 r r K sZ
H%- ' ' '0 r5 r c | g}| fdt | D t j }| d | dd | S # t t f$ r%}t d| Y d }~nd }~ww xY wd S )Nc 3 D K | ]\ }}|v t | V d S r )ro )r fieldr fieldss r6 r z user_identity.<locals>.<genexpr> s?
u
JJ
r5 r utf8surrogateescapez9Generation of user identity hash failed, invalid data: %s)
extendsorteditemshashlibsha1r{ joinr r| rk UnicodeEncodeErrorr_ r ) attackers_ipsourcer uid_datahash_alges ` r6
user_identityr { s
!>
&v||~~ 6 6
<>>))009JKKLLL!!### * +
G
4s B%B) )C :CC c 0 t j dk S Nr )r getuidr4 r5 r6 is_root_userr s
9;;! r5 maskc # K t j | } d V t j | d S # t j | w xY wr )r r )r current_masks r6 run_with_umaskr sM 8D>>L
s 2 Ar usernamec ~ t | t st d| z t j | v rt d t j | }n0# t $ r# t d | w xY wt j
|j | }t | S )z
Returns user's home dir if `relpath` is not specified.
Otherwise, returns absolute path of `relpath`
build from `username`'s home dir
:raise ValueError: when user home dir is not exists
z#Invalid type for %s, should be str!zInvalid usernamezUser {!r} doesn't exist)
rn ro rk r sepr getpwnamKeyErrorr r
r pw_dirr )r relpathpwabs_paths r6 get_abspath_from_user_dirr s h $ $ K>IJJJ v+,,,E
\(
#
# E E E299(CCDDDEw||BIw//H >>s A -Br
c d} t | }t | | d}n># t $ r1}t t
| Y d }~nd }~ww xY w|S )NFT)r r relative_tork r_ r ro )r
r status user_homer s r6 does_path_belong_to_userr s
F -h77 T
y))) s1vv Ms 38
A3'A..A3c t j | st d| z t j | rg t j t j | j j S # t $ r) t t j | j cY S w xY wt j | } )NzPath %s should be absolute!)
r r
abspathrk r: r getpwuidr st_uidr r ro r r
s r6 get_path_ownerr s
7??4 ?6=>>>%
7>>$ 1
1|BGDMM$899AA
1
1
1274==/00000
1wt$$
%s /B 0B65B6 iterable
chunk_sizec # K t | }t t || }|r%|V t t || }|#dS dS )a
Generator that splits iterable on N-parts by chunk_size items in each chunk
>>> list(split_for_chunk([0, 1, 2, 3, 4, 5, 6, 7, 8, 9], chunk_size=2))
[[0, 1], [2, 3], [4, 5], [6, 7], [8, 9]]
:param iterable:
:param int chunk_size:
:return: generator:
N)iterrr r )r r ipieces r6 split_for_chunkr sp
XA :&& ' 'E
, VAz**++ , , , , ,r5 c t | t r+t d | D S t | t rt d | D S | S )Nc 3 > K | ]\ }}|t | fV d S r freeze)r keyr s r6 r zfreeze.<locals>.<genexpr> s1 JJ*#u#ve}}-JJJJJJr5 c 3 4 K | ]}t | V d S r r )r r s r6 r zfreeze.<locals>.<genexpr> s( 22uVE]]222222r5 )rn rH r: r rr rs )rO s r6 r r sm !T 3JJ JJJJJJ At 322222222 Hr5 c & e Zd ZdZi Z fdZ xZS ) Singletonzc
Metaclass for creating only one instance of class, when providing
the same arguments.
c | t | t | f}| j | s( t t | j |i || j |< | j | S r )r
_instancesr; superr r )r< rN rO r __class__s r6 r zSingleton.__call__ sr F4LL&..1~!!#&& "@% 3"7"7"@# # #CN3 ~c""r5 )r- r. r/ r] r r
__classcell__)r s @r6 r r sI
J# # # # # # # # #r5 r c t j dd 5 } | cddd S # 1 swxY w Y dS )z3
:return str: server's external IP address
zhttps://api.ipify.orgrb r N)urllibrequesturlopenr r )r s r6 get_external_ipr# s
7 C C !qvvxx ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !s &AA Ac < d}| | | }t j | st d|d| t |d 5 }| }ddd n # 1 swxY w Y |S )z
Reads parameter of kernel module
from /sys/module/{module_name}/parameters/{parameter}
:return str: value of the parameter
z(/sys/module/{mod}/parameters/{parameter})mod parameterzCannot find parameter z for module r N)r r r
r: rk r r r ) module_namer&
_MOD_PAR_PATH
param_filepr s r6 get_kernel_module_parameterr+ s ?M %%+%KKJ
7>>* % %
j8A ;; O
j# !! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! Ls 'BBBc d}| D ][\ }}t |t r%|| vs|s|| |< d}(t | | | }?|| vs|sJ | d| || |< d}\|S )zPerforms deep update of dict dst with values from src.
Does not overwrite subdicts in dst blindly with new dicts in src, but does
a deep update of (sub)dict content recursivelyFTz already exists in )r rn rH dict_deep_update)dstsrcallow_overwriteupdatedr@ rA s r6 r- r- s G 1 a ||1|A *3q6155 ---- /CFGG Nr5 c 8 e Zd Zd
dZd Zd Zd ZdedefdZd S )
TimedCacher c t |t sJ || _ || _ t | _ i | _ d S r )rn r
expirationr7 r cache_locks)r r5 r7 s r6 r zTimedCache.__init__* s< *i00000$ ]]
r5 c t }| j D ]J}| j | \ }}t j |z
| j k r||f||< K|| _ dS )z Clear cache from expired valuesN)r r6 r? r5
total_seconds)r tmp_cacher r added_ats r6 _collectzTimedCache._collect1 sh MM : 1 1C "joOE8 h&$/*G*G*I*III!& #
r5 c : t | _ i | _ d S r )r r6 r7 r s r6 r' zTimedCache.cache_clear: s ]]
r5 c |}|r3t | }|t | z
}t | S )z
Generate key from call arguments
:param args: call positional args
:param kwargs: call keyword args
:return:
)r r rs hash)r rN rO seedkws r6 _make_keyzTimedCache._make_key> sB ''B E"II DDzzr5 funcr` c t fd }t fd }t j r|n|} j |_ |S )a
Use it to cache calls to decorated function
@TimedCache(expiration=timedelta(minutes=10))
async def func(*args, **kwargs):
pass
:param func: decorated function
:return:
NOTE: is not thread safe.
c h K | | }j | }| t j x}j |< t j | j d {V nP# t j $ r= |j | u r t j x}j |< n
j | }Y nw xY w
j | \ }}ns# t $ rf t j j k rj d | i | d {V }|t! j fj |< Y nw xY w| n# | w xY w|S )NTFlast)rC r7 r; rp r r acquirer5 r9 TimeoutErrorr< r6 r r r7 popitemr? release)rN rO r lockr r rD r s r6
wrapper_asyncz*TimedCache.__call__.<locals>.wrapper_asyncX s ..v..C;??3''D|*1,..8t{3'
00!* (E(E(G(G + 0 0 0 t{3 ///29,..@t{3 / / #{3 / 0
0
: $
3IFAA : : :4:$,66
***666#'4#8#8#8 8 8 8 8 8 8F&,dikk&9DJsOOO : MsE AB A C&%C&+F D F A-F>F FF F/c Z | | } j | \ }}nm# t $ r` t j j k rj d | i |}|t j fj |< Y nw xY w|S )NFrG )r< rC r6 r r r7 rK r? )rN rO r r r rD r s r6 wrapper_syncz)TimedCache.__call__.<locals>.wrapper_sync{ s MMOOO..v..C
6 JsO
6
6
6tz??dl22J&&E&222 t.v.."($)++"5
3
6
Ms > A'B('B()r rp iscoroutinefunctionr' )r rD rN rP rQ s `` r6 r zTimedCache.__call__K s
t
D
t
*400
MM
# .r5 N)r ) r- r. r/ r r< r' rC r# r r4 r5 r6 r3 r3 ) s CQ C1 C C C C C Cr5 r3 r c > K | r<| s& | n# t $ r Y nw xY wdS | t j | h| d{V \ }}|rL| s| nd}|r t d| | dS dS | s4t d| | |
d dS dS )u Cancel *task* and wait up to *timeout* seconds for it to finish.
Unlike the common ``task.cancel(); suppress(CancelledError); await task``
pattern, this function **always returns** within *timeout* seconds —
even if the task catches ``CancelledError`` and continues running
(see DEF-40570 / CPython #103486).
Uses ``asyncio.wait`` (not ``wait_for``) because ``wait_for`` also
hangs when the inner task survives cancellation.
Nr z&Task %r raised during cancellation: %sz.Task %r did not finish within %ds after cancelc $ t | d S )Nz*Abandoned task failed after cancel timeout)message)log_future_errors)ts r6 <lambda>z"safe_cancel_task.<locals>.<lambda> s 'G r5 ) done cancelledr r cancelrp ry r r_ r add_done_callback)taskr rY r r s r6 safe_cancel_taskr^ s^ yy{{ ~~
KKMMML$999999999GD!
&*nn&6&6@dnn D P NNCT3 O O O O O P P
YY[[
<dG
s A
A
Ac f t j t j t j dS )z
Send SIGUSR2 to os.getpid() to shutdown agent process by signal (implies
exit code -12).
Agent will do failover restart then thanks to systemd (or chkservd) if it
needs.
N)r killgetpidsignalSIGUSR2r4 r5 r6 fail_agent_servicerd s$ GBIKK (((((r5 c
K | dt t j }t |d 5 }| t
t j j ||d t d| | t j j | fi | d{V }t |dz d 5 }|
d |j t! j |j ddd n # 1 swxY w Y ddd n # 1 swxY w Y |S ) z
Runs command and log it's output to the log file
:param cmd:
:param log_file_mask:
:return: str path of log file
*r Trf z
Popen(%r, %r)Nz.pidz{:d} {}
)replacero r ra r r{ rH rp
subprocessr r_ rA rq r
r pidpsutilProcess create_timehex)r
log_file_mask popen_kwargslive_log live_log_fpr~ pfs r6 run_cmd_and_logrs s $$S#bikk*:*:;;H
h (0"""&
_c<888 '?
(V#S
)
) R HH ##HfnTX 6 6 B B D D H H J J
& Os8 BE A*D?3 E?E EE EE Ec t d 5 } | D ]C}| d r,| d dk c cddd S D ddd n # 1 swxY w Y n# t $ r Y nw xY wdS )aL Return True iff this process has PR_SET_NO_NEW_PRIVS=1.
Used to decide whether to wrap package-management subprocesses in
systemd-run. On systemd<231 hosts (CL7) the MR's compat drop-in
resets NoNewPrivileges=no, so the wrap is unnecessary and would
also fail (CL7 ships systemd 219, no --pipe/--wait support).
z/proc/self/statusz NoNewPrivs:r 1NF)r r r r )r> r? s r6 _has_no_new_privsrv s
%
&
& 2!
2
2??=11 2 ::<<?c111 2 2 2 2 2 2 2 22
2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2
5s@ A1 9A%
A1 A% A1 %A))A1 ,A)-A1 1
A>=A>) systemd-runz--quietz--waitz--pipez --collectz --property=NoNewPrivileges=noz--property=ProtectSystem=noc ` | sdS t d | D S )Nr4 c 3 , K | ]\ }}d | d| V dS )z --setenv=r4 Nr4 )r r@ rA s r6 r z+_systemd_run_setenv_args.<locals>.<genexpr> s7 ==A$Q$$$$======r5 )rs r envs r6 _systemd_run_setenv_argsr| s4 r ===== = ==r5 r c t s| S t t | z dd| fz }d d |D S )zWrap a shell command so it runs as a transient systemd unit
outside the agent's NoNewPrivileges= sandbox. Returns the original
command unchanged when this process is not under NNP./bin/sh-c c 3 > K | ]}t j | V d S r shlexquoter r* s r6 r z._wrap_outside_sandbox_shell.<locals>.<genexpr> * 22qEKNN222222r5 )rv _SYSTEMD_RUN_BASEr| r r r{ partss r6 _wrap_outside_sandbox_shellr sa
"3
'
' ( dC
!
8822E222 2 22r5 c t st | S t t t | z dz t | z S )z5Argv-form counterpart of _wrap_outside_sandbox_shell.)z--)rv rr r r| rs )argvr{ s r6 _wrap_outside_sandbox_argvr " sY Dzz
"3
'
' (
++ r5 rz c L K t t | | |fi | d{V S )u run_cmd_and_log variant that escapes the agent's systemd sandbox.
Use for shell commands whose RPM/apt scriptlets perform LSM domain
transitions on exec (e.g. kernelcare install, hardened-php
groupinstall) — see the module-level NNP note above.
rz N)rs r r rn r{ ro s r6 run_cmd_and_log_outside_sandboxr . sZ !#CS111 r5 c J K t t | | fi | d{V S )z7run() variant that escapes the agent's systemd sandbox.rz N)r r r r{ rO s r6 run_outside_sandboxr > s< /#>>>II&II I I I I I IIr5 c J K t t | | fi | d{V S )z=check_run() variant that escapes the agent's systemd sandbox.rz N)r r r s r6 check_run_outside_sandboxr C s< 5dDDDOOOO O O O O O OOr5 c N t sdS t j ddgt j t j dd j } n # t t j f$ r Y dS w xY wt j d| }|dS t | t k S )z=Return True iff systemd-run can host a transient unit for us.Frw z --versionT )rh ri textr z\d+)
r= rl r rm r rh r SubprocessErrorr$ r% r r& _SYSTEMD_RUN_MIN_VERSION) version_liner* s r6 _systemd_run_supportedr W s u "
K ( # &
[0 1 uu Ifl + +E }u u{{}} !9 99s 4A A! A!c t s| S t t | z dd| fz }d d |D S )zWrap a shell command so PID 1 owns its cgroup, keeping its CPU and
memory off the agent's. Returns the command unchanged where systemd-run
cannot host it.r~ r r c 3 > K | ]}t j | V d S r r r s r6 r z,_wrap_in_own_cgroup_shell.<locals>.<genexpr>w r r5 )r r r| r r s r6 _wrap_in_own_cgroup_shellr l sa " # #
"3
'
' ( dC
!
8822E222 2 22r5 c L K t t | | |fi | d{V S )zrun_cmd_and_log variant that keeps the command's resource usage out of
the agent's cgroup. Use for package transactions heavy enough to matter
against the agent's own CPU and memory allowance.
rz N)rs r r s r6 run_cmd_and_log_in_own_cgroupr z sZ !!#3/// r5 c e Zd Zd ZdS )r c ` | j dk r7| j r0| dd}| j r
| j |d< | j | t j | d S # t $ r t | j dd pt | j dd }t | j dd pt | j dd }t | j d d pt | j d
d }|j
}|r|j p|j }t d || j || Y d S w xY w) NPENDINGz%Task was destroyed but it is pending!)r] rU source_tracebackr/ r- gi_codecr_codegi_framecr_framez+!> Finalizer error in {}() {} at {} line {})_state_log_destroy_pending_source_traceback_loopcall_exception_handlerr __del__AttributeErrorgetattr_coro co_filenamef_linenoco_firstlinenoprintr )r contextr r framer linenos r6 r z Task.__del__ s{ ;) # #(A # B G %
E.2.D*+ J - -g 6 6 6 N4 4:~t<<
JA AD 4:y$77 7
It< <D DJ
D99 W
J> >E 'H.F43FF =DD$+x
s A CD-,D-N)r- r. r/ r r4 r5 r6 r r s# r5 r c fd}|S )zReturn async callback which waits for *seconds*.
Usage:
@retry_on(Error, on_error=await_for(seconds=PAUSE_INTERVAL), timeout=T)
async def coro():
'here's something that may raise Error.'
c < K t j d {V S r )rp r )rN rc s r6 pausezawait_for.<locals>.pause s) ]7+++++++++r5 r4 )rc r s ` r6 rw rw s# , , , , , Lr5 c j t g st d fd}|S )a
Retry the function call on exception (or exceptions,
if given in tuple) at most *max_tries*.
Await *on_error* (if set) for each exception.
If *timeout* is set, stop all attempts in *timeout* seconds.
If *silent* is set to True - don't raise exceptions after max
If *should_retry* is set - await it and on False, stop auto-retry cycle
tries or timeout.
z Set any of max_tries, timeoutc t j fd }t j fd }t j r|S |S )Nc ~ K rt j z }
st j d nt d
dz D ]} rg|t j z
}|dk r$t j | i || d {V c S
s t
j r d n | i | d {V c S }# t
j t
j f$ r $ rX} || d {V }|s
}|
k r
s r d| || d {V Y d }~d }~ww xY wd S )Nr r r Timeout exceeded when calling %s0Max tries exceeded when calling %s with error %s)
r? r@ itertoolscountr rp r rJ r r rN rO end_timer remaining_timer should_retry_retr rD rD rd re should_retrysilentr s r6 rN z2retry_on.<locals>.decorator.<locals>.wrapper_async s,
6 >++g5 !- """1i!m,,(
/ (
/
#/ ;)1DN4D4D)D)A--)0)9 $d 5f 5 5~* * * $ $ $ $ $ $ $* "&-&: :!$ " # $F!" !" !" &*T4%:6%:%: : : : : : :::: ,g.DE / / /#/1= c11E1E+E+E+E+E+E+E( / * )AI~~ % ! II!, $ # + &hsA . ........#//(
/ (
/s ?C
4C D:"AD55D:c rt j z }
st j d nt d
dz D ]} rH|t j z
}|dk r
| i |c S
st
r d n
| i |c S X# $ rL} || }|s
}|
k r
s r d| || Y d }~d }~ww xY wd S )Nr r r r )r? r@ r r r rJ r r s r6 rP z1retry_on.<locals>.decorator.<locals>.wrapper_sync s
6 >++g5 !- """1i!m,,$
) $
)
) 5)1DN4D4D)D)A--#'4#8#8#8 8 8 8#) "&2 2!$ " # $F!" !" !" $tT 4V 4 4444 ) ) )#/+7<Q+?+?( / * )AI~~ % ! II!, $ # + a(((#)'$
) $
)s %B.)BC, AC''C,rS r rp rQ )
rD rN rP r rD rd re r r r s
` r6 rU zretry_on.<locals>.decorator s + / + / + / + / + / + / + / + / + / + / + /
+ /Z
' ) ' ) ' ) ' ) ' ) ' ) ' ) ' ) ' ) ' ) ' )
' )R &t , , r5 )r rk )r re rd r r rD r rU s ``````` r6 ru ru sz $ 7# $ $ :8999\ \ \ \ \ \ \ \ \ \ \ | r5 c t j fd }t j fd }t j r|n|S )zhIf func throws an exception it is catched, converted to a string and
returned as a result of a call.c r K | i | d {V S # t $ r}t | cY d }~S d }~ww xY wr r reprrN rO r rD s r6 rN z,stub_unexpected_error.<locals>.wrapper_async5 sg t.v........ . 77NNNNNN s
6166c b | i |S # t $ r}t | cY d }~S d }~ww xY wr r r s r6 rP z+stub_unexpected_error.<locals>.wrapper_sync< sQ 4((( ( 77NNNNNN s
.)..r )rD rN rP s ` r6 stub_unexpected_errorr 1 s _T _T $ 7 = = O==<Or5 c 2 t j fd}|S )zkA decorator that logs uncaught exceptions ignoring them otherwise.
CancelledError is not handled.
Nc t j fd }t j fd }t j r|S |S )Nc K | i | d {V S # t j $ r $ r'} dt dd | Y d }~d S d }~ww xY wNz Ignoring exception from %s: %sr/ r )rp r r rN rO r r r log_handlers r6 rN z>log_error_and_ignore.<locals>.decorator.<locals>.wrapper_asyncO s
!T4 26 2 22222222)
4D.&99
s
A A Ac t | i |S # $ r'} dt dd | Y d }~d S d }~ww xY wr )r r s r6 rP z=log_error_and_ignore.<locals>.decorator.<locals>.wrapper_sync\ s
tT,V,,,
4D.&99
s 7 27r )r rN rP r r s ` r6 rU z'log_error_and_ignore.<locals>.decoratorN s
&t , , r5 )r_ r )r r rU s `` r6 log_error_and_ignorer F s9
l < r5 c fd}|S )z'Abort the agent service on *exception*.c L t j fd }|S )Nc K | i | d {V S # $ r/}t | Y d }~d S d }~ww xY wr )r_ r )rN rO r abortr r s r6 rQ z2abort_agent_on.<locals>.decorator.<locals>.wrappers s
!T4 26 2 22222222
###
s
A$AArR )r rQ r r s ` r6 rU z!abort_agent_on.<locals>.decoratorr sC
r5 r4 )r r rU s `` r6 abort_agent_onr o s* r5 c R t j dd| S )zPascalCase to snake_casez([a-z])([A-Z])z\1_\2)r$ subrK )strings r6
snake_caser s#
6"Hf 5 5 ; ; = ==r5 g?g ?c H dt | v S )Nr )ro rK )r s r6 _is_db_locked_errorr s s3xx~~'' ''r5 )exec_expr_with_empty_iterc ' K |s|rdg}nt |t }ddlm} |j 5 |D ]} | |g|R E d{V ddd dS # 1 swxY w Y dS )a]
Get iterator over results of sql expression expr. Given iterable will be
split for chunks and we will return iterator containing results of all
split queries. Useful for sql selects with in_() in order to avoid
too many sql variables error.
If exec_expr_with_empty_iter is True and iterable is None(empty) we will
process expression once, passing here chunk=None expr(None, *args)
:param expr:
:param iterable:
:param exec_expr_with_empty_iter: if iterable is None(empty) process
given expression once, passing here chunk=None expr(None, *args)
:return:
Nr r instance)r CHUNK_SIZE_SQL_QUERYdefence360agent.modelr db transaction)exprr r rN chunksr r s r6 get_results_iterable_expressionr s & L1 L 6JKKK...... " " * * * *EtE)D))) ) ) ) ) ) ) ) ) ** * * * * * * * * * * * * * * * * *s A##A'*A'r c t t || ddlm d }t t
|t dz d fd } | S ) a
Get number of results of sql expression expr. Given iterable will be
split for chunks and we will return number of results of all
split queries. Useful for sql delete with in_() in order to avoid
too many sql variables error.
The iterable is materialized BEFORE the database transaction opens,
and the transaction is retried on transient SQLite lock errors. This
matters because callers commonly pass a generator that does its own
SELECTs (e.g. ``MalwareHit.delete_hits(get_outdated_entries(...))``):
in SQLite WAL mode, the read snapshot taken inside a transaction
becomes stale as soon as another writer commits, and the subsequent
write raises SQLITE_BUSY_SNAPSHOT, which PRAGMA busy_timeout does
*not* cover.
r r r c t t d|dz
z z t }t d||t
| t
j | d S )Nrb r z;SQLite lock contention, retrying in %.3fs (retry %d/%d): %s)minDB_LOCK_RETRY_BACKOFF_BASEDB_LOCK_RETRY_BACKOFF_MAXr_ r DB_LOCK_MAX_RETRIESr? r )r attemptbackoffs r6 _backoffz-execute_iterable_expression.<locals>._backoff sd &!! *< = %
I
7r5 r c t | S r )r )r r s r6 rX z-execute_iterable_expression.<locals>.<lambda> s *=c*B*B r5 )re rd r c d} j 5 D ] }| |gR z
} ! d d d n # 1 swxY w Y | S r )r r execute)r r rN r r r s r6 _execute_allz1execute_iterable_expression.<locals>._execute_all s
[
$
$
&
& 8 8
8
844----55777
8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 s $AAA)rr r r r ru r r )r r r rN r r r r s ` ` @@r6 execute_iterable_expressionr s $ /(zBBB
C
CF...... %)BB
<>>r5 c X t j | dd dz S )Nr \nr )r fsencoderg r s r6 encode_filenamer s%
;t||D%00 1 1E 99r5 c b t j | d d dd S )Nr( r r )r fsdecoderg r s r6 decode_filenamer s+
;t SbS ! ) )% 6 66r5 c N t j t j | S r )base64 b64encoder r r s r6 base64_encode_filenamer
s BK - - . ..r5 b64namec h t t j t j | S r )r r r r b64decode)r s r6 base64_decode_filenamer s% F ,W 5 566 7 77r5 c V t j | }n# t $ r d}Y nw xY w|S )zS
Like pwd.getpwnam(username) but returns None instead of raising KeyError.
N)r r r )r r s r6 r r sA h'' Ms &&c > t t | | | S )zH
Put the specified `value` inside the [`low`, `high`] interval.
)maxr )r lowhighs r6 clipr s s5$ % %%r5 Background task failedc | t j } | dS # t j $ r Y dS t
$ r} |d|| Y d}~dS d}~ww xY w)a[
Callback for asyncio.Future that logs exceptions and ignores CancelledError.
Use this as a done_callback for asyncio tasks/futures:
future.add_done_callback(log_future_errors)
Or with custom logging:
future.add_done_callback(
lambda f: log_future_errors(f, logger.warning, "Upload failed")
)
Nz%s: %s)r_ r r rp r r )futr rU r s r6 rV rV s n *
!
* * * Hgq)))))))))*s & A A
AAr .c r fd} ||i | }| | |S )z
Use this function in plugin initialization instead of
loop.create_task to be able to see the exceptions from the specified
coroutine.
c | sA| / d| | d d S d S d S )Nz1Unhandled exception during plugin initialization!)rU r r] )rZ r r )r] r s r6 _log_exceptionz6create_task_and_log_exceptions.<locals>._log_exception+ sv ~~ DNN$4$4$@ ' ' L!% !1!1
$@$@r5 ) create_taskr\ )r r rN rO r new_tasks ` r6 create_task_and_log_exceptionsr " sY
d 5f 5 566H ~... Or5 c fd}|S )a5
Create coroutine from regular function
Useful to pass functions to APIs requiring coroutines
Note: coroutine will still block event loop in main thread.
For most blocking functions, run_in_executor should be considered instead
:param function:
:return: coroutine running function
c K | i |S r r4 )rN rO functions r6 r zmake_coro.<locals>.coroF s x((((r5 r4 )r# r s ` r6 make_coror$ < s# ) ) ) ) ) Kr5 c K |t k r
t j }n t j } |dt | dd x}rd| dnd| | t j t d {V d S )Nz7Failed to copy data%s to modsec ruleset dir %r, try: %sr z ()r )COPY_TO_MODSEC_MAXTRIESr_ r r r rp r _MODSEC_COPY_FAILURE_TIMEOUT)r r rD fns r6 log_failed_to_copy_to_modsecr* P s ###lnCA $S*d ; ;;rD
R
" -4
5
5555555555r5 ) err_buf_sizec
4 K d }t | }t j | dt j j t j j d| d{V } t j ||j | |j 2 3 d{V }|W V
6 | d{V }|dk r%t || dd
| dS # | d{V }|dk r%t || dd
| w xY w)z
Start *cmd*, yield its stdout line by line [b'
']
If *cmd* return nonzero exit status, raise CheckRunError with the
last *err_buf_size* lines from stderr.
c J K | 2 3 d {V }| | 6 d S r )append)pipebufr? s r6 read_pipe_intoz1readlines_from_cmd_output.<locals>.read_pipe_intoh sL $ JJt $$s ")maxlenT)rj rh ri Nr r5 ) r rp rt rh rm r ri rh ry r r )r r+ ro r1 err_bufr~ r? r s r6 readlines_from_cmd_outputr4 ^ s <(((G/ !&!&
D I NN4; @ @AAA + $JJJJJ &+ 99;;&&&&&&
??
Cchhw6G6GHH H ? 99;;&&&&&&
??
Cchhw6G6GHH H H H H Hs *C :B C ADrb )rd delayc K t d|dz D ]3} | | d{V }|s!||k rt j | d{V 0|c S dS )z
Retry *predicate_coro(*args)* until it becomes true,
but no more than *max_tries* attempts.
Sleep for *delay* seconds before the next *predicate_coro()* call.
Return whether the predicate became true.
r N)r rp r )predicate_corord r5 rN r r s r6 finally_happenedr8 s IM** %~t,,,,,,, 'I---&& & & & & & & &
r5 ' c K t | d D ]-\ }}|W V ||z dk rt j d d{V .dS )z6Yield to the event loop every *chunk_size* iterations.r )rE r N) enumeraterp r )r r r items r6
nice_iteratorr= so XQ/// # #4
Nq -"" " " " " " " "# #r5 c e Zd ZdZd Zd ZdS )LazyLocka
Descriptor object to share async Lock between client objects.
Used in order to achieve lazy evaluation of the lock and share state
between it's clients.
Using asyncio.Lock in client code directly:
>>> class Foo:
>>> lock = asyncio.Lock()
leads to an unclear error ([Errno 9] Bad file descriptor),
when trying to move this Lock during demonization process.
c d | _ d S r )r r> s r6 r zLazyLock.__init__ s
r5 c N | j st j | _ | j S r )r rp r )r r owners r6 __get__zLazyLock.__get__ s! z ( DJzr5 N)r- r. r/ r] r rC r4 r5 r6 r? r? s< r5 r? c | } | rd| v sd| vrdS | dd \ }}||fS )zOParse RPM output line, return (package_name, version) or None if not installed.z
not installed: Nr )r rK r )r? pkg_nameversions r6 _parse_rpm_linerH s[ ::<<D ?djjll22d$6F6Ft
4++Hg W r5 c
| } | rd| v sd| vrdS | d sdS | dd \ }}|r| d nd}||fS )zVParse dpkg-query output line, return (package_name, version) or None if not installed.zno packages foundrE Nz
ok installedr r r )r rK r r )r? rF restrG s r6 _parse_dpkg_linerK s ::<<D &$**,,66$d:J:Jt
== ) ) tZZa((NHd!%-djjll1oo2G W r5 c t st r g dt fS g dt fS )N)z
dpkg-queryz--showz --showformatz!${Package}: ${Version} ${Status}
)rpmz-qz5--queryformat=%{NAME}: %{VERSION}-%{RELEASE}.%{ARCH}
)r- ra ri rK rH r4 r5 r6 _get_package_query_cmdrN sg
M$;$;$=$=
r5 c e Zd ZdZdS )FirewallDisabledExceptionz;Exception in case of using firewall api, when it's disabledNr r4 r5 r6 rP rP s EEEEr5 rP c < t fd }|S )Nc K t j d rt d | i | d {V S )Nz!/var/imunify360/firewall_disabledz"Not available in the current build)r r
r: rP )rN rO rD s r6 rQ z(check_disabled_firewall.<locals>.wrapper s\
7>>= > > +4
T4*6*********r5 r )rD rQ s ` r6 check_disabled_firewallrS s3
4[[+ + + + [+ Nr5 >
imunify-ui imunify-coreimunify-antivirusimunify360-firewallpackagesc K t \ }}t | }t ||z dd d{V }t ||| S )a
Retrieves the version of the specified system packages using
a command and regex specific to the current system.
Parameters:
packages (Iterable[str]): A set of package names to retrieve version for.
Returns:
A dictionary mapping package names
to their corresponding version strings, or None
if the package is not installed or version information
cannot be retrieved.
r F)r r N)rN rr safe_run_with_timeout_parse_package_info_output)rX r
parse_line
packages_listr s r6 system_packages_infor^ st -..OCNNM( mR% F &fmZ H HHr5 r r\ c n fd| D fd|D S )Nc X i | ]&} | xd xd x#'S )r r r4 )r r? r\ pkgr vers r6
<dictcomp>z._parse_package_info_output.<locals>.<dictcomp> sf j&& &F 1I
S
1I
S S r5 c < i | ]}| | S r4 )r; )r ra parseds r6 rc z._parse_package_info_output.<locals>.<dictcomp> s% 5 5 5SCC 5 5 5r5 )
splitlines)r rX r\ re ra r rb s `@@@@r6 r[ r[ sf
%%'' F 6 5 5 5H 5 5 55r5 c K t j t | fi || d {V S # t j $ r |d| Y dS w xY w)Nr z#Command %s failed: Timeout occurredr )rp r r rJ )rz r rD rO s r6 rZ rZ # s % W ' ' ' '
17;;;rrs &+ A
A
nc # K |dk rt d t | }t t || x}r%|V t t || x}#d S d S )Nr zn must be at least one)rk r rr r )r rh itbatchs r6 batchedrl / s
1uu1222
h Br1
&&
&% r1
&&
&% r5 rO c # R K t | D ]} fd|D V d S )Nc " i | ] }|| S r4 r4 )r r@ rO s r6 rc z batched_dict.<locals>.<dictcomp>= s &&&1q!A$&&&r5 )rl )rO rh rk s ` r6 batched_dictro ; sK A ' '&&&&&&&&&&&' 'r5 c n t j ddgd } | d }|s?t d r t j ddgd }d|v rd}|S # t $ r&}t d | Y d }~d
S d }~ww xY w) Nhostnamez-fT)r )z.cloudwaysapps.comz.cloudwaysstagingapps.comz/usr/local/sbin/apminfo Cloudwaysz$Error while checking environment: %sF) rl check_outputr r r r: r r_ r )rq
_is_cloudwaysr r s r6 is_cloudwaysrv @ s +
T
%'' !)) ?
%&;!<!<!C!C!E!E % -&/d F f$$ $
;Q???uuuuus BB
B4B//B4pid_filec t j }| rt | dk r|S | | d |S # t $ r'}t
d| |cY d }~S d }~ww xY w)Nr r z Error while creatin PID file: %s)r ra ro
write_textr r_ r )rw ri r s r6 write_pid_filerz U s
)++C s8}}**
sJJJ'''
7;;;
s A
A7 A2,A72A7c | rt | dk rd S | r| d S # t $ r&}t d| Y d }~d S d }~ww xY w)Nr z Error while cleanup PID file: %s)ro r: r r r_ r )rw r s r6 cleanup_pid_filer| c s s8}}**t ?? OO 7;;;s (A
A3
A..A3c | K t d|| t j d|z d{V dS )a
Used with retry_on decorator as on_error handler:
Example:
```
@retry_on(
PanelException,
on_error=backoff_sleep,
timeout=_HTTP_REQUEST_RETRY_TIMEOUT,
)
def some_function():
...
```
z#%s sleep on: %srb N)r_ r rp r )r r s r6
backoff_sleepr~ p sK NN%w :::
-W
%
%%%%%%%%%%r5 )NN)r` N)T)r Fr )rt )r )r )r )r
)NNNFNN)Nr )r9 )rp r r rS r r loggingr r r$ r r rb r rh rl r? urllib.requestr r collectionsr r collections.abcr r
contextlibr r r
datetimer enumr fcntlr
r r r r r pathlibr tempfiler typingr r r r r r r r async_lrurI rj peeweer _shutilr r! fd_opsr" r# getLoggerr- r_ USER_IDENTITY_FIELDUSER_IDENTITY_HEADERSr r r9 rf AV_PID_PATHIM360_NON_RESIDENT_PID_PATHIM360_RESIDENT_PID_PATHr environr; HTTP_REQUEST_RETRY_TIMEOUTr, lru_cacher= rG rW rY rm bytesr r r r r r ro r r r r r r r r r boolr r r" r+ r- md5ry rw r r r r r r partial
alru_cacheasync_lru_cacher r r r r r r r r r r r r r typer r# r+ r- r3 timed_cacher^ rd rs rv r r| r r r r r r r r r r rw ru r r r r r r r r r r r r r r
r r r rV r r$ r' r( r* r4 r8 r= r? rs rH rK rr rN rP rS r: IMUNIFY_PACKAGE_NAMESrH r^ r[ r rZ rl ro rv rz r| r~ r4 r5 r6 <module>r s
* * * * * * * * / / / / / / / / : : : : : : : : : : 2 2 2 2 2 2 2 2 2 2 2 2 ' ' ' ' ' '
# # # # # # 0 0 0 0 0 0 0 0 % % % % % % GCx 8 $ $ d011 6 d344 "d#B C C $ 899 SJNN:B??
+ + + + +D + + + Q K K K K 4T 4
0 0 3u 0 0 0 0 f 0
K2
(5
5
.;
'
'
'
'
' ,
+ + + + + + + +@ :?; ; ; ;F (, d d d
3J $ d
$Jd
d d d dN Q
?
?C
?
?
?
?h' h' h' h' h' h' h' h'X %[4
A
A
A58
A
A
A
A
A # ## # 38_ # # # #2 . <
$)#
5 T 5 T % % %- - - - - - - -` 0E 6 D &3 # $ % % %
,
,h
,C
,)
,
,
,
,
# # # # # # # #" R ! ! ! ! " 2e e e e e e e eP -. !
!
!
!
!
H) ) ) Z Q 4 $ > > > 3 3S 3s 3 3 3 3 $
,0 J J J J J
26 P P P P P" Q : : : : :( 3 33 3S 3 3 3 3 $ 7< B
$ s s s slP P P* $-$ & & & &R %7 &> > >
! ( ( ( ( (
6; * * * * *@ ';1 1 1 1 1h: : :7 7 7/ /% / / / /8E 8d 8 8 8 8 & & &* * * *.i ( 4
6 6 6 %( I I I
c I I I ID =>Q
# # # # 0 # %S/D"8 3 5c?T#9 " Q $s)XseU38_t%; ;<
<= .F F F F F F F F " IsmI #sTz/I I I I, 6 63i 6 #c3h$ 667 6
#sTz/ 6 6 6 6 !, 'DcN 's ' ' ' '
Q ( T c
t
& & & & &r5 defence360agent/utils/__pycache__/_shutil.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003443 00000000000 021232 0 ustar
r_j d d Z ddlZddlZddlZddlZ ej e ZdefdZ d dddZ
dS )
zHigh-level file operations. Nreturnc t | t o9t | o*d| vo&| t j | k o| dvS )N ).z..)
isinstancestrboolospathbasename)names R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/_shutil.pyis_safe_subdir_namer
s] 4 $ JJ $ $ $
BG$$T** * $
# F ) max_triesc t d|dz D ]s} t j | || c S # t $ rL}||k s |j t j t j fvr t d| | Y d}~ld}~ww xY wdS )zMore robust shutil.rmtree.
Retry on "Directory not empty" race condition:
https://github.com/ansible/ansible/issues/34335#issuecomment-362995700
z Can't remove %s tree, reason: %sN) rangeshutilrmtreeOSErrorerrnoEEXIST ENOTEMPTYloggerwarning)r
ignore_errorsonerrorr ies r r r s 1i!m
$
$ H H
H=}g>> > > > H H HI~~ 1 " "
NN=tQ G G G G G G G G H H Hs /
BAB B)FN) __doc__r loggingr
r getLogger__name__r r r r r r <module>r' s ! !
8 $ $ H H H H H H H Hr defence360agent/utils/__pycache__/_shutil.cpython-311.pyc 0000644 0000000 0000000 00000003443 00000000000 020273 0 ustar
r_j d d Z ddlZddlZddlZddlZ ej e ZdefdZ d dddZ
dS )
zHigh-level file operations. Nreturnc t | t o9t | o*d| vo&| t j | k o| dvS )N ).z..)
isinstancestrboolospathbasename)names R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/_shutil.pyis_safe_subdir_namer
s] 4 $ JJ $ $ $
BG$$T** * $
# F ) max_triesc t d|dz D ]s} t j | || c S # t $ rL}||k s |j t j t j fvr t d| | Y d}~ld}~ww xY wdS )zMore robust shutil.rmtree.
Retry on "Directory not empty" race condition:
https://github.com/ansible/ansible/issues/34335#issuecomment-362995700
z Can't remove %s tree, reason: %sN) rangeshutilrmtreeOSErrorerrnoEEXIST ENOTEMPTYloggerwarning)r
ignore_errorsonerrorr ies r r r s 1i!m
$
$ H H
H=}g>> > > > H H HI~~ 1 " "
NN=tQ G G G G G G G G H H Hs /
BAB B)FN) __doc__r loggingr
r getLogger__name__r r r r r r <module>r' s ! !
8 $ $ H H H H H H H Hr defence360agent/utils/__pycache__/antivirus_mode.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002341 00000000000 022607 0 ustar
r_j 4 d dl Z d dlZd dlmZ d Zee cZZdS ) NANTIVIRUS_MODEc t j fd }t j fd }t j r|n|S )Nc 6 K t rd n
| i | d {V S Nr argskwargsfs Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/antivirus_mode.py
async_wrapperzskip.<locals>.async_wrapper s7 %CttD1CF1C1C+C+C+C+C+C+CC c & t rd n | i |S r r r s r wrapperzskip.<locals>.wrapper s! %=tt11d+=f+=+==r ) functoolswrapsinspectiscoroutinefunction)r r
r s ` r skipr s _QD D D D D _Q> > > > > $ 7 : : G==Gr )r r defence360agent.contracts.configr r enableddisabled r r <module>r sS ; ; ; ; ; ; H H H #$6 r defence360agent/utils/__pycache__/antivirus_mode.cpython-311.pyc 0000644 0000000 0000000 00000002341 00000000000 021650 0 ustar
r_j 4 d dl Z d dlZd dlmZ d Zee cZZdS ) NANTIVIRUS_MODEc t j fd }t j fd }t j r|n|S )Nc 6 K t rd n
| i | d {V S Nr argskwargsfs Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/antivirus_mode.py
async_wrapperzskip.<locals>.async_wrapper s7 %CttD1CF1C1C+C+C+C+C+C+CC c & t rd n | i |S r r r s r wrapperzskip.<locals>.wrapper s! %=tt11d+=f+=+==r ) functoolswrapsinspectiscoroutinefunction)r r
r s ` r skipr s _QD D D D D _Q> > > > > $ 7 : : G==Gr )r r defence360agent.contracts.configr r enableddisabled r r <module>r sS ; ; ; ; ; ; H H H #$6 r defence360agent/utils/__pycache__/async_utils.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003526 00000000000 022122 0 ustar
r_j L d dl mZmZmZ d dlZ G d d ZdedefdZdS ) )ListUnionTupleNc < e Zd Zdeeef fdZd Zd Zd Z dS ) AsyncIteratedatac . t | | _ d S N)iterqueueselfr s V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/async_utils.py__init__zAsyncIterate.__init__ s $ZZ
c | S r
)r s r __aiter__zAsyncIterate.__aiter__ s r c P K | d {V }||S t r
)
fetch_dataStopAsyncIterationr
s r __anext__zAsyncIterate.__anext__ s8 __&&&&&&&& K$ $r c Z K t | j }n# t $ r d }Y nw xY w|S r
)nextr
StopIteration)r items r r zAsyncIterate.fetch_data sE
##DD DDD s ((N)
__name__
__module__ __qualname__r r r r r r r r r r r r se U4; / % % % r r tasksreturnc L K t j | d {V }t | S r
)asynciogatherr )r resultss r r$ r$ s2 NE*******G r )typingr r r r# r r$ r r r <module>r' s % % % % % % % % % % ,! !, ! ! ! ! ! !r defence360agent/utils/__pycache__/async_utils.cpython-311.pyc 0000644 0000000 0000000 00000003526 00000000000 021163 0 ustar
r_j L d dl mZmZmZ d dlZ G d d ZdedefdZdS ) )ListUnionTupleNc < e Zd Zdeeef fdZd Zd Zd Z dS ) AsyncIteratedatac . t | | _ d S N)iterqueueselfr s V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/async_utils.py__init__zAsyncIterate.__init__ s $ZZ
c | S r
)r s r __aiter__zAsyncIterate.__aiter__ s r c P K | d {V }||S t r
)
fetch_dataStopAsyncIterationr
s r __anext__zAsyncIterate.__anext__ s8 __&&&&&&&& K$ $r c Z K t | j }n# t $ r d }Y nw xY w|S r
)nextr
StopIteration)r items r r zAsyncIterate.fetch_data sE
##DD DDD s ((N)
__name__
__module__ __qualname__r r r r r r r r r r r r se U4; / % % % r r tasksreturnc L K t j | d {V }t | S r
)asynciogatherr )r resultss r r$ r$ s2 NE*******G r )typingr r r r# r r$ r r r <module>r' s % % % % % % % % % % ,! !, ! ! ! ! ! !r defence360agent/utils/__pycache__/benchmark.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002715 00000000000 021516 0 ustar
r_j 4 d dl Z d dlmZ G d d ZdS ) N)
TracebackTypec h e Zd Zd dZdee dz dedz dedz ddfdZede fd Z
dS )
BenchmarkreturnNc 6 t j | _ | S N)time monotonic_ns
start_timeselfs T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/benchmark.py __enter__zBenchmark.__enter__ s +-- exc_typeexc_valexc_tbc ^ t j | _ | j | j z
| _ d S r )r r
end_timer elapsed_time_ns)r
r r r s r __exit__zBenchmark.__exit__
s+ )++
#}t > r c | j dz S )Ngư>)r r s r elapsed_time_mszBenchmark.elapsed_time_ms s #d**r )r N) __name__
__module__ __qualname__r type
BaseExceptionr r propertyfloatr r r r r s ?}%,? %? $ ?
? ? ? ? + + + + X+ + +r r )r typesr r r! r r <module>r# sR + + + + + + + + + +r defence360agent/utils/__pycache__/benchmark.cpython-311.pyc 0000644 0000000 0000000 00000002715 00000000000 020557 0 ustar
r_j 4 d dl Z d dlmZ G d d ZdS ) N)
TracebackTypec h e Zd Zd dZdee dz dedz dedz ddfdZede fd Z
dS )
BenchmarkreturnNc 6 t j | _ | S N)time monotonic_ns
start_timeselfs T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/benchmark.py __enter__zBenchmark.__enter__ s +-- exc_typeexc_valexc_tbc ^ t j | _ | j | j z
| _ d S r )r r
end_timer elapsed_time_ns)r
r r r s r __exit__zBenchmark.__exit__
s+ )++
#}t > r c | j dz S )Ngư>)r r s r elapsed_time_mszBenchmark.elapsed_time_ms s #d**r )r N) __name__
__module__ __qualname__r type
BaseExceptionr r propertyfloatr r r r r s ?}%,? %? $ ?
? ? ? ? + + + + X+ + +r r )r typesr r r! r r <module>r# sR + + + + + + + + + +r defence360agent/utils/__pycache__/buffer.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000010202 00000000000 021023 0 ustar
r_j t G d de Z G d de Z G d de Z G d d ZdS ) c e Zd ZdS )LineBufferOverflowN__name__
__module__ __qualname__ Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/buffer.pyr r Dr r c 4 e Zd ZdZdZd Zd Zd Zd Zd Z dS )
LineBufferz
Allows to accumulate data, and than iterate over it getting tokens
split by line breaks '
'. If at the end there is no line break,
the data will sit in the line buffer until more data with line
break comes in.
c d| _ d S N bufselfs r
__init__zLineBuffer.__init__
r c t | j t | z | j k r.d| _ t d | j | xj |z
c_ d S )Nr z,LineBuffer exceeded maximum size of {} bytes)lenr MAX_SIZEr formatr datas r
appendzLineBuffer.append si tx==3t99 $t} 4 4DH$>EEM
Dr c | S Nr r s r
__iter__zLineBuffer.__iter__ r c | j d }|dk r(| j d| }| j |dz d | _ |S t )N
)r find
StopIteration)r posresults r
__next__zLineBuffer.__next__ sN hmmD!! "99Xae_Fxa *DHMr c d| _ d S r r r s r
cleanzLineBuffer.clean' r r N)
r r r __doc__r r r r! r, r. r r r
r
r
sp H r r
c e Zd ZdS )SizeBufferOverflowNr r r r
r1 r1 + r r r1 c , e Zd ZdZddZd Zd Zd ZdS )
SizeBufferr c " d| _ || _ d S )Nr )_buf _size_len)r size_lens r
r zSizeBuffer.__init__2 s !r c t | j t | z | j k r.d| _ t d | j | xj |z
c_ d S )Nr z,SizeBuffer exceeded maximum size of {} bytes)r r6 r r1 r r s r
r zSizeBuffer.append6 si ty>>CII %
5 5DI$>EEM
T r c | S r r r s r
r! zSizeBuffer.__iter__@ r" r c D | j st t | j d | j d }t | j | j d |k r:| j | j | j |z }| j | j |z d | _ |S t )Nbig)r6 r) int
from_bytesr7 r )r sizer s r
r, zSizeBuffer.__next__C s y ~~di(8$.(8 95AA ty ))* + +t 3 39T^dnt.C CDD $.4"7"9"9:DIKr N)r4 )r r r r r r r! r, r r r
r3 r3 / sZ H" " " " r r3 N) Exceptionr objectr
r1 r3 r r r
<module>rB s # # # # # # # #L r defence360agent/utils/__pycache__/buffer.cpython-311.pyc 0000644 0000000 0000000 00000010202 00000000000 020064 0 ustar
r_j t G d de Z G d de Z G d de Z G d d ZdS ) c e Zd ZdS )LineBufferOverflowN__name__
__module__ __qualname__ Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/buffer.pyr r Dr r c 4 e Zd ZdZdZd Zd Zd Zd Zd Z dS )
LineBufferz
Allows to accumulate data, and than iterate over it getting tokens
split by line breaks '
'. If at the end there is no line break,
the data will sit in the line buffer until more data with line
break comes in.
c d| _ d S N bufselfs r
__init__zLineBuffer.__init__
r c t | j t | z | j k r.d| _ t d | j | xj |z
c_ d S )Nr z,LineBuffer exceeded maximum size of {} bytes)lenr MAX_SIZEr formatr datas r
appendzLineBuffer.append si tx==3t99 $t} 4 4DH$>EEM
Dr c | S Nr r s r
__iter__zLineBuffer.__iter__ r c | j d }|dk r(| j d| }| j |dz d | _ |S t )N
)r find
StopIteration)r posresults r
__next__zLineBuffer.__next__ sN hmmD!! "99Xae_Fxa *DHMr c d| _ d S r r r s r
cleanzLineBuffer.clean' r r N)
r r r __doc__r r r r! r, r. r r r
r
r
sp H r r
c e Zd ZdS )SizeBufferOverflowNr r r r
r1 r1 + r r r1 c , e Zd ZdZddZd Zd Zd ZdS )
SizeBufferr c " d| _ || _ d S )Nr )_buf _size_len)r size_lens r
r zSizeBuffer.__init__2 s !r c t | j t | z | j k r.d| _ t d | j | xj |z
c_ d S )Nr z,SizeBuffer exceeded maximum size of {} bytes)r r6 r r1 r r s r
r zSizeBuffer.append6 si ty>>CII %
5 5DI$>EEM
T r c | S r r r s r
r! zSizeBuffer.__iter__@ r" r c D | j st t | j d | j d }t | j | j d |k r:| j | j | j |z }| j | j |z d | _ |S t )Nbig)r6 r) int
from_bytesr7 r )r sizer s r
r, zSizeBuffer.__next__C s y ~~di(8$.(8 95AA ty ))* + +t 3 39T^dnt.C CDD $.4"7"9"9:DIKr N)r4 )r r r r r r r! r, r r r
r3 r3 / sZ H" " " " r r3 N) Exceptionr objectr
r1 r3 r r r
<module>rB s # # # # # # # #L r defence360agent/utils/__pycache__/check_db.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000032466 00000000000 021314 0 ustar
r_j " d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dlm Z m
Z
d dl m Z d dl
mZ d dlmZ d d lmZ d d
lmZ e j e Z G d d e Zd
Zd ZddZ d Z d Z d Z d Z d Z!ddZ"de de#e$ ddfdZ%dS ) N)suppress)datetime)copy)connect
DatabaseError)SqliteExtDatabase)app)
simple_rpc)Model)simplificationc e Zd ZdS )OperationErrorN)__name__
__module__ __qualname__ S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/check_db.pyr r s Dr r z.Blank database will be created on agent start c V t j } t j rt d t
j | st d| dt t | rt | }|st d t | }t
d| z t j | |st d|dt t | | }|st d t | r+t j | t d t z t
d
|z t j | t
d t! j t% s+t j | t d t z d S # t& $ r3}t j | t d
|dt d }~ww xY wd S )NzCannot perform database check and backup while agent is running. Please, stop the imunify360 agent with `service imunify360 stop`zDB z is not exists. z{Cannot proceed without backup copy of the database.Please contact imunify360 support team at https://cloudlinux.zendesk.comz*Removing original corrupted database at %sz0Cannot dump database to sql. Old DB backuped at z. zRLoading dump to new database failed. Database will be recreated during migrations.zBRestored database is still corrupt. Removing restored database. %sz0Database restored successfully. Removing dump %sz*Performing migrations on restored databasez;Restored database does not contain all necessary tables. %sz(Migrations on restored database failed: )r PATHr
is_runningr ospathisfileWORKAROUND_MSGis_db_corrupted make_backup dump_to_sqlloggerinforemove
load_from_sqlr migrateall_tables_are_present Exception)basebackupdumprestoredes r check_and_repairr+ su :D >
O
W^^D
!
! 9 n)-~~ >
4 4 &&F
$5
t$$D KKDtK L L L IdOOO (
$n vv~~/
)t44 (:
#8,, Ih'''(02@A
FM $KK LMMM"*,,, 233 $ , !#1 2 ! IdOOO(. 11nn. O4 4 s -G) )
H&3.H!!H&c t j }d | | d }|r|d|z z S |S )a
>>> mark_with_timestamp('/var/imunify360/imunify360.db')
'/var/imunify360/imunify360.db_2017-09-26_03:33:44.705967'
>>> mark_with_timestamp('/var/imunify360/imunify360.db', extension='sql')
'/var/imunify360/imunify360.db_2017-09-26_03:34:01.098544.sql'
z{}_{}_z.%s)r nowformat isoformat)filename extensioninstantbasenames r mark_with_timestampr5 ` sM lnnG~~h(9(9#(>(>??H %)+++r c t d| z d}t | 5 } | d }t | }d|v r t d d}n2# t
$ r%}t d| Y d }~nd }~ww xY w|cd d d S # 1 swxY w Y d S )Nz Database %s integrity check...TzPRAGMA INTEGRITY_CHECK;okz#Database integrity check succeeded.FzDatabaseError detected: %s)r r r executenextr warning)db_path is_corrupted
connectioncursorresultr* s r r r o s
KK07:;;;L Z < ''(ABBF&\\Fv~~ ABBB $ < < < NN7 ; ; ; ; ; ; ; ; < s; B6AA65B66
B% B B6 B%%B66B:=B:c X t | d }t d|z t |d 5 }t | 5 }| D ]}| | d d d n # 1 swxY w Y d d d n # 1 swxY w Y n}# t t f$ ri}t d|z t t 5 t j | d d d n # 1 swxY w Y d }Y d }~nd }~ww xY w|S )Nsql)r2 z!Dumping imunify360 database to %swz(Error during dump: %s. Operation aborted)
r5 r r openr iterdumpwriter OSErrorerrorr r r! )r; dumpfiler( r= rowr* s r r r ~ s "7e<<<H
KK3h>???
(C
D''*:*: j!**,,
3
7 # ?!CDDD
g
Ih
Os B- B!-B
> B!
B B!B B! B- !B%%B- (B%)B- -D'>1D"/D D"D D"D D""D'c t j | r t d d S t d|d| d t
|d 5 }t | 5 } | }| | ns# t $ rf}t | t t 5 t j | d d d n # 1 swxY w Y d } Y d }~nd }~ww xY wd d d n # 1 swxY w Y d d d n # 1 swxY w Y | S )Nz^Database already exists. Loading dump to existing database may cause errors. Operation abortedz
Reading dump z into new database z...r)r r existsr r: r rC r read
executescript MemoryErrorrG r rF r! )r; rH r( r= rA r* s r r" r" s
w~~g
;
t
KKK5=XXwwwG
h
gg&6&6
* ))++C $ $S ) ) ) ) LLOOO'""
#
# '"""
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#GGGGGG
Ns -D?=D(?)B)(D()
D3.D!D 6 DD
D D
DD(DD( D?(D, ,D?/D, 0D??EEc t d| z t | d } t | | t d|z nt# t $ rg}t d| t
t 5 t j | d d d n # 1 swxY w Y d }Y d }~nd }~ww xY w|S )NzMaking backup of the %s...r' z$Database copied successfully to: %s zMaking backup failed: %s)
r r r5 r r% rG r rF r r! )r; backup_filenamer* s r r r s
KK,w6777)'8<<O Wo&&& :_LMMMM /333
g
' ' Io & & & ' ' ' ' ' ' ' ' ' ' ' ' ' ' '
s; -A
C'/C B7+ C 7B; ;C >B; ?C Cc t d t j d t j D } t
d | D r t d dS t d dS )NzDVerifying that db schema is up-to-date and all tables are present...c 6 g | ]}t j | S r r
get_models.0modules r
<listcomp>z*all_tables_are_present.<locals>.<listcomp> s3
%f - -
r c 3 > K | ]}| V d S N) table_exists)rW models r <genexpr>z)all_tables_are_present.<locals>.<genexpr> s.
4
4E5
4
4
4
4
4
4r zAll tables are presentTz Some tables are missing in db.F)r r itertoolschainr MODULES_WITH_MODELSallrG )modelss r r$ r$ s
KKN _
1
F
4
4V
4
4
444 ,---t 5666ur returnc t j j t j t d g } t j D ]\\ }}t d| t j j
d||f | | ]t t j j | t d d S )Nz#Recreating schema for linked DBs...z
Attach db: %sz
ATTACH ? AS ?z Schema recreated successfully.)
r instancedbinitr r r r r MIGRATIONS_ATTACHED_DBS execute_sqlappendrecreate_schema_models)attached_schemasr; schemas r recreate_schemaro s ##EJ///
KK5666 6 ( ( OW--- ".. gv .
''''>257GHHH
KK011111r rg target_schemasc " fdt j d t j D D }t d| | | | | t d d S )Nc 0 g | ]}|j j v |S r )_metarn )rW r] rp s r rY z*recreate_schema_models.<locals>.<listcomp> s7 ; / / 0 / /r c 6 g | ]}t j | S r rT rV s r rY z*recreate_schema_models.<locals>.<listcomp> s3 )&11 r z%rz%Schema models recreated successfully.)r_ r` r ra r r bind
create_tables)rg rp models_to_creates ` r rl rl s _ ! 5
KK&''' GG %&&&
KK788888r r[ )rd N)&loggingr_ r
contextlibr r shutilr sqlite3r r playhouse.sqlite_extr defence360agent.applicationr defence360agentr
defence360agent.contracts.configr defence360agent.modelr getLoggerr r r% r r r+ r5 r r r" r r$ ro liststrrl r r r <module>r s * * * * * * * * 2 2 2 2 2 2 + + + + + + & & & & & & 2 2 2 2 2 2 0 0 0 0 0 0
8 $ $ Y B@ @ @F 4 $
2
2
2
2 99+/99 9 9 9 9 9 9r defence360agent/utils/__pycache__/check_db.cpython-311.pyc 0000644 0000000 0000000 00000032466 00000000000 020355 0 ustar
r_j " d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dlm Z m
Z
d dl m Z d dl
mZ d dlmZ d d lmZ d d
lmZ e j e Z G d d e Zd
Zd ZddZ d Z d Z d Z d Z d Z!ddZ"de de#e$ ddfdZ%dS ) N)suppress)datetime)copy)connect
DatabaseError)SqliteExtDatabase)app)
simple_rpc)Model)simplificationc e Zd ZdS )OperationErrorN)__name__
__module__ __qualname__ S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/check_db.pyr r s Dr r z.Blank database will be created on agent start c V t j } t j rt d t
j | st d| dt t | rt | }|st d t | }t
d| z t j | |st d|dt t | | }|st d t | r+t j | t d t z t
d
|z t j | t
d t! j t% s+t j | t d t z d S # t& $ r3}t j | t d
|dt d }~ww xY wd S )NzCannot perform database check and backup while agent is running. Please, stop the imunify360 agent with `service imunify360 stop`zDB z is not exists. z{Cannot proceed without backup copy of the database.Please contact imunify360 support team at https://cloudlinux.zendesk.comz*Removing original corrupted database at %sz0Cannot dump database to sql. Old DB backuped at z. zRLoading dump to new database failed. Database will be recreated during migrations.zBRestored database is still corrupt. Removing restored database. %sz0Database restored successfully. Removing dump %sz*Performing migrations on restored databasez;Restored database does not contain all necessary tables. %sz(Migrations on restored database failed: )r PATHr
is_runningr ospathisfileWORKAROUND_MSGis_db_corrupted make_backup dump_to_sqlloggerinforemove
load_from_sqlr migrateall_tables_are_present Exception)basebackupdumprestoredes r check_and_repairr+ su :D >
O
W^^D
!
! 9 n)-~~ >
4 4 &&F
$5
t$$D KKDtK L L L IdOOO (
$n vv~~/
)t44 (:
#8,, Ih'''(02@A
FM $KK LMMM"*,,, 233 $ , !#1 2 ! IdOOO(. 11nn. O4 4 s -G) )
H&3.H!!H&c t j }d | | d }|r|d|z z S |S )a
>>> mark_with_timestamp('/var/imunify360/imunify360.db')
'/var/imunify360/imunify360.db_2017-09-26_03:33:44.705967'
>>> mark_with_timestamp('/var/imunify360/imunify360.db', extension='sql')
'/var/imunify360/imunify360.db_2017-09-26_03:34:01.098544.sql'
z{}_{}_z.%s)r nowformat isoformat)filename extensioninstantbasenames r mark_with_timestampr5 ` sM lnnG~~h(9(9#(>(>??H %)+++r c t d| z d}t | 5 } | d }t | }d|v r t d d}n2# t
$ r%}t d| Y d }~nd }~ww xY w|cd d d S # 1 swxY w Y d S )Nz Database %s integrity check...TzPRAGMA INTEGRITY_CHECK;okz#Database integrity check succeeded.FzDatabaseError detected: %s)r r r executenextr warning)db_path is_corrupted
connectioncursorresultr* s r r r o s
KK07:;;;L Z < ''(ABBF&\\Fv~~ ABBB $ < < < NN7 ; ; ; ; ; ; ; ; < s; B6AA65B66
B% B B6 B%%B66B:=B:c X t | d }t d|z t |d 5 }t | 5 }| D ]}| | d d d n # 1 swxY w Y d d d n # 1 swxY w Y n}# t t f$ ri}t d|z t t 5 t j | d d d n # 1 swxY w Y d }Y d }~nd }~ww xY w|S )Nsql)r2 z!Dumping imunify360 database to %swz(Error during dump: %s. Operation aborted)
r5 r r openr iterdumpwriter OSErrorerrorr r r! )r; dumpfiler( r= rowr* s r r r ~ s "7e<<<H
KK3h>???
(C
D''*:*: j!**,,
3
7 # ?!CDDD
g
Ih
Os B- B!-B
> B!
B B!B B! B- !B%%B- (B%)B- -D'>1D"/D D"D D"D D""D'c t j | r t d d S t d|d| d t
|d 5 }t | 5 } | }| | ns# t $ rf}t | t t 5 t j | d d d n # 1 swxY w Y d } Y d }~nd }~ww xY wd d d n # 1 swxY w Y d d d n # 1 swxY w Y | S )Nz^Database already exists. Loading dump to existing database may cause errors. Operation abortedz
Reading dump z into new database z...r)r r existsr r: r rC r read
executescript MemoryErrorrG r rF r! )r; rH r( r= rA r* s r r" r" s
w~~g
;
t
KKK5=XXwwwG
h
gg&6&6
* ))++C $ $S ) ) ) ) LLOOO'""
#
# '"""
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#GGGGGG
Ns -D?=D(?)B)(D()
D3.D!D 6 DD
D D
DD(DD( D?(D, ,D?/D, 0D??EEc t d| z t | d } t | | t d|z nt# t $ rg}t d| t
t 5 t j | d d d n # 1 swxY w Y d }Y d }~nd }~ww xY w|S )NzMaking backup of the %s...r' z$Database copied successfully to: %s zMaking backup failed: %s)
r r r5 r r% rG r rF r r! )r; backup_filenamer* s r r r s
KK,w6777)'8<<O Wo&&& :_LMMMM /333
g
' ' Io & & & ' ' ' ' ' ' ' ' ' ' ' ' ' ' '
s; -A
C'/C B7+ C 7B; ;C >B; ?C Cc t d t j d t j D } t
d | D r t d dS t d dS )NzDVerifying that db schema is up-to-date and all tables are present...c 6 g | ]}t j | S r r
get_models.0modules r
<listcomp>z*all_tables_are_present.<locals>.<listcomp> s3
%f - -
r c 3 > K | ]}| V d S N) table_exists)rW models r <genexpr>z)all_tables_are_present.<locals>.<genexpr> s.
4
4E5
4
4
4
4
4
4r zAll tables are presentTz Some tables are missing in db.F)r r itertoolschainr MODULES_WITH_MODELSallrG )modelss r r$ r$ s
KKN _
1
F
4
4V
4
4
444 ,---t 5666ur returnc t j j t j t d g } t j D ]\\ }}t d| t j j
d||f | | ]t t j j | t d d S )Nz#Recreating schema for linked DBs...z
Attach db: %sz
ATTACH ? AS ?z Schema recreated successfully.)
r instancedbinitr r r r r MIGRATIONS_ATTACHED_DBS execute_sqlappendrecreate_schema_models)attached_schemasr; schemas r recreate_schemaro s ##EJ///
KK5666 6 ( ( OW--- ".. gv .
''''>257GHHH
KK011111r rg target_schemasc " fdt j d t j D D }t d| | | | | t d d S )Nc 0 g | ]}|j j v |S r )_metarn )rW r] rp s r rY z*recreate_schema_models.<locals>.<listcomp> s7 ; / / 0 / /r c 6 g | ]}t j | S r rT rV s r rY z*recreate_schema_models.<locals>.<listcomp> s3 )&11 r z%rz%Schema models recreated successfully.)r_ r` r ra r r bind
create_tables)rg rp models_to_creates ` r rl rl s _ ! 5
KK&''' GG %&&&
KK788888r r[ )rd N)&loggingr_ r
contextlibr r shutilr sqlite3r r playhouse.sqlite_extr defence360agent.applicationr defence360agentr
defence360agent.contracts.configr defence360agent.modelr getLoggerr r r% r r r+ r5 r r r" r r$ ro liststrrl r r r <module>r s * * * * * * * * 2 2 2 2 2 2 + + + + + + & & & & & & 2 2 2 2 2 2 0 0 0 0 0 0
8 $ $ Y B@ @ @F 4 $
2
2
2
2 99+/99 9 9 9 9 9 9r defence360agent/utils/__pycache__/check_lock.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003456 00000000000 021654 0 ustar
r_jX . d dl Z d dlZddedefdZd ZdS ) NFcheck_lock_periodjitterc . | s|j dd |r\t j t | }| t t j |z | z |S | t t j | z dS t | | x}dk r8| t t j | z dS |S )NT)parentsexist_okr )
existsparentmkdirrandom randrangeint
write_textstrtimeis_period_passed)r lock_filer delay time_lefts U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/check_lock.py
check_lockr s td ;;; $S):%;%;<<E TY[[5%8;L%L!M!M N N NL S/@!@ A ABBBq%&7CCC II S/@!@ A ABBBq c t | }n# t t f$ r Y dS w xY w|t j z
S )Nr )float read_textFileNotFoundError
ValueErrorr )periodr when_to_runs r r r sZ I / / 1 122 z * qq $$s !$ 99)F)r r r
boolr r r r <module>r! sW
# $ "% % % % %r defence360agent/utils/__pycache__/check_lock.cpython-311.pyc 0000644 0000000 0000000 00000003456 00000000000 020715 0 ustar
r_jX . d dl Z d dlZddedefdZd ZdS ) NFcheck_lock_periodjitterc . | s|j dd |r\t j t | }| t t j |z | z |S | t t j | z dS t | | x}dk r8| t t j | z dS |S )NT)parentsexist_okr )
existsparentmkdirrandom randrangeint
write_textstrtimeis_period_passed)r lock_filer delay time_lefts U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/check_lock.py
check_lockr s td ;;; $S):%;%;<<E TY[[5%8;L%L!M!M N N NL S/@!@ A ABBBq%&7CCC II S/@!@ A ABBBq c t | }n# t t f$ r Y dS w xY w|t j z
S )Nr )float read_textFileNotFoundError
ValueErrorr )periodr when_to_runs r r r sZ I / / 1 122 z * qq $$s !$ 99)F)r r r
boolr r r r <module>r! sW
# $ "% % % % %r defence360agent/utils/__pycache__/cli.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000037577 00000000000 020351 0 ustar
r_j9$ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZddddZdZ dZ
dZ d d
gZ d \ Z
ZZed ed
iZe
d ee
ee iZd Z G d d Zd Zd Zd Zd Zd Zd Zd Zd Zd Z d Z d Z d Z d Z d Z!i d e d ed!ed"ed#ed$ed%ed&ed'ed(e d)e d*e d+e d,e d-e d.e d/e e e e e!d0Z"d1hZ#d2 Z$d;d4Z%d5 Z&d<d6Z'd7e(fd8Z) d<ej* d9d:Z+dS )= ) defaultdictNT ),: ) sort_keysindent
separators z /bin/lessz /bin/more)successwarningserrorWARNINGERRORc t j dt d t D d }|t | d S t
j |g| t j
d S )NPAGERc 3 X K | ]%}t j | !|V &d S N)ospathisfile).0ps N/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/cli.py <genexpr>zpager.<locals>.<genexpr> s5 >>QBGNN1,=,=>q>>>>>> )inputstdout) r environgetnextPAGERSprint
subprocessrunencodesysr )datapagers r r) r) st JNN>>&>>>EE
E
}
d wdkkmmCJGGGGGGr c d e Zd Zd Z ddZej fdZed Z ed Z
dS ) TablePrinterc b i | _ t t | _ i | _ i | _ d S r )_headersr list_mappers_right_aligned_widths)selfs r __init__zTablePrinter.__init__' s+
#D))
r NFc |r
|| j |< |r
|| j |< || j |< |r|n| | j |< d S r )r/ r1 r0 upperr- )r2 fieldmappers max_width right_alignheaders r set_field_propertiesz!TablePrinter.set_field_properties- s\ +#*DM% ,"+DL %0E")/ BvvU[[]]
e r c fd|D }d |D }g }|D ]}g }t | D ]\ } }
| |
} j |
D ]
} | | } t | } t | || k rQ j |
}
|
r#t | |
k r| d |
dz
dz } t | || < | | | | t ||d |D ]?}t || j |
d @d S )Nc j g | ]/}j || 0S )r- r r5 )r r6 r2 s r
<listcomp>z&TablePrinter.print.<locals>.<listcomp>= s3 OOOu4=$$UEKKMM::OOOr c , g | ]}t | S r> )len)r r6 s r r? z&TablePrinter.print.<locals>.<listcomp>> s 222#e**222r r
z...F)
enumerater r/ strrA r1 appendr# _format_rowr0 )r2 fieldsitemsfileheaderswidthsrowsitemrowir6 vmapperr8 s ` r r# zTablePrinter.print< s OOOOOOO22'222
DC %f - -
5HHUOO "mE 2 " "F q AAFFq66F1I%% $ 0 0 7 7I 7SVVi%7%7 o A
o . 6 #AF1I
1
KK
d w66777 C !4!8!8!F!F
r c Z |r| | S | | S r )rjustljust)valuewidthr9 s r _add_paddingzTablePrinter._add_paddingV s. &;;u%% %{{5!!!r c h fdt | D }d | S )Nc Z g | ]'\ }}t || (S r> )r+ rV )r rN rT
right_alignedrJ s r r? z,TablePrinter._format_row.<locals>.<listcomp>^ sC
5
% %eVAY
F F
r z )rB join)columnsrJ rY colss `` r rE zTablePrinter._format_row\ sK
%g . .
yy r )NNFN) __name__
__module__ __qualname__r3 r; r' r r# staticmethodrV rE r> r r r+ r+ & s
C
C
C
C ),
4 " " \"
\ r r+ c | | ndS )Nzn/ar> rT s r n_arc e s %5550r c ( | t | n| S r )intrb s r to_intrf i s *3u:::5r c fd}|S )Nc \ t | t r| S | S r )
isinstancedictr )rT r6 s r extractorz extract_field.<locals>.extractorn s, eT " " $99U## # r r> )r6 rk s ` r
extract_fieldrl m s$
r c t }|D ] } |j |
| d |D | d S )Nc g | ]
}|d S )r r> )r rL s r r? z print_table.<locals>.<listcomp>z s 111Ta111r )r+ r; r# )r( field_propstablepropss r print_tablerr v sV NNE + +""E*** KK11[111488888r c dt gfdt gfdt d gfdt gfdt gfdt gff}t | | d S )N timestampabusercountrycodetimesnameseverity)rf rc rl rr r( ro s r print_incidentsr| } se vh C5 ]6**+, 3% # cU
K k"""""r c t t j }| D ],}| dd }|dk r ||z
|d< 'd|d< -d S )N
expirationr ttl)re timer )r( nowrL r~ s r add_ttlr se
dikk
C XXlA..
>>$s*DKKDKK r c n t | dddt d gff}t | | d S )Nipr rv rw r rl rr r{ s r print_graylistr sE DMMM ]6**+,K
k"""""r c r t | dddt d gfddf}t | | d S )Nr r rv rw )
imported_from)commentr r{ s r print_bwlistr sK DMMM ]6**+, K k"""""r c t | t t f rt | rt }t | d t
rdt
| d }| dt d g |
|| d S | D ]}t | d S d S t | d S )Nr rv rw )r7 ) ri r. tuplerA r+ rj sortedkeysr; rl r# )r( printerr rL s r
guess_printerr s $u
&&
t99
"nnG$q'4((
d1gllnn--,,
f(=(='> -
dD))))) D$KKKK
d r c t | t rt | d S t t j | d d S )NF)default_flow_style)ri rC r# yamldumpr( s r yaml_printerr sF $ 9
d
di77788888r c t | t rt | d S t t j | d S r )ri rC r# jsondumpsr s r json_printerr sA $
d
dj r c V t | t r*t d | d d S g }| D ]B}| d |d |d |d rdnd Ct d | d S )
Nz
Status: {}statuszEvent: {}, Path: {}{}eventr nativez native
)ri rj r# formatrD rZ )r( resulthooks r hook_printerr s $ !
l!!$x.1122222 D MM'..ML"&x.8JJb
dii r c | st d d S dddd}| D ]}||d xx dz
cc< t dj di | t t | d d S ) NzNo users targeted.r ) succeededskippedfailedr z:{succeeded} succeeded, {skipped} skipped, {failed} failed.))user)r )reasonr> )r# r rr )rG countsrL s r waf_set_printerr s
"### a
8
8F $ $tH~ !# KDK
GGG<=====r c z d| dd z }| dd s|dz
}t | t d| dd z | d pg }| d
t | }t | |k r1t d |t | n"t d | t |st d
d S t |d d S )Nz Global WAF:
global_wafunknownsecurity_plugin_enabledTz
(plugin off)zDefault (no override): global_waf_defaultrG total_countz Total accounts: {} (showing {})zTotal accounts: {}z No accounts.))ry )
waf_status)source)wp_sites)r r# rA r rr )r r: rG totals r waf_status_printerr s>
fjj y A A
AF ::/ 6 6 "/! &MMM !FJJ/CY$O$OO
JJw %2E JJ}c%jj 1 1E
5zzE /66uc%jjIIJJJJ
"))%00111 GGG
n
@ r )configshow)eular r ) whitelist)r r r. ) blacklist)r r r. )graylist)r r r. )malwarez on-demandr )feature-managementdefaults)r r )r enable)r disable)r r )r add)r delete))r r. )r z
add-native)wordpress-pluginwafsetr r r r c @ | d | d ndS )NrG OKr )r s r _get_default_outputr s! $jj 1 1 =6'??4Gr Fc Z |rt ni }t t j | fi | d S r )PRETTY_JSON_ARGSr# r r )r
is_verbose pretty_argss r _print_json_responser # s8 &08""bK $*V
+
+{
+
+,,,,,r c t | t }| t v r
|| dS |t | dS )z<Print result in plain text format using appropriate printer.N)PRINTERSr r _FULL_RESULT_PRINTERSr )methodr print_funs r _print_plain_responser ( sV V]33I
&&& & %f--.....r c N |rt || d S t | | d S r )r r )r r is_jsonr s r print_responser 1 s6 . VZ00000 ff-----r r( c t | t sd S | dg D ] }t |t j d S )Nr
rH )ri rj r r# r' stderr)r( warnings r print_warningsr 8 sX dD ! ! 88J++ ( (
gCJ'''''( (r r c |r.|rt ni }t t j | |ifi | d S t |t
t f r(|D ]#}t t | d|| $d S t || d S )Nr r )r r# r r ri r. r _CLI_MSG_PREFIX)r messagesr r rH r msgs r print_errorr A s '*4<&&"
dj&(+;;{;;<<<<< hu
. . '
L
L/&"9"9"933?dKKKKK
L
L
( & & & & & &r )F)FF), collectionsr r r r$ r' r r r EXITCODE_NOT_FOUNDEXITCODE_WARNINGEXITCODE_GENERAL_ERRORr" SUCCESSr r r
EXIT_CODESr) r+ rc rf rl rr r| r r r r r r r r r r r r r r r rj r r r r> r r <module>r sJ # # # # # #
!%+NN
{ #8 %Iug6 Q
!
H H H< < < < < < < < ~1 1 16 6 6 9 9 9 # # # # # # # # # "9 9 9
!
!
!
>
>
> 4 e
o L
L
> ' ' #L %l &| "< \! " # $ # ((7+=+ 4 ?? H H H- - - -
/ / /. . . .( ( ( ( ( 16 '?Bz ' ' ' ' ' ' 'r defence360agent/utils/__pycache__/cli.cpython-311.pyc 0000644 0000000 0000000 00000037577 00000000000 017412 0 ustar
r_j9$ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZddddZdZ dZ
dZ d d
gZ d \ Z
ZZed ed
iZe
d ee
ee iZd Z G d d Zd Zd Zd Zd Zd Zd Zd Zd Zd Z d Z d Z d Z d Z d Z!i d e d ed!ed"ed#ed$ed%ed&ed'ed(e d)e d*e d+e d,e d-e d.e d/e e e e e!d0Z"d1hZ#d2 Z$d;d4Z%d5 Z&d<d6Z'd7e(fd8Z) d<ej* d9d:Z+dS )= ) defaultdictNT ),: ) sort_keysindent
separators z /bin/lessz /bin/more)successwarningserrorWARNINGERRORc t j dt d t D d }|t | d S t
j |g| t j
d S )NPAGERc 3 X K | ]%}t j | !|V &d S N)ospathisfile).0ps N/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/cli.py <genexpr>zpager.<locals>.<genexpr> s5 >>QBGNN1,=,=>q>>>>>> )inputstdout) r environgetnextPAGERSprint
subprocessrunencodesysr )datapagers r r) r) st JNN>>&>>>EE
E
}
d wdkkmmCJGGGGGGr c d e Zd Zd Z ddZej fdZed Z ed Z
dS ) TablePrinterc b i | _ t t | _ i | _ i | _ d S r )_headersr list_mappers_right_aligned_widths)selfs r __init__zTablePrinter.__init__' s+
#D))
r NFc |r
|| j |< |r
|| j |< || j |< |r|n| | j |< d S r )r/ r1 r0 upperr- )r2 fieldmappers max_width right_alignheaders r set_field_propertiesz!TablePrinter.set_field_properties- s\ +#*DM% ,"+DL %0E")/ BvvU[[]]
e r c fd|D }d |D }g }|D ]}g }t | D ]\ } }
| |
} j |
D ]
} | | } t | } t | || k rQ j |
}
|
r#t | |
k r| d |
dz
dz } t | || < | | | | t ||d |D ]?}t || j |
d @d S )Nc j g | ]/}j || 0S )r- r r5 )r r6 r2 s r
<listcomp>z&TablePrinter.print.<locals>.<listcomp>= s3 OOOu4=$$UEKKMM::OOOr c , g | ]}t | S r> )len)r r6 s r r? z&TablePrinter.print.<locals>.<listcomp>> s 222#e**222r r
z...F)
enumerater r/ strrA r1 appendr# _format_rowr0 )r2 fieldsitemsfileheaderswidthsrowsitemrowir6 vmapperr8 s ` r r# zTablePrinter.print< s OOOOOOO22'222
DC %f - -
5HHUOO "mE 2 " "F q AAFFq66F1I%% $ 0 0 7 7I 7SVVi%7%7 o A
o . 6 #AF1I
1
KK
d w66777 C !4!8!8!F!F
r c Z |r| | S | | S r )rjustljust)valuewidthr9 s r _add_paddingzTablePrinter._add_paddingV s. &;;u%% %{{5!!!r c h fdt | D }d | S )Nc Z g | ]'\ }}t || (S r> )r+ rV )r rN rT
right_alignedrJ s r r? z,TablePrinter._format_row.<locals>.<listcomp>^ sC
5
% %eVAY
F F
r z )rB join)columnsrJ rY colss `` r rE zTablePrinter._format_row\ sK
%g . .
yy r )NNFN) __name__
__module__ __qualname__r3 r; r' r r# staticmethodrV rE r> r r r+ r+ & s
C
C
C
C ),
4 " " \"
\ r r+ c | | ndS )Nzn/ar> rT s r n_arc e s %5550r c ( | t | n| S r )intrb s r to_intrf i s *3u:::5r c fd}|S )Nc \ t | t r| S | S r )
isinstancedictr )rT r6 s r extractorz extract_field.<locals>.extractorn s, eT " " $99U## # r r> )r6 rk s ` r
extract_fieldrl m s$
r c t }|D ] } |j |
| d |D | d S )Nc g | ]
}|d S )r r> )r rL s r r? z print_table.<locals>.<listcomp>z s 111Ta111r )r+ r; r# )r( field_propstablepropss r print_tablerr v sV NNE + +""E*** KK11[111488888r c dt gfdt gfdt d gfdt gfdt gfdt gff}t | | d S )N timestampabusercountrycodetimesnameseverity)rf rc rl rr r( ro s r print_incidentsr| } se vh C5 ]6**+, 3% # cU
K k"""""r c t t j }| D ],}| dd }|dk r ||z
|d< 'd|d< -d S )N
expirationr ttl)re timer )r( nowrL r~ s r add_ttlr se
dikk
C XXlA..
>>$s*DKKDKK r c n t | dddt d gff}t | | d S )Nipr rv rw r rl rr r{ s r print_graylistr sE DMMM ]6**+,K
k"""""r c r t | dddt d gfddf}t | | d S )Nr r rv rw )
imported_from)commentr r{ s r print_bwlistr sK DMMM ]6**+, K k"""""r c t | t t f rt | rt }t | d t
rdt
| d }| dt d g |
|| d S | D ]}t | d S d S t | d S )Nr rv rw )r7 ) ri r. tuplerA r+ rj sortedkeysr; rl r# )r( printerr rL s r
guess_printerr s $u
&&
t99
"nnG$q'4((
d1gllnn--,,
f(=(='> -
dD))))) D$KKKK
d r c t | t rt | d S t t j | d d S )NF)default_flow_style)ri rC r# yamldumpr( s r yaml_printerr sF $ 9
d
di77788888r c t | t rt | d S t t j | d S r )ri rC r# jsondumpsr s r json_printerr sA $
d
dj r c V t | t r*t d | d d S g }| D ]B}| d |d |d |d rdnd Ct d | d S )
Nz
Status: {}statuszEvent: {}, Path: {}{}eventr nativez native
)ri rj r# formatrD rZ )r( resulthooks r hook_printerr s $ !
l!!$x.1122222 D MM'..ML"&x.8JJb
dii r c | st d d S dddd}| D ]}||d xx dz
cc< t dj di | t t | d d S ) NzNo users targeted.r ) succeededskippedfailedr z:{succeeded} succeeded, {skipped} skipped, {failed} failed.))user)r )reasonr> )r# r rr )rG countsrL s r waf_set_printerr s
"### a
8
8F $ $tH~ !# KDK
GGG<=====r c z d| dd z }| dd s|dz
}t | t d| dd z | d pg }| d
t | }t | |k r1t d |t | n"t d | t |st d
d S t |d d S )Nz Global WAF:
global_wafunknownsecurity_plugin_enabledTz
(plugin off)zDefault (no override): global_waf_defaultrG total_countz Total accounts: {} (showing {})zTotal accounts: {}z No accounts.))ry )
waf_status)source)wp_sites)r r# rA r rr )r r: rG totals r waf_status_printerr s>
fjj y A A
AF ::/ 6 6 "/! &MMM !FJJ/CY$O$OO
JJw %2E JJ}c%jj 1 1E
5zzE /66uc%jjIIJJJJ
"))%00111 GGG
n
@ r )configshow)eular r ) whitelist)r r r. ) blacklist)r r r. )graylist)r r r. )malwarez on-demandr )feature-managementdefaults)r r )r enable)r disable)r r )r add)r delete))r r. )r z
add-native)wordpress-pluginwafsetr r r r c @ | d | d ndS )NrG OKr )r s r _get_default_outputr s! $jj 1 1 =6'??4Gr Fc Z |rt ni }t t j | fi | d S r )PRETTY_JSON_ARGSr# r r )r
is_verbose pretty_argss r _print_json_responser # s8 &08""bK $*V
+
+{
+
+,,,,,r c t | t }| t v r
|| dS |t | dS )z<Print result in plain text format using appropriate printer.N)PRINTERSr r _FULL_RESULT_PRINTERSr )methodr print_funs r _print_plain_responser ( sV V]33I
&&& & %f--.....r c N |rt || d S t | | d S r )r r )r r is_jsonr s r print_responser 1 s6 . VZ00000 ff-----r r( c t | t sd S | dg D ] }t |t j d S )Nr
rH )ri rj r r# r' stderr)r( warnings r print_warningsr 8 sX dD ! ! 88J++ ( (
gCJ'''''( (r r c |r.|rt ni }t t j | |ifi | d S t |t
t f r(|D ]#}t t | d|| $d S t || d S )Nr r )r r# r r ri r. r _CLI_MSG_PREFIX)r messagesr r rH r msgs r print_errorr A s '*4<&&"
dj&(+;;{;;<<<<< hu
. . '
L
L/&"9"9"933?dKKKKK
L
L
( & & & & & &r )F)FF), collectionsr r r r$ r' r r r EXITCODE_NOT_FOUNDEXITCODE_WARNINGEXITCODE_GENERAL_ERRORr" SUCCESSr r r
EXIT_CODESr) r+ rc rf rl rr r| r r r r r r r r r r r r r r r rj r r r r> r r <module>r sJ # # # # # #
!%+NN
{ #8 %Iug6 Q
!
H H H< < < < < < < < ~1 1 16 6 6 9 9 9 # # # # # # # # # "9 9 9
!
!
!
>
>
> 4 e
o L
L
> ' ' #L %l &| "< \! " # $ # ((7+=+ 4 ?? H H H- - - -
/ / /. . . .( ( ( ( ( 16 '?Bz ' ' ' ' ' ' 'r defence360agent/utils/__pycache__/common.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000053007 00000000000 021054 0 ustar
r_j9 N d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZ ej d
Z ej d
Z ej d
Z
ej d
Z ej e Z G d de Z G d d
e Z G d d ZeZ G d
d Z e Zd Z G d d Z G d de Z ddZ dS ) N )minutes)hours)days)weeksc e Zd ZdZd Zd Zd Zd Zd Zd Z G d d e
Z G d
d e Z G d d
e Z
G d de ZdS ) ServiceBasezBase service class.c d || _ d| _ d | _ | | | _ d S NF)_loop _should_stop
_main_task StoppedState_state)selfloops Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/common.py__init__zServiceBase.__init__ s1
! ''-- c 4 | j S N)r startr s r r zServiceBase.start s { """r c 4 | j S r )r should_stopr s r r zServiceBase.should_stop s {&&(((r c D K | j d {V S r )r waitr s r r zServiceBase.wait" s, [%%'''''''''r c 4 | j S r )r
is_runningr s r r zServiceBase.is_running% s {%%'''r c K t r )NotImplementedErrorr s r _runzServiceBase._run( s !!r c , e Zd Zd Zd Zd Zd Zd ZdS )ServiceBase.Statec || _ dS )z:type obj: ServiceBaseN)_objr objs r r zServiceBase.State.__init__, s
DIIIr c d S r r s r r zServiceBase.State.start0 Dr c d S r r* r s r r z ServiceBase.State.should_stop3 r+ r c : K | j j }|r
| d {V d S d S r )r& r )r tasks r r zServiceBase.State.wait6 s7 9'D
r c dS r r* r s r r z ServiceBase.State.is_running; s 5r N)__name__
__module__ __qualname__r r r r r r* r r Stater$ + s_
r r3 c e Zd Zd Zd ZdS )ServiceBase.StoppedStatec p t | j | j _ d| j _ d S r )r r r& r r
)r futures r _on_stopz!ServiceBase.StoppedState._on_stop? s, * 7 7 B BDI %*DI " " "r c | j }|j | |_ |j | j t | |_ d S r )
r& r create_taskr" r add_done_callbackr8 r RunningStater r' s r r z ServiceBase.StoppedState.startC sY )C Y 2 2388:: > >CN N , ,T] ; ; ;$11#66CJJJr N)r0 r1 r2 r8 r r* r r r r5 > s2 + + + 7 7 7 7 7r r c e Zd Zd Zd ZdS )ServiceBase.RunningStatec | j }d|_ |j t | |_ d S NT)r& r
r cancelr
StoppingStater r' s r r z$ServiceBase.RunningState.should_stopJ s> )C #C N ! ! # # #$22377CJJJr c dS r@ r* r s r r z#ServiceBase.RunningState.is_runningP s 4r N)r0 r1 r2 r r r* r r r< r> I s2 8 8 8 r r< c e Zd Zd ZdS )ServiceBase.StoppingStatec t d )Nz9Cannot start stopping service. Please wait while it stop.)ProgrammingErrorr s r r z ServiceBase.StoppingState.startT s "K
r N)r0 r1 r2 r r* r r rB rE S s# r rB N)r0 r1 r2 __doc__r r r r r r" objectr3 r r< rB r* r r r r s . . . # # #) ) )( ( (( ( (" " " & 7 7 7 7 7u 7 7 7 u r r c e Zd ZdS )rG N)r0 r1 r2 r* r r rG rG Z s Dr rG c H e Zd ZdZej fdddZed Zd Z dS ) RateLimita3 Decorator to limit function calls to one per *period* seconds.
If less than *period* seconds have passed since the last call,
then the request to call the function is replace with an *on_drop*
call with the same arguments.
If *on_drop* is None [default] then the call is just dropped
N)on_dropc > d | _ || _ || _ || _ d S r )_next_call_time_period_timer_on_drop)r periodtimerrM s r r zRateLimit.__init__i s# #
r c N | j d u p | j | k S r )rO rQ r s r should_be_calledzRateLimit.should_be_calledo s,
D (
5#t{{}}4
r c t j fd }t j fd }t j r|n|S )Nc j r) j z _ | i |S j
j | i |S d S r rV rQ rP rO rR argskwargsfuncr s r wrapperz#RateLimit.__call__.<locals>.wrapperw sa $
6'+{{}}t|'C$tT,V,,, *$t}d5f555 +*r c K j r/ j z _ | i | d {V S j
j | i |S d S r rY rZ s r
async_wrapperz)RateLimit.__call__.<locals>.async_wrapper sw $
6'+{{}}t|'C$ !T4 26 2 22222222 *$t}d5f555 +*r ) functoolswrapsasyncioiscoroutinefunction)r r] r^ r` s `` r __call__zRateLimit.__call__v s 6 6 6 6 6
6
6 6 6 6 6
6 !( ;D A AN}}wNr )
r0 r1 r2 rH time monotonicr propertyrV re r* r r rL rL ^ st &*^
X
O O O O Or rL c e Zd Zd ZdddZdS )
CoalesceCallsc < t d | _ d | _ d S )Nz-inf)float call_time delayed_callr s r r zCoalesceCalls.__init__ s v r N)
done_callbackc fd}|S )a
Decorator to coalesce coroutine calls to one per *period* seconds.
Requests for a coroutine call in a given time period are coalesced:
If t is the time of the last call, then N call requests in the [t,
t+period) time interval results in a single call at the
t+period time iff N>0 i.e.,
if less than *period* seconds have passed since the last call,
then the calls are coalesced: (N-1) requests are dropped, Nth
requests is performed in *period* seconds.
It is unspecified which exact call is made if arguments differ.
If the call is not dropped then *done_callback* is attached
to the task when the coroutine is scheduled with the event loop.
Given `c` is the time of the last [actual] call (`loop.create_task()`)
And `T` is the coalesce time period
When a call request arrives at `t` time
Then
| call pending? | t>c+T | c<=t<=c+T | t<c |
|----------------+--------------------------------+------------+------|
| no p. call | call soon | call at c+T| warn |
| p. call at c+T | cancel the call/warn, call soon| drop call | warn |
c N t j fd }|S )Nc K | d t j | s|r d| d|}nd}
j d|d fd
fd} }|
j z k r
j Wt
j }
j d
_ t
d |
j | t d
|
| |
_ d S
j |cxk r
j z k rn n
j z |z
}
j t d | d S
j J t d |
j z |
| |
_ d S t
d
j | d S )Nr *z, ** ()c | sD| 2 dz | | d dS dS dS )zLog task's error
if any with event's loop exception handler.
CancelledError is not logged.
NzUnhandled exception during )message exceptionr. ) cancelledry call_exception_handler)r. call_reprr s r
log_exceptionzWCoalesceCalls.coalesce_calls.<locals>.decorator.<locals>.wrapper.<locals>.log_exception s} >>++ 0@0@0L 33+H"+,,-1^^-=-=(, 0L0Lr c t d _ d_ | |i | }| n dS )z*Call & schedule the delayed coroutine now.zSchedule call %sN)loggerinforf rm rn r: r; ) coror[ r\ r. r| ro r} r r s r call_delayedzVCoalesceCalls.coalesce_calls.<locals>.decorator.<locals>.wrapper.<locals>.call_delayed s KK 2I>>>%)YY[[DN(,D% ++DD$,A&,A,ABBD**(0 &
* r ziThere was a scheduled call (%s) but more than period (%r) seconds passed since the last call (%r, now=%r)zSSatisfy the call request soon: %s. No calls in more than %r seconds since the startz`Drop call request for %s, enforcing one call per %r seconds limit. Next call is in ~%.2f secondszQDelay call request: %s for ~%.2f seconds. Enforcing one call per %r seconds limitzNDrop call request for %s, reason: last call time (%r, now=%r) is in the future)getrc get_event_loopr0 rf rm rn strrA r warningr call_sooncall_at)r[ r\ args_reprr nowold_delayed_call_reprdelayr| r} r r ro rS r s @@@r r^ z@CoalesceCalls.coalesce_calls.<locals>.decorator.<locals>.wrapper s zz&))<"133D #6 #/3ttVV <II "I(,
yyy A
iikk$.6122(4 14D4E0F0F- )00222,0) @ 2 " N KK@! )-$dD&) )D%%% ^sGGGGt~/FGGGGG !^f 4 ;E(4 > & " !
$ 0 8 8 8 H % ! " -1LL NV 3 ( " - -))) NN9! r )ra rb )r r^ ro rS r s ` r decoratorz/CoalesceCalls.coalesce_calls.<locals>.decorator sQ
_T
"
"c
c
c
c
c
c
c
#
"c
J Nr r* )r rS ro r s ``` r coalesce_callsz CoalesceCalls.coalesce_calls s8 8g g g g g g g R r )r0 r1 r2 r r r* r r rj rj sH ! ! ! 7; E E E E E E Er rj c t j } | '| d rt j S | S )ziReturns readable name of the server.
It is sent to CLN and allows user to sort out his servers.
N localhost)socketgetfqdnlower
startswith gethostname)hostnames r get_hostnamer sH
~ H8>>++66{CC!### Or c > e Zd ZdZd
dZd Zd Zd Zd Zd Z d Z
dS ) VersionzAbstract base class for version numbering classes. Just provides
constructor (__init__) and reproducer (__repr__), because those
seem to be the same for all version numbering classes; and route
rich comparisons to _cmp.
Nc 8 |r| | d S d S r )parse)r vstrings r r zVersion.__init__3 s, JJw r c \ d | j j t | S )Nz {} ('{}'))format __class__r0 r r s r __repr__zVersion.__repr__7 s# !!$."93t99EEEr c N | | }|t u r|S |dk S Nr _cmpNotImplementedr othercs r __eq__zVersion.__eq__: , IIe HAv
r c N | | }|t u r|S |dk S r r r s r __lt__zVersion.__lt__@ , IIe H1u r c N | | }|t u r|S |dk S r r r s r __le__zVersion.__le__F r r c N | | }|t u r|S |dk S r r r s r __gt__zVersion.__gt__L r r c N | | }|t u r|S |dk S r r r s r __ge__zVersion.__ge__R r r r ) r0 r1 r2 rH r r r r r r r r* r r r r , s F F F r r c V e Zd ZdZ ej dej Zd Zd Z d Z
d Z dS ) LooseVersiona Version numbering for anarchists and software realists.
Implements the standard interface for version number classes as
described above. A version number consists of a series of numbers,
separated by either periods or strings of letters. When comparing
version numbers, the numeric components will be compared
numerically, and the alphabetic components lexically. The following
are all valid version numbers, in no particular order:
1.5.1
1.5.2b2
161
3.10a
8.02
3.4j
1996.07.12
3.2.pl0
3.1.1.6
2g6
11g
0.960923
2.2beta29
1.13++
5.5.kw
2.0b1pl0
In fact, there is no such thing as an invalid version number under
this scheme; the rules for comparison are simple and predictable,
but may not always give the results you want (for some definition
of "want").
z(\d+ | [a-z]+ | \.)c || _ d | j | D }t | D ](\ }} t | ||< # t
$ r Y %w xY w|| _ d S )Nc " g | ] }|r|d k
|
S ).r* ).0xs r
<listcomp>z&LooseVersion.parse.<locals>.<listcomp> s,
1
ABcAr )r component_resplit enumerateint
ValueErrorversion)r r
componentsir( s r r zLooseVersion.parse} s
(..w77
++ FAs
#C
1
" s A
A! A!c | j S r )r r s r __str__zLooseVersion.__str__ s
|r c & dt | z S )NzLooseVersion ('%s'))r r s r r zLooseVersion.__repr__ s $s4yy00r c t |t rt | }n t |t st S | j |j k rdS | j |j k rdS | j |j k rdS d S )Nr r )
isinstancer r r r )r r s r r zLooseVersion._cmp s eS ! ! " ''EEE<00 "! ! <5= ( (1 <%- ' '2 <%- ' '1 ( 'r N) r0 r1 r2 rH recompileVERBOSEr r r r r r* r r r r Z sr > 2: 4bjAAL" " " 1 1 1 r r c R t j | \ }}t j dk r |dk r| dz } t j | r| S |[t j dd }|9 t j d }n## t t f$ r t j }Y nw xY w|sdS | t j
}|D ]E}t j || }t j | r|c S FdS )zTries to find 'executable' in the directories listed in 'path'.
A string listing directories separated by 'os.pathsep'; defaults to
os.environ['PATH']. Returns the complete filename or None if not found.
win32z.exeNPATHCS_PATH)ospathsplitextsysplatformisfileenvironr confstrAttributeErrorr defpathr pathsepjoin)
executabler _extpathspfs r find_executabler s) W
j
)
)FAs cVmm &(
w~~j!! |z~~fd++ <
"z),,"J/
"
"
"z
" t JJrz " "E
GLLJ ' '
7>>! HHH 4s B B98B9r ) rc datetimera loggingr rf r r r timedelta
total_secondsMINUTEHOURDAYWEEK getLoggerr0 r rI r ExceptionrG rL
rate_limitrj webserver_gracefull_restartr r r r r* r r <module>r sL
A & & & 4 4 6 6x"""0022ha ..00x"""0022 8 $ $D D D D D& D D DN y )O )O )O )O )O )O )O )OX
J J J J J J J JZ ,moo * * * * * * * *\D D D D D7 D D DP" " " " " "r defence360agent/utils/__pycache__/common.cpython-311.pyc 0000644 0000000 0000000 00000053007 00000000000 020115 0 ustar
r_j9 N d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZ ej d
Z ej d
Z ej d
Z
ej d
Z ej e Z G d de Z G d d
e Z G d d ZeZ G d
d Z e Zd Z G d d Z G d de Z ddZ dS ) N )minutes)hours)days)weeksc e Zd ZdZd Zd Zd Zd Zd Zd Z G d d e
Z G d
d e Z G d d
e Z
G d de ZdS ) ServiceBasezBase service class.c d || _ d| _ d | _ | | | _ d S NF)_loop _should_stop
_main_task StoppedState_state)selfloops Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/common.py__init__zServiceBase.__init__ s1
! ''-- c 4 | j S N)r startr s r r zServiceBase.start s { """r c 4 | j S r )r should_stopr s r r zServiceBase.should_stop s {&&(((r c D K | j d {V S r )r waitr s r r zServiceBase.wait" s, [%%'''''''''r c 4 | j S r )r
is_runningr s r r zServiceBase.is_running% s {%%'''r c K t r )NotImplementedErrorr s r _runzServiceBase._run( s !!r c , e Zd Zd Zd Zd Zd Zd ZdS )ServiceBase.Statec || _ dS )z:type obj: ServiceBaseN)_objr objs r r zServiceBase.State.__init__, s
DIIIr c d S r r s r r zServiceBase.State.start0 Dr c d S r r* r s r r z ServiceBase.State.should_stop3 r+ r c : K | j j }|r
| d {V d S d S r )r& r )r tasks r r zServiceBase.State.wait6 s7 9'D
r c dS r r* r s r r z ServiceBase.State.is_running; s 5r N)__name__
__module__ __qualname__r r r r r r* r r Stater$ + s_
r r3 c e Zd Zd Zd ZdS )ServiceBase.StoppedStatec p t | j | j _ d| j _ d S r )r r r& r r
)r futures r _on_stopz!ServiceBase.StoppedState._on_stop? s, * 7 7 B BDI %*DI " " "r c | j }|j | |_ |j | j t | |_ d S r )
r& r create_taskr" r add_done_callbackr8 r RunningStater r' s r r z ServiceBase.StoppedState.startC sY )C Y 2 2388:: > >CN N , ,T] ; ; ;$11#66CJJJr N)r0 r1 r2 r8 r r* r r r r5 > s2 + + + 7 7 7 7 7r r c e Zd Zd Zd ZdS )ServiceBase.RunningStatec | j }d|_ |j t | |_ d S NT)r& r
r cancelr
StoppingStater r' s r r z$ServiceBase.RunningState.should_stopJ s> )C #C N ! ! # # #$22377CJJJr c dS r@ r* r s r r z#ServiceBase.RunningState.is_runningP s 4r N)r0 r1 r2 r r r* r r r< r> I s2 8 8 8 r r< c e Zd Zd ZdS )ServiceBase.StoppingStatec t d )Nz9Cannot start stopping service. Please wait while it stop.)ProgrammingErrorr s r r z ServiceBase.StoppingState.startT s "K
r N)r0 r1 r2 r r* r r rB rE S s# r rB N)r0 r1 r2 __doc__r r r r r r" objectr3 r r< rB r* r r r r s . . . # # #) ) )( ( (( ( (" " " & 7 7 7 7 7u 7 7 7 u r r c e Zd ZdS )rG N)r0 r1 r2 r* r r rG rG Z s Dr rG c H e Zd ZdZej fdddZed Zd Z dS ) RateLimita3 Decorator to limit function calls to one per *period* seconds.
If less than *period* seconds have passed since the last call,
then the request to call the function is replace with an *on_drop*
call with the same arguments.
If *on_drop* is None [default] then the call is just dropped
N)on_dropc > d | _ || _ || _ || _ d S r )_next_call_time_period_timer_on_drop)r periodtimerrM s r r zRateLimit.__init__i s# #
r c N | j d u p | j | k S r )rO rQ r s r should_be_calledzRateLimit.should_be_calledo s,
D (
5#t{{}}4
r c t j fd }t j fd }t j r|n|S )Nc j r) j z _ | i |S j
j | i |S d S r rV rQ rP rO rR argskwargsfuncr s r wrapperz#RateLimit.__call__.<locals>.wrapperw sa $
6'+{{}}t|'C$tT,V,,, *$t}d5f555 +*r c K j r/ j z _ | i | d {V S j
j | i |S d S r rY rZ s r
async_wrapperz)RateLimit.__call__.<locals>.async_wrapper sw $
6'+{{}}t|'C$ !T4 26 2 22222222 *$t}d5f555 +*r ) functoolswrapsasyncioiscoroutinefunction)r r] r^ r` s `` r __call__zRateLimit.__call__v s 6 6 6 6 6
6
6 6 6 6 6
6 !( ;D A AN}}wNr )
r0 r1 r2 rH time monotonicr propertyrV re r* r r rL rL ^ st &*^
X
O O O O Or rL c e Zd Zd ZdddZdS )
CoalesceCallsc < t d | _ d | _ d S )Nz-inf)float call_time delayed_callr s r r zCoalesceCalls.__init__ s v r N)
done_callbackc fd}|S )a
Decorator to coalesce coroutine calls to one per *period* seconds.
Requests for a coroutine call in a given time period are coalesced:
If t is the time of the last call, then N call requests in the [t,
t+period) time interval results in a single call at the
t+period time iff N>0 i.e.,
if less than *period* seconds have passed since the last call,
then the calls are coalesced: (N-1) requests are dropped, Nth
requests is performed in *period* seconds.
It is unspecified which exact call is made if arguments differ.
If the call is not dropped then *done_callback* is attached
to the task when the coroutine is scheduled with the event loop.
Given `c` is the time of the last [actual] call (`loop.create_task()`)
And `T` is the coalesce time period
When a call request arrives at `t` time
Then
| call pending? | t>c+T | c<=t<=c+T | t<c |
|----------------+--------------------------------+------------+------|
| no p. call | call soon | call at c+T| warn |
| p. call at c+T | cancel the call/warn, call soon| drop call | warn |
c N t j fd }|S )Nc K | d t j | s|r d| d|}nd}
j d|d fd
fd} }|
j z k r
j Wt
j }
j d
_ t
d |
j | t d
|
| |
_ d S
j |cxk r
j z k rn n
j z |z
}
j t d | d S
j J t d |
j z |
| |
_ d S t
d
j | d S )Nr *z, ** ()c | sD| 2 dz | | d dS dS dS )zLog task's error
if any with event's loop exception handler.
CancelledError is not logged.
NzUnhandled exception during )message exceptionr. ) cancelledry call_exception_handler)r. call_reprr s r
log_exceptionzWCoalesceCalls.coalesce_calls.<locals>.decorator.<locals>.wrapper.<locals>.log_exception s} >>++ 0@0@0L 33+H"+,,-1^^-=-=(, 0L0Lr c t d _ d_ | |i | }| n dS )z*Call & schedule the delayed coroutine now.zSchedule call %sN)loggerinforf rm rn r: r; ) coror[ r\ r. r| ro r} r r s r call_delayedzVCoalesceCalls.coalesce_calls.<locals>.decorator.<locals>.wrapper.<locals>.call_delayed s KK 2I>>>%)YY[[DN(,D% ++DD$,A&,A,ABBD**(0 &
* r ziThere was a scheduled call (%s) but more than period (%r) seconds passed since the last call (%r, now=%r)zSSatisfy the call request soon: %s. No calls in more than %r seconds since the startz`Drop call request for %s, enforcing one call per %r seconds limit. Next call is in ~%.2f secondszQDelay call request: %s for ~%.2f seconds. Enforcing one call per %r seconds limitzNDrop call request for %s, reason: last call time (%r, now=%r) is in the future)getrc get_event_loopr0 rf rm rn strrA r warningr call_sooncall_at)r[ r\ args_reprr nowold_delayed_call_reprdelayr| r} r r ro rS r s @@@r r^ z@CoalesceCalls.coalesce_calls.<locals>.decorator.<locals>.wrapper s zz&))<"133D #6 #/3ttVV <II "I(,
yyy A
iikk$.6122(4 14D4E0F0F- )00222,0) @ 2 " N KK@! )-$dD&) )D%%% ^sGGGGt~/FGGGGG !^f 4 ;E(4 > & " !
$ 0 8 8 8 H % ! " -1LL NV 3 ( " - -))) NN9! r )ra rb )r r^ ro rS r s ` r decoratorz/CoalesceCalls.coalesce_calls.<locals>.decorator sQ
_T
"
"c
c
c
c
c
c
c
#
"c
J Nr r* )r rS ro r s ``` r coalesce_callsz CoalesceCalls.coalesce_calls s8 8g g g g g g g R r )r0 r1 r2 r r r* r r rj rj sH ! ! ! 7; E E E E E E Er rj c t j } | '| d rt j S | S )ziReturns readable name of the server.
It is sent to CLN and allows user to sort out his servers.
N localhost)socketgetfqdnlower
startswith gethostname)hostnames r get_hostnamer sH
~ H8>>++66{CC!### Or c > e Zd ZdZd
dZd Zd Zd Zd Zd Z d Z
dS ) VersionzAbstract base class for version numbering classes. Just provides
constructor (__init__) and reproducer (__repr__), because those
seem to be the same for all version numbering classes; and route
rich comparisons to _cmp.
Nc 8 |r| | d S d S r )parse)r vstrings r r zVersion.__init__3 s, JJw r c \ d | j j t | S )Nz {} ('{}'))format __class__r0 r r s r __repr__zVersion.__repr__7 s# !!$."93t99EEEr c N | | }|t u r|S |dk S Nr _cmpNotImplementedr othercs r __eq__zVersion.__eq__: , IIe HAv
r c N | | }|t u r|S |dk S r r r s r __lt__zVersion.__lt__@ , IIe H1u r c N | | }|t u r|S |dk S r r r s r __le__zVersion.__le__F r r c N | | }|t u r|S |dk S r r r s r __gt__zVersion.__gt__L r r c N | | }|t u r|S |dk S r r r s r __ge__zVersion.__ge__R r r r ) r0 r1 r2 rH r r r r r r r r* r r r r , s F F F r r c V e Zd ZdZ ej dej Zd Zd Z d Z
d Z dS ) LooseVersiona Version numbering for anarchists and software realists.
Implements the standard interface for version number classes as
described above. A version number consists of a series of numbers,
separated by either periods or strings of letters. When comparing
version numbers, the numeric components will be compared
numerically, and the alphabetic components lexically. The following
are all valid version numbers, in no particular order:
1.5.1
1.5.2b2
161
3.10a
8.02
3.4j
1996.07.12
3.2.pl0
3.1.1.6
2g6
11g
0.960923
2.2beta29
1.13++
5.5.kw
2.0b1pl0
In fact, there is no such thing as an invalid version number under
this scheme; the rules for comparison are simple and predictable,
but may not always give the results you want (for some definition
of "want").
z(\d+ | [a-z]+ | \.)c || _ d | j | D }t | D ](\ }} t | ||< # t
$ r Y %w xY w|| _ d S )Nc " g | ] }|r|d k
|
S ).r* ).0xs r
<listcomp>z&LooseVersion.parse.<locals>.<listcomp> s,
1
ABcAr )r component_resplit enumerateint
ValueErrorversion)r r
componentsir( s r r zLooseVersion.parse} s
(..w77
++ FAs
#C
1
" s A
A! A!c | j S r )r r s r __str__zLooseVersion.__str__ s
|r c & dt | z S )NzLooseVersion ('%s'))r r s r r zLooseVersion.__repr__ s $s4yy00r c t |t rt | }n t |t st S | j |j k rdS | j |j k rdS | j |j k rdS d S )Nr r )
isinstancer r r r )r r s r r zLooseVersion._cmp s eS ! ! " ''EEE<00 "! ! <5= ( (1 <%- ' '2 <%- ' '1 ( 'r N) r0 r1 r2 rH recompileVERBOSEr r r r r r* r r r r Z sr > 2: 4bjAAL" " " 1 1 1 r r c R t j | \ }}t j dk r |dk r| dz } t j | r| S |[t j dd }|9 t j d }n## t t f$ r t j }Y nw xY w|sdS | t j
}|D ]E}t j || }t j | r|c S FdS )zTries to find 'executable' in the directories listed in 'path'.
A string listing directories separated by 'os.pathsep'; defaults to
os.environ['PATH']. Returns the complete filename or None if not found.
win32z.exeNPATHCS_PATH)ospathsplitextsysplatformisfileenvironr confstrAttributeErrorr defpathr pathsepjoin)
executabler _extpathspfs r find_executabler s) W
j
)
)FAs cVmm &(
w~~j!! |z~~fd++ <
"z),,"J/
"
"
"z
" t JJrz " "E
GLLJ ' '
7>>! HHH 4s B B98B9r ) rc datetimera loggingr rf r r r timedelta
total_secondsMINUTEHOURDAYWEEK getLoggerr0 r rI r ExceptionrG rL
rate_limitrj webserver_gracefull_restartr r r r r* r r <module>r sL
A & & & 4 4 6 6x"""0022ha ..00x"""0022 8 $ $D D D D D& D D DN y )O )O )O )O )O )O )O )OX
J J J J J J J JZ ,moo * * * * * * * *\D D D D D7 D D DP" " " " " "r defence360agent/utils/__pycache__/completions.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000041001 00000000000 022107 0 ustar
r_j' 2 d Z ddlZddlZddlmZmZmZ dedefdZdej deeedf ee f fd Z
dej dee fd
Z dej d eedf d eeedf ee f fd
Z deeedf ee f deedf dee fdZ
ddej dedefdZ ddej dedefdZ ddej dedefdZeeedZ ee Z ddej dededefdZdS )z
Shell auto-completion script generators for the CLI.
Introspects an argparse parser to enumerate all commands, subcommands, and
flags, then emits completion scripts for bash, zsh, and fish.
N)DictListTupleprogreturnc . t j dd| S )zDConvert a prog name to a safe shell identifier (letters, digits, _).z [^a-zA-Z0-9]_)resub)r s V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/completions.py_safe_identifierr
s
6/3 - -- parser.c , i }t | d| |S )z@Walk the parser tree and return {command_path: [flags]} mapping. ) _walk_parser)r results r _collect_commandsr s 02FV$$$ Mr c g }| j D ]W}t |t j r t |t j r8|j D ]}| | Xt | S )z:Extract all optional flags from a parser (excluding help).)_actions
isinstanceargparse _HelpAction_SubParsersActionoption_stringsappendsorted)r flagsactionopts r
_get_flagsr! s E/ fh 2 3 3 fh 8 9 9 ( C LL %==r pathr c t | }|||< | j D ]P}t |t j r4|j D ]\ }}t |||fz | QdS )z>Recursively walk subparsers and collect command paths + flags.N)r! r r r r choicesitemsr )r r" r r r name subparsers r r r ( s
v EF4L/ @ @ fh 8 9 9 @#)>#7#7#9#9
@
@i Yw????@ @r commandsprefixc t }| D ][}t | t | dz k r6|dt | |k r| |d \t | S )z,Get immediate subcommands of a given prefix. N)setlenaddr )r( r) subsr" s r _get_subcommandsr1 7 ss
55D t99F a ' 'D 3v;; ,?6,I,I HHT"X $<<r imunify360-agentc , t | }g }| d| | d| d | d | dt | d | d | d | d | d
| d | d | d
| d | d | d | d | d | d | d | d | d | d | d | d | d | d | d t | d }|D ]}|st || }|| }d ||z }d | } | d | d | d | d! | d" t |d# }
| d#g } d |
| z } | d$ | d | d! | d" | d% | d& | d | d't | d(| | d d) | S )*z"Generate a bash completion script.z# bash completion for # Auto-generated by z completions bash r z_completions() {z local cur prev words cwordz. if type _init_completion &>/dev/null; thenz" _init_completion || returnz elsez COMPREPLY=()z' cur="${COMP_WORDS[COMP_CWORD]}"z* prev="${COMP_WORDS[COMP_CWORD-1]}"z" words=("${COMP_WORDS[@]}")z cword=$COMP_CWORDz fiz' # Build the command path from wordsz local cmd_path=""z local iz% for (( i=1; i < cword; i++ )); doz case "${words[i]}" inz -*) continue ;;zB *) cmd_path="${cmd_path:+${cmd_path} }${words[i]}" ;;z esac donez case "$cmd_path" inc & t | | fS Nr. ps r <lambda>z generate_bash.<locals>.<lambda>g Awl r key "")z% COMPREPLY=($(compgen -W "z
" -- "$cur"))z return ;;r "") esac}z
complete -F _z
_completions
)r r r
r keysr1 joinget)
r r r( lines all_pathsr" r0 r completionspattern root_subs
root_flagsroot_completionss
r
generate_bashrQ C s !((H E LL0$00111 LL????@@@ LL LL>%d++>>>??? LL1222 LLABBB LL5666 LL LL'((( LL:;;; LL=>>> LL5666 LL,--- LL LL LL:;;; LL())) LL LL8999 LL0111 LL./// LLL
LL LL LL LL*+++ x}},B,BCCCI . . $//hhte|,, ((4..
,,,,---
NK N N N
,---- !2..I b"%%Jxx J 677 LL LLO0@OOO
LL())) LL LL LL LLL!1$!7!7LLdLLMMM LL 99U r c 2 t | }dt | }g }| d| | d| | d| d | d | | d | d | d | d | d
| d | d | d
| d | d | d | d | d t | d }|D ]}|st || }|| }d | } | d| d |r8d d |D }
| d|
d |r8d d |D } | d| d | |rd nd d | d | d t |d } | d g }
d d! | D }| d" | d| d |
r8d d# |
D } | d| d | d | d | d$ | d% | d | | | d d& | S )'z!Generate a zsh completion script.r z #compdef z# zsh completion for r4 z completions zshr5 z() {z local -a commands flagsz local cmd_pathz# # Build command path from wordsz cmd_path=()z" for word in ${words[2,-1]}; doz% [[ $word == -* ]] && continuez5 [[ $word == "$words[$CURRENT]" ]] && continuez cmd_path+=($word)r6 z case "${cmd_path[*]}" inc & t | | fS r8 r9 r: s r r< z generate_zsh.<locals>.<lambda> r= r r> r@ rA rB c 3 " K | ]
}d | d V dS "Nr .0ss r <genexpr>z generate_zsh.<locals>.<genexpr> s* 8 8aQ 8 8 8 8 8 8r z commands=()c 3 " K | ]
}d | d V dS rU r rX fs r rZ z generate_zsh.<locals>.<genexpr> s* 9 9aQ 9 9 9 9 9 9r z flags=(z; _describe 'command' commands -- flags && returnz compadd -- z
&& returnz ;;r c 3 " K | ]
}d | d V dS rU r rW s r rZ z generate_zsh.<locals>.<genexpr> s* 55aQ555555r rC c 3 " K | ]
}d | d V dS rU r r] s r rZ z generate_zsh.<locals>.<genexpr> s* : :!XXXX : : : : : :r rD rE rF )r r
r r rG r1 rH rI )r r r( func_namerJ rK r" r0 r rM desc_list flag_listrN rO root_descs r generate_zshre s; !((H,$T**,,I E LL#T##$$$ LL///000 LL>>>>??? LL LLI$$$%%% LL./// LL%&&& LL LL6777 LL"### LL5666 LL8999 LLHIII LL,--- LL LL LL/000x}},B,BCCCI ' ' $//((4..
,,,,--- @ 8 84 8 8 888I LL>)>>> ? ? ? = 9 95 9 9 999I LL;y;;; < < <
G I IF388E??FFF
%&&&& !2..I b"%%J55955555I LL LL6)666777 9HH : :z : : :::
79777888 LLNOOO LL!""" LL LL LL LLI LL 99U r c t | }g }| d| | d| d | d t | d D ]}t || }|| }|sdd t |d }|D ]!}| d
| d | d | d
"|D ]{} | d r(| d
| d | d| dd d
?| d r'| d
| d | d| dd d
|g }
|D ]} |
d| d |
}|} | r|dd | z
}|D ]!}| d
| d | d | d
"|D ]{} | d r(| d
| d | d| dd d
?| d r'| d
| d | d| dd d
|| d d | S )z"Generate a fish completion script.z# fish completion for r4 z completions fishr5 c $ t | | fS r8 r9 r: s r r< z generate_fish.<locals>.<lambda> s s1vvqk r r> z not __fish_seen_subcommand_from r@ r z complete -c z -n 'z ' -f -a ''z--z' -l ' N-z' -s 'r+ z __fish_seen_subcommand_from z && z$ && not __fish_seen_subcommand_from rF )r r r rG r1 rH
startswith)
r r r( rJ r" r0 r conditionr flag
seen_partsr;
child_subss
r
generate_fishrp s !((H E LL0$00111 LL????@@@ LL x}},A,ABBB 1 1 $// - ?HH -h ; ;<<? ?
H4HHiHH#HHH
??4(( LLNtNN)NN48NNN __S)) LLNtNN)NN48NNN
J
F
F!!"D"D"DEEEE J//I J
/,,/ /
H4HHiHH#HHH
??4(( LLNtNN)NN48NNN __S)) LLNtNN)NN48NNN
LL 99U r )bashzshfishshellc t | }|-t d| dd t || | S )zfGenerate completion script for the given shell.
Raises ValueError if shell is not supported.
NzUnsupported shell: z. Supported shells: z, )
GENERATORSrI
ValueErrorrH SUPPORTED_SHELLS)r rt r generators r generate_completionsrz sl u%%I
?%
?
?!%+;!<!<
?
?
9VT " ""r )r2 )__doc__r r
typingr r r strr
ArgumentParserr r! r r1 rQ re rp rv r rG rx rz r r r <module>r s $ $ $ $ $ $ $ $ $ $.3 .3 . . . .
# %S/49
$%
x.
49
@ # @
S/ @
sCx $s)+ , @ @ @ @ 5c?DI-. #s(O
#Y 2D@ @ #@ +.@ @ @ @ @ H 2D> > #> +.> > > > > D 2D@ @ #@ +.@ @ @ @ @ H
6*//++,, ## # ## # # # # # # # #r defence360agent/utils/__pycache__/completions.cpython-311.pyc 0000644 0000000 0000000 00000041001 00000000000 021150 0 ustar
r_j' 2 d Z ddlZddlZddlmZmZmZ dedefdZdej deeedf ee f fd Z
dej dee fd
Z dej d eedf d eeedf ee f fd
Z deeedf ee f deedf dee fdZ
ddej dedefdZ ddej dedefdZ ddej dedefdZeeedZ ee Z ddej dededefdZdS )z
Shell auto-completion script generators for the CLI.
Introspects an argparse parser to enumerate all commands, subcommands, and
flags, then emits completion scripts for bash, zsh, and fish.
N)DictListTupleprogreturnc . t j dd| S )zDConvert a prog name to a safe shell identifier (letters, digits, _).z [^a-zA-Z0-9]_)resub)r s V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/completions.py_safe_identifierr
s
6/3 - -- parser.c , i }t | d| |S )z@Walk the parser tree and return {command_path: [flags]} mapping. ) _walk_parser)r results r _collect_commandsr s 02FV$$$ Mr c g }| j D ]W}t |t j r t |t j r8|j D ]}| | Xt | S )z:Extract all optional flags from a parser (excluding help).)_actions
isinstanceargparse _HelpAction_SubParsersActionoption_stringsappendsorted)r flagsactionopts r
_get_flagsr! s E/ fh 2 3 3 fh 8 9 9 ( C LL %==r pathr c t | }|||< | j D ]P}t |t j r4|j D ]\ }}t |||fz | QdS )z>Recursively walk subparsers and collect command paths + flags.N)r! r r r r choicesitemsr )r r" r r r name subparsers r r r ( s
v EF4L/ @ @ fh 8 9 9 @#)>#7#7#9#9
@
@i Yw????@ @r commandsprefixc t }| D ][}t | t | dz k r6|dt | |k r| |d \t | S )z,Get immediate subcommands of a given prefix. N)setlenaddr )r( r) subsr" s r _get_subcommandsr1 7 ss
55D t99F a ' 'D 3v;; ,?6,I,I HHT"X $<<r imunify360-agentc , t | }g }| d| | d| d | d | dt | d | d | d | d | d
| d | d | d
| d | d | d | d | d | d | d | d | d | d | d | d | d | d | d t | d }|D ]}|st || }|| }d ||z }d | } | d | d | d | d! | d" t |d# }
| d#g } d |
| z } | d$ | d | d! | d" | d% | d& | d | d't | d(| | d d) | S )*z"Generate a bash completion script.z# bash completion for # Auto-generated by z completions bash r z_completions() {z local cur prev words cwordz. if type _init_completion &>/dev/null; thenz" _init_completion || returnz elsez COMPREPLY=()z' cur="${COMP_WORDS[COMP_CWORD]}"z* prev="${COMP_WORDS[COMP_CWORD-1]}"z" words=("${COMP_WORDS[@]}")z cword=$COMP_CWORDz fiz' # Build the command path from wordsz local cmd_path=""z local iz% for (( i=1; i < cword; i++ )); doz case "${words[i]}" inz -*) continue ;;zB *) cmd_path="${cmd_path:+${cmd_path} }${words[i]}" ;;z esac donez case "$cmd_path" inc & t | | fS Nr. ps r <lambda>z generate_bash.<locals>.<lambda>g Awl r key "")z% COMPREPLY=($(compgen -W "z
" -- "$cur"))z return ;;r "") esac}z
complete -F _z
_completions
)r r r
r keysr1 joinget)
r r r( lines all_pathsr" r0 r completionspattern root_subs
root_flagsroot_completionss
r
generate_bashrQ C s !((H E LL0$00111 LL????@@@ LL LL>%d++>>>??? LL1222 LLABBB LL5666 LL LL'((( LL:;;; LL=>>> LL5666 LL,--- LL LL LL:;;; LL())) LL LL8999 LL0111 LL./// LLL
LL LL LL LL*+++ x}},B,BCCCI . . $//hhte|,, ((4..
,,,,---
NK N N N
,---- !2..I b"%%Jxx J 677 LL LLO0@OOO
LL())) LL LL LL LLL!1$!7!7LLdLLMMM LL 99U r c 2 t | }dt | }g }| d| | d| | d| d | d | | d | d | d | d | d
| d | d | d
| d | d | d | d | d t | d }|D ]}|st || }|| }d | } | d| d |r8d d |D }
| d|
d |r8d d |D } | d| d | |rd nd d | d | d t |d } | d g }
d d! | D }| d" | d| d |
r8d d# |
D } | d| d | d | d | d$ | d% | d | | | d d& | S )'z!Generate a zsh completion script.r z #compdef z# zsh completion for r4 z completions zshr5 z() {z local -a commands flagsz local cmd_pathz# # Build command path from wordsz cmd_path=()z" for word in ${words[2,-1]}; doz% [[ $word == -* ]] && continuez5 [[ $word == "$words[$CURRENT]" ]] && continuez cmd_path+=($word)r6 z case "${cmd_path[*]}" inc & t | | fS r8 r9 r: s r r< z generate_zsh.<locals>.<lambda> r= r r> r@ rA rB c 3 " K | ]
}d | d V dS "Nr .0ss r <genexpr>z generate_zsh.<locals>.<genexpr> s* 8 8aQ 8 8 8 8 8 8r z commands=()c 3 " K | ]
}d | d V dS rU r rX fs r rZ z generate_zsh.<locals>.<genexpr> s* 9 9aQ 9 9 9 9 9 9r z flags=(z; _describe 'command' commands -- flags && returnz compadd -- z
&& returnz ;;r c 3 " K | ]
}d | d V dS rU r rW s r rZ z generate_zsh.<locals>.<genexpr> s* 55aQ555555r rC c 3 " K | ]
}d | d V dS rU r r] s r rZ z generate_zsh.<locals>.<genexpr> s* : :!XXXX : : : : : :r rD rE rF )r r
r r rG r1 rH rI )r r r( func_namerJ rK r" r0 r rM desc_list flag_listrN rO root_descs r generate_zshre s; !((H,$T**,,I E LL#T##$$$ LL///000 LL>>>>??? LL LLI$$$%%% LL./// LL%&&& LL LL6777 LL"### LL5666 LL8999 LLHIII LL,--- LL LL LL/000x}},B,BCCCI ' ' $//((4..
,,,,--- @ 8 84 8 8 888I LL>)>>> ? ? ? = 9 95 9 9 999I LL;y;;; < < <
G I IF388E??FFF
%&&&& !2..I b"%%J55955555I LL LL6)666777 9HH : :z : : :::
79777888 LLNOOO LL!""" LL LL LL LLI LL 99U r c t | }g }| d| | d| d | d t | d D ]}t || }|| }|sdd t |d }|D ]!}| d
| d | d | d
"|D ]{} | d r(| d
| d | d| dd d
?| d r'| d
| d | d| dd d
|g }
|D ]} |
d| d |
}|} | r|dd | z
}|D ]!}| d
| d | d | d
"|D ]{} | d r(| d
| d | d| dd d
?| d r'| d
| d | d| dd d
|| d d | S )z"Generate a fish completion script.z# fish completion for r4 z completions fishr5 c $ t | | fS r8 r9 r: s r r< z generate_fish.<locals>.<lambda> s s1vvqk r r> z not __fish_seen_subcommand_from r@ r z complete -c z -n 'z ' -f -a ''z--z' -l ' N-z' -s 'r+ z __fish_seen_subcommand_from z && z$ && not __fish_seen_subcommand_from rF )r r r rG r1 rH
startswith)
r r r( rJ r" r0 r conditionr flag
seen_partsr;
child_subss
r
generate_fishrp s !((H E LL0$00111 LL????@@@ LL x}},A,ABBB 1 1 $// - ?HH -h ; ;<<? ?
H4HHiHH#HHH
??4(( LLNtNN)NN48NNN __S)) LLNtNN)NN48NNN
J
F
F!!"D"D"DEEEE J//I J
/,,/ /
H4HHiHH#HHH
??4(( LLNtNN)NN48NNN __S)) LLNtNN)NN48NNN
LL 99U r )bashzshfishshellc t | }|-t d| dd t || | S )zfGenerate completion script for the given shell.
Raises ValueError if shell is not supported.
NzUnsupported shell: z. Supported shells: z, )
GENERATORSrI
ValueErrorrH SUPPORTED_SHELLS)r rt r generators r generate_completionsrz sl u%%I
?%
?
?!%+;!<!<
?
?
9VT " ""r )r2 )__doc__r r
typingr r r strr
ArgumentParserr r! r r1 rQ re rp rv r rG rx rz r r r <module>r s $ $ $ $ $ $ $ $ $ $.3 .3 . . . .
# %S/49
$%
x.
49
@ # @
S/ @
sCx $s)+ , @ @ @ @ 5c?DI-. #s(O
#Y 2D@ @ #@ +.@ @ @ @ @ H 2D> > #> +.> > > > > D 2D@ @ #@ +.@ @ @ @ @ H
6*//++,, ## # ## # # # # # # # #r defence360agent/utils/__pycache__/config.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006152 00000000000 021030 0 ustar
r_j d dl Z d dlZd dlZd dlmZ d dlmZmZ d dlm Z ej
j dz Z ee
ZdZdZd Zd Zd d
ZdS ) N) getLogger)configmessages)checkers
KERNELCAREedfc t | t t v r t d d S d S )NzYConfiguration update with an obsolete kernelcare option 'edf'. This option has no effect.)OBSOLETE_OPTIONgetOBSOLETE_SECTIONdictloggerwarning)datas Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/config.pywarn_obsolete_optionr sM $((#3TVV<<<<
*
=< c | | d }t |t sd S t j t j j k rX| d du rCt j j s4| dd |s | dd d S d S d S d S d S )N WORDPRESS waf_enabledT)
r
isinstancer r caller_typeUserTypeNON_ROOT Wordpress WAF_DEFAULTpop)r wordpresss r enforce_waf_optin_policyr s %%I i & & FO$<<< MM- ( (D 0 0 ,
1
mT*** ( HH[$ ' ' ' ' '
=< 0 0 0 0 ( (r c
K t | t j || t | t j | }| |d t j }| t j |t j |t j | d {V t j | t" d {V d S )NT)without_defaults)conf timestampevent submitted)timeout)r r config_validationr r
ConfigFiledict_to_configasyncioEventprocess_messager ConfigUpdatetimecopydeepcopywait_forwaitCONFIG_UPDATE_TIMEOUT)sinkr userr# updateds r
update_configr8 ' s tT*** T""" T " "Dt444mooG
ikk mD))
7<<>>3H
I
I
IIIIIIIIIIr )N)r+ r0 r/ loggingr defence360agent.contractsr r "defence360agent.feature_managementr SimpleRpcCLIENT_TIMEOUTr4 __name__r r
r r r r8 r r <module>r@ s 6 6 6 6 6 6 6 6 7 7 7 7 7 7 (7!; 8
( ( ( J J J J J Jr defence360agent/utils/__pycache__/config.cpython-311.pyc 0000644 0000000 0000000 00000006152 00000000000 020071 0 ustar
r_j d dl Z d dlZd dlZd dlmZ d dlmZmZ d dlm Z ej
j dz Z ee
ZdZdZd Zd Zd d
ZdS ) N) getLogger)configmessages)checkers
KERNELCAREedfc t | t t v r t d d S d S )NzYConfiguration update with an obsolete kernelcare option 'edf'. This option has no effect.)OBSOLETE_OPTIONgetOBSOLETE_SECTIONdictloggerwarning)datas Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/config.pywarn_obsolete_optionr sM $((#3TVV<<<<
*
=< c | | d }t |t sd S t j t j j k rX| d du rCt j j s4| dd |s | dd d S d S d S d S d S )N WORDPRESS waf_enabledT)
r
isinstancer r caller_typeUserTypeNON_ROOT Wordpress WAF_DEFAULTpop)r wordpresss r enforce_waf_optin_policyr s %%I i & & FO$<<< MM- ( (D 0 0 ,
1
mT*** ( HH[$ ' ' ' ' '
=< 0 0 0 0 ( (r c
K t | t j || t | t j | }| |d t j }| t j |t j |t j | d {V t j | t" d {V d S )NT)without_defaults)conf timestampevent submitted)timeout)r r config_validationr r
ConfigFiledict_to_configasyncioEventprocess_messager ConfigUpdatetimecopydeepcopywait_forwaitCONFIG_UPDATE_TIMEOUT)sinkr userr# updateds r
update_configr8 ' s tT*** T""" T " "Dt444mooG
ikk mD))
7<<>>3H
I
I
IIIIIIIIIIr )N)r+ r0 r/ loggingr defence360agent.contractsr r "defence360agent.feature_managementr SimpleRpcCLIENT_TIMEOUTr4 __name__r r
r r r r8 r r <module>r@ s 6 6 6 6 6 6 6 6 7 7 7 7 7 7 (7!; 8
( ( ( J J J J J Jr defence360agent/utils/__pycache__/cronjob.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004066 00000000000 021221 0 ustar
r_j 2 d dl mZmZ G d de ZdS ) )UnionOptionalc r e Zd ZdZdeeedf deeedf dee fdZd Z e
d Z dS ) CronJobminutehourcmdr Nr r
c 0 || _ || _ || _ d S )Nr )selfr r r
s R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/cronjob.py__init__zCronJob.__init__ s c 8 d| j d| j d| j dS )Nz6# DO NOT EDIT. AUTOMATICALLY GENERATED BY IMUNIFY360.
z * * * root
r )r s r
__str__zCronJob.__str__ sF
C
C
C #y
C
C6:h
C
C
C
r c d x}x}}d | D }|rH|d d }|d }|d }d |dd }t ||| S )Nc * g | ]}|d dk |S )r # ).0xs r
<listcomp>z$CronJob.from_str.<locals>.<listcomp> s! ===q1r r r r )
splitlinessplitjoinr )clsdatar r r
lines line_memberss r
from_strzCronJob.from_str s """==DOO - -=== - 8>>#..L!!_F ?D((<+,,Cf4S9999r ) __name__
__module__ __qualname__ __slots__r intstrr r r classmethodr$ r r r
r r s 'I c3n% CdN#
c]
: : [: : :r r N)typingr r objectr r r r
<module>r. sQ " " " " " " " " : : : : :f : : : : :r defence360agent/utils/__pycache__/cronjob.cpython-311.pyc 0000644 0000000 0000000 00000004066 00000000000 020262 0 ustar
r_j 2 d dl mZmZ G d de ZdS ) )UnionOptionalc r e Zd ZdZdeeedf deeedf dee fdZd Z e
d Z dS ) CronJobminutehourcmdr Nr r
c 0 || _ || _ || _ d S )Nr )selfr r r
s R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/cronjob.py__init__zCronJob.__init__ s c 8 d| j d| j d| j dS )Nz6# DO NOT EDIT. AUTOMATICALLY GENERATED BY IMUNIFY360.
z * * * root
r )r s r
__str__zCronJob.__str__ sF
C
C
C #y
C
C6:h
C
C
C
r c d x}x}}d | D }|rH|d d }|d }|d }d |dd }t ||| S )Nc * g | ]}|d dk |S )r # ).0xs r
<listcomp>z$CronJob.from_str.<locals>.<listcomp> s! ===q1r r r r )
splitlinessplitjoinr )clsdatar r r
lines line_memberss r
from_strzCronJob.from_str s """==DOO - -=== - 8>>#..L!!_F ?D((<+,,Cf4S9999r ) __name__
__module__ __qualname__ __slots__r intstrr r r classmethodr$ r r r
r r s 'I c3n% CdN#
c]
: : [: : :r r N)typingr r objectr r r r
<module>r. sQ " " " " " " " " : : : : :f : : : : :r defence360agent/utils/__pycache__/doctor.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000024243 00000000000 021056 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlm Z d dl
m Z d dl m
Z
d dlmZ d dlmZmZ dZ ej e ZdZd ez Zed
z Z e d Z e d e d
fZde e fdZ de de ddfdZ d Z de ddfdZ de de!ddfdZ"de de ddfdZ#de e fdZ$de fdZ%de fdZ&d Z'dS ) N)Path)Optional) Packaging)
save_state)
CheckRunError check_run zimunify-doctor.shz2https://repo.imunify360.cloudlinux.com/defence360/.sigz/var/imunify360/tmpz//etc/pki/rpm-gpg/RPM-GPG-KEY-CloudLinux-Imunifyz1/etc/apt/trusted.gpg.d/RPM-GPG-KEY-CloudLinux.gpgreturnc t D ]F} | r0t j t | t j r| c S Gd S N)
_PUBKEY_PATHSis_fileosaccessstrR_OKps Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/doctor.py _find_pubkeyr sK
99;; 29SVVRW55 HHH 4 urldstc F t j | }t j |t 5 }| d 5 }t
j || d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S )N)timeoutwb)urllibrequestRequesturlopen
_HTTP_TIMEOUTopenshutil copyfileobj)r r reqrespfps r _blocking_downloadr) & s
.
%
%C ] ; ; %tSXX F F % 4$$$% % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % %s6 B A>2 B>B BB BB Bc ` t } | t j d sdS t ddd t t
j dt t }n9# t $ r,}t dt | Y d}~dS d}~ww xY w | }t j |j s5t j |j r |j t% j k r%t j t | d dS |d
z d nV# t $ rI}t d | t j t | d Y d}~dS d}~ww xY w| |fS )
zLocate the pubkey + gpg binary and create a validated 0700 workdir.
Returns (pubkey_path, workdir_path) on success or None on failure;
any partial state is removed before returning.
Ngpg T)modeparentsexist_okzimunify-doctor.)prefixdirz#cannot prepare workdir under %s: %s
ignore_errorsgnupg)r- zworkdir setup failed: %s)r r$ which_TMPDIRmkdirr tempfilemkdtempr OSErrorloggerinfolstatstatS_ISLNKst_modeS_ISDIRst_uidr geteuidrmtree)pubkeyworkdirexcsts r _blocking_setup_workdirrI . s ^^F
~V\% 0 0~t
5$
>>> $53w<< H H H
97CHHHttttt
]]__ L $ $ <
++ yBJLL(( M#g,,d ; ; ; ;4 7 !!u!---- .444
c'll$7777ttttt 7?s7 AA; ;
B1!B,,B15BE <E
F) >F$$F)r c L t j t | d d S )NTr2 )r$ rD r r s r _blocking_rmtreerK T s#
M#a&&------r r- c 0 | | d S r
)chmod)r r- s r _blocking_chmodrN X s GGDMMMMMr c v K t j }| dt | | d{V dS )zFetch *url* to *dst* without blocking the event loop.
Raises urllib.error.URLError (subclass of OSError) on any HTTP/transport
error, which the caller's `except OSError` already handles.
N)asyncioget_event_looprun_in_executorr) )r r loops r _downloadrT \ sI ! # #D
t%7c
B
BBBBBBBBBBr c
K t j } | dt d{V }|dS |\ }}|t z }|t dz z }|dz }d} t t | d{V t t | d{V t t j
t | }t dddd t | g|
d{V t dddd t | t | g|
d{V | dt |d d{V d
}||s#| dt | d{V S S # t t f$ rL} t" d| Y d} ~ |s$| dt | d{V dS dS d} ~ ww xY w# |s#| dt | d{V w w xY w)a#
Download imunify-doctor.sh + .sig into /var/imunify360/tmp and verify the
detached signature against an ephemeral keyring seeded with the
CloudLinux pubkey. Returns the verified script on success or None on
any failure (so the caller can fall back to the package copy).
Nr
r4 F) GNUPGHOMEr+ z--batchz--quietz--import)envz--verifyr, Tz%signed remote doctor fetch failed: %s)rP rQ rR rI _SCRIPT_NAMErT _SCRIPT_URL_SIG_URLdictr environr r rN rK r r: r; r< )
rS setuprE rF scriptsiggpghomesuccessrW rG s
r _verified_remote_scriptrb f s ! # #D&&t-DEE E E E E E EE }tOFG
|
#F
\F*
+C GGH V,,,,,,,,,#&&&&&&&&&2:W 666
Iy*c&kk B
Iy*c#hhF L
""4 &%HHHHHHHHH
H&&t-=wGG G G G G G G G G H
7 # ;SAAAttt H&&t-=wGG G G G G G G G G G H H H&&t-=wGG G G G G G G G G Hs+ C$E) )G:GG GG 'G0c K t d {V } | t d t j } t t | g d {V }| d t | j d {V n,# | d t | j d {V w xY w|
}|st d |S )Nz)Signed remote doctor script not availablezDoctor key is empty) rb
ValueErrorrP rQ r r rR rK parentdecodestrip)r^ rS outkeys r _repo_get_doctor_keyrj s
*,,
,
,
,
,
,
,F
~DEEE ! # #DJ s6{{m,,,,,,,,""4)96=IIIIIIIIIId""4)96=IIIIIIIIII
**,,
C 0./// Js #B )B0c K t j } t | sd} t t | dt
g d {V }| }|S )Nz%/opt/imunify360/venv/share/imunify360scripts)r DATADIRr is_dirr rX rf rg )dir_rh ri s r _package_get_doctor_keyrp sy D :: 764i >>?@@
@
@
@
@
@
@C
**,,
C Jr c K t d {V } n1# t t t f$ r t d {V } Y nw xY wt dd| i | S )N
doctor_key)rj r rd r: rp r )ri s r get_doctor_keyrs s .(******** :w / . . .+--------.|lC 0111 Js +AA)(rP loggingr r$ r> r8 urllib.requestr pathlibr typingr defence360agent.contracts.configr 'defence360agent.subsys.persistent_stater defence360agent.utilsr r r" getLogger__name__r; rX rY rZ r6 r r r r) rI rK intrN rT rb rj rp rs r r <module>r sV
6 6 6 6 6 6 > > > > > > : : : : : : : :
8 $ $" 8<G
$$
%
%D :;;D <==
htn %C %d %t % % % %# # #L. . . . . .t 3 4 C C4 CD C C C C&Hx~ &H &H &H &HR C s r defence360agent/utils/__pycache__/doctor.cpython-311.pyc 0000644 0000000 0000000 00000024243 00000000000 020117 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlm Z d dl
m Z d dl m
Z
d dlmZ d dlmZmZ dZ ej e ZdZd ez Zed
z Z e d Z e d e d
fZde e fdZ de de ddfdZ d Z de ddfdZ de de!ddfdZ"de de ddfdZ#de e fdZ$de fdZ%de fdZ&d Z'dS ) N)Path)Optional) Packaging)
save_state)
CheckRunError check_run zimunify-doctor.shz2https://repo.imunify360.cloudlinux.com/defence360/.sigz/var/imunify360/tmpz//etc/pki/rpm-gpg/RPM-GPG-KEY-CloudLinux-Imunifyz1/etc/apt/trusted.gpg.d/RPM-GPG-KEY-CloudLinux.gpgreturnc t D ]F} | r0t j t | t j r| c S Gd S N)
_PUBKEY_PATHSis_fileosaccessstrR_OKps Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/doctor.py _find_pubkeyr sK
99;; 29SVVRW55 HHH 4 urldstc F t j | }t j |t 5 }| d 5 }t
j || d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S )N)timeoutwb)urllibrequestRequesturlopen
_HTTP_TIMEOUTopenshutil copyfileobj)r r reqrespfps r _blocking_downloadr) & s
.
%
%C ] ; ; %tSXX F F % 4$$$% % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % %s6 B A>2 B>B BB BB Bc ` t } | t j d sdS t ddd t t
j dt t }n9# t $ r,}t dt | Y d}~dS d}~ww xY w | }t j |j s5t j |j r |j t% j k r%t j t | d dS |d
z d nV# t $ rI}t d | t j t | d Y d}~dS d}~ww xY w| |fS )
zLocate the pubkey + gpg binary and create a validated 0700 workdir.
Returns (pubkey_path, workdir_path) on success or None on failure;
any partial state is removed before returning.
Ngpg T)modeparentsexist_okzimunify-doctor.)prefixdirz#cannot prepare workdir under %s: %s
ignore_errorsgnupg)r- zworkdir setup failed: %s)r r$ which_TMPDIRmkdirr tempfilemkdtempr OSErrorloggerinfolstatstatS_ISLNKst_modeS_ISDIRst_uidr geteuidrmtree)pubkeyworkdirexcsts r _blocking_setup_workdirrI . s ^^F
~V\% 0 0~t
5$
>>> $53w<< H H H
97CHHHttttt
]]__ L $ $ <
++ yBJLL(( M#g,,d ; ; ; ;4 7 !!u!---- .444
c'll$7777ttttt 7?s7 AA; ;
B1!B,,B15BE <E
F) >F$$F)r c L t j t | d d S )NTr2 )r$ rD r r s r _blocking_rmtreerK T s#
M#a&&------r r- c 0 | | d S r
)chmod)r r- s r _blocking_chmodrN X s GGDMMMMMr c v K t j }| dt | | d{V dS )zFetch *url* to *dst* without blocking the event loop.
Raises urllib.error.URLError (subclass of OSError) on any HTTP/transport
error, which the caller's `except OSError` already handles.
N)asyncioget_event_looprun_in_executorr) )r r loops r _downloadrT \ sI ! # #D
t%7c
B
BBBBBBBBBBr c
K t j } | dt d{V }|dS |\ }}|t z }|t dz z }|dz }d} t t | d{V t t | d{V t t j
t | }t dddd t | g|
d{V t dddd t | t | g|
d{V | dt |d d{V d
}||s#| dt | d{V S S # t t f$ rL} t" d| Y d} ~ |s$| dt | d{V dS dS d} ~ ww xY w# |s#| dt | d{V w w xY w)a#
Download imunify-doctor.sh + .sig into /var/imunify360/tmp and verify the
detached signature against an ephemeral keyring seeded with the
CloudLinux pubkey. Returns the verified script on success or None on
any failure (so the caller can fall back to the package copy).
Nr
r4 F) GNUPGHOMEr+ z--batchz--quietz--import)envz--verifyr, Tz%signed remote doctor fetch failed: %s)rP rQ rR rI _SCRIPT_NAMErT _SCRIPT_URL_SIG_URLdictr environr r rN rK r r: r; r< )
rS setuprE rF scriptsiggpghomesuccessrW rG s
r _verified_remote_scriptrb f s ! # #D&&t-DEE E E E E E EE }tOFG
|
#F
\F*
+C GGH V,,,,,,,,,#&&&&&&&&&2:W 666
Iy*c&kk B
Iy*c#hhF L
""4 &%HHHHHHHHH
H&&t-=wGG G G G G G G G G H
7 # ;SAAAttt H&&t-=wGG G G G G G G G G G H H H&&t-=wGG G G G G G G G G Hs+ C$E) )G:GG GG 'G0c K t d {V } | t d t j } t t | g d {V }| d t | j d {V n,# | d t | j d {V w xY w|
}|st d |S )Nz)Signed remote doctor script not availablezDoctor key is empty) rb
ValueErrorrP rQ r r rR rK parentdecodestrip)r^ rS outkeys r _repo_get_doctor_keyrj s
*,,
,
,
,
,
,
,F
~DEEE ! # #DJ s6{{m,,,,,,,,""4)96=IIIIIIIIIId""4)96=IIIIIIIIII
**,,
C 0./// Js #B )B0c K t j } t | sd} t t | dt
g d {V }| }|S )Nz%/opt/imunify360/venv/share/imunify360scripts)r DATADIRr is_dirr rX rf rg )dir_rh ri s r _package_get_doctor_keyrp sy D :: 764i >>?@@
@
@
@
@
@
@C
**,,
C Jr c K t d {V } n1# t t t f$ r t d {V } Y nw xY wt dd| i | S )N
doctor_key)rj r rd r: rp r )ri s r get_doctor_keyrs s .(******** :w / . . .+--------.|lC 0111 Js +AA)(rP loggingr r$ r> r8 urllib.requestr pathlibr typingr defence360agent.contracts.configr 'defence360agent.subsys.persistent_stater defence360agent.utilsr r r" getLogger__name__r; rX rY rZ r6 r r r r) rI rK intrN rT rb rj rp rs r r <module>r sV
6 6 6 6 6 6 > > > > > > : : : : : : : :
8 $ $" 8<G
$$
%
%D :;;D <==
htn %C %d %t % % % %# # #L. . . . . .t 3 4 C C4 CD C C C C&Hx~ &H &H &H &HR C s r defence360agent/utils/__pycache__/fd_ops.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000024306 00000000000 021036 0 ustar
r_j d Z ddlZddlZddlZddlZddlmZmZ ddlm Z ej
e Z ddZ
defdZeej fddd Zed
Zd ed edefd
ZdS )a[ fd-based file operations for symlink-attack mitigation.
All helpers in this module use O_NOFOLLOW and dir_fd-relative syscalls
so that no path-based resolution can be redirected by a concurrent
symlink swap.
This module is intentionally kept separate from utils/__init__.py to
avoid loading these OS-specific helpers into every agent component.
N)contextmanagersuppress)Pathreturnc | dfg} |r$|d \ }}d}t j | 5 }|D ]}| d r`t j |j t j t j z t j z | }| ||j f d} n t j |j | ddd n # 1 swxY w Y |sN|
\ }} | 5t j | |d \ }
}t j | |
|"dS dS # t $ r |D ]\ }} | t j | w xY w)u Remove all contents of a directory using fd-relative operations.
Every entry is opened with ``O_NOFOLLOW`` so symlinks inside the tree
are unlinked rather than followed. The directory referenced by
*dir_fd* itself is **not** removed — the caller should ``os.rmdir()``
the parent entry after this call returns.
Uses an iterative approach with an explicit stack to avoid hitting
Python's recursion limit on adversarial deeply-nested trees.
*dir_fd* must be an open ``O_RDONLY | O_DIRECTORY`` descriptor.
NF)follow_symlinksdir_fdT)osscandiris_diropennameO_RDONLY O_DIRECTORY
O_NOFOLLOWappendunlinkpopclosermdir
BaseException) r stack
current_fd_pushedentriesentrychild_fdfdr parent_fds Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/fd_ops.py rmtree_fdr$ s " d^ E 5 !"IMJFJ''
A7 $ A AE ||E|::
A#%7 !J K". 82= H#-$ $ $
h
%;<<<!% %*Z@@@@@
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
5 99;;D#HRLLL#(9LIqHT)4444/ 5 5 5 5 50 HB
s0 $D0 BC D0 CD0 CAD0 0*Ec t j t j | } t | j }t j |d t j t j z } |dd D ]S}t j |t j t j z t j z | }t j
| |}T|S # t $ r t j
| w xY w)a Open a directory, refusing symlinks at every path component.
Walks the absolute *path* one component at a time, opening each with
``O_NOFOLLOW | O_DIRECTORY`` relative to the parent fd. This guards
against symlink attacks at *any* depth in the hierarchy, not just the
leaf.
Returns an ``O_RDONLY`` file descriptor for the final directory.
The caller is responsible for closing it.
r Nr
) r pathabspathfspathr partsr r r r r r )r' r* r! partnew_fds r# open_dir_no_symlinksr- H s 7??29T?? + +D JJ E q2; 7 8 8B !""I DW bn,r}< F
HRLLLBB
s
9A C C9r
c # K |d|ini }t j t | |t j z fi |} |V t j | dS # t j | w xY w)zOpen a file with O_NOFOLLOW, closing the fd on exit.
Yields the raw file descriptor. Rejects symlinks at the leaf
component (raises ELOOP).
When *dir_fd* is provided, *path* is resolved relative to that
directory descriptor.
Nr )r r strr r )r' flagsr kwr! s r#
open_nofollowr2 e ss & 1(F rB TEBM 1 8 8R 8 8B
s A A)c # K t | } |V t j | dS # t j | w xY w)zOpen a directory with symlink protection, closing the fd on exit.
Walks every path component with O_NOFOLLOW via open_dir_no_symlinks
and yields the resulting fd.
N)r- r r )r' r! s r# safe_dirr4 w sF
d # #B
s - Adatar c t j | \ }} t j |t j t j z | } t j | d 5 }
|
t | dz } ddd n # 1 swxY w Y | |k rdS n9# t $ r Y n-t $ r!} | j t j k rn Y d} ~ nd} ~ ww xY w|s |s t d|| dS | t j ||d }
t j |
j r7t t j t j t j | t j |
j }n># t $ r1 t j d }t j | d | z }Y nw xY wd}d
}t+ d D ]}| d t j d
d} t j |t j t j z t j z t j z d| } n # t6 $ r Y w xY wt7 d t9 | }d}|t | k r3|t j |||d z
}|t | k 3||t j ||| t j || t j | t j! | d
}t j" |||| d}|dk rt j! | |BtG t 5 t j$ || ddd n # 1 swxY w Y nd# |dk rt j! | |CtG t 5 t j$ || ddd w # 1 swxY w Y w w xY wdS )a dir_fd-relative implementation of atomic_rewrite.
The caller opens the directory with O_NOFOLLOW before any file I/O
begins. All file operations use dir_fd so that a concurrent rename
of the directory to a symlink cannot redirect writes to a privileged
path.
r
rbr& NFz empty content: %r for file: %s)r r r i r d r z .i360editi z.Could not create temporary file (100 attempts))
src_dir_fd
dst_dir_fdT)%r r' splitr r r fdopenreadlenFileNotFoundErrorOSErrorerrnoELOOPloggererrorstatS_ISLNKst_modestrerrorS_IMODEumaskrangeurandomhexO_WRONLYO_CREATO_EXCLFileExistsError
memoryviewwritechownchmodfsyncr renamer r )filenamer5 uidgidallow_empty_content permissionsr r basename
content_fdf old_contentexcst
current_umask tmp_basenametmp_fdviewwrittens r# atomic_rewrite_fdri s " '--))KAxW bkBM1&
Yz4
(
( 0A&&TQ //K 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 $ 5
9 # #
DDDD t 5tXFFFu 1&%HHHB|BJ''
O ek2;u{+C+CXNNN ,rz22KK 1 1 1 HQKKM H] # # # =.0KKK 1 L
F
3ZZ
P
P"CCRZ]]%6%6%8%8CCC W bj(294r}D F
E H NOOO7$ D !! rxWXX77 7G D !! ?s HVS# & & &
%%%
,VOOOO Q;; HV #+,,
7
7 ,v6666
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7 Q;; HV #+,,
7
7 ,v6666
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7 $ 4s AB- '&B
B- B B- B ! B- -
C#9 C#C C# B F 8GG A I
I$#I$7C
N 1NNN 1PO4( P4O8 8P;O8 <P)r N)__doc__rB loggingr rF
contextlibr r pathlibr getLogger__name__rD r$ intr- r r2 r4 bytesboolri r# <module>ru s0
/ / / / / / / / 8 $ $0 0 0 0f# : k T "
[
[
[
[ [ [ [ [ [rt defence360agent/utils/__pycache__/fd_ops.cpython-311.pyc 0000644 0000000 0000000 00000024306 00000000000 020077 0 ustar
r_j d Z ddlZddlZddlZddlZddlmZmZ ddlm Z ej
e Z ddZ
defdZeej fddd Zed
Zd ed edefd
ZdS )a[ fd-based file operations for symlink-attack mitigation.
All helpers in this module use O_NOFOLLOW and dir_fd-relative syscalls
so that no path-based resolution can be redirected by a concurrent
symlink swap.
This module is intentionally kept separate from utils/__init__.py to
avoid loading these OS-specific helpers into every agent component.
N)contextmanagersuppress)Pathreturnc | dfg} |r$|d \ }}d}t j | 5 }|D ]}| d r`t j |j t j t j z t j z | }| ||j f d} n t j |j | ddd n # 1 swxY w Y |sN|
\ }} | 5t j | |d \ }
}t j | |
|"dS dS # t $ r |D ]\ }} | t j | w xY w)u Remove all contents of a directory using fd-relative operations.
Every entry is opened with ``O_NOFOLLOW`` so symlinks inside the tree
are unlinked rather than followed. The directory referenced by
*dir_fd* itself is **not** removed — the caller should ``os.rmdir()``
the parent entry after this call returns.
Uses an iterative approach with an explicit stack to avoid hitting
Python's recursion limit on adversarial deeply-nested trees.
*dir_fd* must be an open ``O_RDONLY | O_DIRECTORY`` descriptor.
NF)follow_symlinksdir_fdT)osscandiris_diropennameO_RDONLY O_DIRECTORY
O_NOFOLLOWappendunlinkpopclosermdir
BaseException) r stack
current_fd_pushedentriesentrychild_fdfdr parent_fds Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/fd_ops.py rmtree_fdr$ s " d^ E 5 !"IMJFJ''
A7 $ A AE ||E|::
A#%7 !J K". 82= H#-$ $ $
h
%;<<<!% %*Z@@@@@
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
5 99;;D#HRLLL#(9LIqHT)4444/ 5 5 5 5 50 HB
s0 $D0 BC D0 CD0 CAD0 0*Ec t j t j | } t | j }t j |d t j t j z } |dd D ]S}t j |t j t j z t j z | }t j
| |}T|S # t $ r t j
| w xY w)a Open a directory, refusing symlinks at every path component.
Walks the absolute *path* one component at a time, opening each with
``O_NOFOLLOW | O_DIRECTORY`` relative to the parent fd. This guards
against symlink attacks at *any* depth in the hierarchy, not just the
leaf.
Returns an ``O_RDONLY`` file descriptor for the final directory.
The caller is responsible for closing it.
r Nr
) r pathabspathfspathr partsr r r r r r )r' r* r! partnew_fds r# open_dir_no_symlinksr- H s 7??29T?? + +D JJ E q2; 7 8 8B !""I DW bn,r}< F
HRLLLBB
s
9A C C9r
c # K |d|ini }t j t | |t j z fi |} |V t j | dS # t j | w xY w)zOpen a file with O_NOFOLLOW, closing the fd on exit.
Yields the raw file descriptor. Rejects symlinks at the leaf
component (raises ELOOP).
When *dir_fd* is provided, *path* is resolved relative to that
directory descriptor.
Nr )r r strr r )r' flagsr kwr! s r#
open_nofollowr2 e ss & 1(F rB TEBM 1 8 8R 8 8B
s A A)c # K t | } |V t j | dS # t j | w xY w)zOpen a directory with symlink protection, closing the fd on exit.
Walks every path component with O_NOFOLLOW via open_dir_no_symlinks
and yields the resulting fd.
N)r- r r )r' r! s r# safe_dirr4 w sF
d # #B
s - Adatar c t j | \ }} t j |t j t j z | } t j | d 5 }
|
t | dz } ddd n # 1 swxY w Y | |k rdS n9# t $ r Y n-t $ r!} | j t j k rn Y d} ~ nd} ~ ww xY w|s |s t d|| dS | t j ||d }
t j |
j r7t t j t j t j | t j |
j }n># t $ r1 t j d }t j | d | z }Y nw xY wd}d
}t+ d D ]}| d t j d
d} t j |t j t j z t j z t j z d| } n # t6 $ r Y w xY wt7 d t9 | }d}|t | k r3|t j |||d z
}|t | k 3||t j ||| t j || t j | t j! | d
}t j" |||| d}|dk rt j! | |BtG t 5 t j$ || ddd n # 1 swxY w Y nd# |dk rt j! | |CtG t 5 t j$ || ddd w # 1 swxY w Y w w xY wdS )a dir_fd-relative implementation of atomic_rewrite.
The caller opens the directory with O_NOFOLLOW before any file I/O
begins. All file operations use dir_fd so that a concurrent rename
of the directory to a symlink cannot redirect writes to a privileged
path.
r
rbr& NFz empty content: %r for file: %s)r r r i r d r z .i360editi z.Could not create temporary file (100 attempts))
src_dir_fd
dst_dir_fdT)%r r' splitr r r fdopenreadlenFileNotFoundErrorOSErrorerrnoELOOPloggererrorstatS_ISLNKst_modestrerrorS_IMODEumaskrangeurandomhexO_WRONLYO_CREATO_EXCLFileExistsError
memoryviewwritechownchmodfsyncr renamer r )filenamer5 uidgidallow_empty_content permissionsr r basename
content_fdf old_contentexcst
current_umask tmp_basenametmp_fdviewwrittens r# atomic_rewrite_fdri s " '--))KAxW bkBM1&
Yz4
(
( 0A&&TQ //K 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 $ 5
9 # #
DDDD t 5tXFFFu 1&%HHHB|BJ''
O ek2;u{+C+CXNNN ,rz22KK 1 1 1 HQKKM H] # # # =.0KKK 1 L
F
3ZZ
P
P"CCRZ]]%6%6%8%8CCC W bj(294r}D F
E H NOOO7$ D !! rxWXX77 7G D !! ?s HVS# & & &
%%%
,VOOOO Q;; HV #+,,
7
7 ,v6666
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7 Q;; HV #+,,
7
7 ,v6666
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7 $ 4s AB- '&B
B- B B- B ! B- -
C#9 C#C C# B F 8GG A I
I$#I$7C
N 1NNN 1PO4( P4O8 8P;O8 <P)r N)__doc__rB loggingr rF
contextlibr r pathlibr getLogger__name__rD r$ intr- r r2 r4 bytesboolri r# <module>ru s0
/ / / / / / / / 8 $ $0 0 0 0f# : k T "
[
[
[
[ [ [ [ [ [rt defence360agent/utils/__pycache__/hyperscan.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001347 00000000000 021560 0 ustar
r_j B d dl Z e j d d ZdS ) N )maxsizec t d 5 } d| v cd d d S # 1 swxY w Y d S )Nz
/proc/cpuinfossse3)openread)fs T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/hyperscan.pyis_ssse3_supportedr s
o #!!&&(("# # # # # # # # # # # # # # # # # #s 377) functools lru_cacher r
<module>r sG Q # # # # #r defence360agent/utils/__pycache__/hyperscan.cpython-311.pyc 0000644 0000000 0000000 00000001347 00000000000 020621 0 ustar
r_j B d dl Z e j d d ZdS ) N )maxsizec t d 5 } d| v cd d d S # 1 swxY w Y d S )Nz
/proc/cpuinfossse3)openread)fs T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/hyperscan.pyis_ssse3_supportedr s
o #!!&&(("# # # # # # # # # # # # # # # # # #s 377) functools lru_cacher r
<module>r sG Q # # # # #r defence360agent/utils/__pycache__/importer.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000011650 00000000000 021423 0 ustar
r_j
d Z ddlZddlZddlZddlZddlmZ ddlmZm Z m
Z
ej e Z
dede
eef ddfd Zd
e e
eef ded fd ZddeddfdZddeddfdZd Zd Z G d d ZdS )z>
Provides utilities for dynamically loading packages/modules.
N)Path) GeneratorListUnion module_name file_pathreturnmodulec t j | | }t j | }|j | |S )z4
Execute and return module from *file_path*
) importlibutilspec_from_file_locationmodule_from_specloader exec_module)r r specr
s S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/importer.pyget_module_by_pathr sK > 1 1+y I ID
^
,
,T
2
2FKF### M paths)r
NNc # K t j | D ]D}|j s;t |j j |j dz }t |j | V EdS )z)
Yields all modules from *paths*
z.pyN)pkgutil iter_modulesispkgr
module_finderpathnamer )r r
r s r r r sr &u-- 8 8| 8,122 5H5H5HHD$V[$77 7 7 78 8r Fr c R t j | }n# t $ r |s Y dS w xY wt j | |j |j r<| }t j |j
D ]"}t j | d|j !dS dS )z
Import *name* module, if *name* is a package import all submodules.
If *name* module/package is not found:
- raise ModuleNotFoundError if *missing_ok* is False
- ignore it if *missing_ok* is True
N.) r r
find_specModuleNotFoundError
import_moduler
is_packager r r submodule_search_locations)r
missing_okr packager
s r loadr' ' s ~''--
D!!! { di(( @ *4+JKK @ @F #w$>$>$>$> ? ? ? ?@ @ @ @s "
33packagesc 2 | D ]}t || d S )N)r% )r' )r( r% r& s r
load_packagesr* < s1 - - W,,,,,- -r c t t j | }n# t $ r |cY S w xY wt ||| S )zh
Return object with *name* from specific *module*.
If object was not found return *default*
)r r" ImportErrorgetattr)r
r defaultms r getr0 A sO
#F + + 1dG $ $$s &&c n t j | }n# t $ r Y dS w xY w|d uS )NF)r r
r r! )r r s r existsr2 M sK ~''-- uu t s "
00c 6 e Zd ZdefdZed Zd ZdS )
LazyImportr c " || _ d | _ d S N) _module_name_module)selfr s r __init__zLazyImport.__init__V s ' r c Z | j t j | j | _ | j S r6 )r8 r r" r7 )r9 s r r
zLazyImport.moduleZ s' < $243DEEDL|r c , t | j | S r6 )r- r
)r9 attrs r __getattr__zLazyImport.__getattr__` s t{D)))r N)__name__
__module__ __qualname__strr: propertyr
r> r r r4 r4 U sY C X
* * * * *r r4 )F)__doc__r importlib.utilloggingr pathlibr typingr r r getLoggerr? loggerrB r r r' tupler* r0 r2 r4 rD r r <module>rM s ) ) ) ) ) ) ) ) ) ) 8 $ $
!&sDy!1
8 c4i ! 8#$ 8 8 8 8@ @s @ @ @ @ @*- -E - - - - -
% % % * * * * * * * * * *r defence360agent/utils/__pycache__/importer.cpython-311.pyc 0000644 0000000 0000000 00000011650 00000000000 020464 0 ustar
r_j
d Z ddlZddlZddlZddlZddlmZ ddlmZm Z m
Z
ej e Z
dede
eef ddfd Zd
e e
eef ded fd ZddeddfdZddeddfdZd Zd Z G d d ZdS )z>
Provides utilities for dynamically loading packages/modules.
N)Path) GeneratorListUnion module_name file_pathreturnmodulec t j | | }t j | }|j | |S )z4
Execute and return module from *file_path*
) importlibutilspec_from_file_locationmodule_from_specloader exec_module)r r specr
s S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/importer.pyget_module_by_pathr sK > 1 1+y I ID
^
,
,T
2
2FKF### M paths)r
NNc # K t j | D ]D}|j s;t |j j |j dz }t |j | V EdS )z)
Yields all modules from *paths*
z.pyN)pkgutil iter_modulesispkgr
module_finderpathnamer )r r
r s r r r sr &u-- 8 8| 8,122 5H5H5HHD$V[$77 7 7 78 8r Fr c R t j | }n# t $ r |s Y dS w xY wt j | |j |j r<| }t j |j
D ]"}t j | d|j !dS dS )z
Import *name* module, if *name* is a package import all submodules.
If *name* module/package is not found:
- raise ModuleNotFoundError if *missing_ok* is False
- ignore it if *missing_ok* is True
N.) r r
find_specModuleNotFoundError
import_moduler
is_packager r r submodule_search_locations)r
missing_okr packager
s r loadr' ' s ~''--
D!!! { di(( @ *4+JKK @ @F #w$>$>$>$> ? ? ? ?@ @ @ @s "
33packagesc 2 | D ]}t || d S )N)r% )r' )r( r% r& s r
load_packagesr* < s1 - - W,,,,,- -r c t t j | }n# t $ r |cY S w xY wt ||| S )zh
Return object with *name* from specific *module*.
If object was not found return *default*
)r r" ImportErrorgetattr)r
r defaultms r getr0 A sO
#F + + 1dG $ $$s &&c n t j | }n# t $ r Y dS w xY w|d uS )NF)r r
r r! )r r s r existsr2 M sK ~''-- uu t s "
00c 6 e Zd ZdefdZed Zd ZdS )
LazyImportr c " || _ d | _ d S N) _module_name_module)selfr s r __init__zLazyImport.__init__V s ' r c Z | j t j | j | _ | j S r6 )r8 r r" r7 )r9 s r r
zLazyImport.moduleZ s' < $243DEEDL|r c , t | j | S r6 )r- r
)r9 attrs r __getattr__zLazyImport.__getattr__` s t{D)))r N)__name__
__module__ __qualname__strr: propertyr
r> r r r4 r4 U sY C X
* * * * *r r4 )F)__doc__r importlib.utilloggingr pathlibr typingr r r getLoggerr? loggerrB r r r' tupler* r0 r2 r4 rD r r <module>rM s ) ) ) ) ) ) ) ) ) ) 8 $ $
!&sDy!1
8 c4i ! 8#$ 8 8 8 8@ @s @ @ @ @ @*- -E - - - - -
% % % * * * * * * * * * *r defence360agent/utils/__pycache__/ipecho.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000013125 00000000000 021030 0 ustar
r_j d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z
mZ ddlmZ ddlmZmZ ej e Zd Zd
Z ed d z Z G d
de
ZdS )z<IPEchoAPI - returns real IP address of the host (behind NAT) N)Path)Optional)
alru_cache)APIAPIError)atomic_rewrite)IP IPVersion i0* z/var/imunify360 ipecho_cachec : e Zd ZdZdZe ed ddedee fd Z
e e j d d
Z
e ddedee fd Zedee fd Zed
e ddfd Zed ZdS ) IPEchoAPIz2Make requests to the API for obtain own IP addressz/api/ip )maxsizeN
ip_versionreturnc < K | | d{V S z5Return cached result for resolved IP from echo ip APIN)ip_for_version)clsr s Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/ipecho.pyget_ipzIPEchoAPI.get_ip s.
''
333333333 c ` | S # t $ r
}t |d}~ww xY wr )_get_ip Exceptionr )r es r server_ipzIPEchoAPI.server_ip$ s< ";;== " " " ! "s
-(-c @ K t j } t j | d| j t
d{V }t
j | |k rt d |S # t j t f$ r
}t |d}~ww xY w)z#Return resolved IP from echo ip APIN)timeoutz
Wrong ip type) asyncioget_event_loopwait_forrun_in_executorr TIMEOUT_FOR_IPECHO_REQUESTr type_of
ValueError TimeoutErrorr )r r loopipr s r r zIPEchoAPI.ip_for_version- s %'' " '$$T3;772 B z"~~++ 111I$j1 " " " ! "s A"A: :B BB c t sd S t j }t j |z
}|dk rd S |t
k r-t }|S d S # t $ r&}t
d| Y d }~d S d }~ww xY w)Nr z IPEchoAPI cache read error: %s) CACHE_FILE_PATHexistsstatst_mtimetimeCACHE_TTL_SECONDS read_textstripr loggererror)r mtime cache_ager+ r s r _load_cachezIPEchoAPI._load_cache? s "))++
t#((**3E e+I1}}t,,,$..006688 t LL91 = = =44444 s" B :B 7B
C B>>Cr+ c t t |dd d S # t $ r&}t d| Y d }~d S d }~ww xY w)NFi )backup permissionsz IPEchoAPI cache write error: %s)r r- r r5 r6 )r r+ r s r _save_cachezIPEchoAPI._save_cacheT s| ? !
? ? ? LL:A > > > > > > > > > ?s
A AA c ` | }||S t j | j | j z }| | }| d dk rt d | d }|r| | |S )zIGet IP from file-based cache or send request to API and process response.NstatusokzUnexpected API errorr+ ) r9 urllibrequestRequest _BASE_URLURLgetr r= )r cached_iprB responser+ s r r zIPEchoAPI._get_ip` s OO%% .(( )@AA;;w'' << ! !T ) )122 2
\\$
OOB r )N)__name__
__module__ __qualname____doc__rE classmethodr r
r strr functools lru_cacher r r9 r= r r r r r sR <<
CZ4 4i 48C= 4 4 4 [4
Y###" " $# [" %)" """ # " " " ["" HSM [( ?S ?T ? ? ? [ ? [ r r )rL r" rO loggingr1 rA pathlibr typingr async_lrur defence360agent.api.serverr r defence360agent.utilsr defence360agent.utils.validater r
getLoggerrI r5 r& r2 r- r rQ r r <module>rZ s$ B B
4 4 4 4 4 4 4 4 0 0 0 0 0 0 8 8 8 8 8 8 8 8 8 $ $ $())N:X X X X X X X X X Xr defence360agent/utils/__pycache__/ipecho.cpython-311.pyc 0000644 0000000 0000000 00000013125 00000000000 020071 0 ustar
r_j d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z
mZ ddlmZ ddlmZmZ ej e Zd Zd
Z ed d z Z G d
de
ZdS )z<IPEchoAPI - returns real IP address of the host (behind NAT) N)Path)Optional)
alru_cache)APIAPIError)atomic_rewrite)IP IPVersion i0* z/var/imunify360 ipecho_cachec : e Zd ZdZdZe ed ddedee fd Z
e e j d d
Z
e ddedee fd Zedee fd Zed
e ddfd Zed ZdS ) IPEchoAPIz2Make requests to the API for obtain own IP addressz/api/ip )maxsizeN
ip_versionreturnc < K | | d{V S z5Return cached result for resolved IP from echo ip APIN)ip_for_version)clsr s Q/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/ipecho.pyget_ipzIPEchoAPI.get_ip s.
''
333333333 c ` | S # t $ r
}t |d}~ww xY wr )_get_ip Exceptionr )r es r server_ipzIPEchoAPI.server_ip$ s< ";;== " " " ! "s
-(-c @ K t j } t j | d| j t
d{V }t
j | |k rt d |S # t j t f$ r
}t |d}~ww xY w)z#Return resolved IP from echo ip APIN)timeoutz
Wrong ip type) asyncioget_event_loopwait_forrun_in_executorr TIMEOUT_FOR_IPECHO_REQUESTr type_of
ValueError TimeoutErrorr )r r loopipr s r r zIPEchoAPI.ip_for_version- s %'' " '$$T3;772 B z"~~++ 111I$j1 " " " ! "s A"A: :B BB c t sd S t j }t j |z
}|dk rd S |t
k r-t }|S d S # t $ r&}t
d| Y d }~d S d }~ww xY w)Nr z IPEchoAPI cache read error: %s) CACHE_FILE_PATHexistsstatst_mtimetimeCACHE_TTL_SECONDS read_textstripr loggererror)r mtime cache_ager+ r s r _load_cachezIPEchoAPI._load_cache? s "))++
t#((**3E e+I1}}t,,,$..006688 t LL91 = = =44444 s" B :B 7B
C B>>Cr+ c t t |dd d S # t $ r&}t d| Y d }~d S d }~ww xY w)NFi )backup permissionsz IPEchoAPI cache write error: %s)r r- r r5 r6 )r r+ r s r _save_cachezIPEchoAPI._save_cacheT s| ? !
? ? ? LL:A > > > > > > > > > ?s
A AA c ` | }||S t j | j | j z }| | }| d dk rt d | d }|r| | |S )zIGet IP from file-based cache or send request to API and process response.NstatusokzUnexpected API errorr+ ) r9 urllibrequestRequest _BASE_URLURLgetr r= )r cached_iprB responser+ s r r zIPEchoAPI._get_ip` s OO%% .(( )@AA;;w'' << ! !T ) )122 2
\\$
OOB r )N)__name__
__module__ __qualname____doc__rE classmethodr r
r strr functools lru_cacher r r9 r= r r r r r sR <<
CZ4 4i 48C= 4 4 4 [4
Y###" " $# [" %)" """ # " " " ["" HSM [( ?S ?T ? ? ? [ ? [ r r )rL r" rO loggingr1 rA pathlibr typingr async_lrur defence360agent.api.serverr r defence360agent.utilsr defence360agent.utils.validater r
getLoggerrI r5 r& r2 r- r rQ r r <module>rZ s$ B B
4 4 4 4 4 4 4 4 0 0 0 0 0 0 8 8 8 8 8 8 8 8 8 $ $ $())N:X X X X X X X X X Xr defence360agent/utils/__pycache__/json.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004601 00000000000 020531 0 ustar
r_j d Z ddlZddlmZmZmZmZ ddlmZ ddl m
Z
de fdZ G d d ej
Z G d
d e ZdS ) z6JSON encoders to help with sending messages to server. N) IPv4Address IPv4Network IPv6Address IPv6Network)
model_to_dict)Modelreturnc p t | j st | j S t | S )zn
IPv4Network('192.168.1.1/32') -> '192.168.1.1'
IPv4Network('192.168.1.0/24') -> '192.168.1.0/24'
)inthostmaskstrnetwork_address)nets O/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/json.pyip_net_to_stringr
s2
s| (3&''' s88O c e Zd Zd ZdS ) IPEncoderc t |t t f rt | S t |t t
f rt
| S t j | | S N)
isinstancer r r r r r
json JSONEncoderdefault)selfobjs r r zIPEncoder.default sb cK5 6 6 )#C(( ( cK5 6 6 s88O ''c222r N)__name__
__module__ __qualname__r r r r r s# 3 3 3 3 3r r c e Zd Z fdZ xZS )ServerJSONEncoderc t |t rt | S t | S r )r r r superr )r r __class__s r r zServerJSONEncoder.default s9 c5 ! ! & %% %wws###r )r r r r
__classcell__)r% s @r r" r" s8 $ $ $ $ $ $ $ $ $r r" )__doc__r ipaddressr r r r playhouse.shortcutsr defence360agent.modelr r
r r r r" r r r <module>r+ s < < H H H H H H H H H H H H - - - - - - ' ' ' ' ' 'S 3 3 3 3 3 3 3 3$ $ $ $ $ $ $ $ $ $r defence360agent/utils/__pycache__/json.cpython-311.pyc 0000644 0000000 0000000 00000004601 00000000000 017572 0 ustar
r_j d Z ddlZddlmZmZmZmZ ddlmZ ddl m
Z
de fdZ G d d ej
Z G d
d e ZdS ) z6JSON encoders to help with sending messages to server. N) IPv4Address IPv4Network IPv6Address IPv6Network)
model_to_dict)Modelreturnc p t | j st | j S t | S )zn
IPv4Network('192.168.1.1/32') -> '192.168.1.1'
IPv4Network('192.168.1.0/24') -> '192.168.1.0/24'
)inthostmaskstrnetwork_address)nets O/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/json.pyip_net_to_stringr
s2
s| (3&''' s88O c e Zd Zd ZdS ) IPEncoderc t |t t f rt | S t |t t
f rt
| S t j | | S N)
isinstancer r r r r r
json JSONEncoderdefault)selfobjs r r zIPEncoder.default sb cK5 6 6 )#C(( ( cK5 6 6 s88O ''c222r N)__name__
__module__ __qualname__r r r r r s# 3 3 3 3 3r r c e Zd Z fdZ xZS )ServerJSONEncoderc t |t rt | S t | S r )r r r superr )r r __class__s r r zServerJSONEncoder.default s9 c5 ! ! & %% %wws###r )r r r r
__classcell__)r% s @r r" r" s8 $ $ $ $ $ $ $ $ $r r" )__doc__r ipaddressr r r r playhouse.shortcutsr defence360agent.modelr r
r r r r" r r r <module>r+ s < < H H H H H H H H H H H H - - - - - - ' ' ' ' ' 'S 3 3 3 3 3 3 3 3$ $ $ $ $ $ $ $ $ $r defence360agent/utils/__pycache__/kwconfig.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000006675 00000000000 021404 0 ustar
r_j \ d dl Z d dlmZ d dlmZ G d d Z G d de ZdS ) N)Optional)atomic_rewritec r e Zd ZdZdxZxZZdZd
dZde e
fdZ de e
fdZ de e
fd Z
dS ) KWConfigz
Basic class for working with key-value configuration files
Subclasses must define SEARCH_PATTERN and WRITE_PATTERN
attributes
TNc | j sJ t j | j | t j | _ |p| j | _ || _ d S N) SEARCH_PATTERNrecompileformat MULTILINE_patternDEFAULT_FILENAME _filename_name)selfnamefilenames S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/kwconfig.py__init__zKWConfig.__init__ sX """"
& &t , ,bl
":T%:
returnc | j sJ t | j 5 }| }d d d n # 1 swxY w Y | | }|*|d| j | j | z dz z
}n9| j | j | j | | }t | j || j
|S )N
)allow_empty_content)
WRITE_PATTERNopenr read_parser
r r subr ALLOW_EMPTY_CONFIG)r valuefcontent old_values r setz KWConfig.set s) !!!!
$.
!
! QffhhG KK(( t)00UCCCdJ
GG m''"))$*e<<g G N $ 7
s ?AAc t | j 5 }| }d d d n # 1 swxY w Y | | S r )r r r r )r r$ r% s r getz KWConfig.get2 s
$.
!
! QffhhG {{7###s 6::c d | j | }|o| d S )N )r searchgroup)r r% matchs r r zKWConfig._parse7 s,
$$W--'Q 'r r )__name__
__module__ __qualname____doc__r
r r r" r r strr' r) r r r r r s 9;:N:%
HSM 0$Xc] $ $ $ $
(# ( ( ( ( ( (r r c e Zd ZdZdZdZdS )PureFTPBaseConfigz^\s*?{}\s+(.*?)\s*?$z{} {}z/etc/pure-ftpd.confN)r/ r0 r1 r
r r r4 r r r6 r6 < s ,NM,r r6 )r typingr defence360agent.utilsr r r6 r4 r r <module>r9 s 0 0 0 0 0 02( 2( 2( 2( 2( 2( 2( 2(j- - - - - - - - - -r defence360agent/utils/__pycache__/kwconfig.cpython-311.pyc 0000644 0000000 0000000 00000006675 00000000000 020445 0 ustar
r_j \ d dl Z d dlmZ d dlmZ G d d Z G d de ZdS ) N)Optional)atomic_rewritec r e Zd ZdZdxZxZZdZd
dZde e
fdZ de e
fdZ de e
fd Z
dS ) KWConfigz
Basic class for working with key-value configuration files
Subclasses must define SEARCH_PATTERN and WRITE_PATTERN
attributes
TNc | j sJ t j | j | t j | _ |p| j | _ || _ d S N) SEARCH_PATTERNrecompileformat MULTILINE_patternDEFAULT_FILENAME _filename_name)selfnamefilenames S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/kwconfig.py__init__zKWConfig.__init__ sX """"
& &t , ,bl
":T%:
returnc | j sJ t | j 5 }| }d d d n # 1 swxY w Y | | }|*|d| j | j | z dz z
}n9| j | j | j | | }t | j || j
|S )N
)allow_empty_content)
WRITE_PATTERNopenr read_parser
r r subr ALLOW_EMPTY_CONFIG)r valuefcontent old_values r setz KWConfig.set s) !!!!
$.
!
! QffhhG KK(( t)00UCCCdJ
GG m''"))$*e<<g G N $ 7
s ?AAc t | j 5 }| }d d d n # 1 swxY w Y | | S r )r r r r )r r$ r% s r getz KWConfig.get2 s
$.
!
! QffhhG {{7###s 6::c d | j | }|o| d S )N )r searchgroup)r r% matchs r r zKWConfig._parse7 s,
$$W--'Q 'r r )__name__
__module__ __qualname____doc__r
r r r" r r strr' r) r r r r r s 9;:N:%
HSM 0$Xc] $ $ $ $
(# ( ( ( ( ( (r r c e Zd ZdZdZdZdS )PureFTPBaseConfigz^\s*?{}\s+(.*?)\s*?$z{} {}z/etc/pure-ftpd.confN)r/ r0 r1 r
r r r4 r r r6 r6 < s ,NM,r r6 )r typingr defence360agent.utilsr r r6 r4 r r <module>r9 s 0 0 0 0 0 02( 2( 2( 2( 2( 2( 2( 2(j- - - - - - - - - -r defence360agent/utils/__pycache__/net.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002450 00000000000 020346 0 ustar
r_jS d dl mZmZmZmZ d dlmZmZ dZd\ Z Z
deeef fdZ deeef dee e e f fd Z
d
S ) ) IPv4Address IPv4Network IPv6Address IPv6Network)TupleUniontcp)inout
ip_addressc | j dk r*t | j d d dd S t | S )N bigT)signed)versionint
from_bytespacked)r s N/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/net.pypack_ip_addressr s@ Q ~~j / 3U4~HHH:
ip_networkreturnc f t | j }t | j }||| j fS )N)r network_addressnetmaskr )r netmasks r pack_ip_networkr s4 *4
5
5C :- . .D j( ((r N) ipaddressr r r r typingr r TCPINOUTr r r r r <module>r' s H H H H H H H H H H H H
C k;&> ? )k;./)
3S=) ) ) ) ) )r defence360agent/utils/__pycache__/net.cpython-311.pyc 0000644 0000000 0000000 00000002450 00000000000 017407 0 ustar
r_jS d dl mZmZmZmZ d dlmZmZ dZd\ Z Z
deeef fdZ deeef dee e e f fd Z
d
S ) ) IPv4Address IPv4Network IPv6Address IPv6Network)TupleUniontcp)inout
ip_addressc | j dk r*t | j d d dd S t | S )N bigT)signed)versionint
from_bytespacked)r s N/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/net.pypack_ip_addressr s@ Q ~~j / 3U4~HHH:
ip_networkreturnc f t | j }t | j }||| j fS )N)r network_addressnetmaskr )r netmasks r pack_ip_networkr s4 *4
5
5C :- . .D j( ((r N) ipaddressr r r r typingr r TCPINOUTr r r r r <module>r' s H H H H H H H H H H H H
C k;&> ? )k;./)
3S=) ) ) ) ) )r defence360agent/utils/__pycache__/net_transport.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000047000 00000000000 022462 0 ustar
r_jp0 d Z ddlZddlZddlZddlZddlZddlZddlZ ddl
m Z m Z ddl
mZ ddlmZmZmZmZ erddlZ ee ZdZdedefd Z G d
d e Z G d d
Z G d de Z G d de Z G d dej j Z! G d dej j" Z# G d de j$ j% Z& G d de j$ j' Z( G d d Z)dS ) av Networking transport helpers for urllib.
This module provides a small abstraction on top of urllib.request so that
callers can keep using urllib.request.Request, but routing of connections
can be customized:
- hostname resolution is handled in user code;
- selected IP may be randomized or chosen using any complex logic;
- for HTTPS: connects to a chosen IP but keeps correct SNI and certificate
hostname validation for the original hostname (NOT the IP).
Examples:
Default behavior (plain urllib):
from defence360agent.utils.net_transport import UrlTransport
transport = UrlTransport()
req = urllib.request.Request(
"https://files.imunify360.com/static/sigs/v1/description.json"
)
with transport.open(req, timeout=10) as resp:
body = resp.read()
Randomize target IP on each connection (A/AAAA -> random choice):
from defence360agent.utils.net_transport import UrlTransport, RandomIpChooser
chooser = RandomIpChooser()
transport = UrlTransport(ip_chooser=chooser)
req = urllib.request.Request(
"https://files.imunify360.com/static/sigs/v1/description.json"
)
with transport.open(req, timeout=10) as resp:
body = resp.read()
Notes:
- HTTPS: connects to the chosen IP but keeps SNI/cert checks against original
hostname.
- HTTP: Host header stays original hostname because urllib builds it from the
URL.
N)ABCabstractmethod) getLogger)DictOptionalTuple
TYPE_CHECKINGg r@ipreturnc ~ t t j | t j S # t $ r Y dS w xY w)z~Return True if *ip* is an IPv4 address string.
Implementation relies solely on ipaddress.ip_address for correctness.
F)
isinstance ipaddress
ip_address IPv4Address
ValueError)r
s X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/net_transport.py_is_ipv4r C sG
).r22I4IJJJ uus +.
<<c J e Zd ZdZedededefd ZdededefdZdS ) IpChooserzSelect an IP address to connect to for a given hostname and port.
Implementations may be stateful and can keep caches/metrics inside.
hostnameportr c t )z6Return an IP address (v4 or v6) for *hostname*:*port*.)NotImplementedErrorselfr r s r choosezIpChooser.chooseT s
"! c . | || S N)r r s r __call__zIpChooser.__call__Y s {{8T***r N) __name__
__module__ __qualname____doc__r strintr r r r r r N s|
"s "# "# " " " ^"+ +C +C + + + + + +r r c X e Zd ZdZej eddedefdZ de
dede e
d f fd
Z d S ) DnsCacheResolverzDNS cache for socket.getaddrinfo() results.
It caches per (hostname, port, family). This is intentionally small and
local: it is meant only to avoid excessive getaddrinfo() calls.
)family ttl_secondsr* r+ c ` || _ || _ i | _ t j | _ d S r )_family _ttl_seconds_cache threadingLock_lock)r r* r+ s r __init__zDnsCacheResolver.__init__d s4 '
^%%
r r r r .c , ||| j f}t j }| j 5 | j | }|;|\ }}||k r0t
d||| j |cd d d S d d d n # 1 swxY w Y t
d||| j t j ||| j t j }g }|D ])\ } } } } }
|
d } | |vr|
| *|s#t d || t | } | j 5 || j z | f| j |< d d d n # 1 swxY w Y t
d||| j | | S )Nz0DnsCacheResolver cache hit for %s:%s (family=%s)z9DnsCacheResolver cache miss/expired for %s:%s (family=%s)r zNo IPs resolved for {}:{}z1DnsCacheResolver resolved %s:%s (family=%s) to %s)r- timer2 r/ getloggerdebugsocket getaddrinfo SOCK_STREAMappendOSErrorformattupler. )
r r r keynowcached
expires_atipsinfos_sockaddrr
ips_ts
r get_ipszDnsCacheResolver.get_ipsq sn t|,ikk
Z [__S))F!"(
C##LLJ G L
" L
$) Aq!Q!B}}
2 N5<<XtLLMM Mc
Z @ @ #d&7 7 ?DK @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ ? L
s$ A B B
B
E&&E*-E*N)
r! r" r# r$ r9 AF_UNSPEC_DNS_DEFAULT_TTL_SECONDSr& floatr3 r% r rI r' r r r) r) ] s & 5 & & & & & & & &3 33 35c? 3 3 3 3 3 3r r) c e Zd ZdZdddddee deej defdZ dd
Z
dd Z d efd Z d ee
fd
Zd efdZde
ded e
fdZdS ) RandomIpChooserWithIPv6TogglezResolve hostname and select a random IP.
IPv6 selection can be enabled/disabled at runtime:
- when IPv6 is enabled: choose from IPv4 + IPv6 candidates
- when IPv6 is disabled: choose from IPv4-only candidates
NT)resolverrng ipv6_enabledrO rP rQ c |p
t | _ |pt j | _ || _ d | _ d S r )r) _resolverrandomRandom_rng
_ipv6_enabled_last_ip)r rO rP rQ s r r3 z&RandomIpChooserWithIPv6Toggle.__init__ s< "7%5%7%7*6=?? )'+
r r c d| _ d S )NTrW r s r enable_ipv6z)RandomIpChooserWithIPv6Toggle.enable_ipv6 s !r c d| _ d S )NFrZ r[ s r disable_ipv6z*RandomIpChooserWithIPv6Toggle.disable_ipv6 s "r c | j S r rZ r[ s r is_ipv6_enabledz-RandomIpChooserWithIPv6Toggle.is_ipv6_enabled s !!r c | j S r )rX r[ s r last_ipz%RandomIpChooserWithIPv6Toggle.last_ip s
} r c < t | j od| j v S )N:)boolrX r[ s r last_ip_was_ipv6z.RandomIpChooserWithIPv6Toggle.last_ip_was_ipv6 s DM""=t}(<=r r r c | j || }| j r@| j | }|| _ t d||| |S t d |D }|s#t d
|| | j | }|| _ t d||| |S )NzERandomIpChooserWithIPv6Toggle selected IP %s for %s:%s (IPv6 enabled)c 3 8 K | ]}t | |V d S r )r ).0r
s r <genexpr>z7RandomIpChooserWithIPv6Toggle.choose.<locals>.<genexpr> s- ::Xb\\:::::::r z No IPv4 IPs resolved for {}:{}zKRandomIpChooserWithIPv6Toggle selected IPv4 IP %s for %s:%s (IPv6 disabled)) rS rI rW rV choicerX r7 r8 r? r= r> )r r r rD chosenipv4_ipss r r z$RandomIpChooserWithIPv6Toggle.choose s n$$Xt44
Y%%c**F "DM LL!
M::c::::: 077$GG
!!(++
r r N)r! r" r# r$ r r) rT rU re r3 r\ r^ r` r% rb rf r& r r' r r rN rN s 04'+ !
,
,
, +,
, fm
$
,
,
,
,
," " " "# # # #" " " " " # >$ > > > > s # # r rN c ` e Zd ZdZddddee deej fdZde de
d e fd
Z dS ) RandomIpChooserzAResolve hostname and select a random IP from resolved candidates.N)rO rP rO rP c d |p
t | _ |pt j | _ d S r )r) rS rT rU rV )r rO rP s r r3 zRandomIpChooser.__init__ s- "7%5%7%7*6=?? r r r r c | j || }| j | }t d||| |S )Nz(RandomIpChooser selected IP %s for %s:%s)rS rI rV rk r7 r8 )r r r rD rl s r r zRandomIpChooser.choose sW n$$Xt44!!#&& 6
r ) r! r" r# r$ r r) rT rU r3 r% r& r r' r r rp rp s KK
04'+ + + + +,+ fm
$ + + + + s # # r rp c Z e Zd ZdZ d
ej dddedee de f fdZ
d d Z xZ S ) ForcedIPHTTPConnectionzHTTPConnection that connects to a chosen IP.
Important: urllib builds the request URL with the original hostname,
therefore the Host header stays correct.
Ntimeoutsource_addressr r
ip_chooserc ` t |||| || _ d S )N)r rv rw superr3 _ip_chooser)r r r rx rv rw __class__s r r3 z ForcedIPHTTPConnection.__init__ sB )
&r r c | j pd}| j | j | }t d||| j t
j ||f| j | j | _
d S )NP z:ForcedIPHTTPConnection connecting to %s:%s for hostname %s) r r| r hostr7 r8 r9 create_connectionrv rw sock)r r r
s r connectz ForcedIPHTTPConnection.connect sw yB
$
$TY
5
5 H I
,
J L
r r rn
r! r" r# r$ r9 _GLOBAL_DEFAULT_TIMEOUTr% r r& r r3 r
__classcell__r} s @r rt rt s #& .& & && sm&
& & & & & &"
r rt c
^ e Zd ZdZ d ej dddedee de ddf fd Z
d
d Z xZ S )ForcedIPHTTPSConnectionzHTTPSConnection that connects to a chosen IP.
TLS details:
- Uses original hostname for SNI (server_hostname in wrap_socket)
- Certificate hostname validation is performed for the original hostname
Nru r r rx contextssl.SSLContextc b t ||||| || _ d S )N)r r rv rw rz )r r r rx r rv rw r} s r r3 z ForcedIPHTTPSConnection.__init__3 sE )
&r r c ~ | j pd}| j | j | }t d||| j t
j ||f| j | j }| j
r"|| _ | | j }| j
|| j | _ d S )Ni z;ForcedIPHTTPSConnection connecting to %s:%s for hostname %s)server_hostname)r r| r r r7 r8 r9 r rv rw _tunnel_hostr _tunnel_context wrap_socket)r r r
raw_socks r r z ForcedIPHTTPSConnection.connectF s y C
$
$TY
5
5 I I
+
J L
! DI LLNNNyHM-- I .
r r rn r r s @r r r + s #& .& & && sm&
& "
& & & & & &&
r r c H e Zd ZdZdef fd Zdej j fdZ xZ
S )ForcedIPHTTPHandlerz3urllib handler that creates ForcedIPHTTPConnection.rx c V t || _ d S r rz )r rx r} s r r3 z ForcedIPHTTPHandler.__init__d s'
%r r c : fd} || S )Nc X t | j | d S )Nrv )rx rv )rt r| r6 r kwargsr s r factoryz.ForcedIPHTTPHandler.http_open.<locals>.factoryi s2 ) +
9--
r do_openr reqr s ` r http_openz ForcedIPHTTPHandler.http_openh s2 ||GS)))r ) r! r" r# r$ r r3 httpclient HTTPResponser r r s @r r r a sj ==&i & & & & & &* 8 * * * * * * * *r r c L e Zd ZdZdeddf fd Zdej j fdZ xZ
S )ForcedIPHTTPSHandlerz4urllib handler that creates ForcedIPHTTPSConnection.rx r r c h t | || _ || _ d S )N)r )r{ r3 r| r )r rx r r} s r r3 z ForcedIPHTTPSHandler.__init__v s1
)))%
r r c : fd} || S )Nc d t | j j | d S )Nrv )rx r rv )r r| r r6 r s r r z0ForcedIPHTTPSHandler.https_open.<locals>.factory| s7 * +
9--
r r r s ` r
https_openz ForcedIPHTTPSHandler.https_open{ s2 ||GS)))r ) r! r" r# r$ r r3 r r r r r r s @r r r s sr >> i :J
*!9 * * * * * * * *r r c e Zd ZdZdddddee ded defd Zdd
d ej j
d ee d
e j
j fdZdS ) UrlTransporta Single entrypoint for opening urllib requests.
If *ip_chooser* is provided, the transport will connect to the selected IP
address, while keeping correct Host/SNI/cert validation for the original
hostname. If *ip_chooser* is not provided, it behaves like plain urllib.
NT)rx ssl_context use_proxiesrx r r r c 6 dd l }|p| | _ g }|s2| t j i |)|t | t || j gz
}t j j | | _
d S )Nr )rx )rx r ) sslcreate_default_context _ssl_contextr< urllibrequest ProxyHandlerr r build_opener_opener)r rx r r _sslhandlerss r r3 zUrlTransport.__init__ s ' H4+F+F+H+H = OOFN 7 7 ; ; < < < ! #z:::$ ) -
H ~2H= r rv r rv r c r || j | S | j || S )Nr )r open)r r rv s r r zUrlTransport.open s: ?<$$S)) )| g 666r )r! r" r# r$ r r re r3 r r RequestrL r r r r r' r r r r s +/26 > > > Y'> ./ >
> > > >: $( 7 7 7
^
#7 % 7
! 7 7 7 7 7 7r r )*r$ http.clientr r rT r9 r0 r5 urllib.requestr abcr r loggingr typingr r r r r r! r7 rK r% re r r r) rN rp r HTTPConnectionrt HTTPSConnectionr r HTTPHandlerr HTTPSHandlerr r r' r r <module>r s , ,\
# # # # # # # # 7 7 7 7 7 7 7 7 7 7 7 7 JJJ 8 ! + + + + + + + + G G G G G G G GT@ @ @ @ @I @ @ @F i 0&
&
&
&
&
T[ 7 &
&
&
R3
3
3
3
3
dk 9 3
3
3
l* * * * *&.4 * * *$* * * * *6>6 * * *()7 )7 )7 )7 )7 )7 )7 )7 )7 )7r defence360agent/utils/__pycache__/net_transport.cpython-311.pyc 0000644 0000000 0000000 00000047000 00000000000 021523 0 ustar
r_jp0 d Z ddlZddlZddlZddlZddlZddlZddlZ ddl
m Z m Z ddl
mZ ddlmZmZmZmZ erddlZ ee ZdZdedefd Z G d
d e Z G d d
Z G d de Z G d de Z G d dej j Z! G d dej j" Z# G d de j$ j% Z& G d de j$ j' Z( G d d Z)dS ) av Networking transport helpers for urllib.
This module provides a small abstraction on top of urllib.request so that
callers can keep using urllib.request.Request, but routing of connections
can be customized:
- hostname resolution is handled in user code;
- selected IP may be randomized or chosen using any complex logic;
- for HTTPS: connects to a chosen IP but keeps correct SNI and certificate
hostname validation for the original hostname (NOT the IP).
Examples:
Default behavior (plain urllib):
from defence360agent.utils.net_transport import UrlTransport
transport = UrlTransport()
req = urllib.request.Request(
"https://files.imunify360.com/static/sigs/v1/description.json"
)
with transport.open(req, timeout=10) as resp:
body = resp.read()
Randomize target IP on each connection (A/AAAA -> random choice):
from defence360agent.utils.net_transport import UrlTransport, RandomIpChooser
chooser = RandomIpChooser()
transport = UrlTransport(ip_chooser=chooser)
req = urllib.request.Request(
"https://files.imunify360.com/static/sigs/v1/description.json"
)
with transport.open(req, timeout=10) as resp:
body = resp.read()
Notes:
- HTTPS: connects to the chosen IP but keeps SNI/cert checks against original
hostname.
- HTTP: Host header stays original hostname because urllib builds it from the
URL.
N)ABCabstractmethod) getLogger)DictOptionalTuple
TYPE_CHECKINGg r@ipreturnc ~ t t j | t j S # t $ r Y dS w xY w)z~Return True if *ip* is an IPv4 address string.
Implementation relies solely on ipaddress.ip_address for correctness.
F)
isinstance ipaddress
ip_address IPv4Address
ValueError)r
s X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/net_transport.py_is_ipv4r C sG
).r22I4IJJJ uus +.
<<c J e Zd ZdZedededefd ZdededefdZdS ) IpChooserzSelect an IP address to connect to for a given hostname and port.
Implementations may be stateful and can keep caches/metrics inside.
hostnameportr c t )z6Return an IP address (v4 or v6) for *hostname*:*port*.)NotImplementedErrorselfr r s r choosezIpChooser.chooseT s
"! c . | || S N)r r s r __call__zIpChooser.__call__Y s {{8T***r N) __name__
__module__ __qualname____doc__r strintr r r r r r N s|
"s "# "# " " " ^"+ +C +C + + + + + +r r c X e Zd ZdZej eddedefdZ de
dede e
d f fd
Z d S ) DnsCacheResolverzDNS cache for socket.getaddrinfo() results.
It caches per (hostname, port, family). This is intentionally small and
local: it is meant only to avoid excessive getaddrinfo() calls.
)family ttl_secondsr* r+ c ` || _ || _ i | _ t j | _ d S r )_family _ttl_seconds_cache threadingLock_lock)r r* r+ s r __init__zDnsCacheResolver.__init__d s4 '
^%%
r r r r .c , ||| j f}t j }| j 5 | j | }|;|\ }}||k r0t
d||| j |cd d d S d d d n # 1 swxY w Y t
d||| j t j ||| j t j }g }|D ])\ } } } } }
|
d } | |vr|
| *|s#t d || t | } | j 5 || j z | f| j |< d d d n # 1 swxY w Y t
d||| j | | S )Nz0DnsCacheResolver cache hit for %s:%s (family=%s)z9DnsCacheResolver cache miss/expired for %s:%s (family=%s)r zNo IPs resolved for {}:{}z1DnsCacheResolver resolved %s:%s (family=%s) to %s)r- timer2 r/ getloggerdebugsocket getaddrinfo SOCK_STREAMappendOSErrorformattupler. )
r r r keynowcached
expires_atipsinfos_sockaddrr
ips_ts
r get_ipszDnsCacheResolver.get_ipsq sn t|,ikk
Z [__S))F!"(
C##LLJ G L
" L
$) Aq!Q!B}}
2 N5<<XtLLMM Mc
Z @ @ #d&7 7 ?DK @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ ? L
s$ A B B
B
E&&E*-E*N)
r! r" r# r$ r9 AF_UNSPEC_DNS_DEFAULT_TTL_SECONDSr& floatr3 r% r rI r' r r r) r) ] s & 5 & & & & & & & &3 33 35c? 3 3 3 3 3 3r r) c e Zd ZdZdddddee deej defdZ dd
Z
dd Z d efd Z d ee
fd
Zd efdZde
ded e
fdZdS ) RandomIpChooserWithIPv6TogglezResolve hostname and select a random IP.
IPv6 selection can be enabled/disabled at runtime:
- when IPv6 is enabled: choose from IPv4 + IPv6 candidates
- when IPv6 is disabled: choose from IPv4-only candidates
NT)resolverrng ipv6_enabledrO rP rQ c |p
t | _ |pt j | _ || _ d | _ d S r )r) _resolverrandomRandom_rng
_ipv6_enabled_last_ip)r rO rP rQ s r r3 z&RandomIpChooserWithIPv6Toggle.__init__ s< "7%5%7%7*6=?? )'+
r r c d| _ d S )NTrW r s r enable_ipv6z)RandomIpChooserWithIPv6Toggle.enable_ipv6 s !r c d| _ d S )NFrZ r[ s r disable_ipv6z*RandomIpChooserWithIPv6Toggle.disable_ipv6 s "r c | j S r rZ r[ s r is_ipv6_enabledz-RandomIpChooserWithIPv6Toggle.is_ipv6_enabled s !!r c | j S r )rX r[ s r last_ipz%RandomIpChooserWithIPv6Toggle.last_ip s
} r c < t | j od| j v S )N:)boolrX r[ s r last_ip_was_ipv6z.RandomIpChooserWithIPv6Toggle.last_ip_was_ipv6 s DM""=t}(<=r r r c | j || }| j r@| j | }|| _ t d||| |S t d |D }|s#t d
|| | j | }|| _ t d||| |S )NzERandomIpChooserWithIPv6Toggle selected IP %s for %s:%s (IPv6 enabled)c 3 8 K | ]}t | |V d S r )r ).0r
s r <genexpr>z7RandomIpChooserWithIPv6Toggle.choose.<locals>.<genexpr> s- ::Xb\\:::::::r z No IPv4 IPs resolved for {}:{}zKRandomIpChooserWithIPv6Toggle selected IPv4 IP %s for %s:%s (IPv6 disabled)) rS rI rW rV choicerX r7 r8 r? r= r> )r r r rD chosenipv4_ipss r r z$RandomIpChooserWithIPv6Toggle.choose s n$$Xt44
Y%%c**F "DM LL!
M::c::::: 077$GG
!!(++
r r N)r! r" r# r$ r r) rT rU re r3 r\ r^ r` r% rb rf r& r r' r r rN rN s 04'+ !
,
,
, +,
, fm
$
,
,
,
,
," " " "# # # #" " " " " # >$ > > > > s # # r rN c ` e Zd ZdZddddee deej fdZde de
d e fd
Z dS ) RandomIpChooserzAResolve hostname and select a random IP from resolved candidates.N)rO rP rO rP c d |p
t | _ |pt j | _ d S r )r) rS rT rU rV )r rO rP s r r3 zRandomIpChooser.__init__ s- "7%5%7%7*6=?? r r r r c | j || }| j | }t d||| |S )Nz(RandomIpChooser selected IP %s for %s:%s)rS rI rV rk r7 r8 )r r r rD rl s r r zRandomIpChooser.choose sW n$$Xt44!!#&& 6
r ) r! r" r# r$ r r) rT rU r3 r% r& r r' r r rp rp s KK
04'+ + + + +,+ fm
$ + + + + s # # r rp c Z e Zd ZdZ d
ej dddedee de f fdZ
d d Z xZ S ) ForcedIPHTTPConnectionzHTTPConnection that connects to a chosen IP.
Important: urllib builds the request URL with the original hostname,
therefore the Host header stays correct.
Ntimeoutsource_addressr r
ip_chooserc ` t |||| || _ d S )N)r rv rw superr3 _ip_chooser)r r r rx rv rw __class__s r r3 z ForcedIPHTTPConnection.__init__ sB )
&r r c | j pd}| j | j | }t d||| j t
j ||f| j | j | _
d S )NP z:ForcedIPHTTPConnection connecting to %s:%s for hostname %s) r r| r hostr7 r8 r9 create_connectionrv rw sock)r r r
s r connectz ForcedIPHTTPConnection.connect sw yB
$
$TY
5
5 H I
,
J L
r r rn
r! r" r# r$ r9 _GLOBAL_DEFAULT_TIMEOUTr% r r& r r3 r
__classcell__r} s @r rt rt s #& .& & && sm&
& & & & & &"
r rt c
^ e Zd ZdZ d ej dddedee de ddf fd Z
d
d Z xZ S )ForcedIPHTTPSConnectionzHTTPSConnection that connects to a chosen IP.
TLS details:
- Uses original hostname for SNI (server_hostname in wrap_socket)
- Certificate hostname validation is performed for the original hostname
Nru r r rx contextssl.SSLContextc b t ||||| || _ d S )N)r r rv rw rz )r r r rx r rv rw r} s r r3 z ForcedIPHTTPSConnection.__init__3 sE )
&r r c ~ | j pd}| j | j | }t d||| j t
j ||f| j | j }| j
r"|| _ | | j }| j
|| j | _ d S )Ni z;ForcedIPHTTPSConnection connecting to %s:%s for hostname %s)server_hostname)r r| r r r7 r8 r9 r rv rw _tunnel_hostr _tunnel_context wrap_socket)r r r
raw_socks r r z ForcedIPHTTPSConnection.connectF s y C
$
$TY
5
5 I I
+
J L
! DI LLNNNyHM-- I .
r r rn r r s @r r r + s #& .& & && sm&
& "
& & & & & &&
r r c H e Zd ZdZdef fd Zdej j fdZ xZ
S )ForcedIPHTTPHandlerz3urllib handler that creates ForcedIPHTTPConnection.rx c V t || _ d S r rz )r rx r} s r r3 z ForcedIPHTTPHandler.__init__d s'
%r r c : fd} || S )Nc X t | j | d S )Nrv )rx rv )rt r| r6 r kwargsr s r factoryz.ForcedIPHTTPHandler.http_open.<locals>.factoryi s2 ) +
9--
r do_openr reqr s ` r http_openz ForcedIPHTTPHandler.http_openh s2 ||GS)))r ) r! r" r# r$ r r3 httpclient HTTPResponser r r s @r r r a sj ==&i & & & & & &* 8 * * * * * * * *r r c L e Zd ZdZdeddf fd Zdej j fdZ xZ
S )ForcedIPHTTPSHandlerz4urllib handler that creates ForcedIPHTTPSConnection.rx r r c h t | || _ || _ d S )N)r )r{ r3 r| r )r rx r r} s r r3 z ForcedIPHTTPSHandler.__init__v s1
)))%
r r c : fd} || S )Nc d t | j j | d S )Nrv )rx r rv )r r| r r6 r s r r z0ForcedIPHTTPSHandler.https_open.<locals>.factory| s7 * +
9--
r r r s ` r
https_openz ForcedIPHTTPSHandler.https_open{ s2 ||GS)))r ) r! r" r# r$ r r3 r r r r r r s @r r r s sr >> i :J
*!9 * * * * * * * *r r c e Zd ZdZdddddee ded defd Zdd
d ej j
d ee d
e j
j fdZdS ) UrlTransporta Single entrypoint for opening urllib requests.
If *ip_chooser* is provided, the transport will connect to the selected IP
address, while keeping correct Host/SNI/cert validation for the original
hostname. If *ip_chooser* is not provided, it behaves like plain urllib.
NT)rx ssl_context use_proxiesrx r r r c 6 dd l }|p| | _ g }|s2| t j i |)|t | t || j gz
}t j j | | _
d S )Nr )rx )rx r ) sslcreate_default_context _ssl_contextr< urllibrequest ProxyHandlerr r build_opener_opener)r rx r r _sslhandlerss r r3 zUrlTransport.__init__ s ' H4+F+F+H+H = OOFN 7 7 ; ; < < < ! #z:::$ ) -
H ~2H= r rv r rv r c r || j | S | j || S )Nr )r open)r r rv s r r zUrlTransport.open s: ?<$$S)) )| g 666r )r! r" r# r$ r r re r3 r r RequestrL r r r r r' r r r r s +/26 > > > Y'> ./ >
> > > >: $( 7 7 7
^
#7 % 7
! 7 7 7 7 7 7r r )*r$ http.clientr r rT r9 r0 r5 urllib.requestr abcr r loggingr typingr r r r r r! r7 rK r% re r r r) rN rp r HTTPConnectionrt HTTPSConnectionr r HTTPHandlerr HTTPSHandlerr r r' r r <module>r s , ,\
# # # # # # # # 7 7 7 7 7 7 7 7 7 7 7 7 JJJ 8 ! + + + + + + + + G G G G G G G GT@ @ @ @ @I @ @ @F i 0&
&
&
&
&
T[ 7 &
&
&
R3
3
3
3
3
dk 9 3
3
3
l* * * * *&.4 * * *$* * * * *6>6 * * *()7 )7 )7 )7 )7 )7 )7 )7 )7 )7r defence360agent/utils/__pycache__/parsers.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000041603 00000000000 021242 0 ustar
r_jg. $ d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm Z m
Z
m Z m Z m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d d lmZ G d
d Zd Z G d
d Z d Z d Z d Z d Z d Z!d Z" ed d Z#d Z$dS ) N) lru_cachepartial)chain)AnyDictIterableIteratorMappingTuple)app)Core)prepare_schema) RpcClient)EXITCODE_NOT_FOUNDc e Zd Zeeeef Zd Ze defd Z
e d Z defdZ defdZ
defdZdefdZdefd Zd
Zd S ) SchemaToArgparsec || _ | d | _ | d | _ | dd | _ | d | _ | dd | _ | d | _ | dd | _ | d | _ d S )
NalloweddefaultenvvarFhelp
positionalrenamerequiredtype)
_argumentget_allowed_default_envvar_help _positional_rename _required_type)selfargumentoptionss R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/parsers.py__init__zSchemaToArgparse.__init__ s &")++i"8"8
$[[ 3 3
#KK% 8 8 !++f--
!(\5!A!A #KK 1 1 &{{:u = =!++f--
returnc Z | j r| j S d| j dd z S )N--_-)r" r replacer& s r) argnamezSchemaToArgparse.argname s2 "> !dn,,S#6666r+ c t t | | | | | | }|S N)dictr choicesr r metavarnargsr )r& argparse_optionss r) r( zSchemaToArgparse.options% si
r+ c # K d}| j dk r%| j s| j r| j s|dfV d S |dfV d S | j r| j s| j
|dfV d S d S d S )Nr9 list+*?)r% r" r$ r r r& options r) r9 zSchemaToArgparse.nargs3 s : #
"
"t|
" ck!!!!! ck!!!!!
4< 4=3H#+ 3H3Hr+ c # K d| j fV d S )Nr7 )r r2 s r) r7 zSchemaToArgparse.choices? s &&&&&&r+ c # K d| j fV d S )Nr )r! r2 s r) r zSchemaToArgparse.helpB s dj r+ c # K d}| j r || j fV d S | j dk r || j fV d S d S )Nr8 r< )r# upperr% r r@ s r) r8 zSchemaToArgparse.metavarE st < 1$,,,... . . . . .
Z6
!
!$...000 0 0 0 0 0 "
!r+ c # l K | j &| j s!| j dk s| j sd| j fV d S d S d S d S )Nr< r )r r r% r" r2 s r) r zSchemaToArgparse.defaultL sZ M %L
&v%%T-=%T]* * * * * *
& % % %%%r+ c # b K | j r | j dk r| j s| j s dV d S d S d S d S d S )Nr< )r T)r$ r% r r" r2 s r) r zSchemaToArgparse.requiredT sd N #
f$$L % $ %
# " " " " " # #$$$$$$r+ N)__name__
__module__ __qualname__r r strr
OptionTyper* propertyr3 r( r9 r7 r r8 r r r+ r) r r s
%S/*J
.
.
. 7 7 7 7 X7
X
z
' ' ' ' '!j ! ! ! !1 1 1 1 1+ + + + +# # # # #r+ r c | d dk r| d o| dd }| | }| d| dd z |d
| d | dd z |d
|j di || d i d S t || } | j |j fi |j d S )Nr booleanr r F)r r. r/ r0
store_true)destactionz--no- store_falser rN )r add_mutually_exclusive_group add_argumentr1 set_defaultsr r3 r( )parserr' r( r bool_parser converters r) schema_to_argparser[ _ s6 {{6i'';;z**O7;;x3O3O/O 9989LL 8##C-- - !
h&&sC00 0 !
! FFHgkk).D.D#EFFFFF$Xw77 I -CC1BCCCCCr+ c e Zd Zedefd Zed Zededee de
e e f fd Z ed Z d S )
EnvParserenvvar_parameter_optionsc | sdS d d d fd| D S )N c @ d| v r| d d| d S | d S )Nr r z rN )r( s r)
format_argz)EnvParser.format_help.<locals>.format_argy s5 !(+BB BBB8$ $r+ z
environment variables:
{}z
c 3 . K | ]} | V d S r5 rN ).0r( rb s r) <genexpr>z(EnvParser.format_help.<locals>.<genexpr> sA
7## r+ )formatjoinvalues)r^ rb s @r) format_helpzEnvParser.format_helpt s| ' 2 % % %
177 KK 7 > > @ @
r+ c p d|v r1 | d n# t $ r
d| d| dfcY S w xY wd S )Nisasciiasciizerror: =z must only contain ascii symbols)encodeUnicodeEncodeError)r valuer( s r) _validatezEnvParser._validate ss
W%%%%%
NfNNuNNN
ts 33environexcluder, c l i }| D ]\ }}||v r |d } || x} ||< | || | x}
rK| |||
} t | t j t j t # t $ r d|v r
|d ||< Y | d sY | ||d
| } t | t j t j t Y w xY w|S )Nr )filer r z-error: environment variable {} is not defined) itemsrq
_format_errorprintsysstderrexitr KeyErrorr rf ) clsrr commandr^ rs kwargs parameterr( envvar_namerp errmsgs r) parsezEnvParser.parse sz ":"@"@"B"B 1 1 IwG##!(+K
1,3K,@@y)" -- UGDDD3 1 ++ !93 C #CJ////H /000+
-
-
- ''(/ (:F9% H {{:.. H'',CJJ# c
+++++,,,,,
-,
s
B D18D1A D10D1c ~ d d | | | | S )Nz {command}:
{help}
{message} )r~ r message)rf rg ri )r} r~ r^ r s r) rw zEnvParser._format_error sA 077HHW%% !9:: 8
r+ N)
rH rI rJ staticmethodr
ri rq classmethodr rK r r rw rN r+ r) r] r] s s
g
\
\ $$
# $
c3h
$ $ $ [$L
[
r+ r] c ^ t j | n# t j $ r Y dS w xY wdS )NFT) ipaddress IPv4AddressAddressValueError)addrs r) is_valid_ipv4_addrr sE d#### & uu 4s **c # K | D ]7\ }}|| di dg v r||fV 8d S )Ncliusers)rv r )schemauserkeyrh s r) _filter_userr se ||~~ V 6::eR((,,Wb99 9 9v+ r+ c > t | j | di |S )N)require_svc_is_runningrN )r cmd)r~ require_rpcparamss r) rpc_endpointr s9 F <9K 8 8 8 <g F
r+ c p i }|D ]0}| dd }t | |d }||||< 1|S )Nr0 r/ )r1 getattr)arg_parser_namespace argumentsr r' arg_parser_argumentrp s r) generate_endpoint_paramsr sU
F % % & . .sC 8 8,.A4HH $F8 Mr+ c i }t | }|D ]| }t t t f sJ d }| }t D ]\ }}|t
dz
k rj| || d t j
}t fd|D r| d |< t d |dz } | | }
|
sE| || d dd x}|| < |
}|s
J d
i } | d i
D ]c\ } }
d |
v r |
| | < |
d
d r%d|
v r) |
j d i |d |
d d|
d< d|
d< t || |
dt | |_ | ddd | ddd | di dd }| t+ t, | t+ t. | d i | d S ) N r )namer formatter_classc 3 Z K | ]%}|k o|d t k V &d S r5 )len)rd cmethodss r) re z apply_parser.<locals>.<genexpr> sT '\Bg>S\\>1B&B r+ Available commandsr )r r T)r r zparser is not definedr r envvar_onlyFr r r z--jsonrQ zreturn data in JSON format)rS r z --verbosez-vcount)rS r r running)r )endpointr r^ r~ rN )sortedkeys
isinstancetupler< enumerater
add_parserr argparseRawDescriptionHelpFormatteranyadd_subparsersrv updater[ r] ri epilogrV rW r r r )
subparsersr _subparserscommandsrh rX subparserir~ hashableexists_subparserr^ r' r( r r s @r) apply_parserr sy Kfkkmm$$H P
P
'E4=11111 #G,, " 1 " 1JAwCLL1$$$"-- F++$,$H .
% ,2+@+@ 1 ,A , ,K( !1q5!122#.??8#<#< ' 18A8L8L $ #ZZ / / 9M 9 9 %n*>nNNOI H 5 5
!1II.....v $& !'Hb!9!9!?!?!A!A : : Hg7""5<(2;;}e44 7"" EE!1'(2C!DEEE&+
#(- % vx 9 9 9 9!--.FGG
\0L
Kg>>> jj++//
yII \7K@@%,( **Xr227799& & & &>
GP
P
r+ c t t t t j | }t | | d S r5 )r6 r r r SCHEMA_PATHSr )r r r s r) _apply_subparsersr 5 s:
,~c.> ? ?FF
G
GFV$$$$$r+ r )maxsizec H t j dt j z } | dd | dg dd | d
d d
| d }t
|d t | | S )Nz CLI for %s.) descriptionz --log-configzlogging config filenamer z--console-log-level)ERRORWARNINGINFODEBUGz%Level of logging input to the consoler7 r z
--remote-addrc ( t | r| nd S r5 )r )ips r) <lambda>z#create_cli_parser.<locals>.<lambda>F s 0 4 4>$ r+ z2Client's IP address for adding it to the whitelist)r r r root)r ArgumentParserConfigNAMErV r r _apply_completions_parser)rX r s r) create_cli_parserr : s
$ 1L
M
M
MF
-FGGG
555
4
>
>
A
&&,@&AAJj&))) j))) Mr+ c ddl m} | dd }| d|d | d
d S ) Nr )SUPPORTED_SHELLS completionsz&Generate shell auto-completion scriptsr shellz!Shell to generate completions forr T)completions_command)!defence360agent.utils.completionsr r rV rW )r r completions_parsers r) r r O s| BBBBBB#..
5 / ##
0 $
###=====r+ )%r r ry functoolsr r itertoolsr typingr r r r r
r defence360agent.applicationr defence360agent.contracts.configr
r defence360agent.rpc_tools.utilsr defence360agent.simple_rpcr defence360agent.utils.clir r r[ r] r r r r r r r r rN r+ r) <module>r s
( ( ( ( ( ( ( ( @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ + + + + + + ; ; ; ; ; ; : : : : : : 0 0 0 0 0 0 8 8 8 8 8 8M# M# M# M# M# M# M# M#`D D D(J
J
J
J
J
J
J
J
Z S
S
S
l% % %
1 ( > > > > >r+ defence360agent/utils/__pycache__/parsers.cpython-311.pyc 0000644 0000000 0000000 00000041603 00000000000 020303 0 ustar
r_jg. $ d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm Z m
Z
m Z m Z m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d d lmZ G d
d Zd Z G d
d Z d Z d Z d Z d Z d Z!d Z" ed d Z#d Z$dS ) N) lru_cachepartial)chain)AnyDictIterableIteratorMappingTuple)app)Core)prepare_schema) RpcClient)EXITCODE_NOT_FOUNDc e Zd Zeeeef Zd Ze defd Z
e d Z defdZ defdZ
defdZdefdZdefd Zd
Zd S ) SchemaToArgparsec || _ | d | _ | d | _ | dd | _ | d | _ | dd | _ | d | _ | dd | _ | d | _ d S )
NalloweddefaultenvvarFhelp
positionalrenamerequiredtype)
_argumentget_allowed_default_envvar_help _positional_rename _required_type)selfargumentoptionss R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/parsers.py__init__zSchemaToArgparse.__init__ s &")++i"8"8
$[[ 3 3
#KK% 8 8 !++f--
!(\5!A!A #KK 1 1 &{{:u = =!++f--
returnc Z | j r| j S d| j dd z S )N--_-)r" r replacer& s r) argnamezSchemaToArgparse.argname s2 "> !dn,,S#6666r+ c t t | | | | | | }|S N)dictr choicesr r metavarnargsr )r& argparse_optionss r) r( zSchemaToArgparse.options% si
r+ c # K d}| j dk r%| j s| j r| j s|dfV d S |dfV d S | j r| j s| j
|dfV d S d S d S )Nr9 list+*?)r% r" r$ r r r& options r) r9 zSchemaToArgparse.nargs3 s : #
"
"t|
" ck!!!!! ck!!!!!
4< 4=3H#+ 3H3Hr+ c # K d| j fV d S )Nr7 )r r2 s r) r7 zSchemaToArgparse.choices? s &&&&&&r+ c # K d| j fV d S )Nr )r! r2 s r) r zSchemaToArgparse.helpB s dj r+ c # K d}| j r || j fV d S | j dk r || j fV d S d S )Nr8 r< )r# upperr% r r@ s r) r8 zSchemaToArgparse.metavarE st < 1$,,,... . . . . .
Z6
!
!$...000 0 0 0 0 0 "
!r+ c # l K | j &| j s!| j dk s| j sd| j fV d S d S d S d S )Nr< r )r r r% r" r2 s r) r zSchemaToArgparse.defaultL sZ M %L
&v%%T-=%T]* * * * * *
& % % %%%r+ c # b K | j r | j dk r| j s| j s dV d S d S d S d S d S )Nr< )r T)r$ r% r r" r2 s r) r zSchemaToArgparse.requiredT sd N #
f$$L % $ %
# " " " " " # #$$$$$$r+ N)__name__
__module__ __qualname__r r strr
OptionTyper* propertyr3 r( r9 r7 r r8 r r r+ r) r r s
%S/*J
.
.
. 7 7 7 7 X7
X
z
' ' ' ' '!j ! ! ! !1 1 1 1 1+ + + + +# # # # #r+ r c | d dk r| d o| dd }| | }| d| dd z |d
| d | dd z |d
|j di || d i d S t || } | j |j fi |j d S )Nr booleanr r F)r r. r/ r0
store_true)destactionz--no- store_falser rN )r add_mutually_exclusive_group add_argumentr1 set_defaultsr r3 r( )parserr' r( r bool_parser converters r) schema_to_argparser[ _ s6 {{6i'';;z**O7;;x3O3O/O 9989LL 8##C-- - !
h&&sC00 0 !
! FFHgkk).D.D#EFFFFF$Xw77 I -CC1BCCCCCr+ c e Zd Zedefd Zed Zededee de
e e f fd Z ed Z d S )
EnvParserenvvar_parameter_optionsc | sdS d d d fd| D S )N c @ d| v r| d d| d S | d S )Nr r z rN )r( s r)
format_argz)EnvParser.format_help.<locals>.format_argy s5 !(+BB BBB8$ $r+ z
environment variables:
{}z
c 3 . K | ]} | V d S r5 rN ).0r( rb s r) <genexpr>z(EnvParser.format_help.<locals>.<genexpr> sA
7## r+ )formatjoinvalues)r^ rb s @r) format_helpzEnvParser.format_helpt s| ' 2 % % %
177 KK 7 > > @ @
r+ c p d|v r1 | d n# t $ r
d| d| dfcY S w xY wd S )Nisasciiasciizerror: =z must only contain ascii symbols)encodeUnicodeEncodeError)r valuer( s r) _validatezEnvParser._validate ss
W%%%%%
NfNNuNNN
ts 33environexcluder, c l i }| D ]\ }}||v r |d } || x} ||< | || | x}
rK| |||
} t | t j t j t # t $ r d|v r
|d ||< Y | d sY | ||d
| } t | t j t j t Y w xY w|S )Nr )filer r z-error: environment variable {} is not defined) itemsrq
_format_errorprintsysstderrexitr KeyErrorr rf ) clsrr commandr^ rs kwargs parameterr( envvar_namerp errmsgs r) parsezEnvParser.parse sz ":"@"@"B"B 1 1 IwG##!(+K
1,3K,@@y)" -- UGDDD3 1 ++ !93 C #CJ////H /000+
-
-
- ''(/ (:F9% H {{:.. H'',CJJ# c
+++++,,,,,
-,
s
B D18D1A D10D1c ~ d d | | | | S )Nz {command}:
{help}
{message} )r~ r message)rf rg ri )r} r~ r^ r s r) rw zEnvParser._format_error sA 077HHW%% !9:: 8
r+ N)
rH rI rJ staticmethodr
ri rq classmethodr rK r r rw rN r+ r) r] r] s s
g
\
\ $$
# $
c3h
$ $ $ [$L
[
r+ r] c ^ t j | n# t j $ r Y dS w xY wdS )NFT) ipaddress IPv4AddressAddressValueError)addrs r) is_valid_ipv4_addrr sE d#### & uu 4s **c # K | D ]7\ }}|| di dg v r||fV 8d S )Ncliusers)rv r )schemauserkeyrh s r) _filter_userr se ||~~ V 6::eR((,,Wb99 9 9v+ r+ c > t | j | di |S )N)require_svc_is_runningrN )r cmd)r~ require_rpcparamss r) rpc_endpointr s9 F <9K 8 8 8 <g F
r+ c p i }|D ]0}| dd }t | |d }||||< 1|S )Nr0 r/ )r1 getattr)arg_parser_namespace argumentsr r' arg_parser_argumentrp s r) generate_endpoint_paramsr sU
F % % & . .sC 8 8,.A4HH $F8 Mr+ c i }t | }|D ]| }t t t f sJ d }| }t D ]\ }}|t
dz
k rj| || d t j
}t fd|D r| d |< t d |dz } | | }
|
sE| || d dd x}|| < |
}|s
J d
i } | d i
D ]c\ } }
d |
v r |
| | < |
d
d r%d|
v r) |
j d i |d |
d d|
d< d|
d< t || |
dt | |_ | ddd | ddd | di dd }| t+ t, | t+ t. | d i | d S ) N r )namer formatter_classc 3 Z K | ]%}|k o|d t k V &d S r5 )len)rd cmethodss r) re z apply_parser.<locals>.<genexpr> sT '\Bg>S\\>1B&B r+ Available commandsr )r r T)r r zparser is not definedr r envvar_onlyFr r r z--jsonrQ zreturn data in JSON format)rS r z --verbosez-vcount)rS r r running)r )endpointr r^ r~ rN )sortedkeys
isinstancetupler< enumerater
add_parserr argparseRawDescriptionHelpFormatteranyadd_subparsersrv updater[ r] ri epilogrV rW r r r )
subparsersr _subparserscommandsrh rX subparserir~ hashableexists_subparserr^ r' r( r r s @r) apply_parserr sy Kfkkmm$$H P
P
'E4=11111 #G,, " 1 " 1JAwCLL1$$$"-- F++$,$H .
% ,2+@+@ 1 ,A , ,K( !1q5!122#.??8#<#< ' 18A8L8L $ #ZZ / / 9M 9 9 %n*>nNNOI H 5 5
!1II.....v $& !'Hb!9!9!?!?!A!A : : Hg7""5<(2;;}e44 7"" EE!1'(2C!DEEE&+
#(- % vx 9 9 9 9!--.FGG
\0L
Kg>>> jj++//
yII \7K@@%,( **Xr227799& & & &>
GP
P
r+ c t t t t j | }t | | d S r5 )r6 r r r SCHEMA_PATHSr )r r r s r) _apply_subparsersr 5 s:
,~c.> ? ?FF
G
GFV$$$$$r+ r )maxsizec H t j dt j z } | dd | dg dd | d
d d
| d }t
|d t | | S )Nz CLI for %s.) descriptionz --log-configzlogging config filenamer z--console-log-level)ERRORWARNINGINFODEBUGz%Level of logging input to the consoler7 r z
--remote-addrc ( t | r| nd S r5 )r )ips r) <lambda>z#create_cli_parser.<locals>.<lambda>F s 0 4 4>$ r+ z2Client's IP address for adding it to the whitelist)r r r root)r ArgumentParserConfigNAMErV r r _apply_completions_parser)rX r s r) create_cli_parserr : s
$ 1L
M
M
MF
-FGGG
555
4
>
>
A
&&,@&AAJj&))) j))) Mr+ c ddl m} | dd }| d|d | d
d S ) Nr )SUPPORTED_SHELLS completionsz&Generate shell auto-completion scriptsr shellz!Shell to generate completions forr T)completions_command)!defence360agent.utils.completionsr r rV rW )r r completions_parsers r) r r O s| BBBBBB#..
5 / ##
0 $
###=====r+ )%r r ry functoolsr r itertoolsr typingr r r r r
r defence360agent.applicationr defence360agent.contracts.configr
r defence360agent.rpc_tools.utilsr defence360agent.simple_rpcr defence360agent.utils.clir r r[ r] r r r r r r r r rN r+ r) <module>r s
( ( ( ( ( ( ( ( @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ + + + + + + ; ; ; ; ; ; : : : : : : 0 0 0 0 0 0 8 8 8 8 8 8M# M# M# M# M# M# M# M#`D D D(J
J
J
J
J
J
J
J
Z S
S
S
l% % %
1 ( > > > > >r+ defence360agent/utils/__pycache__/resource_limits.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000022630 00000000000 022772 0 ustar
r_j&
d dl Z d dlZd dlmZ d dlmZ d dlmZ d dlm Z d dl
m Z m Z m
Z
d dlmZ ej e ZdZ e d Z e d
Z e d Z e d Zd
Z G d de ZdefdZde e dede de de j j f
dZ de dede e fdZ de de e fdZ!de de e fdZ"de de e fd Z#d e de e fd Z$de de e
e ef fd Z%de&fd Z'de&fd!Z(dS )" N)suppress)Enum)fsdecode)Path)ListOptionalTuple)
OsReleaseInfoz /usr/libexec/run-with-intensityz/usr/sbin/lvectlz/proc/lve/listz/procz/sys/fs/cgroupl c e Zd ZdZdZdZdS ) LimitsMethodnicelvecgroupsN)__name__
__module__ __qualname__NICELVECGROUPS Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/resource_limits.pyr r s D
CGGGr r returnc K t j t dt j j t j j d{V } | d{V \ }}t
| }|dk r t j S |dk r t j
S |dk r t j S t d
|t
| )z6Returns limit method, used in run-with-intensity tool.show)stdoutstderrNr
r r z>Parsing of used limitation method failed
stdout: {}
stderr: {})asynciocreate_subprocess_execRUN_WITH_INTENSITY
subprocessPIPE communicater stripr r r r LookupErrorformat)procr r s r get_current_methodr( s /!&!& D ++--------NFF
f
#
#
%
%F
##
J ((..00 1 1 r cmdkey
intensity_cpu intensity_ioc K t ddt | dt | g}| d|g t j || z i | d{V S )aS
Creates asyncio.Process with limited resources (cpu & io),
using run-with-intensity tool.
:param cmd: command to execute
:param intensity_cpu: cpu intensity limit
:param intensity_io: io intensity limit
:param subprocess_kwargs: keyword arguments for create_subprocess_exec func
:return: executed Process
runz--intensity-cpuz--intensity-ioz--keyN)r strextendr r )r) r* r+ r, subprocess_kwargs
limits_cmds r create_subprocessr3 8 s $
M L
J wn%%%/
s
0 r pidfieldc t t | z dz }n# t $ r Y d S w xY w| D ]|}| d \ }}}||k r[t
t t 5 t |
d cd d d c S # 1 swxY w Y }d S )Nstatus:r ) PROC_PATHr/ read_textOSError
splitlines partitionr
IndexError
ValueErrorintsplit)r4 r5 r7 linename_values r _status_field_kbrF X s c#hh&1<<>> tt!!## - - ,,a 5==*j11
-
-5;;==+,,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 4s ,/
=='CC C c g } t t t | z dz }n# t $ r |cY S w xY w|D ]} |dz }n# t $ r Y 'w xY wt
t 5 | d | D d d d n # 1 swxY w Y |S )Ntaskchildrenc 3 4 K | ]}t | V d S N)r@ ).0childs r <genexpr>z _child_pids.<locals>.<genexpr>q s( CC5CJJCCCCCCr )
sortedr9 r/ iterdirr; r: r r? r0 rA )r4 rI threadsthreadlisteds r _child_pidsrT e sL H)c#hh.7@@BBCC D D z)4466FF H
j
!
! D D OOCCFLLNNCCC C C C D D D D D D D D D D D D D D D Os3 9> A
A
A--
A:9A:2CC C c g | g}}|rM| }| | | t | |M|S rK )popappendr0 rT )r4 treependingcurrents r
_process_treer[ u s_ 'D
-++-- G {7++,,, - Kr c ` d}t | D ]}t |d }||pd|z } |S )z;Peak RSS of the process and its descendants, summed, in kB.NVmHWMr )r[ rF )r4 totalprocesspeaks r peak_rss_kbra ~ sG E %% ( ( 11 Za4'E Lr pathc 2 | }n# t $ r Y d S w xY w|dk rd S t t 5 t | }|t k r|cd d d S d d d n # 1 swxY w Y d S )Nmax)r: r$ r; r r? r@ _CGROUP_V1_NO_LIMIT)rb rE limits r _cgroup_limit_bytesrg s &&(( tt ~~t * E
& & & & 4s &)
77 B BBc t t | z dz }n# t $ r Y dS w xY w| D ]}| d \ }}}| d \ }}}| d }|s t t |z dz }d} n8d| d v r t t dz |z d z }d
} n| |d z | fc S dS ) zFThe cgroup memory limit the process runs under, in kB, and its source.cgroupNr8 /z
memory.maxz cgroup v2memory,zmemory.limit_in_bytesz cgroup v1i )
r9 r/ r: r; r< r= lstriprg CGROUP_PATHrA )
r4 r rB rD rest controllersri relativerf sources
r memory_bound_kbrs s9 s3xx'(2==?? tt""$$ ) )^^C((
1d!% !4!4 Q==%% ' h(> (MNNE FF
**3//
/
/'h&14KK E !FF D=&( ( ( ( 4s ,/
==c Z t ot j S )z1Checks that LVE-utils is active resource limiter.)PROC_LVE_LIST_PATHexistsr
is_cloudlinuxr r r
is_lve_activerx s$ $ $ & & H=+F+H+HHr c 4 t S )z#Checks that LVE-utils is installed.)LVECTL_BIN_PATHrv r r r
has_lvectlr{ s ! ! # ##r ))r logging
contextlibr enumr osr pathlibr typingr r r defence360agent.utilsr
getLoggerr loggerr rz ru r9 rn re r r( r/ r@ r! Processr3 rF rT r[ ra rg rs boolrx r{ r r r <module>r s ( ( ( ( ( ( ( ( ( ( / / / / / / 8 $ $ 7 $)**T*++ DMM d#$$ 4 , 0
c
@
#
c
hsm
S
T#Y
s tCy S Xc] d x} %S/!: 2It I I I I$D $ $ $ $ $ $r defence360agent/utils/__pycache__/resource_limits.cpython-311.pyc 0000644 0000000 0000000 00000022630 00000000000 022033 0 ustar
r_j&
d dl Z d dlZd dlmZ d dlmZ d dlmZ d dlm Z d dl
m Z m Z m
Z
d dlmZ ej e ZdZ e d Z e d
Z e d Z e d Zd
Z G d de ZdefdZde e dede de de j j f
dZ de dede e fdZ de de e fdZ!de de e fdZ"de de e fd Z#d e de e fd Z$de de e
e ef fd Z%de&fd Z'de&fd!Z(dS )" N)suppress)Enum)fsdecode)Path)ListOptionalTuple)
OsReleaseInfoz /usr/libexec/run-with-intensityz/usr/sbin/lvectlz/proc/lve/listz/procz/sys/fs/cgroupl c e Zd ZdZdZdZdS ) LimitsMethodnicelvecgroupsN)__name__
__module__ __qualname__NICELVECGROUPS Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/resource_limits.pyr r s D
CGGGr r returnc K t j t dt j j t j j d{V } | d{V \ }}t
| }|dk r t j S |dk r t j
S |dk r t j S t d
|t
| )z6Returns limit method, used in run-with-intensity tool.show)stdoutstderrNr
r r z>Parsing of used limitation method failed
stdout: {}
stderr: {})asynciocreate_subprocess_execRUN_WITH_INTENSITY
subprocessPIPE communicater stripr r r r LookupErrorformat)procr r s r get_current_methodr( s /!&!& D ++--------NFF
f
#
#
%
%F
##
J ((..00 1 1 r cmdkey
intensity_cpu intensity_ioc K t ddt | dt | g}| d|g t j || z i | d{V S )aS
Creates asyncio.Process with limited resources (cpu & io),
using run-with-intensity tool.
:param cmd: command to execute
:param intensity_cpu: cpu intensity limit
:param intensity_io: io intensity limit
:param subprocess_kwargs: keyword arguments for create_subprocess_exec func
:return: executed Process
runz--intensity-cpuz--intensity-ioz--keyN)r strextendr r )r) r* r+ r, subprocess_kwargs
limits_cmds r create_subprocessr3 8 s $
M L
J wn%%%/
s
0 r pidfieldc t t | z dz }n# t $ r Y d S w xY w| D ]|}| d \ }}}||k r[t
t t 5 t |
d cd d d c S # 1 swxY w Y }d S )Nstatus:r ) PROC_PATHr/ read_textOSError
splitlines partitionr
IndexError
ValueErrorintsplit)r4 r5 r7 linename_values r _status_field_kbrF X s c#hh&1<<>> tt!!## - - ,,a 5==*j11
-
-5;;==+,,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 4s ,/
=='CC C c g } t t t | z dz }n# t $ r |cY S w xY w|D ]} |dz }n# t $ r Y 'w xY wt
t 5 | d | D d d d n # 1 swxY w Y |S )Ntaskchildrenc 3 4 K | ]}t | V d S N)r@ ).0childs r <genexpr>z _child_pids.<locals>.<genexpr>q s( CC5CJJCCCCCCr )
sortedr9 r/ iterdirr; r: r r? r0 rA )r4 rI threadsthreadlisteds r _child_pidsrT e sL H)c#hh.7@@BBCC D D z)4466FF H
j
!
! D D OOCCFLLNNCCC C C C D D D D D D D D D D D D D D D Os3 9> A
A
A--
A:9A:2CC C c g | g}}|rM| }| | | t | |M|S rK )popappendr0 rT )r4 treependingcurrents r
_process_treer[ u s_ 'D
-++-- G {7++,,, - Kr c ` d}t | D ]}t |d }||pd|z } |S )z;Peak RSS of the process and its descendants, summed, in kB.NVmHWMr )r[ rF )r4 totalprocesspeaks r peak_rss_kbra ~ sG E %% ( ( 11 Za4'E Lr pathc 2 | }n# t $ r Y d S w xY w|dk rd S t t 5 t | }|t k r|cd d d S d d d n # 1 swxY w Y d S )Nmax)r: r$ r; r r? r@ _CGROUP_V1_NO_LIMIT)rb rE limits r _cgroup_limit_bytesrg s &&(( tt ~~t * E
& & & & 4s &)
77 B BBc t t | z dz }n# t $ r Y dS w xY w| D ]}| d \ }}}| d \ }}}| d }|s t t |z dz }d} n8d| d v r t t dz |z d z }d
} n| |d z | fc S dS ) zFThe cgroup memory limit the process runs under, in kB, and its source.cgroupNr8 /z
memory.maxz cgroup v2memory,zmemory.limit_in_bytesz cgroup v1i )
r9 r/ r: r; r< r= lstriprg CGROUP_PATHrA )
r4 r rB rD rest controllersri relativerf sources
r memory_bound_kbrs s9 s3xx'(2==?? tt""$$ ) )^^C((
1d!% !4!4 Q==%% ' h(> (MNNE FF
**3//
/
/'h&14KK E !FF D=&( ( ( ( 4s ,/
==c Z t ot j S )z1Checks that LVE-utils is active resource limiter.)PROC_LVE_LIST_PATHexistsr
is_cloudlinuxr r r
is_lve_activerx s$ $ $ & & H=+F+H+HHr c 4 t S )z#Checks that LVE-utils is installed.)LVECTL_BIN_PATHrv r r r
has_lvectlr{ s ! ! # ##r ))r logging
contextlibr enumr osr pathlibr typingr r r defence360agent.utilsr
getLoggerr loggerr rz ru r9 rn re r r( r/ r@ r! Processr3 rF rT r[ ra rg rs boolrx r{ r r r <module>r s ( ( ( ( ( ( ( ( ( ( / / / / / / 8 $ $ 7 $)**T*++ DMM d#$$ 4 , 0
c
@
#
c
hsm
S
T#Y
s tCy S Xc] d x} %S/!: 2It I I I I$D $ $ $ $ $ $r defence360agent/utils/__pycache__/safe_fileops.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000044137 00000000000 022227 0 ustar
r_jP' @ U d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
d dlmZ d dlmZmZmZ d dlmZ ej Zej ej z ej z Z ej e Z e Z ee
e!d< de j" fd Z#d)d Z$ ej% e$ d Z& G d
de' Z(de)d
dfdZ*d Z+d*dZ,de)fdZ-de)de)fdZ.de)de)fdZ/de)fdZ0 e,ej1 Z1 e,ej2 Z2e d+d Z3e d Z4e d e)fd Z5e d,d ee)e6f fd Z7e d e)d!e6d"e6d#e8fd$ Z9d%eee)e6f ee6df f d&eee)e6f ee6df f fd'Z: d-d%e)d&e)fd(Z;dS ). N)ProcessPoolExecutor)contextmanagersuppress)chain)SetTupleUnion)utils
_active_poolsloopc K t d }t | | j |g|R d {V | d t | S # t | w xY w# | d t | w # t | w xY wxY w)N ) max_workersF)wait)r r addrun_in_executorshutdowndiscard)r argspools W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/safe_fileops.py_run_in_fresh_executorr s 1 - - -Dd()T)$66666666666 ( MMuM % % % ! !$ ' ' ' 'M ! !$ ' ' ' ' ( MMuM % % % ! !$ ' ' ' 'M ! !$ ' ' ' 's/ B A44 BC%C+C% C""C%returnc t t D ]L} | dd # t $ r%}t d| Y d}~Ed}~ww xY wt dS )zShutdown all tracked ProcessPoolExecutors.
Should be called during agent shutdown to ensure clean process termination.
FT)r cancel_futuresz+Error shutting down ProcessPoolExecutor: %sN)listr r Exceptionloggerwarningclear)r es r shutdown_process_poolsr" ) s
]## M M M MMuTM : : : : M M M NNH! L L L L L L L L Ms 0
A AA c t j g t j | t j | | | S N)os setgroupssetgidsetuid)funuidgidr s r dropr, : s8 LIcNNNIcNNN 3: c e Zd ZdS )UnsafeFileOperationN)__name__
__module__ __qualname__ r- r r/ r/ A s Dr- r/ pathc t j | }t j |j sYt
d| t j |j t j | t d| dS )zVerify path is a regular file; remove and raise FileNotFoundError if not.
Uses os.lstat() to avoid following symlinks. If the file is a FIFO,
symlink, socket, device, etc., it is deleted so the caller can
recreate it as a regular file.
z:Identity file %s is not a regular file (mode=%s), removingz#Removed non-regular identity file: N)
r% lstatstatS_ISREGst_moder r filemodeunlinkFileNotFoundError)r4 sts r ensure_regular_filer> E s
$ B <
# # N H M"* % %
$ Ld L LMMMN Nr- c t j t | }|j t j k r t
dt | z dS )Nz The file belongs to admin user: T)r% r7 strst_uidr
get_min_uidr/ )filer= s r check_non_admin_filerD W sT T B y5$&&&&! .T :
4r- Fc fd}|S )Nc P t j d d fd
}|S )N)r c B K t j | s
st d| z t j | }t
t |j |g }
rt |j }|D ]I}t j t | }|j dk r|j dk r|j |j }} n Jt dt | z |pt j }t! |t" ||| g|R d {V S )NzNo such file or directory: r z"Unsafe file operation under root: )r% r4 existsr< pathlibPathr reversedparentsr7 r@ rA st_gidr/ asyncioget_event_loopr r, ) filenamer r r4 pathspr= r* r+ r)
missing_oks r wrapperz$safe.<locals>._safe.<locals>.wrapperb sQ 7>>(++
J
'1H< <))D(4<004&99E
/ ..
WSVV__9>>bi1nn !y")CE)83t99D 37133D/
r- ) functoolswraps)r) rT rS s ` r _safezsafe.<locals>._safea sK 04
> r- r3 )rS rW s ` r saferX ` s$ ! ! ! ! !F Lr- rP c R t j | d S r$ )rI rJ touchrP s r _touchr\ s$ L """""r- datac T t j | | d S r$ )rI rJ
write_textrP r] s r _write_textra s& L%%d+++++r- c b K t d t | | d {V S NT)rS )rX ra r` s r r_ r_ s@ 3&&&&{33HdCC C C C C C CCr- c ` K t d t | d {V S rc )rX r\ r[ s r rZ rZ s> .&&&&v..x88 8 8 8 8 8 88r- Tc # L K d|v rt d t | | 5 }t j | }t j | }t j d| }t | }||k s|j |j
k rt d| |rEt j |j
t j | j vrt d| d |V d d d d S # 1 swxY w Y d S )Nwz'w' mode is not permittedz/proc/self/fd/zUnable to safely read z . File is not in user homedir)r/ openr% fstatfilenopwdgetpwnamreadlinkr@ rA pw_uidrI rJ pw_dirrL ) rP modeuserrespect_homedirfr= passwd real_path filename_strs r safe_open_filerv sz
d{{!"=>>>
h
Xahhjj
!
! d##K = = =>> 8}}
I % %29
+E+E%&M|&M&MNN N
V]++< --56 6 &. . . .
- s C&DD D c / B K t j | i |} |V t t 5 t j | ddd dS # 1 swxY w Y dS # t t 5 t j | ddd w # 1 swxY w Y w xY w)z
Context manager which wraps os.open and close file descriptor at the end
:param args: positional arguments for os.open
:param kwargs: keyword arguments for os.open
N)r% rg r OSErrorclose)r kwargsfds r open_fdr| s!
$ !& ! !B
g
HRLLL Xg
HRLLL s@ A AAA B 1B B B B B B namec / K t | g|R dt j i|5 }t j d | }| |k rt d |V ddd dS # 1 swxY w Y dS )a
Context manager to get a directory file descriptor
It also checks if a directory doesn't contain a symlink in the path
:param name: full directory name
:param args: positional arguments for os.open
:param kwargs: keyword arguments for os.open
flagsz/proc/self/fd/{}z%Operations on symlinks are prohibitedN)r| r% O_DIRECTORYrl formatr/ )r} r rz dir_fdreals r
opendir_fdr s
= = = =BN =f = = {-44V<<== 4<<%&MNN N s AA--A14A1rr c # K d}t | t rt t 5 t j | | }t j | |j t
j z t
j z | ddd n # 1 swxY w Y t j
| || } t | | 5 }|pt j | |_ |V |rGt t 5 t j | |j ddd n # 1 swxY w Y nO# |rHt t 5 t j | |j ddd w # 1 swxY w Y w w xY wddd dS # 1 swxY w Y dS )a
Context manager to open file object from file name or from file descriptor
File object extended with 'st' attribute that contains os.stat_result of
the opened file
:param f: file name or file descriptor to open
:param dir_fd: directory descriptor, ignored if 'f' is a file descriptor
:param flags: flags for os.open, ignored if 'f' is a file descriptor
:param mode: mode for built-in open
Nr )ro r )r r ro )
isinstancer@ r rx r% r7 chmodr9 S_IRUSRS_IWUSRrg r= )rr r r ro r= fos r open_fobjr s
B!S 3
g
6***B H
T\1DL@
GAU6 2 2 2
ad 1r bgajj 1HHH
1 g&& 1 1HQRZ00001 1 1 1 1 1 1 1 1 1 1 1 1 1 1
1 g&& 1 1HQRZ00001 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1s A
BB B : FD%F1 D
FD F D !F%E1< E$ E1$E(
(E1+E(
,E11FFFr r is_safec # K |r3t | || 5 }|dfV ddd dS # 1 swxY w Y dS | |fV dS )z
If is_safe flag is True, open file descriptor using name and dir_fd
If is_safe is False, return name and dir_fd as is
)r r N)r| )r} r r r r{ s r
safe_tupler s
T&
6
6
6 "d(NNN Fls +//srcdstc \ | \ }}|\ }}t |rdn t j z } t ||t d 5 }
t ||| d 5 } |r |d t j |
| t |t r2t j |
|
j j d d d n # 1 swxY w Y |r=t |t r(|r |d t j
|| d d d d S # 1 swxY w Y d S )Nr rb)r r ro wbr r r )W_FLAGSr% O_EXCLr R_FLAGSshutil copyfileobjr r@ r ri r= r9 r; ) r r
src_unlink
dst_overwriteracecallsrc_f
src_dir_fddst_f
dst_dir_fdw_flagssrc_fodst_fos r _mover
s E:E:m:;G
jd
0
*G$
B
vv . . .%%%
B vy/@AAAA B B B B B B B B B B B B B B B 0*UC00 0
IeJ / / / /%0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0s7 D!A/C
> D!
C D!C AD!!D%(D%c z K t j | \ }}t j | \ } }
t | 5 } t | 5 } t || t
| 5 }
t |
| t | 5 }t j || }t j }t |t t |j
|j |
||||
d {V |r*|r(|r |d t j || |r>t j |
|j
|j | t j |
|j | d d d n # 1 swxY w Y d d d n # 1 swxY w Y d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S )Nr r )r% r4 splitr r r r r7 rN rO r r, r rA rM r; chownr r9 )r r safe_srcsafe_dstr r r src_dirsrc_namedst_dirdst_namer r src_tuple dst_tuplesrc_str s r safe_mover . s
c**GX
c**GX G B
J- - B Z*gx B
J*gx B
*555%''$ M M
3( 3
Ihz 2 2 2 2 B HXv}fmJ O O O O HXv~j A A A A= B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B Bs F0&F>FCE* F*E.
.F1E.
2F5 FF FF F F0F F0 F F00F47F4)r N)F)T)Nr N)FFTFN)<rN atexitrU loggingr% rI rj r r7 concurrent.futuresr
contextlibr r itertoolsr typingr r r defence360agentr
O_RDONLYr O_TRUNCO_CREATO_WRONLYr getLoggerr0 r setr __annotations__AbstractEventLoopr r" registerr, r r/ r@ r> rD rX r\ ra r_ rZ r r; rv r| r intr boolr r r r3 r- r <module>r s
2 2 2 2 2 2 / / / / / / / / $ $ $ $ $ $ $ $ $ $ ! ! ! ! ! !
+
*rz
!BK
/ 8 $ $ +.#%%
s&' / / / (w'@ ( ( ( (
& ' ' ' ) Nc Nd N N N N$ $ $ $ $N#S # # # #,# ,S , , , ,Ds D# D D D D9# 9 9 9 9
RX
bi 8
S
1 1sCx 1 1 1 1F S # c D 0 uS#Xc4i 00 1 0 uS#Xc4i 00 1 0 0 0 0H
*B *B *B *B *B *B *B *B *Br- defence360agent/utils/__pycache__/safe_fileops.cpython-311.pyc 0000644 0000000 0000000 00000044137 00000000000 021270 0 ustar
r_jP' @ U d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
d dlmZ d dlmZmZmZ d dlmZ ej Zej ej z ej z Z ej e Z e Z ee
e!d< de j" fd Z#d)d Z$ ej% e$ d Z& G d
de' Z(de)d
dfdZ*d Z+d*dZ,de)fdZ-de)de)fdZ.de)de)fdZ/de)fdZ0 e,ej1 Z1 e,ej2 Z2e d+d Z3e d Z4e d e)fd Z5e d,d ee)e6f fd Z7e d e)d!e6d"e6d#e8fd$ Z9d%eee)e6f ee6df f d&eee)e6f ee6df f fd'Z: d-d%e)d&e)fd(Z;dS ). N)ProcessPoolExecutor)contextmanagersuppress)chain)SetTupleUnion)utils
_active_poolsloopc K t d }t | | j |g|R d {V | d t | S # t | w xY w# | d t | w # t | w xY wxY w)N ) max_workersF)wait)r r addrun_in_executorshutdowndiscard)r argspools W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/safe_fileops.py_run_in_fresh_executorr s 1 - - -Dd()T)$66666666666 ( MMuM % % % ! !$ ' ' ' 'M ! !$ ' ' ' ' ( MMuM % % % ! !$ ' ' ' 'M ! !$ ' ' ' 's/ B A44 BC%C+C% C""C%returnc t t D ]L} | dd # t $ r%}t d| Y d}~Ed}~ww xY wt dS )zShutdown all tracked ProcessPoolExecutors.
Should be called during agent shutdown to ensure clean process termination.
FT)r cancel_futuresz+Error shutting down ProcessPoolExecutor: %sN)listr r Exceptionloggerwarningclear)r es r shutdown_process_poolsr" ) s
]## M M M MMuTM : : : : M M M NNH! L L L L L L L L Ms 0
A AA c t j g t j | t j | | | S N)os setgroupssetgidsetuid)funuidgidr s r dropr, : s8 LIcNNNIcNNN 3: c e Zd ZdS )UnsafeFileOperationN)__name__
__module__ __qualname__ r- r r/ r/ A s Dr- r/ pathc t j | }t j |j sYt
d| t j |j t j | t d| dS )zVerify path is a regular file; remove and raise FileNotFoundError if not.
Uses os.lstat() to avoid following symlinks. If the file is a FIFO,
symlink, socket, device, etc., it is deleted so the caller can
recreate it as a regular file.
z:Identity file %s is not a regular file (mode=%s), removingz#Removed non-regular identity file: N)
r% lstatstatS_ISREGst_moder r filemodeunlinkFileNotFoundError)r4 sts r ensure_regular_filer> E s
$ B <
# # N H M"* % %
$ Ld L LMMMN Nr- c t j t | }|j t j k r t
dt | z dS )Nz The file belongs to admin user: T)r% r7 strst_uidr
get_min_uidr/ )filer= s r check_non_admin_filerD W sT T B y5$&&&&! .T :
4r- Fc fd}|S )Nc P t j d d fd
}|S )N)r c B K t j | s
st d| z t j | }t
t |j |g }
rt |j }|D ]I}t j t | }|j dk r|j dk r|j |j }} n Jt dt | z |pt j }t! |t" ||| g|R d {V S )NzNo such file or directory: r z"Unsafe file operation under root: )r% r4 existsr< pathlibPathr reversedparentsr7 r@ rA st_gidr/ asyncioget_event_loopr r, ) filenamer r r4 pathspr= r* r+ r)
missing_oks r wrapperz$safe.<locals>._safe.<locals>.wrapperb sQ 7>>(++
J
'1H< <))D(4<004&99E
/ ..
WSVV__9>>bi1nn !y")CE)83t99D 37133D/
r- ) functoolswraps)r) rT rS s ` r _safezsafe.<locals>._safea sK 04
> r- r3 )rS rW s ` r saferX ` s$ ! ! ! ! !F Lr- rP c R t j | d S r$ )rI rJ touchrP s r _touchr\ s$ L """""r- datac T t j | | d S r$ )rI rJ
write_textrP r] s r _write_textra s& L%%d+++++r- c b K t d t | | d {V S NT)rS )rX ra r` s r r_ r_ s@ 3&&&&{33HdCC C C C C C CCr- c ` K t d t | d {V S rc )rX r\ r[ s r rZ rZ s> .&&&&v..x88 8 8 8 8 8 88r- Tc # L K d|v rt d t | | 5 }t j | }t j | }t j d| }t | }||k s|j |j
k rt d| |rEt j |j
t j | j vrt d| d |V d d d d S # 1 swxY w Y d S )Nwz'w' mode is not permittedz/proc/self/fd/zUnable to safely read z . File is not in user homedir)r/ openr% fstatfilenopwdgetpwnamreadlinkr@ rA pw_uidrI rJ pw_dirrL ) rP modeuserrespect_homedirfr= passwd real_path filename_strs r safe_open_filerv sz
d{{!"=>>>
h
Xahhjj
!
! d##K = = =>> 8}}
I % %29
+E+E%&M|&M&MNN N
V]++< --56 6 &. . . .
- s C&DD D c / B K t j | i |} |V t t 5 t j | ddd dS # 1 swxY w Y dS # t t 5 t j | ddd w # 1 swxY w Y w xY w)z
Context manager which wraps os.open and close file descriptor at the end
:param args: positional arguments for os.open
:param kwargs: keyword arguments for os.open
N)r% rg r OSErrorclose)r kwargsfds r open_fdr| s!
$ !& ! !B
g
HRLLL Xg
HRLLL s@ A AAA B 1B B B B B B namec / K t | g|R dt j i|5 }t j d | }| |k rt d |V ddd dS # 1 swxY w Y dS )a
Context manager to get a directory file descriptor
It also checks if a directory doesn't contain a symlink in the path
:param name: full directory name
:param args: positional arguments for os.open
:param kwargs: keyword arguments for os.open
flagsz/proc/self/fd/{}z%Operations on symlinks are prohibitedN)r| r% O_DIRECTORYrl formatr/ )r} r rz dir_fdreals r
opendir_fdr s
= = = =BN =f = = {-44V<<== 4<<%&MNN N s AA--A14A1rr c # K d}t | t rt t 5 t j | | }t j | |j t
j z t
j z | ddd n # 1 swxY w Y t j
| || } t | | 5 }|pt j | |_ |V |rGt t 5 t j | |j ddd n # 1 swxY w Y nO# |rHt t 5 t j | |j ddd w # 1 swxY w Y w w xY wddd dS # 1 swxY w Y dS )a
Context manager to open file object from file name or from file descriptor
File object extended with 'st' attribute that contains os.stat_result of
the opened file
:param f: file name or file descriptor to open
:param dir_fd: directory descriptor, ignored if 'f' is a file descriptor
:param flags: flags for os.open, ignored if 'f' is a file descriptor
:param mode: mode for built-in open
Nr )ro r )r r ro )
isinstancer@ r rx r% r7 chmodr9 S_IRUSRS_IWUSRrg r= )rr r r ro r= fos r open_fobjr s
B!S 3
g
6***B H
T\1DL@
GAU6 2 2 2
ad 1r bgajj 1HHH
1 g&& 1 1HQRZ00001 1 1 1 1 1 1 1 1 1 1 1 1 1 1
1 g&& 1 1HQRZ00001 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1s A
BB B : FD%F1 D
FD F D !F%E1< E$ E1$E(
(E1+E(
,E11FFFr r is_safec # K |r3t | || 5 }|dfV ddd dS # 1 swxY w Y dS | |fV dS )z
If is_safe flag is True, open file descriptor using name and dir_fd
If is_safe is False, return name and dir_fd as is
)r r N)r| )r} r r r r{ s r
safe_tupler s
T&
6
6
6 "d(NNN Fls +//srcdstc \ | \ }}|\ }}t |rdn t j z } t ||t d 5 }
t ||| d 5 } |r |d t j |
| t |t r2t j |
|
j j d d d n # 1 swxY w Y |r=t |t r(|r |d t j
|| d d d d S # 1 swxY w Y d S )Nr rb)r r ro wbr r r )W_FLAGSr% O_EXCLr R_FLAGSshutil copyfileobjr r@ r ri r= r9 r; ) r r
src_unlink
dst_overwriteracecallsrc_f
src_dir_fddst_f
dst_dir_fdw_flagssrc_fodst_fos r _mover
s E:E:m:;G
jd
0
*G$
B
vv . . .%%%
B vy/@AAAA B B B B B B B B B B B B B B B 0*UC00 0
IeJ / / / /%0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0s7 D!A/C
> D!
C D!C AD!!D%(D%c z K t j | \ }}t j | \ } }
t | 5 } t | 5 } t || t
| 5 }
t |
| t | 5 }t j || }t j }t |t t |j
|j |
||||
d {V |r*|r(|r |d t j || |r>t j |
|j
|j | t j |
|j | d d d n # 1 swxY w Y d d d n # 1 swxY w Y d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S )Nr r )r% r4 splitr r r r r7 rN rO r r, r rA rM r; chownr r9 )r r safe_srcsafe_dstr r r src_dirsrc_namedst_dirdst_namer r src_tuple dst_tuplesrc_str s r safe_mover . s
c**GX
c**GX G B
J- - B Z*gx B
J*gx B
*555%''$ M M
3( 3
Ihz 2 2 2 2 B HXv}fmJ O O O O HXv~j A A A A= B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B Bs F0&F>FCE* F*E.
.F1E.
2F5 FF FF F F0F F0 F F00F47F4)r N)F)T)Nr N)FFTFN)<rN atexitrU loggingr% rI rj r r7 concurrent.futuresr
contextlibr r itertoolsr typingr r r defence360agentr
O_RDONLYr O_TRUNCO_CREATO_WRONLYr getLoggerr0 r setr __annotations__AbstractEventLoopr r" registerr, r r/ r@ r> rD rX r\ ra r_ rZ r r; rv r| r intr boolr r r r3 r- r <module>r s
2 2 2 2 2 2 / / / / / / / / $ $ $ $ $ $ $ $ $ $ ! ! ! ! ! !
+
*rz
!BK
/ 8 $ $ +.#%%
s&' / / / (w'@ ( ( ( (
& ' ' ' ) Nc Nd N N N N$ $ $ $ $N#S # # # #,# ,S , , , ,Ds D# D D D D9# 9 9 9 9
RX
bi 8
S
1 1sCx 1 1 1 1F S # c D 0 uS#Xc4i 00 1 0 uS#Xc4i 00 1 0 0 0 0H
*B *B *B *B *B *B *B *B *Br- defence360agent/utils/__pycache__/safe_sequence.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001462 00000000000 022370 0 ustar
r_jk d dl Z defdZdS ) Npc z | n$# t $ r t j | cY S w xY w| S )z
Make safe sequence from path-like string
Useful if p contains unprintable sequence
If p is safe to be printed (e.g. via logger) return it as is
If it can cause an exception, return bytes instead
)encodeUnicodeEncodeErrorosfsencode)r s X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/safe_sequence.pypathr
sL
{1~~
Hs 88)r strr
r <module>r s3
C
r
defence360agent/utils/__pycache__/safe_sequence.cpython-311.pyc 0000644 0000000 0000000 00000001462 00000000000 021431 0 ustar
r_jk d dl Z defdZdS ) Npc z | n$# t $ r t j | cY S w xY w| S )z
Make safe sequence from path-like string
Useful if p contains unprintable sequence
If p is safe to be printed (e.g. via logger) return it as is
If it can cause an exception, return bytes instead
)encodeUnicodeEncodeErrorosfsencode)r s X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/safe_sequence.pypathr
sL
{1~~
Hs 88)r strr
r <module>r s3
C
r
defence360agent/utils/__pycache__/serialization.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000013063 00000000000 022437 0 ustar
r_jj d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z m
Z
m Z ej e
Zde de fdZd Zd ed
efd Zdd d ed
e e
ef fdZdS )zLJSON persistence helpers for small agent state files (no pickle at runtime). N)iscoroutinefunction)AnyCallableUnionobjreturnc t | t j r d | D S t | t r d | D S t | t
t f r d | D S | S )Nc , g | ]}t | S _to_jsonable.0items X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/serialization.py
<listcomp>z _to_jsonable.<locals>.<listcomp> 333t T""333 c 4 i | ]\ }}|t | S r r )r kvs r
<dictcomp>z _to_jsonable.<locals>.<dictcomp> s$ ;;;tq!<??;;;r c , g | ]}t | S r r r s r r z _to_jsonable.<locals>.<listcomp> r r )
isinstance collectionsdequedictitemslisttuple)r s r r
r
s #{()) 433s3333#t <;;syy{{;;;;#e}%% 433s3333 Jr c t j t | }d | }t |dd 5 }| | ddd n # 1 swxY w Y t
j || dS )z-Atomically write ``obj`` to ``path`` as JSON.z{}.tmpwutf-8encodingN)jsondumpsr
formatopenwriteosreplace)pathr payloadtmpr" s r _dumpr0 s j c**++G
//$
C
c3 ) ) ) Q JsDs A++A/2A/r- attrc fd}|S )zZDecorator: after the wrapped method runs, persist ``self.<attr>``
to ``path`` as JSON.c t j fd }t j fd }t r|S |S )Nc | g|R i |}t | }t d| t | |S NzWrite %r to %rgetattrloggerdebugr0 selfargskwargsresultr r1 fr- s r wrapperz2serialize_attr.<locals>.decorator.<locals>.wrapper& s] Qt-d---f--F$%%C LL)3 5 5 5 $ Mr c K | g|R i | d {V }t | }t d| t | |S r5 r6 r: s r
async_wrapperz8serialize_attr.<locals>.decorator.<locals>.async_wrapper. ss 1T3D333F33333333F$%%C LL)3 5 5 5 $ Mr ) functoolswrapsr )r? r@ rB r1 r- s ` r decoratorz!serialize_attr.<locals>.decorator% s
q ! ! ! r r )r- r1 rE s `` r serialize_attrrF ! s* * r )fallbackrG c t | dd 5 }t j | }ddd n # 1 swxY w Y t |t rt j | S |S # t $ r t d| Y n1t $ r%}t d| Y d}~nd}~ww xY wt | r
| n|S )zRestore an object from ``path`` (JSON); a top-level list becomes a
deque to match the legacy queue API, and missing/unparseable input
returns ``fallback`` (called if callable).rr# r$ Nz Can't find %s to unserializez.Unserialize failed with %r. Returning fallback)
r) r& loadr r r r FileNotFoundErrorr8 warning Exceptionerrorcallable)r- rG rI r es r unserializerQ = s:
$g
.
.
. !)A,,C c4 * $S)) )
= = =5t<<<<< J J J EqIIIIIIIIJ "(++ 988:::9s8 A+ 5 A+ 9A+ 9A+ +%C C B;;C )__doc__r rC r& loggingr+ asyncior typingr r r getLogger__name__r8 r
r0 strrF objectrQ r r r <module>rZ s R R ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' 8 $ $c c C s 8 CG : : : :h.>(? : : : : : :r defence360agent/utils/__pycache__/serialization.cpython-311.pyc 0000644 0000000 0000000 00000013063 00000000000 021500 0 ustar
r_jj d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z m
Z
m Z ej e
Zde de fdZd Zd ed
efd Zdd d ed
e e
ef fdZdS )zLJSON persistence helpers for small agent state files (no pickle at runtime). N)iscoroutinefunction)AnyCallableUnionobjreturnc t | t j r d | D S t | t r d | D S t | t
t f r d | D S | S )Nc , g | ]}t | S _to_jsonable.0items X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/serialization.py
<listcomp>z _to_jsonable.<locals>.<listcomp> 333t T""333 c 4 i | ]\ }}|t | S r r )r kvs r
<dictcomp>z _to_jsonable.<locals>.<dictcomp> s$ ;;;tq!<??;;;r c , g | ]}t | S r r r s r r z _to_jsonable.<locals>.<listcomp> r r )
isinstance collectionsdequedictitemslisttuple)r s r r
r
s #{()) 433s3333#t <;;syy{{;;;;#e}%% 433s3333 Jr c t j t | }d | }t |dd 5 }| | ddd n # 1 swxY w Y t
j || dS )z-Atomically write ``obj`` to ``path`` as JSON.z{}.tmpwutf-8encodingN)jsondumpsr
formatopenwriteosreplace)pathr payloadtmpr" s r _dumpr0 s j c**++G
//$
C
c3 ) ) ) Q JsDs A++A/2A/r- attrc fd}|S )zZDecorator: after the wrapped method runs, persist ``self.<attr>``
to ``path`` as JSON.c t j fd }t j fd }t r|S |S )Nc | g|R i |}t | }t d| t | |S NzWrite %r to %rgetattrloggerdebugr0 selfargskwargsresultr r1 fr- s r wrapperz2serialize_attr.<locals>.decorator.<locals>.wrapper& s] Qt-d---f--F$%%C LL)3 5 5 5 $ Mr c K | g|R i | d {V }t | }t d| t | |S r5 r6 r: s r
async_wrapperz8serialize_attr.<locals>.decorator.<locals>.async_wrapper. ss 1T3D333F33333333F$%%C LL)3 5 5 5 $ Mr ) functoolswrapsr )r? r@ rB r1 r- s ` r decoratorz!serialize_attr.<locals>.decorator% s
q ! ! ! r r )r- r1 rE s `` r serialize_attrrF ! s* * r )fallbackrG c t | dd 5 }t j | }ddd n # 1 swxY w Y t |t rt j | S |S # t $ r t d| Y n1t $ r%}t d| Y d}~nd}~ww xY wt | r
| n|S )zRestore an object from ``path`` (JSON); a top-level list becomes a
deque to match the legacy queue API, and missing/unparseable input
returns ``fallback`` (called if callable).rr# r$ Nz Can't find %s to unserializez.Unserialize failed with %r. Returning fallback)
r) r& loadr r r r FileNotFoundErrorr8 warning Exceptionerrorcallable)r- rG rI r es r unserializerQ = s:
$g
.
.
. !)A,,C c4 * $S)) )
= = =5t<<<<< J J J EqIIIIIIIIJ "(++ 988:::9s8 A+ 5 A+ 9A+ 9A+ +%C C B;;C )__doc__r rC r& loggingr+ asyncior typingr r r getLogger__name__r8 r
r0 strrF objectrQ r r r <module>rZ s R R ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' 8 $ $c c C s 8 CG : : : :h.>(? : : : : : :r defence360agent/utils/__pycache__/sshutil.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000051775 00000000000 021271 0 ustar
r_jF; d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
d dl m Z d dl
mZ d dlmZmZ d dlmZ e
e ZdZdZ ed Z ed
Z ej d Zd e d
efdZ dZ dZ dZ d Z!d#dZ"d
e#fdZ$d$ddd
e fdZ% ej d Z&d
e'fdZ(de d e'd
e fd Z)d e fd Z*d Z+d%d!Z,d%d
e'fd"Z-dS )& N) getLogger)URLError)Path)BACKUP_EXTENSIONatomic_rewrite)open_dir_no_symlinkszFhttps://repo.imunify360.cloudlinux.com/defense360/assisted-cleanup.pubz!clsupport@sshbox\.cloudlinux\.comz/etc/ssh/sshd_configz/etc/ssh/sshd_config.dz^[a-z_][a-z0-9_-]{0,31}\Zusernamereturnc t | t rt | st d| | dk rt d S t
j | j }n%# t $ r}t d| |d}~ww xY w|r t j | st d| d| t t j
|dd S )
zMHome dir via pwd.getpwnam, not /home/ concatenation, to block path traversal.zinvalid username: rootz/root/.ssh/authorized_keyszno such user: Nz non-absolute home directory for : .sshauthorized_keys)
isinstancestr _USERNAME_REmatch
ValueErrorr pwdgetpwnampw_dirKeyErrorospathisabsjoin)r homees R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/sshutil.py_resolve_authorized_keysr s h $ $ ?L,>,>x,H,H ?j88=>>>60111B|H%%, B B Bjxx9::AB
rw}}T**
j8@$$ G
T6+<== > >>s A2 2
B<BB %IMUNIFY_ASSISTED_CLEANUP_KEY_TTL_DAYSz restrict,ptyc 6 K d} t g}t r:| t t d t
| D ]} | D ]}| }|
d r]|
d sH t | d } | c c | c S # t t f$ r Y w xY w# t $ r*}t d| d| Y d}~d}~ww xY wn4# t$ $ r'}t d | Y d}~nd}~ww xY w| S # | c cY S xY w)
z
Detect SSH port from config and its overrides.
Searches configs in reverse order to find the last override first.
z*.confPort # zFailed to read r
NzFailed to get SSH port: )SSH_CONFIG_PATHSSH_CONFIG_DIRexistsextendsortedglobreversed read_text
splitlinesstrip
startswithintsplit
IndexErrorr IOErrorloggerwarning Exception)port config_files config_fileliner s r get_ssh_portr> 9 s
D'( " " G ~':':8'D'D E E F F F $L11 K
' 1 1 3 3 > > @ @ % %D ::<<Dw// %8L8L %% $'tzz||A#7#7D#'KKKK !+J 7 % % % $H% %
C C C C CDDD
7 7 75!55666666667 t s A,E 3A&D#(D
D#E
D D# D D#"E #
E- E
E EE F
F % FF F F Fr$ c r K t j d| d{V \ }} t j | d d{V }| dd }t
j d| rRt d | d
| d |
| d{V d S t d | d
| d |
| d{V dS # t j
$ rO t d| Y |
| d{V dS w xY w# |
| d{V w xY w# t t f$ r+}t d| d| Y d}~dS d}~wt $ r+}t d| d| Y d}~dS d}~ww xY w)zBTest if port is actually an SSH port by checking the server bannerz 127.0.0.1Ng @timeoututf-8ignoreerrorsz ^SSH-[12]\.r% z is confirmed as SSH (banner: )Tz is open but not SSH (got: Fz'Timeout waiting for SSH banner on port zFailed to connect to port r
z#Unexpected error checking SSH port )asyncioopen_connectionwait_forreadlinedecoder1 rer r7 infoclose wait_closedr8 TimeoutErrorConnectionRefusedErrorOSErrorr9 )r: readerwriterbannerr s r check_ssh_connectionrV \ s & 6{D I IIIIIII '"+FOO,=,=sKKKKKKKKKF]]78]<<BBDDFx//
IDIIIII
LLNNN$$&& & & & & & & & & & FDFFVFFF
LLNNN$$&& & & & & & & & & & # NNKTKK L L L LLNNN$$&& & & & & & & & & &
LLNNN$$&& & & & & & & & & "G , ?D??A??@@@uuuuu HTHHQHHIIIuuuuuse G B
D3 1.G !!D3 .G 3,F F .G FF 0GG H6 G>>
H6 H11H6c t j t d } t | }|dk r|S n# t
t f$ r Y nw xY wt S )zDRead the assisted-cleanup key TTL from env, falling back to default. r )r environgetKEY_TTL_ENV_VARr3 TypeErrorr DEFAULT_KEY_TTL_DAYS)rawttls r
_key_ttl_daysr` ~ se
*.. "
-
-C
#hh 77J z "
s ? AAnowzdatetime.datetime | Nonec | p-t j t j j }| t j t
z }| d S )N)daysz
%Y%m%d%H%M)datetimera timezoneutc
astimezone timedeltar` strftime)ra baseexpirys r _expiry_timestamprl s] >(#''(9(=>>D
__
!3 !I!I!I
IF ??< ( (( zOpenSSH_(\d+)\.(\d+)c K t j ddt j j t j j d {V } t j | d d {V \ }}n?# t t j f$ r&}t d| Y d }~dS d }~ww xY w|pd
d d
p|pd
d d
}t | }|s%t d |d d
dS t | d t | d }}||fdk S )Nsshz-V)stdoutstderr r@ zssh -V probe failed: %sFrm rB rC rD z0ssh -V did not match OpenSSH version pattern: %r r' )r! r! )rG create_subprocess_exec
subprocessPIPErI communicaterR rP r7 r8 rK _OPENSSH_VERSION_REsearchr3 group)procrp rq r outputr majorminors r _sshd_supports_expiry_timer s
3 %*%*
' /0@0@0B0BA N N NNNNNNN W) * 0!444uuuuu m
#
#GH
#
=
= '
# fWXf&&
& &v . .E >tt
uu{{1~~&&EKKNN(;(;5E 5>V ##s A-A2 2B.B))B.pub_keysupports_expiryc z |rt dt d}nt }| d| S )Nz,expiry-time="" )KEY_OPTIONS_BASErl r1 )r r optionss r build_authorized_key_liner sJ #%KK5F5H5HKKK" ) )
) ))rm c | dk rdS t j | }n,# t $ r t d| Y dS w xY w|j |j fS )zResolve uid/gid for the target user, or (None, None) when not applicable.
Returning ``(None, None)`` for root or unknown users lets
``atomic_rewrite`` skip its chown step and preserve the existing
file's ownership.
r )NNz>user %r not found; leaving authorized_keys ownership untouched)r r r r7 r8 pw_uidpw_gid)r pws r _target_uid_gidr s{ 6z
\(
#
# L
zz 9bi s %AAc d}|r+ t j dd| d}n# t $ r Y nw xY wt j dt j t j z t j z | }|rT ||t j ||| t j |d n## t $ r t j
| w xY w|S )z@O_NOFOLLOW fd for .ssh under *home_fd*; a symlinked .ssh raises.Fr i )modedir_fdTr ) r mkdirFileExistsErroropenO_RDONLY O_DIRECTORY
O_NOFOLLOWchownfchmod
BaseExceptionrN )home_fduidgidcreatecreatedssh_fds r
_open_ssh_dirr s G
HV% 8 8 8 8GG D
W
bn$r}4 F
3?c*** Ife $ $ $ $ HV Ms
--./B B>r c h K t | }n3# t $ r&}t d| Y d }~dS d }~ww xY wt j dk r t d dS t j t
}n5# t $ r(}t d| Y d }~dS d }~ww xY wd|v sd|v r t d dS t |t d {V }t! | \ }}t j |j j } t) | }n8# t* $ r+}t d
| d | Y d }~dS d }~ww xY w t- |||d
} nQ# t* $ rD}t d|j d | Y d }~t j | dS d }~ww xY w d }
t j dt j t j z | } t j | d 5 } |
}
d d d n # 1 swxY w Y n[# t8 $ r d}
d}
Y nKt* $ r?}|j t: j k r t d| d}
d}
Y d }~nd }~ww xY wtA j! dtD z dz d|
}|}|r|# d s|dz
}||dz z
}tI d|d|||
| t j | n# t j | w xY w t j | n# t j | w xY wt % d| |& dd d d S # tN $ r(}t d| Y d }~dS d }~ww xY w) Nzinstall_pub_key: %sFr z Function must be run as rootz Failed to download public key:
z*Downloaded public key spans multiple lines)r Cannot open home directory r
Tr z Failed to prepare directory r r rrX i zReplacing symlinked %s.*.*\n?backupr r permissionsr z/Installed assisted-cleanup key for user %s (%s)r r' z Failed to install public key: )(r r r7 errorr geteuidurllibrequesturlopenANALYST_PUB_KEY_URLreadrK r1 r r r r r realpathparentr rR r rN r r r fdopenFileNotFoundErrorerrnoELOOPr8 rL sub KEY_PATTERNendswithr rM r4 r9 )r auth_keys_pathr r guarded_liner r r r r r keys_fdfexistingstripped new_contents r install_pub_keyr s! l 5h ? ?NN LL. 2 2 255555
:<<1 LL7 8 8 85 &&':;;
G LL>1>> ? ? ?55555 7??dgoo LLE F F F50 "<">"> > > > > > >
#8,,S
w 5 <== *400GG LLBtBBqBB C C C55555 6
&wSFFF
O>3HOOAOO uuu^
HW g
,
! " , g) bm3 % G 7C00 ,A#$6688, , , , , , , , , , , , , , , ) ( ( ( !H"'KKK ( ( (w%+-- NN#;^LLL !H"'KKKKKK ( 6K'(2
' ({';';D'A'A ( 4'K|d 22 % +! HW BHW = sA & &q )
t 9a99:::uuuuusG O?
AA O? A4O? <AC O?
D ! D>O? D %O? 0A O? F O?
G) G O? GO? G- ,N. -
H;7%H6 N. O? 6H;;N. ?M? .J2 0M? J& M? &J**M? -J*.M? 2L
M? L
5L M? L
A M? *N. ?NN. O? .O9O? ?
P1 P,,P1c t | }n3# t $ r&}t d| Y d}~dS d}~ww xY wt | \ }}t
j |j j } t | }n8# t $ r+}t d| d| Y d}~dS d}~ww xY w t |||d }nQ# t $ rD}t d|j d| Y d}~t j
| dS d}~ww xY w t j dt
j t
j z | }n`# t $ rS}t d
| d| Y d}~t j
| t j
| dS d}~ww xY wt j |d 5 } t% j t j | j }
| } ddd n # 1 swxY w Y t1 j t4 | sHt d | t j
| t j
| dS t1 j d
t4 z dz d| } | s t d| d t= dt> z | d|||
| t= d| d||| t d| t j
| t j
| dS # t j
| w xY w# t j
| w xY w# t@ $ r(}t d| Y d}~dS d}~ww xY w)zRemove analyst public key for the specified user
This function removes the analyst's public key that was previously
installed using the install_pub_key function.
returns: True if key was successfully removed, False otherwise.
zremove_pub_key: %sNFr r
r zCannot open directory r r z Cannot open r z Analyst public key not found in r r rX zFile z will be empty after removalr )r r r r z-Successfully removed analyst public key from Tz Failed to remove public key: )!r r r7 r r r r r r r rR r8 r rN r r r r statS_IMODEfstatfilenost_moder rL rz r rM r r1 r r r9 )
r r r r r r r r r r r contentr s
r remove_pub_keyr W s S 5h ? ?NN LL-q 1 1 155555 #8,,Sw 5 <== *400GG NNDDDDD E E E55555 B
&wSGGG
I^-BIIaII uuuv
HW
8
!! g) bm3 % GG
! ! !NN#G.#G#GA#G#GHHH 555^ HW g! Yw,, '"&,rx
/C/C/K"L"LK ffhhG' ' ' ' ' ' ' ' ' ' ' ' ' ' ' yg66 !KKK>KK !L HW K !fK'(2B #((** KKLLLL %(88 +! % !
)&) ) HW HW 8Q88999uuuuus N"
A>N" A>N" B N"
C C<N" CN" C N
D.*%D)N N" )D..N 3.E" !M0 "
F?, F: M0 N $N" :F??M0 AH5) M0 5H99M0 <H9=:M0 8N N" "B#M0 N N" 0NN N N" "
O, OO)r$ )N)r ).rG rd r r rL r urllib.requestr r loggingr urllib.errorr pathlibr defence360agent.utilsr r defence360agent.utils.fd_opsr __name__r7 r r r( r) compiler r r r] r[ r r> rV r3 r` rl ry boolr r r r r r rm r <module>r sp
! ! ! ! ! ! B B B B B B B B = = = = = = 8 M 3 $-...// rz677 ?s ?t ? ? ? ?, 9! F D s ) )5 ) ) ) ) ) !bj!899 $$ $ $ $ $6*s * * * * * * c ( 2o o o odZ Zt Z Z Z Z Z Zrm defence360agent/utils/__pycache__/sshutil.cpython-311.pyc 0000644 0000000 0000000 00000051775 00000000000 020332 0 ustar
r_jF; d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
d dl m Z d dl
mZ d dlmZmZ d dlmZ e
e ZdZdZ ed Z ed
Z ej d Zd e d
efdZ dZ dZ dZ d Z!d#dZ"d
e#fdZ$d$ddd
e fdZ% ej d Z&d
e'fdZ(de d e'd
e fd Z)d e fd Z*d Z+d%d!Z,d%d
e'fd"Z-dS )& N) getLogger)URLError)Path)BACKUP_EXTENSIONatomic_rewrite)open_dir_no_symlinkszFhttps://repo.imunify360.cloudlinux.com/defense360/assisted-cleanup.pubz!clsupport@sshbox\.cloudlinux\.comz/etc/ssh/sshd_configz/etc/ssh/sshd_config.dz^[a-z_][a-z0-9_-]{0,31}\Zusernamereturnc t | t rt | st d| | dk rt d S t
j | j }n%# t $ r}t d| |d}~ww xY w|r t j | st d| d| t t j
|dd S )
zMHome dir via pwd.getpwnam, not /home/ concatenation, to block path traversal.zinvalid username: rootz/root/.ssh/authorized_keyszno such user: Nz non-absolute home directory for : .sshauthorized_keys)
isinstancestr _USERNAME_REmatch
ValueErrorr pwdgetpwnampw_dirKeyErrorospathisabsjoin)r homees R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/sshutil.py_resolve_authorized_keysr s h $ $ ?L,>,>x,H,H ?j88=>>>60111B|H%%, B B Bjxx9::AB
rw}}T**
j8@$$ G
T6+<== > >>s A2 2
B<BB %IMUNIFY_ASSISTED_CLEANUP_KEY_TTL_DAYSz restrict,ptyc 6 K d} t g}t r:| t t d t
| D ]} | D ]}| }|
d r]|
d sH t | d } | c c | c S # t t f$ r Y w xY w# t $ r*}t d| d| Y d}~d}~ww xY wn4# t$ $ r'}t d | Y d}~nd}~ww xY w| S # | c cY S xY w)
z
Detect SSH port from config and its overrides.
Searches configs in reverse order to find the last override first.
z*.confPort # zFailed to read r
NzFailed to get SSH port: )SSH_CONFIG_PATHSSH_CONFIG_DIRexistsextendsortedglobreversed read_text
splitlinesstrip
startswithintsplit
IndexErrorr IOErrorloggerwarning Exception)port config_files config_fileliner s r get_ssh_portr> 9 s
D'( " " G ~':':8'D'D E E F F F $L11 K
' 1 1 3 3 > > @ @ % %D ::<<Dw// %8L8L %% $'tzz||A#7#7D#'KKKK !+J 7 % % % $H% %
C C C C CDDD
7 7 75!55666666667 t s A,E 3A&D#(D
D#E
D D# D D#"E #
E- E
E EE F
F % FF F F Fr$ c r K t j d| d{V \ }} t j | d d{V }| dd }t
j d| rRt d | d
| d |
| d{V d S t d | d
| d |
| d{V dS # t j
$ rO t d| Y |
| d{V dS w xY w# |
| d{V w xY w# t t f$ r+}t d| d| Y d}~dS d}~wt $ r+}t d| d| Y d}~dS d}~ww xY w)zBTest if port is actually an SSH port by checking the server bannerz 127.0.0.1Ng @timeoututf-8ignoreerrorsz ^SSH-[12]\.r% z is confirmed as SSH (banner: )Tz is open but not SSH (got: Fz'Timeout waiting for SSH banner on port zFailed to connect to port r
z#Unexpected error checking SSH port )asyncioopen_connectionwait_forreadlinedecoder1 rer r7 infoclose wait_closedr8 TimeoutErrorConnectionRefusedErrorOSErrorr9 )r: readerwriterbannerr s r check_ssh_connectionrV \ s & 6{D I IIIIIII '"+FOO,=,=sKKKKKKKKKF]]78]<<BBDDFx//
IDIIIII
LLNNN$$&& & & & & & & & & & FDFFVFFF
LLNNN$$&& & & & & & & & & & # NNKTKK L L L LLNNN$$&& & & & & & & & & &
LLNNN$$&& & & & & & & & & "G , ?D??A??@@@uuuuu HTHHQHHIIIuuuuuse G B
D3 1.G !!D3 .G 3,F F .G FF 0GG H6 G>>
H6 H11H6c t j t d } t | }|dk r|S n# t
t f$ r Y nw xY wt S )zDRead the assisted-cleanup key TTL from env, falling back to default. r )r environgetKEY_TTL_ENV_VARr3 TypeErrorr DEFAULT_KEY_TTL_DAYS)rawttls r
_key_ttl_daysr` ~ se
*.. "
-
-C
#hh 77J z "
s ? AAnowzdatetime.datetime | Nonec | p-t j t j j }| t j t
z }| d S )N)daysz
%Y%m%d%H%M)datetimera timezoneutc
astimezone timedeltar` strftime)ra baseexpirys r _expiry_timestamprl s] >(#''(9(=>>D
__
!3 !I!I!I
IF ??< ( (( zOpenSSH_(\d+)\.(\d+)c K t j ddt j j t j j d {V } t j | d d {V \ }}n?# t t j f$ r&}t d| Y d }~dS d }~ww xY w|pd
d d
p|pd
d d
}t | }|s%t d |d d
dS t | d t | d }}||fdk S )Nsshz-V)stdoutstderr r@ zssh -V probe failed: %sFrm rB rC rD z0ssh -V did not match OpenSSH version pattern: %r r' )r! r! )rG create_subprocess_exec
subprocessPIPErI communicaterR rP r7 r8 rK _OPENSSH_VERSION_REsearchr3 group)procrp rq r outputr majorminors r _sshd_supports_expiry_timer s
3 %*%*
' /0@0@0B0BA N N NNNNNNN W) * 0!444uuuuu m
#
#GH
#
=
= '
# fWXf&&
& &v . .E >tt
uu{{1~~&&EKKNN(;(;5E 5>V ##s A-A2 2B.B))B.pub_keysupports_expiryc z |rt dt d}nt }| d| S )Nz,expiry-time="" )KEY_OPTIONS_BASErl r1 )r r optionss r build_authorized_key_liner sJ #%KK5F5H5HKKK" ) )
) ))rm c | dk rdS t j | }n,# t $ r t d| Y dS w xY w|j |j fS )zResolve uid/gid for the target user, or (None, None) when not applicable.
Returning ``(None, None)`` for root or unknown users lets
``atomic_rewrite`` skip its chown step and preserve the existing
file's ownership.
r )NNz>user %r not found; leaving authorized_keys ownership untouched)r r r r7 r8 pw_uidpw_gid)r pws r _target_uid_gidr s{ 6z
\(
#
# L
zz 9bi s %AAc d}|r+ t j dd| d}n# t $ r Y nw xY wt j dt j t j z t j z | }|rT ||t j ||| t j |d n## t $ r t j
| w xY w|S )z@O_NOFOLLOW fd for .ssh under *home_fd*; a symlinked .ssh raises.Fr i )modedir_fdTr ) r mkdirFileExistsErroropenO_RDONLY O_DIRECTORY
O_NOFOLLOWchownfchmod
BaseExceptionrN )home_fduidgidcreatecreatedssh_fds r
_open_ssh_dirr s G
HV% 8 8 8 8GG D
W
bn$r}4 F
3?c*** Ife $ $ $ $ HV Ms
--./B B>r c h K t | }n3# t $ r&}t d| Y d }~dS d }~ww xY wt j dk r t d dS t j t
}n5# t $ r(}t d| Y d }~dS d }~ww xY wd|v sd|v r t d dS t |t d {V }t! | \ }}t j |j j } t) | }n8# t* $ r+}t d
| d | Y d }~dS d }~ww xY w t- |||d
} nQ# t* $ rD}t d|j d | Y d }~t j | dS d }~ww xY w d }
t j dt j t j z | } t j | d 5 } |
}
d d d n # 1 swxY w Y n[# t8 $ r d}
d}
Y nKt* $ r?}|j t: j k r t d| d}
d}
Y d }~nd }~ww xY wtA j! dtD z dz d|
}|}|r|# d s|dz
}||dz z
}tI d|d|||
| t j | n# t j | w xY w t j | n# t j | w xY wt % d| |& dd d d S # tN $ r(}t d| Y d }~dS d }~ww xY w) Nzinstall_pub_key: %sFr z Function must be run as rootz Failed to download public key:
z*Downloaded public key spans multiple lines)r Cannot open home directory r
Tr z Failed to prepare directory r r rrX i zReplacing symlinked %s.*.*\n?backupr r permissionsr z/Installed assisted-cleanup key for user %s (%s)r r' z Failed to install public key: )(r r r7 errorr geteuidurllibrequesturlopenANALYST_PUB_KEY_URLreadrK r1 r r r r r realpathparentr rR r rN r r r fdopenFileNotFoundErrorerrnoELOOPr8 rL sub KEY_PATTERNendswithr rM r4 r9 )r auth_keys_pathr r guarded_liner r r r r r keys_fdfexistingstripped new_contents r install_pub_keyr s! l 5h ? ?NN LL. 2 2 255555
:<<1 LL7 8 8 85 &&':;;
G LL>1>> ? ? ?55555 7??dgoo LLE F F F50 "<">"> > > > > > >
#8,,S
w 5 <== *400GG LLBtBBqBB C C C55555 6
&wSFFF
O>3HOOAOO uuu^
HW g
,
! " , g) bm3 % G 7C00 ,A#$6688, , , , , , , , , , , , , , , ) ( ( ( !H"'KKK ( ( (w%+-- NN#;^LLL !H"'KKKKKK ( 6K'(2
' ({';';D'A'A ( 4'K|d 22 % +! HW BHW = sA & &q )
t 9a99:::uuuuusG O?
AA O? A4O? <AC O?
D ! D>O? D %O? 0A O? F O?
G) G O? GO? G- ,N. -
H;7%H6 N. O? 6H;;N. ?M? .J2 0M? J& M? &J**M? -J*.M? 2L
M? L
5L M? L
A M? *N. ?NN. O? .O9O? ?
P1 P,,P1c t | }n3# t $ r&}t d| Y d}~dS d}~ww xY wt | \ }}t
j |j j } t | }n8# t $ r+}t d| d| Y d}~dS d}~ww xY w t |||d }nQ# t $ rD}t d|j d| Y d}~t j
| dS d}~ww xY w t j dt
j t
j z | }n`# t $ rS}t d
| d| Y d}~t j
| t j
| dS d}~ww xY wt j |d 5 } t% j t j | j }
| } ddd n # 1 swxY w Y t1 j t4 | sHt d | t j
| t j
| dS t1 j d
t4 z dz d| } | s t d| d t= dt> z | d|||
| t= d| d||| t d| t j
| t j
| dS # t j
| w xY w# t j
| w xY w# t@ $ r(}t d| Y d}~dS d}~ww xY w)zRemove analyst public key for the specified user
This function removes the analyst's public key that was previously
installed using the install_pub_key function.
returns: True if key was successfully removed, False otherwise.
zremove_pub_key: %sNFr r
r zCannot open directory r r z Cannot open r z Analyst public key not found in r r rX zFile z will be empty after removalr )r r r r z-Successfully removed analyst public key from Tz Failed to remove public key: )!r r r7 r r r r r r r rR r8 r rN r r r r statS_IMODEfstatfilenost_moder rL rz r rM r r1 r r r9 )
r r r r r r r r r r r contentr s
r remove_pub_keyr W s S 5h ? ?NN LL-q 1 1 155555 #8,,Sw 5 <== *400GG NNDDDDD E E E55555 B
&wSGGG
I^-BIIaII uuuv
HW
8
!! g) bm3 % GG
! ! !NN#G.#G#GA#G#GHHH 555^ HW g! Yw,, '"&,rx
/C/C/K"L"LK ffhhG' ' ' ' ' ' ' ' ' ' ' ' ' ' ' yg66 !KKK>KK !L HW K !fK'(2B #((** KKLLLL %(88 +! % !
)&) ) HW HW 8Q88999uuuuus N"
A>N" A>N" B N"
C C<N" CN" C N
D.*%D)N N" )D..N 3.E" !M0 "
F?, F: M0 N $N" :F??M0 AH5) M0 5H99M0 <H9=:M0 8N N" "B#M0 N N" 0NN N N" "
O, OO)r$ )N)r ).rG rd r r rL r urllib.requestr r loggingr urllib.errorr pathlibr defence360agent.utilsr r defence360agent.utils.fd_opsr __name__r7 r r r( r) compiler r r r] r[ r r> rV r3 r` rl ry boolr r r r r r rm r <module>r sp
! ! ! ! ! ! B B B B B B B B = = = = = = 8 M 3 $-...// rz677 ?s ?t ? ? ? ?, 9! F D s ) )5 ) ) ) ) ) !bj!899 $$ $ $ $ $6*s * * * * * * c ( 2o o o odZ Zt Z Z Z Z Z Zrm defence360agent/utils/__pycache__/subprocess.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004152 00000000000 021751 0 ustar
r_j" Z d Z ddlZddlZddlmZ g dZ G d dej Zd ZdS )z0General utilities for working with subprocesses. N)PIPE)r CalledProcessError check_outputc e Zd ZdZd ZdS )r z'Add stdout,stderr to str representationc & | j rn| j dk rcd| j dt j | j d| j d| j S # t $ r! d| j | j | j | j fz cY S w xY wd| j | j | j | j fz S )Nr z Command 'z ' died with z
.
Stdout: z
Stderr: z?Command '%s' died with unknown signal %d.
Stdout: %s
Stderr: %szDCommand '%s' returned non-zero exit status %d.
Stdout: %s
Stderr: %s)
returncodecmdsignalSignalsstdoutstderr
ValueError)selfs U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/subprocess.py__str__zCalledProcessError.__str__ s ? t 2 2
HHHN ( KKKKK
/x$/!14; LM
+8T_dk4;GH
s 4A (A32A3N)__name__
__module__ __qualname____doc__r r r r s) 11 r r c t j | i |S # t j $ r,}t |j |j |j |j dd}~ww xY w)z_A wrapper for stdlib subprocess.check_output.
Include stdout/stderr in error message.
N)
subprocessr r r r r r
)argskwargses r r r % se
&7777 (
L!%18
s A'A A)r r
r r __all__r r r r r <module>r s 6 6
8
8
8 6 8
r defence360agent/utils/__pycache__/subprocess.cpython-311.pyc 0000644 0000000 0000000 00000004152 00000000000 021012 0 ustar
r_j" Z d Z ddlZddlZddlmZ g dZ G d dej Zd ZdS )z0General utilities for working with subprocesses. N)PIPE)r CalledProcessError check_outputc e Zd ZdZd ZdS )r z'Add stdout,stderr to str representationc & | j rn| j dk rcd| j dt j | j d| j d| j S # t $ r! d| j | j | j | j fz cY S w xY wd| j | j | j | j fz S )Nr z Command 'z ' died with z
.
Stdout: z
Stderr: z?Command '%s' died with unknown signal %d.
Stdout: %s
Stderr: %szDCommand '%s' returned non-zero exit status %d.
Stdout: %s
Stderr: %s)
returncodecmdsignalSignalsstdoutstderr
ValueError)selfs U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/subprocess.py__str__zCalledProcessError.__str__ s ? t 2 2
HHHN ( KKKKK
/x$/!14; LM
+8T_dk4;GH
s 4A (A32A3N)__name__
__module__ __qualname____doc__r r r r s) 11 r r c t j | i |S # t j $ r,}t |j |j |j |j dd}~ww xY w)z_A wrapper for stdlib subprocess.check_output.
Include stdout/stderr in error message.
N)
subprocessr r r r r r
)argskwargses r r r % se
&7777 (
L!%18
s A'A A)r r
r r __all__r r r r r <module>r s 6 6
8
8
8 6 8
r defence360agent/utils/__pycache__/support.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000017231 00000000000 021277 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dl m
Z
d dl m Z d dl
mZ e
e Z G d de ZdZd Zd
Zd Zd Zd
Z ddZd Zd Zdddde fdZ d Z d Z dS ) N)partial) getLogger)Path)ANTIVIRUS_MODEc e Zd Z fdZ xZS )ZendeskAPIErrorc t || _ || _ || _ t | d S )N)error descriptiondetailssuper__init__)selfr
r r __class__s R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/support.pyr zZendeskAPIError.__init__ s7
&
%%%%% )__name__
__module__ __qualname__r
__classcell__)r s @r r r s8 & & & & & & & & &r r z(https://cloudlinux.zendesk.com/api/v2/{}z-https://cloudlinux.zendesk.com/hc/requests/{}iqiiQdl VA,c K t | d{V }t | }||g|d< t | | }t t rdnddt ddg} |r | t |d |r | t |d t |||| }
t |
d{V S )
z?
Send request to support of Imunify360 via Zendesk API
N)bodyuploads)nameemail
pr_imunify_avpr_im360)idvalueT) requestersubjectcomment
custom_fields) _upload_attachmentsdict _PRODUCT_IDr _PRIVACY_POLICY_IDappend
_DOCTOR_ID_CLN_ID_post_support_request) sender_emailr! r
doctor_keycln attachments upload_tokenr" r r# requests r send_requestr2 " s -[99999999L $$$G *^ ,l;;;I
(6F__J
"D11 M F J D DEEE
< Gc : :;;; # G 'w// / / / / / //r c t j t j | | j d S )Nzutf-8)encoding)jsonloadio
TextIOWrapperheadersget_content_charset)responses r decode_as_jsonr< S sB 9
%99'BB
r c t j | }|j }|r|dz
}|t j | z
}t j |j |j |j |j ||j
f }|S )N&) urllibparseurlparsequery urlencode
urlunparseschemenetlocpathparamsfragment)rH urlprB s r parse_paramsrL \ s c""A
GE
V\
#
#F
+
++E
,
!
!
18QVQXuajA C Jr )rH timeoutdatac |rt || } t j t j | || | 5 }|j t
| fcddd S # 1 swxY w Y dS # t j $ r t t $ r:}t |d s |j |j t
| ni fcY d}~S d}~ww xY w)zHTTP POST *data* to *url* with given *headers*.
Add query *params* to the *url* if given.
Return (http_status, decoded_json_response) tuple.
)rN r9 )rM Ncode)
rL r? r1 urlopenRequestrP r< socketrM TimeoutErrorOSErrorhasattrfp)rJ rN r9 rH rM r; es r
_post_datarY h sU (63'' G
^
#
# N " "3T7 " C C $
; =.":":: ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;
> G G Gq&!! vQT-=q)))2FFFFFFF GsB AB A8+ B 8A<<B ?A< B C $/CC C c K t d }ddi}t j t | d d }t
j }| dt ||| d{V \ }}|d k rs|
d
}|r t |d S d | v rdS t d
dd | t |
dd |
d |
di )zReturn url of the support request or None if request is suspended,
because of we not able to obtain the id of the ticket if it suspended.
z
requests.json Content-Typezapplication/json)r1 T) sort_keysasciiN r1 r suspended_ticketzResponse errorz
UNKNOWN ERRORz{!r}r
r r )
_API_URL_TMPLformatr5 dumpsr% encodeasyncioget_event_looprun_in_executorrY get _HC_URL_TMPLkeysr )r1 rJ r9 rN loopstatusresult request_datas r r+ r+ sb
/
/C 12G :d7+++t < < < C CG L LD ! # #D // j#tW NFF }} zz),, &&|D'9:: :
6;;==
0
04! /6==3H3H
JJw 0 0 JJ} % % JJy" % %
r c K d }| |S t j }| D ]}t | }d|j i}|||d< | d t t t d | ddi| d {V \ }}|dk r#t d||d ||d
d }|S ) Nfilenametokenz uploads.jsonr[ zapplication/binary)rN r9 rH r^ z'Failed to upload file %s to Zendesk: %sr
upload) rd re r r rf r rY r` ra
read_bytesloggerwarning)r/ r0 rj
attachmentrG rH rk rl s r r$ r$ s$ L ! # #D! 5 5
J di( # *F7O # 3 3 $$^44__&&')=>
S== NN9w
!(+G4L r )NNN) rd r7 r5 rS urllib.parser? urllib.request functoolsr loggingr pathlibr defence360agent.contracts.configr r rs Exceptionr r` rh r& r) r* r' r2 r< rL bytesrY r+ r$ r r <module>r s~
; ; ; ; ; ; 8 & & & & &i & & & ;
>
#
.0 .0 .0 .0b 59$ G G G% G G G G2
:! ! ! ! !r defence360agent/utils/__pycache__/support.cpython-311.pyc 0000644 0000000 0000000 00000017231 00000000000 020340 0 ustar
r_j d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dl m
Z
d dl m Z d dl
mZ e
e Z G d de ZdZd Zd
Zd Zd Zd
Z ddZd Zd Zdddde fdZ d Z d Z dS ) N)partial) getLogger)Path)ANTIVIRUS_MODEc e Zd Z fdZ xZS )ZendeskAPIErrorc t || _ || _ || _ t | d S )N)error descriptiondetailssuper__init__)selfr
r r __class__s R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/support.pyr zZendeskAPIError.__init__ s7
&
%%%%% )__name__
__module__ __qualname__r
__classcell__)r s @r r r s8 & & & & & & & & &r r z(https://cloudlinux.zendesk.com/api/v2/{}z-https://cloudlinux.zendesk.com/hc/requests/{}iqiiQdl VA,c K t | d{V }t | }||g|d< t | | }t t rdnddt ddg} |r | t |d |r | t |d t |||| }
t |
d{V S )
z?
Send request to support of Imunify360 via Zendesk API
N)bodyuploads)nameemail
pr_imunify_avpr_im360)idvalueT) requestersubjectcomment
custom_fields) _upload_attachmentsdict _PRODUCT_IDr _PRIVACY_POLICY_IDappend
_DOCTOR_ID_CLN_ID_post_support_request) sender_emailr! r
doctor_keycln attachments upload_tokenr" r r# requests r send_requestr2 " s -[99999999L $$$G *^ ,l;;;I
(6F__J
"D11 M F J D DEEE
< Gc : :;;; # G 'w// / / / / / //r c t j t j | | j d S )Nzutf-8)encoding)jsonloadio
TextIOWrapperheadersget_content_charset)responses r decode_as_jsonr< S sB 9
%99'BB
r c t j | }|j }|r|dz
}|t j | z
}t j |j |j |j |j ||j
f }|S )N&) urllibparseurlparsequery urlencode
urlunparseschemenetlocpathparamsfragment)rH urlprB s r parse_paramsrL \ s c""A
GE
V\
#
#F
+
++E
,
!
!
18QVQXuajA C Jr )rH timeoutdatac |rt || } t j t j | || | 5 }|j t
| fcddd S # 1 swxY w Y dS # t j $ r t t $ r:}t |d s |j |j t
| ni fcY d}~S d}~ww xY w)zHTTP POST *data* to *url* with given *headers*.
Add query *params* to the *url* if given.
Return (http_status, decoded_json_response) tuple.
)rN r9 )rM Ncode)
rL r? r1 urlopenRequestrP r< socketrM TimeoutErrorOSErrorhasattrfp)rJ rN r9 rH rM r; es r
_post_datarY h sU (63'' G
^
#
# N " "3T7 " C C $
; =.":":: ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;
> G G Gq&!! vQT-=q)))2FFFFFFF GsB AB A8+ B 8A<<B ?A< B C $/CC C c K t d }ddi}t j t | d d }t
j }| dt ||| d{V \ }}|d k rs|
d
}|r t |d S d | v rdS t d
dd | t |
dd |
d |
di )zReturn url of the support request or None if request is suspended,
because of we not able to obtain the id of the ticket if it suspended.
z
requests.json Content-Typezapplication/json)r1 T) sort_keysasciiN r1 r suspended_ticketzResponse errorz
UNKNOWN ERRORz{!r}r
r r )
_API_URL_TMPLformatr5 dumpsr% encodeasyncioget_event_looprun_in_executorrY get _HC_URL_TMPLkeysr )r1 rJ r9 rN loopstatusresult request_datas r r+ r+ sb
/
/C 12G :d7+++t < < < C CG L LD ! # #D // j#tW NFF }} zz),, &&|D'9:: :
6;;==
0
04! /6==3H3H
JJw 0 0 JJ} % % JJy" % %
r c K d }| |S t j }| D ]}t | }d|j i}|||d< | d t t t d | ddi| d {V \ }}|dk r#t d||d ||d
d }|S ) Nfilenametokenz uploads.jsonr[ zapplication/binary)rN r9 rH r^ z'Failed to upload file %s to Zendesk: %sr
upload) rd re r r rf r rY r` ra
read_bytesloggerwarning)r/ r0 rj
attachmentrG rH rk rl s r r$ r$ s$ L ! # #D! 5 5
J di( # *F7O # 3 3 $$^44__&&')=>
S== NN9w
!(+G4L r )NNN) rd r7 r5 rS urllib.parser? urllib.request functoolsr loggingr pathlibr defence360agent.contracts.configr r rs Exceptionr r` rh r& r) r* r' r2 r< rL bytesrY r+ r$ r r <module>r s~
; ; ; ; ; ; 8 & & & & &i & & & ;
>
#
.0 .0 .0 .0b 59$ G G G% G G G G2
:! ! ! ! !r defence360agent/utils/__pycache__/threads.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000003021 00000000000 021205 0 ustar
r_j 0 d Z ddlZddlZddlmZ dZd ZdS )a High-level support for working with threads in asyncio
Modified from Python 3.10 stdlib
https://github.com/python/cpython/blob/b11a951f16f0603d98de24fee5c023df83ea552c/Lib/asyncio/threads.py
(the license GPL-compatible but doesn't require to open-source either).
N)events) to_threadc K t j }t j }t j |j | g|R i |}| d| d{V S )a Asynchronously run function *func* in a separate thread.
Any *args and **kwargs supplied for this function are directly passed
to *func*. Also, the current :class:`contextvars.Context` is propogated,
allowing context variables from the main thread to be accessed in the
separate thread.
Return a coroutine that can be awaited to get the eventual result of *func*
N)r get_running_loop contextvars copy_context functoolspartialrunrun_in_executor)funcargskwargsloopctx func_calls R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/threads.pyr r sp " $ $D
"
$
$C!#'4A$AAA&AAI%%dI66 6 6 6 6 6 66 )__doc__r r asyncior __all__r r r <module>r s[ 7 7 7 7 7r defence360agent/utils/__pycache__/threads.cpython-311.pyc 0000644 0000000 0000000 00000003021 00000000000 020246 0 ustar
r_j 0 d Z ddlZddlZddlmZ dZd ZdS )a High-level support for working with threads in asyncio
Modified from Python 3.10 stdlib
https://github.com/python/cpython/blob/b11a951f16f0603d98de24fee5c023df83ea552c/Lib/asyncio/threads.py
(the license GPL-compatible but doesn't require to open-source either).
N)events) to_threadc K t j }t j }t j |j | g|R i |}| d| d{V S )a Asynchronously run function *func* in a separate thread.
Any *args and **kwargs supplied for this function are directly passed
to *func*. Also, the current :class:`contextvars.Context` is propogated,
allowing context variables from the main thread to be accessed in the
separate thread.
Return a coroutine that can be awaited to get the eventual result of *func*
N)r get_running_loop contextvars copy_context functoolspartialrunrun_in_executor)funcargskwargsloopctx func_calls R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/threads.pyr r sp " $ $D
"
$
$C!#'4A$AAA&AAI%%dI66 6 6 6 6 6 66 )__doc__r r asyncior __all__r r r <module>r s[ 7 7 7 7 7r defence360agent/utils/__pycache__/validate.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000017750 00000000000 021362 0 ustar
r_j d dl mZ d dlmZmZmZmZmZmZm Z m
Z
m Z d dl m
Z
mZmZ e
d Z G d dee Z G d dee Zd Zdd Z G d d
ZdS ) )Enum)
IPV4LENGTH
IPV6LENGTHAddressValueError IPv4Address IPv4Network IPv6Address IPv6Network
ip_address
ip_network)LiteralOptionalUnion)ipv4ipv6c e Zd ZdZdZd ZdS ) LocalhostIPz 127.0.0.1z::1c | j S N)valueselfs S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/validate.py__str__zLocalhostIP.__str__ s
z N)__name__
__module__ __qualname__r r r r r r r s- D D r r c X e Zd ZdZdZdZd Zedee ded fd Z
dS ) NumericIPVersionz=Example: (IPListRecord.version==NumericIPVersion[ip_version]) c * t | j S r )strr r s r r zNumericIPVersion.__str__ s 4: r
ip_versionreturnc F |d S |t j k r| j n| j S r )IPV4r r )clsr& s r from_ip_versionz NumericIPVersion.from_ip_version# s) 4%..sxxCH<r N) r r r __doc__r r r classmethodr IPVersionr, r r r r! r! sn GG D D =!),= $ %= = = [= = =r r! c 6 t | S r )r) is_valid_ipv4_addr)addrs r r1 r1 - s
& &&r Fc 8 t | | S r )r) is_valid_ipv4_network)r2 stricts r r4 r4 1 s
# #D& 1 11r c e Zd ZU dZeed< dZeed< ed Zed Z ed Z
ed Z ed Z e dd e
eeef fd Ze dd e
eeef fd
Zed Zedd Zede
eeeeef de
eef fd Zede
eef defd Zede
eeef de
eef fd ZdS )r) r r* r V6c R t fd| j | j fD S )Nc 3 $ K | ]
}|k V d S r r ).0verversions r <genexpr>z"IP.check_ip_ver.<locals>.<genexpr>; s' >>c7c>>>>>>>r )anyr* r7 )r+ r< s `r check_ip_verzIP.check_ip_ver9 s/ >>>>cfcf-=>>>>>>r c J t | n# t $ r Y dS w xY wdS NFT)r
ValueErrorr+ r2 s r is_valid_ipzIP.is_valid_ip= s? t 55 t
c 6 | j |i |p | j |i |S r )r4 is_valid_ipv6_network)r+ argskwargss r is_valid_ip_networkzIP.is_valid_ip_networkE s> (s(
8
&S
&
7
7
7 8r c J t | n# t $ r Y dS w xY wdS rA )r r rC s r r1 zIP.is_valid_ipv4_addrK ? 55 trE c J t | n# t $ r Y dS w xY wdS rA )r r rC s r is_valid_ipv6_addrzIP.is_valid_ipv6_addrS rL rE Fr2 c n t | }n# t $ r Y dS w xY w|r|j t k S dS rA )r rB prefixlenr r+ r2 r5 ips r r4 zIP.is_valid_ipv4_network[ T T""BB 55 .<:- -trE c n t | }n# t $ r Y dS w xY w|r|j t k S dS rA )r
rB rP r rQ s r rG zIP.is_valid_ipv6_networki rS rE c | | r t j S | | r t j S t d )NzInvalid ip address)r4 r) r* rG r7 rB rC s r type_ofz
IP.type_ofw sK $ $T * * 5L
&
&t
,
, 5L-...r /64c H t ||z d }t | S )zConver ipv6 addr to ipv6 network with mask
:param str ip: ip for converting
:param str mask: ip network mask
F)r5 )r
r% )r+ rR masknetworks r convert_to_ipv6_networkzIP.convert_to_ipv6_network s& b4i6667||r ip_argr' c t | t t f r| S t | t t f r7| j dk rt nt }t t | |f S t | S )zt
Eliminate str from the Union
:raise ValueError: if cannot convert ip_arg str to ip network
r" )
isinstancer r
r r r< r r r int)r\ rP s r adopt_to_ipvX_networkzIP.adopt_to_ipvX_network ss f{K 8 9 9 8M
k :
;
; 8&,n&9&9
zI s6{{I 677 7&!!!r netc p t |j st |j S t | S )zz
IPv4Network('192.168.1.1/32') -> '192.168.1.1'
IPv4Network('192.168.1.0/24') -> '192.168.1.0/24'
)r_ hostmaskr% network_address)r+ ra s r ip_net_to_stringzIP.ip_net_to_string s2 3< ,s*++ +3xxr rR c t |t r/t | t | S |S r )r^ r r
r[ r% )r+ rR s r ipv6_to_64networkzIP.ipv6_to_64network s> b+ & & E s : :3r77 C CDD D r NF)rW )r r r r* r/ __annotations__r7 r. r? rD rJ r1 rN r r% r r
r4 rG rV r[ staticmethodr r r` re rg r r r r) r) 5 s6 B B ? ? [? [ 8 8 [8
[ [ @E k;67 [ @E k;67 [ / / [/ [
"c; [+MN
" {K' (
"
"
" \
" 5k)A#B s [ {K45 {K' ( [ r r) Nrh )enumr ipaddressr r r r r r r
r r typingr
r r r/ r% r r_ r! r1 r4 r) r r r <module>rn sf
, + + + + + + + + + N # #t = = = = =sD = = =&' ' '2 2 2 2u u u u u u u u u ur defence360agent/utils/__pycache__/validate.cpython-311.pyc 0000644 0000000 0000000 00000017750 00000000000 020423 0 ustar
r_j d dl mZ d dlmZmZmZmZmZmZm Z m
Z
m Z d dl m
Z
mZmZ e
d Z G d dee Z G d dee Zd Zdd Z G d d
ZdS ) )Enum)
IPV4LENGTH
IPV6LENGTHAddressValueError IPv4Address IPv4Network IPv6Address IPv6Network
ip_address
ip_network)LiteralOptionalUnion)ipv4ipv6c e Zd ZdZdZd ZdS ) LocalhostIPz 127.0.0.1z::1c | j S N)valueselfs S/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/validate.py__str__zLocalhostIP.__str__ s
z N)__name__
__module__ __qualname__r r r r r r r s- D D r r c X e Zd ZdZdZdZd Zedee ded fd Z
dS ) NumericIPVersionz=Example: (IPListRecord.version==NumericIPVersion[ip_version]) c * t | j S r )strr r s r r zNumericIPVersion.__str__ s 4: r
ip_versionreturnc F |d S |t j k r| j n| j S r )IPV4r r )clsr& s r from_ip_versionz NumericIPVersion.from_ip_version# s) 4%..sxxCH<r N) r r r __doc__r r r classmethodr IPVersionr, r r r r! r! sn GG D D =!),= $ %= = = [= = =r r! c 6 t | S r )r) is_valid_ipv4_addr)addrs r r1 r1 - s
& &&r Fc 8 t | | S r )r) is_valid_ipv4_network)r2 stricts r r4 r4 1 s
# #D& 1 11r c e Zd ZU dZeed< dZeed< ed Zed Z ed Z
ed Z ed Z e dd e
eeef fd Ze dd e
eeef fd
Zed Zedd Zede
eeeeef de
eef fd Zede
eef defd Zede
eeef de
eef fd ZdS )r) r r* r V6c R t fd| j | j fD S )Nc 3 $ K | ]
}|k V d S r r ).0verversions r <genexpr>z"IP.check_ip_ver.<locals>.<genexpr>; s' >>c7c>>>>>>>r )anyr* r7 )r+ r< s `r check_ip_verzIP.check_ip_ver9 s/ >>>>cfcf-=>>>>>>r c J t | n# t $ r Y dS w xY wdS NFT)r
ValueErrorr+ r2 s r is_valid_ipzIP.is_valid_ip= s? t 55 t
c 6 | j |i |p | j |i |S r )r4 is_valid_ipv6_network)r+ argskwargss r is_valid_ip_networkzIP.is_valid_ip_networkE s> (s(
8
&S
&
7
7
7 8r c J t | n# t $ r Y dS w xY wdS rA )r r rC s r r1 zIP.is_valid_ipv4_addrK ? 55 trE c J t | n# t $ r Y dS w xY wdS rA )r r rC s r is_valid_ipv6_addrzIP.is_valid_ipv6_addrS rL rE Fr2 c n t | }n# t $ r Y dS w xY w|r|j t k S dS rA )r rB prefixlenr r+ r2 r5 ips r r4 zIP.is_valid_ipv4_network[ T T""BB 55 .<:- -trE c n t | }n# t $ r Y dS w xY w|r|j t k S dS rA )r
rB rP r rQ s r rG zIP.is_valid_ipv6_networki rS rE c | | r t j S | | r t j S t d )NzInvalid ip address)r4 r) r* rG r7 rB rC s r type_ofz
IP.type_ofw sK $ $T * * 5L
&
&t
,
, 5L-...r /64c H t ||z d }t | S )zConver ipv6 addr to ipv6 network with mask
:param str ip: ip for converting
:param str mask: ip network mask
F)r5 )r
r% )r+ rR masknetworks r convert_to_ipv6_networkzIP.convert_to_ipv6_network s& b4i6667||r ip_argr' c t | t t f r| S t | t t f r7| j dk rt nt }t t | |f S t | S )zt
Eliminate str from the Union
:raise ValueError: if cannot convert ip_arg str to ip network
r" )
isinstancer r
r r r< r r r int)r\ rP s r adopt_to_ipvX_networkzIP.adopt_to_ipvX_network ss f{K 8 9 9 8M
k :
;
; 8&,n&9&9
zI s6{{I 677 7&!!!r netc p t |j st |j S t | S )zz
IPv4Network('192.168.1.1/32') -> '192.168.1.1'
IPv4Network('192.168.1.0/24') -> '192.168.1.0/24'
)r_ hostmaskr% network_address)r+ ra s r ip_net_to_stringzIP.ip_net_to_string s2 3< ,s*++ +3xxr rR c t |t r/t | t | S |S r )r^ r r
r[ r% )r+ rR s r ipv6_to_64networkzIP.ipv6_to_64network s> b+ & & E s : :3r77 C CDD D r NF)rW )r r r r* r/ __annotations__r7 r. r? rD rJ r1 rN r r% r r
r4 rG rV r[ staticmethodr r r` re rg r r r r) r) 5 s6 B B ? ? [? [ 8 8 [8
[ [ @E k;67 [ @E k;67 [ / / [/ [
"c; [+MN
" {K' (
"
"
" \
" 5k)A#B s [ {K45 {K' ( [ r r) Nrh )enumr ipaddressr r r r r r r
r r typingr
r r r/ r% r r_ r! r1 r4 r) r r r <module>rn sf
, + + + + + + + + + N # #t = = = = =sD = = =&' ' '2 2 2 2u u u u u u u u u ur defence360agent/utils/__pycache__/whmcs.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000030434 00000000000 020704 0 ustar
r_jh d dl Z d dlZd dlZd dlmc mc mZ d dl m
Z
d dl m Z d dl
mZ d dlmZmZ d dlmZmZmZ e
e ZeegZ G d d Zd Zd
Zd Z d Z d
Z d Z d Z d Z!d Z"dS ) N) getLogger)config)
update_config)update_users_protection MyImunify)MU_PLUGIN_INSTALLATIONADVICE_EMAIL_NOTIFICATIONWordPressMuPluginc " e Zd ZdZdZd Zd ZdS ) WhmcsConfz
read/write data passed by whmcs
Internal use, for commands called from whcms only
it saves ALL data came from whcms w/o any validation deliberately
in order to simplify compatability with current installed whmcs plugin
z /var/imunify360/whmcs_data.jsonc t j | j si S t | j d 5 }| }d d d n # 1 swxY w Y nA# t
$ r4}t dt | i cY d }~S d }~ww xY w t j
| }n9# t j t f$ r t d| i cY S w xY w|S )Nrz"Failed to read whmcs data file: %sz"Malformed file with whmcs data: %s)
ospathexistsopenreadIOErrorloggererrorstrjsonloadsJSONDecodeError
ValueError)selffraw_dataedatas P/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/whmcs.pyr zWhmcsConf.read! s= w~~di(( I di%%
$ 6688
$
$
$
$
$
$
$
$
$
$
$
$
$
$
$ LL=s1vv F F FIIIIII :h''DD$j1 LL=x H H HIII sR A* A A* A""A* %A"&A* *
B(4)B# B(#B(,C 3C76C7c d | }| | t | j d 5 }t j ||d ddd dS # 1 swxY w Y dS # t $ r3}t dt | Y d}~dS d}~ww xY w)z
Saves ALL data passed by WHMCS
it should not have any validations deliberately to be as compatible as possible
with current installed WHMCS plugin
w )indentNz&Failed to write whmcs data to file: %s)
r updater r r dumpr r r r )r r current_datafiler s r! savezWhmcsConf.save4 s yy{{ D!!! Kdi%%
8 ,Q7777
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8 K K K LLA3q66 J J J J J J J J J Ks; A2 A% A2 %A))A2 ,A)-A2 2
B/<(B**B/N)__name__
__module__ __qualname____doc__r r r* r! r r sH -D &K K K K Kr0 r c p K | t j }t | | d {V S N)getr MY_IMUNIFY_KEY mi_update)sinkr my_imunify_updatess r! sync_billing_datar8 E s> &"7884!344 4 4 4 4 4 44r0 c j | dk r
dddd| fS | dk r
dddd| fS | dk rd |fS | |fS )
zf
Convert several keys to config key, otherwise just return same key
any key is acceptable
statusenableTF)activeinactive
protection)enableddisabledmu_plugin_installationsmart_advice_allowedr/ keyvalues r! convert_to_config_key_valuerF J s
h !
!
( ( (%u,, :r0 c V | dk rd|rdndfS | dk rd|rdndfS | dk rd |fS | |fS )
zk
Convert several keys from config format, otherwise just return same key
any key is acceptable
r; r: r< r= r> r? r@ rB rA r/ rC s r! convert_from_config_key_valuerH d sa
he;((<< 5 @iijAA & & &'.. :r0 c \ K t j d {V S r2 )hp HostingPanel get_usersr/ r0 r! rL rL r s2 "",,.. . . . . . ..r0 c \ K |s t d dS | d }|r6t d| d i t | | d{V t
|| t | d st g d{V S t d{V | dg p}fd|D }|rZt dt | t | |t d|d d d{V nt d t | d{V S )
z
Updates supported parameters if passed, otherwise does nothing
updates 2 config parameters (if specified): status and purchase_page_url
updates protection status for users (if specified)
z Nothing to update for MyImunifyNr: r> usersc g | ]}|v | S r/ r/ ).0user all_userss r!
<listcomp>z mi_update.<locals>.<listcomp> s* ):):):):):r0 z'Updating protection status for users=%s z!No users to update protection for)r infor3 r r* update_configsr
"prepare_for_mu_plugin_installationr get_current_whmcs_datarL r r rF warning)r6 requested_myimunify_datawhmcs_activation_status target_usersfiltered_passed_usersrR s @r! r5 r5 v s $ 5666 6 : :8 D D M ($<$@$@$J$JKLLL
7
8
88888888:: $$%;<<
$ ' ' 5 5 0+B///////// kk!!!!!!I+//<<I L %
< 5 % & &
& ! ' 6| D
:;;;'(=>> > > > > > >>r0 c K t j rdgnddgt fd| D }t d | D }i }|r||t j < |r||d< |r@t
dt | t | | d {V d S d S )Npurchase_page_urlr: c 3 F K | ]\ }}|v t || V d S r2 )rF )rP paramrE mi_config_parameterss r! <genexpr>z!update_configs.<locals>.<genexpr> sI E5 ( ( ( $E511 ( ( ( ( r0 c 3 N K | ] \ }}|t v t || V !d S r2 )MU_PLUGIN_KEYSrF rP ra rE s r! rc z!update_configs.<locals>.<genexpr> sG E5 N " " $E511 " " " " r0
CONTROL_PANELz Updating config with data: %s) r is_mi_freemium_licensedictitemsr4 r rU r r )r6 rZ mi_config_datamu_plugin_data config_dictrb s @r! rV rV s1 ( * * - !8
, 4 : : < < N 4 : : < < N K <-; F)* 6'5 O$ / 3S5E5EFFFD+.........../ /r0 c K | rUt j t j | n$t j }d |D S )zp
Returns information from database based on passed users
if no users passed - returns for all users
c X g | ]'}|d t d|d d d(S )rQ r> rT )rQ r> rH )rP items r! rS z"get_users_info.<locals>.<listcomp> sW
L7 d< 0
r0 )r selectwhererQ in_dicts)rN results r! get_users_inforw s ( !3!3E!:!:;;AACCC
%
%
'
'
r0 c K t j }t d | t j i D }| d }t d| d d |t < | t |t < t | d{V |d< |S )z
Returns the current configuration and user protection status.
{MY_IMUNIFY: {'status': 'active/inactive', 'purchase_page_url': 'SOMEURL', 'protection': []}}
c 3 < K | ]\ }}t || V d S r2 rp rf s r! rc z)get_current_whmcs_data.<locals>.<genexpr> sD E5 &eU33 r0 rg rB rT Nr> ) r
ConfigFileconfig_to_dictri r3 r4 rj rH r r rw )rN conf_datacurrent_configcp_datas r! rX rX s
!##2244I %MM&*? D D J J L L N
mmO,,G-J ,B C C. .. N)* 18 !1 1N,- *8)>)>#>#>#>#>#>#>N< r0 c
t j j d dz t j ddd| |t j d z }|S )N/z/?cloudlinux_advantage provisioning my_imunify_account_protection)mactionsuiteusernamedomain server_ip)
r MyImunifyConfigPURCHASE_PAGE_URLrstripurllibparse urlencoderJ rK
get_server_ip)r r purchase_url_links r! get_upgrade_url_linkr sx 077<<
,
+(8 $ _ . . < < > >
r0 )#r r urllib.parser +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelrJ loggingr defence360agent.contractsr defence360agent.utils.configr defence360agent.myimunify.modelr r )defence360agent.utils.wordpress_mu_pluginr r r
r+ r re r r8 rF rH rL r5 rV rw rX r r/ r0 r! <module>r s 8 8 8 8 8 8 8 8 8 8 8 8 , , , , , , 6 6 6 6 6 6 N N N N N N N N
8 (*CD+K +K +K +K +K +K +K +K\5 5 5
4 / / /-? -? -?` / / /B * . r0 defence360agent/utils/__pycache__/whmcs.cpython-311.pyc 0000644 0000000 0000000 00000030434 00000000000 017745 0 ustar
r_jh d dl Z d dlZd dlZd dlmc mc mZ d dl m
Z
d dl m Z d dl
mZ d dlmZmZ d dlmZmZmZ e
e ZeegZ G d d Zd Zd
Zd Z d Z d
Z d Z d Z d Z!d Z"dS ) N) getLogger)config)
update_config)update_users_protection MyImunify)MU_PLUGIN_INSTALLATIONADVICE_EMAIL_NOTIFICATIONWordPressMuPluginc " e Zd ZdZdZd Zd ZdS ) WhmcsConfz
read/write data passed by whmcs
Internal use, for commands called from whcms only
it saves ALL data came from whcms w/o any validation deliberately
in order to simplify compatability with current installed whmcs plugin
z /var/imunify360/whmcs_data.jsonc t j | j si S t | j d 5 }| }d d d n # 1 swxY w Y nA# t
$ r4}t dt | i cY d }~S d }~ww xY w t j
| }n9# t j t f$ r t d| i cY S w xY w|S )Nrz"Failed to read whmcs data file: %sz"Malformed file with whmcs data: %s)
ospathexistsopenreadIOErrorloggererrorstrjsonloadsJSONDecodeError
ValueError)selffraw_dataedatas P/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/whmcs.pyr zWhmcsConf.read! s= w~~di(( I di%%
$ 6688
$
$
$
$
$
$
$
$
$
$
$
$
$
$
$ LL=s1vv F F FIIIIII :h''DD$j1 LL=x H H HIII sR A* A A* A""A* %A"&A* *
B(4)B# B(#B(,C 3C76C7c d | }| | t | j d 5 }t j ||d ddd dS # 1 swxY w Y dS # t $ r3}t dt | Y d}~dS d}~ww xY w)z
Saves ALL data passed by WHMCS
it should not have any validations deliberately to be as compatible as possible
with current installed WHMCS plugin
w )indentNz&Failed to write whmcs data to file: %s)
r updater r r dumpr r r r )r r current_datafiler s r! savezWhmcsConf.save4 s yy{{ D!!! Kdi%%
8 ,Q7777
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8 K K K LLA3q66 J J J J J J J J J Ks; A2 A% A2 %A))A2 ,A)-A2 2
B/<(B**B/N)__name__
__module__ __qualname____doc__r r r* r! r r sH -D &K K K K Kr0 r c p K | t j }t | | d {V S N)getr MY_IMUNIFY_KEY mi_update)sinkr my_imunify_updatess r! sync_billing_datar8 E s> &"7884!344 4 4 4 4 4 44r0 c j | dk r
dddd| fS | dk r
dddd| fS | dk rd |fS | |fS )
zf
Convert several keys to config key, otherwise just return same key
any key is acceptable
statusenableTF)activeinactive
protection)enableddisabledmu_plugin_installationsmart_advice_allowedr/ keyvalues r! convert_to_config_key_valuerF J s
h !
!
( ( (%u,, :r0 c V | dk rd|rdndfS | dk rd|rdndfS | dk rd |fS | |fS )
zk
Convert several keys from config format, otherwise just return same key
any key is acceptable
r; r: r< r= r> r? r@ rB rA r/ rC s r! convert_from_config_key_valuerH d sa
he;((<< 5 @iijAA & & &'.. :r0 c \ K t j d {V S r2 )hp HostingPanel get_usersr/ r0 r! rL rL r s2 "",,.. . . . . . ..r0 c \ K |s t d dS | d }|r6t d| d i t | | d{V t
|| t | d st g d{V S t d{V | dg p}fd|D }|rZt dt | t | |t d|d d d{V nt d t | d{V S )
z
Updates supported parameters if passed, otherwise does nothing
updates 2 config parameters (if specified): status and purchase_page_url
updates protection status for users (if specified)
z Nothing to update for MyImunifyNr: r> usersc g | ]}|v | S r/ r/ ).0user all_userss r!
<listcomp>z mi_update.<locals>.<listcomp> s* ):):):):):r0 z'Updating protection status for users=%s z!No users to update protection for)r infor3 r r* update_configsr
"prepare_for_mu_plugin_installationr get_current_whmcs_datarL r r rF warning)r6 requested_myimunify_datawhmcs_activation_status target_usersfiltered_passed_usersrR s @r! r5 r5 v s $ 5666 6 : :8 D D M ($<$@$@$J$JKLLL
7
8
88888888:: $$%;<<
$ ' ' 5 5 0+B///////// kk!!!!!!I+//<<I L %
< 5 % & &
& ! ' 6| D
:;;;'(=>> > > > > > >>r0 c K t j rdgnddgt fd| D }t d | D }i }|r||t j < |r||d< |r@t
dt | t | | d {V d S d S )Npurchase_page_urlr: c 3 F K | ]\ }}|v t || V d S r2 )rF )rP paramrE mi_config_parameterss r! <genexpr>z!update_configs.<locals>.<genexpr> sI E5 ( ( ( $E511 ( ( ( ( r0 c 3 N K | ] \ }}|t v t || V !d S r2 )MU_PLUGIN_KEYSrF rP ra rE s r! rc z!update_configs.<locals>.<genexpr> sG E5 N " " $E511 " " " " r0
CONTROL_PANELz Updating config with data: %s) r is_mi_freemium_licensedictitemsr4 r rU r r )r6 rZ mi_config_datamu_plugin_data config_dictrb s @r! rV rV s1 ( * * - !8
, 4 : : < < N 4 : : < < N K <-; F)* 6'5 O$ / 3S5E5EFFFD+.........../ /r0 c K | rUt j t j | n$t j }d |D S )zp
Returns information from database based on passed users
if no users passed - returns for all users
c X g | ]'}|d t d|d d d(S )rQ r> rT )rQ r> rH )rP items r! rS z"get_users_info.<locals>.<listcomp> sW
L7 d< 0
r0 )r selectwhererQ in_dicts)rN results r! get_users_inforw s ( !3!3E!:!:;;AACCC
%
%
'
'
r0 c K t j }t d | t j i D }| d }t d| d d |t < | t |t < t | d{V |d< |S )z
Returns the current configuration and user protection status.
{MY_IMUNIFY: {'status': 'active/inactive', 'purchase_page_url': 'SOMEURL', 'protection': []}}
c 3 < K | ]\ }}t || V d S r2 rp rf s r! rc z)get_current_whmcs_data.<locals>.<genexpr> sD E5 &eU33 r0 rg rB rT Nr> ) r
ConfigFileconfig_to_dictri r3 r4 rj rH r r rw )rN conf_datacurrent_configcp_datas r! rX rX s
!##2244I %MM&*? D D J J L L N
mmO,,G-J ,B C C. .. N)* 18 !1 1N,- *8)>)>#>#>#>#>#>#>N< r0 c
t j j d dz t j ddd| |t j d z }|S )N/z/?cloudlinux_advantage provisioning my_imunify_account_protection)mactionsuiteusernamedomain server_ip)
r MyImunifyConfigPURCHASE_PAGE_URLrstripurllibparse urlencoderJ rK
get_server_ip)r r purchase_url_links r! get_upgrade_url_linkr sx 077<<
,
+(8 $ _ . . < < > >
r0 )#r r urllib.parser +defence360agent.subsys.panels.hosting_panelsubsyspanels
hosting_panelrJ loggingr defence360agent.contractsr defence360agent.utils.configr defence360agent.myimunify.modelr r )defence360agent.utils.wordpress_mu_pluginr r r
r+ r re r r8 rF rH rL r5 rV rw rX r r/ r0 r! <module>r s 8 8 8 8 8 8 8 8 8 8 8 8 , , , , , , 6 6 6 6 6 6 N N N N N N N N
8 (*CD+K +K +K +K +K +K +K +K\5 5 5
4 / / /-? -? -?` / / /B * . r0 defence360agent/utils/__pycache__/wordpress_mu_plugin.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000004026 00000000000 023670 0 ustar
r_j Z d dl Z d dlmZ ee ZdZdZeegZ G d d ZdS ) N) getLoggermu_plugin_installationadvice_email_notificationc e Zd Zd ZdS )WordPressMuPluginc T t |dk |g s8t dt | t | dS |s*t dt | dS t j d st d dS )z
Must use plugin works only if cl-hosting-smart-advice is installed
So it is a requirement to be sure it is installed
It is expected to be installed by default with Imunify360
activeznNothing to prepare for Must Use plugin as settings are not turned on, activation status=%s mu_plugin_status=%sNz=Nothing to prepare for Must Use plugin as mu_plugin_status=%sz!/usr/sbin/cl-hosting-smart-advicezccl-hosting-smart-advice rpm package is not installed in the system, please install it and try again)allloggerwarningstrospathexists
ValueError)selfactivation_statusmu_plugin_statuss ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/wordpress_mu_plugin.py"prepare_for_mu_plugin_installationz4WordPressMuPlugin.prepare_for_mu_plugin_installation s %13CDEE NNN%&&$%%
F NN)$%%
Fw~~ ABB A
N)__name__
__module__ __qualname__r r r r r
s# r r ) r loggingr r r MU_PLUGIN_INSTALLATIONADVICE_EMAIL_NOTIFICATIONMU_PLUGIN_KEYSr r r r <module>r sx 8 1 7 (*CD r defence360agent/utils/__pycache__/wordpress_mu_plugin.cpython-311.pyc 0000644 0000000 0000000 00000004026 00000000000 022731 0 ustar
r_j Z d dl Z d dlmZ ee ZdZdZeegZ G d d ZdS ) N) getLoggermu_plugin_installationadvice_email_notificationc e Zd Zd ZdS )WordPressMuPluginc T t |dk |g s8t dt | t | dS |s*t dt | dS t j d st d dS )z
Must use plugin works only if cl-hosting-smart-advice is installed
So it is a requirement to be sure it is installed
It is expected to be installed by default with Imunify360
activeznNothing to prepare for Must Use plugin as settings are not turned on, activation status=%s mu_plugin_status=%sNz=Nothing to prepare for Must Use plugin as mu_plugin_status=%sz!/usr/sbin/cl-hosting-smart-advicezccl-hosting-smart-advice rpm package is not installed in the system, please install it and try again)allloggerwarningstrospathexists
ValueError)selfactivation_statusmu_plugin_statuss ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/wordpress_mu_plugin.py"prepare_for_mu_plugin_installationz4WordPressMuPlugin.prepare_for_mu_plugin_installation s %13CDEE NNN%&&$%%
F NN)$%%
Fw~~ ABB A
N)__name__
__module__ __qualname__r r r r r
s# r r ) r loggingr r r MU_PLUGIN_INSTALLATIONADVICE_EMAIL_NOTIFICATIONMU_PLUGIN_KEYSr r r r <module>r sx 8 1 7 (*CD r defence360agent/utils/__pycache__/zipsafe.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002543 00000000000 021224 0 ustar
r_j 8 d dl Z d dlmZ de j deddfdZdS ) N)Pathzfdestreturnc t | }| D ]}| d rt d| t | j }d|v rt d| ||z }||k r||j vrt d| | | d S )N)/\z!Unsafe absolute zip member path: z..z)Unsafe parent-traversal zip member path: z Zip member escapes destination: )r resolvenamelist
startswith
ValueErrorpartsparents
extractall)r r
dest_resolvedmemberr targets R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/zipsafe.pysafe_extractallr s JJ&&((M++--
O
O [ ) ) P *ff NOO OV " 5== *AGI
&(1133 ] " "}FN'J'J *VV MNN NMM- )zipfilepathlibr ZipFiler r r <module>r sU
!
!t
!
!
!
!
!
!
!r defence360agent/utils/__pycache__/zipsafe.cpython-311.pyc 0000644 0000000 0000000 00000002543 00000000000 020265 0 ustar
r_j 8 d dl Z d dlmZ de j deddfdZdS ) N)Pathzfdestreturnc t | }| D ]}| d rt d| t | j }d|v rt d| ||z }||k r||j vrt d| | | d S )N)/\z!Unsafe absolute zip member path: z..z)Unsafe parent-traversal zip member path: z Zip member escapes destination: )r resolvenamelist
startswith
ValueErrorpartsparents
extractall)r r
dest_resolvedmemberr targets R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/zipsafe.pysafe_extractallr s JJ&&((M++--
O
O [ ) ) P *ff NOO OV " 5== *AGI
&(1133 ] " "}FN'J'J *VV MNN NMM- )zipfilepathlibr ZipFiler r r <module>r sU
!
!t
!
!
!
!
!
!
!r defence360agent/utils/_shutil.py 0000644 0000000 0000000 00000002004 00000000000 013723 0 ustar """High-level file operations."""
import errno
import logging
import os
import shutil
logger = logging.getLogger(__name__)
def is_safe_subdir_name(name) -> bool:
return (
isinstance(name, str)
and bool(name)
and "\x00" not in name
and name == os.path.basename(name)
and name not in (".", "..")
)
def rmtree(path, ignore_errors=False, onerror=None, *, max_tries=3):
"""More robust shutil.rmtree.
Retry on "Directory not empty" race condition:
https://github.com/ansible/ansible/issues/34335#issuecomment-362995700
"""
for i in range(1, max_tries + 1):
try:
return shutil.rmtree(path, ignore_errors, onerror)
except OSError as e:
if i == max_tries or e.errno not in [
errno.EEXIST,
errno.ENOTEMPTY,
]:
raise
# Got "Directory not empty" and attempts are not exhausted yet
logger.warning("Can't remove %s tree, reason: %s", path, e)
defence360agent/utils/antivirus_mode.py 0000644 0000000 0000000 00000000761 00000000000 015314 0 ustar import functools
import inspect
from defence360agent.contracts.config import ANTIVIRUS_MODE
def skip(f):
@functools.wraps(f)
async def async_wrapper(*args, **kwargs):
return None if ANTIVIRUS_MODE else await f(*args, **kwargs)
@functools.wraps(f)
def wrapper(*args, **kwargs):
return None if ANTIVIRUS_MODE else f(*args, **kwargs)
return async_wrapper if inspect.iscoroutinefunction(f) else wrapper
enabled, disabled = ANTIVIRUS_MODE, not ANTIVIRUS_MODE
defence360agent/utils/async_utils.py 0000644 0000000 0000000 00000001316 00000000000 014616 0 ustar from typing import List, Union, Tuple
import asyncio
class AsyncIterate: # not AsyncIterable because python use this name already
def __init__(self, data: Union[List, Tuple]):
self.queue = iter(data)
def __aiter__(self):
return self
async def __anext__(self):
data = await self.fetch_data()
if data is not None:
return data
else:
raise StopAsyncIteration
async def fetch_data(self):
try:
item = next(self.queue)
except StopIteration:
item = None
return item
async def gather(*tasks: List) -> AsyncIterate:
results = await asyncio.gather(*tasks)
return AsyncIterate(results)
defence360agent/utils/benchmark.py 0000644 0000000 0000000 00000001032 00000000000 014206 0 ustar import time
from types import TracebackType
class Benchmark:
def __enter__(self) -> None:
self.start_time = time.monotonic_ns()
return self
def __exit__(
self,
exc_type: type[BaseException] | None,
exc_val: BaseException | None,
exc_tb: TracebackType | None,
) -> None:
self.end_time = time.monotonic_ns()
self.elapsed_time_ns = self.end_time - self.start_time
@property
def elapsed_time_ms(self) -> float:
return self.elapsed_time_ns * 1e-6
defence360agent/utils/buffer.py 0000644 0000000 0000000 00000003631 00000000000 013534 0 ustar class LineBufferOverflow(Exception):
pass
class LineBuffer(object):
"""
Allows to accumulate data, and than iterate over it getting tokens
split by line breaks '\n'. If at the end there is no line break,
the data will sit in the line buffer until more data with line
break comes in.
"""
MAX_SIZE = 16 * 1024 * 1024
def __init__(self):
self.buf = ""
def append(self, data):
if len(self.buf) + len(data) > self.MAX_SIZE:
self.buf = ""
raise LineBufferOverflow(
"LineBuffer exceeded maximum size of {} bytes".format(
self.MAX_SIZE
)
)
self.buf += data
def __iter__(self):
return self
def __next__(self):
pos = self.buf.find("\n")
if pos != -1:
result = self.buf[0:pos]
self.buf = self.buf[pos + 1 :]
return result
raise StopIteration
def clean(self):
self.buf = ""
class SizeBufferOverflow(Exception):
pass
class SizeBuffer:
MAX_SIZE = 16 * 1024 * 1024
def __init__(self, size_len=2):
self._buf = b""
self._size_len = size_len
def append(self, data):
if len(self._buf) + len(data) > self.MAX_SIZE:
self._buf = b""
raise SizeBufferOverflow(
"SizeBuffer exceeded maximum size of {} bytes".format(
self.MAX_SIZE
)
)
self._buf += data
def __iter__(self):
return self
def __next__(self):
if not self._buf:
raise StopIteration
size = int.from_bytes(self._buf[: self._size_len], "big")
if len(self._buf[self._size_len :]) >= size:
data = self._buf[self._size_len : self._size_len + size]
self._buf = self._buf[self._size_len + size :]
return data
raise StopIteration
defence360agent/utils/check_db.py 0000644 0000000 0000000 00000017335 00000000000 014013 0 ustar import logging
import itertools
import os
from contextlib import suppress
from datetime import datetime
from shutil import copy
from sqlite3 import connect, DatabaseError
from playhouse.sqlite_ext import SqliteExtDatabase
from defence360agent.application import app
from defence360agent import simple_rpc
from defence360agent.contracts.config import Model
from defence360agent.model import simplification
logger = logging.getLogger(__name__)
class OperationError(Exception):
pass
WORKAROUND_MSG = "Blank database will be created on agent start "
def check_and_repair():
base = Model.PATH
if simple_rpc.is_running():
raise OperationError(
"Cannot perform database check and backup while agent is running. "
"Please, stop the imunify360 agent with `service imunify360 stop`"
)
elif not os.path.isfile(base):
raise OperationError(
"DB %s is not exists. %s" % (base, WORKAROUND_MSG)
)
else:
if is_db_corrupted(base):
backup = make_backup(base)
if not backup:
raise OperationError(
"Cannot proceed without backup copy of the database."
"Please contact imunify360 support team at "
"https://cloudlinux.zendesk.com"
)
dump = dump_to_sql(base)
logger.info("Removing original corrupted database at %s" % base)
# TODO: Notify user in UI that original DB was dropped
os.remove(base)
if not dump:
raise OperationError(
"Cannot dump database to sql. Old DB backuped at %s. %s"
% (backup, WORKAROUND_MSG)
)
else:
restored = load_from_sql(base, dump)
if not restored:
raise OperationError(
"Loading dump to new database failed. Database will "
"be recreated during migrations."
)
if is_db_corrupted(restored):
os.remove(restored)
raise OperationError(
"Restored database is still corrupt. Removing "
"restored database. %s" % WORKAROUND_MSG
)
logger.info(
"Database restored successfully. Removing dump %s" % dump
)
os.remove(dump)
try:
logger.info("Performing migrations on restored database")
simplification.migrate()
except Exception as e:
os.remove(base)
raise OperationError(
"Migrations on restored database failed: %s. %s"
% (e, WORKAROUND_MSG)
)
else:
if not all_tables_are_present():
os.remove(base)
raise OperationError(
"Restored database does not "
"contain all necessary tables. "
"%s" % WORKAROUND_MSG
)
def mark_with_timestamp(filename, extension=None):
"""
>>> mark_with_timestamp('/var/imunify360/imunify360.db')
'/var/imunify360/imunify360.db_2017-09-26_03:33:44.705967'
>>> mark_with_timestamp('/var/imunify360/imunify360.db', extension='sql')
'/var/imunify360/imunify360.db_2017-09-26_03:34:01.098544.sql'
"""
instant = datetime.now()
basename = "{}_{}".format(filename, instant.isoformat("_"))
if extension:
return basename + ".%s" % extension
else:
return basename
def is_db_corrupted(db_path):
logger.info("Database %s integrity check..." % db_path)
is_corrupted = True
with connect(db_path) as connection:
try:
cursor = connection.execute("PRAGMA INTEGRITY_CHECK;")
result = next(cursor)
if "ok" in result:
logger.info("Database integrity check succeeded.")
is_corrupted = False
except DatabaseError as e:
logger.warning("DatabaseError detected: %s", e)
return is_corrupted
def dump_to_sql(db_path):
dumpfile = mark_with_timestamp(db_path, extension="sql")
logger.info("Dumping imunify360 database to %s" % dumpfile)
try:
with open(dumpfile, "w") as dump, connect(db_path) as connection:
for row in connection.iterdump():
dump.write(row)
except (DatabaseError, OSError) as e:
logger.error("Error during dump: %s. Operation aborted" % e)
with suppress(OSError):
os.remove(dumpfile)
dumpfile = None
return dumpfile
def load_from_sql(db_path, dumpfile):
# This is unlikely to happen because we delete the original file
# but to be defensive here won't hurt in case of reuse in other places.
if os.path.exists(db_path):
logger.warning(
"Database already exists. Loading dump to existing "
"database may cause errors. Operation aborted"
)
return None
logger.info(
"Reading dump %s into new database %s..." % (dumpfile, db_path)
)
with open(dumpfile, "r") as dump, connect(db_path) as connection:
# We cannot read line by line because SQL statements are dumped
# not in a statement-per-line way
try:
sql = dump.read()
connection.executescript(sql)
except MemoryError as e:
logger.error(e)
with suppress(OSError):
os.remove(db_path)
db_path = None
return db_path
def make_backup(db_path):
logger.info("Making backup of the %s..." % db_path)
backup_filename = mark_with_timestamp(db_path, "backup")
try:
copy(db_path, backup_filename)
logger.info("Database copied successfully to: %s " % backup_filename)
except Exception as e:
logger.error("Making backup failed: %s", e)
with suppress(OSError):
os.remove(backup_filename)
backup_filename = None
return backup_filename
def all_tables_are_present():
logger.info(
"Verifying that db schema is up-to-date and all tables are present..."
)
models = itertools.chain(
*[
simplification.get_models(module)
for module in app.MODULES_WITH_MODELS
]
)
if all(model.table_exists() for model in models):
logger.info("All tables are present")
return True
else:
logger.error("Some tables are missing in db.")
return False
def recreate_schema() -> None:
simplification.instance.db.init(Model.PATH)
logger.info("Recreating schema for linked DBs...")
attached_schemas = []
for db_path, schema in app.MIGRATIONS_ATTACHED_DBS:
logger.info("Attach db: %s", db_path)
simplification.instance.db.execute_sql(
"ATTACH ? AS ?", (db_path, schema)
)
attached_schemas.append(schema)
recreate_schema_models(simplification.instance.db, attached_schemas)
logger.info("Schema recreated successfully.")
def recreate_schema_models(
db: SqliteExtDatabase, target_schemas: list[str]
) -> None:
models_to_create = [
model
for model in itertools.chain(
*[
simplification.get_models(module)
for module in app.MODULES_WITH_MODELS
]
)
if model._meta.schema in target_schemas
]
logger.info("%r", models_to_create)
# bind models to the db to avoid issues related to initialization order
db.bind(models_to_create)
db.create_tables(models_to_create)
logger.info("Schema models recreated successfully.")
defence360agent/utils/check_lock.py 0000644 0000000 0000000 00000001530 00000000000 014344 0 ustar import random
import time
def check_lock(check_lock_period: int, lock_file, jitter: bool = False):
if not lock_file.exists():
lock_file.parent.mkdir(parents=True, exist_ok=True)
if jitter:
delay = random.randrange(int(check_lock_period))
lock_file.write_text(str(time.time() + delay + check_lock_period))
return delay
lock_file.write_text(str(time.time() + check_lock_period))
return 0
if (time_left := is_period_passed(check_lock_period, lock_file)) <= 0:
lock_file.write_text(str(time.time() + check_lock_period))
return 0
else:
return time_left
def is_period_passed(period, lock_file):
try:
when_to_run = float(lock_file.read_text())
except (FileNotFoundError, ValueError):
return 0
return when_to_run - time.time()
defence360agent/utils/cli.py 0000644 0000000 0000000 00000022071 00000000000 013031 0 ustar from collections import defaultdict
import json
import os
import subprocess
import sys
import time
import yaml
PRETTY_JSON_ARGS = {"sort_keys": True, "indent": 2, "separators": (",", ": ")}
EXITCODE_NOT_FOUND = 2
EXITCODE_WARNING = 3
EXITCODE_GENERAL_ERROR = 11
PAGERS = ["/bin/less", "/bin/more"]
SUCCESS, WARNING, ERROR = "success", "warnings", "error" # see simple_rpc
_CLI_MSG_PREFIX = {WARNING: "WARNING", ERROR: "ERROR"}
EXIT_CODES = {
SUCCESS: 0,
WARNING: EXITCODE_WARNING,
ERROR: EXITCODE_GENERAL_ERROR,
}
def pager(data):
pager = os.environ.get(
"PAGER", next((p for p in PAGERS if os.path.isfile(p)), None)
)
if pager is None:
print(data)
else:
subprocess.run([pager], input=data.encode(), stdout=sys.stdout)
class TablePrinter:
def __init__(self):
self._headers = {}
self._mappers = defaultdict(list)
self._right_aligned = {}
self._widths = {}
def set_field_properties(
self,
field,
mappers=None,
max_width=None,
right_align=False,
header=None,
):
if mappers:
self._mappers[field] = mappers
if max_width:
self._widths[field] = max_width
self._right_aligned[field] = right_align
self._headers[field] = header if header else field.upper()
def print(self, fields, items, file=sys.stdout):
headers = [self._headers.get(field, field.upper()) for field in fields]
widths = [len(field) for field in headers]
rows = []
for item in items:
row = []
for i, field in enumerate(fields):
v = item.get(field)
for mapper in self._mappers[field]:
v = mapper(v)
v = str(v)
if len(v) > widths[i]:
max_width = self._widths.get(field)
if max_width and len(v) > max_width:
v = v[: max_width - 3] + "..."
widths[i] = len(v)
row.append(v)
rows.append(row)
print(self._format_row(headers, widths, False))
for row in rows:
print(
self._format_row(
row, widths, self._right_aligned.get(field, False)
)
)
@staticmethod
def _add_padding(value, width, right_align):
if right_align:
return value.rjust(width)
return value.ljust(width)
@staticmethod
def _format_row(columns, widths, right_aligned):
cols = [
TablePrinter._add_padding(value, widths[i], right_aligned)
for i, value in enumerate(columns)
]
return " ".join(cols)
def n_a(value):
return value if value is not None else "n/a"
def to_int(value):
return int(value) if value is not None else value
def extract_field(field):
def extractor(value):
if isinstance(value, dict):
return value.get(field)
return value
return extractor
def print_table(data, field_props):
table = TablePrinter()
for props in field_props:
table.set_field_properties(*props)
table.print([item[0] for item in field_props], data)
def print_incidents(data):
field_props = (
("timestamp", [to_int]),
("abuser", [n_a]),
("country", [extract_field("code")]),
("times", [n_a]),
("name", [n_a]),
("severity", [n_a]),
)
print_table(data, field_props)
def add_ttl(data):
now = int(time.time())
for item in data:
expiration = item.get("expiration", 0)
if expiration > 0:
item["ttl"] = expiration - now
else:
item["ttl"] = 0
def print_graylist(data):
add_ttl(data)
field_props = (
("ip",),
("ttl",),
("country", [extract_field("code")]),
)
print_table(data, field_props)
def print_bwlist(data):
add_ttl(data)
field_props = (
("ip",),
("ttl",),
("country", [extract_field("code")]),
("imported_from",),
("comment",),
)
print_table(data, field_props)
def guess_printer(data):
if isinstance(data, (list, tuple)):
if len(data):
printer = TablePrinter()
if isinstance(data[0], dict):
keys = sorted(data[0].keys())
printer.set_field_properties(
"country", mappers=[extract_field("code")]
)
printer.print(keys, data)
else:
for item in data:
print(item)
else:
print(data)
def yaml_printer(data):
if isinstance(data, str):
print(data)
else:
print(yaml.dump(data, default_flow_style=False))
def json_printer(data):
if isinstance(data, str):
print(data)
else:
print(json.dumps(data))
def hook_printer(data):
if isinstance(data, dict):
print("Status: {}".format(data["status"]))
else:
result = []
for hook in data:
result.append(
"Event: {}, Path: {}{}".format(
hook["event"],
hook["path"],
" native" if hook["native"] else "",
)
)
print("\n".join(result))
def waf_set_printer(items):
if not items:
print("No users targeted.")
return
counts = {"succeeded": 0, "skipped": 0, "failed": 0}
for item in items:
counts[item["status"]] += 1
print(
"{succeeded} succeeded, {skipped} skipped, {failed} failed.".format(
**counts
)
)
print()
print_table(items, (("user",), ("status",), ("reason",)))
def waf_status_printer(result):
header = "Global WAF: " + result.get("global_waf", "unknown")
if not result.get("security_plugin_enabled", True):
header += " (plugin off)"
print(header)
print(
"Default (no override): " + result.get("global_waf_default", "unknown")
)
items = result.get("items") or []
total = result.get("total_count", len(items))
if len(items) < total:
# Page or 500-cap truncated the list — make the gap explicit so a
# human doesn't read the table as the complete set.
print("Total accounts: {} (showing {})".format(total, len(items)))
else:
print("Total accounts: {}".format(total))
print()
if not items:
print("No accounts.")
return
print_table(
items,
(("name",), ("waf_status",), ("source",), ("wp_sites",)),
)
PRINTERS = {
("config", "show"): json_printer,
("eula", "show"): pager,
("get",): print_incidents,
("whitelist",): print_bwlist,
("whitelist", "ip", "list"): print_bwlist,
("blacklist",): print_bwlist,
("blacklist", "ip", "list"): print_bwlist,
("graylist",): print_graylist,
("graylist", "ip", "list"): print_graylist,
("malware", "on-demand", "status"): yaml_printer,
("feature-management", "defaults"): yaml_printer,
("feature-management", "show"): yaml_printer,
("feature-management", "enable"): yaml_printer,
("feature-management", "disable"): yaml_printer,
("feature-management", "get"): yaml_printer,
("hook", "add"): hook_printer,
("hook", "delete"): hook_printer,
("hook", "list"): hook_printer,
("hook", "add-native"): hook_printer,
("wordpress-plugin", "waf", "set"): waf_set_printer,
("wordpress-plugin", "waf", "status"): waf_status_printer,
}
# Printers that consume the full response dict (globals + items), not just
# result["items"] — needed for the header line the waf status table carries.
_FULL_RESULT_PRINTERS = {("wordpress-plugin", "waf", "status")}
def _get_default_output(result):
return result["items"] if result.get("items") is not None else "OK"
def _print_json_response(result, is_verbose=False):
pretty_args = PRETTY_JSON_ARGS if is_verbose else {}
print(json.dumps(result, **pretty_args))
def _print_plain_response(method, result):
"""Print result in plain text format using appropriate printer."""
print_fun = PRINTERS.get(method, guess_printer)
if method in _FULL_RESULT_PRINTERS:
print_fun(result)
else:
print_fun(_get_default_output(result))
def print_response(method, result, is_json=False, is_verbose=False):
if is_json:
_print_json_response(result, is_verbose)
else:
_print_plain_response(method, result)
def print_warnings(data: dict):
if not isinstance(data, dict):
# This can happen, for example, if validation of cli args fails
return
for warning in data.get("warnings", []):
print(warning, file=sys.stderr)
def print_error(
result, messages, is_json=False, is_verbose=False, *, file=sys.stderr
):
if is_json:
pretty_args = PRETTY_JSON_ARGS if is_verbose else {}
print(json.dumps({result: messages}, **pretty_args))
else:
if isinstance(messages, (list, tuple)):
for msg in messages:
print("%s: %s" % (_CLI_MSG_PREFIX[result], msg), file=file)
else:
print(messages, file=file)
defence360agent/utils/common.py 0000644 0000000 0000000 00000034645 00000000000 013564 0 ustar import asyncio
import datetime
import functools
import logging
import socket
import time
import re
import os
import sys
MINUTE = datetime.timedelta(minutes=1).total_seconds()
HOUR = datetime.timedelta(hours=1).total_seconds()
DAY = datetime.timedelta(days=1).total_seconds()
WEEK = datetime.timedelta(weeks=1).total_seconds()
logger = logging.getLogger(__name__)
class ServiceBase(object):
"""Base service class."""
def __init__(self, loop):
self._loop = loop
self._should_stop = False
self._main_task = None
self._state = self.StoppedState(self)
def start(self):
return self._state.start()
def should_stop(self):
return self._state.should_stop()
async def wait(self):
return await self._state.wait()
def is_running(self):
return self._state.is_running()
async def _run(self):
raise NotImplementedError
class State(object):
def __init__(self, obj):
""":type obj: ServiceBase"""
self._obj = obj
def start(self):
pass
def should_stop(self):
pass
async def wait(self):
task = self._obj._main_task
if task:
await task
def is_running(self):
return False
class StoppedState(State):
def _on_stop(self, future):
self._obj._state = ServiceBase.StoppedState(self._obj)
self._obj._should_stop = False
def start(self):
obj = self._obj
obj._main_task = obj._loop.create_task(obj._run())
obj._main_task.add_done_callback(self._on_stop)
obj._state = ServiceBase.RunningState(obj)
class RunningState(State):
def should_stop(self):
obj = self._obj
obj._should_stop = True
obj._main_task.cancel()
obj._state = ServiceBase.StoppingState(obj)
def is_running(self):
return True
class StoppingState(State):
def start(self):
raise ProgrammingError(
"Cannot start stopping service. Please wait while it stop."
)
class ProgrammingError(Exception):
pass
class RateLimit:
"""Decorator to limit function calls to one per *period* seconds.
If less than *period* seconds have passed since the last call,
then the request to call the function is replace with an *on_drop*
call with the same arguments.
If *on_drop* is None [default] then the call is just dropped
"""
def __init__(self, period, timer=time.monotonic, *, on_drop=None):
self._next_call_time = None
self._period = period
self._timer = timer
self._on_drop = on_drop
@property
def should_be_called(self):
return (
self._next_call_time is None
or self._next_call_time <= self._timer()
)
def __call__(self, func):
@functools.wraps(func)
def wrapper(*args, **kwargs):
if self.should_be_called:
self._next_call_time = self._timer() + self._period
return func(*args, **kwargs)
elif self._on_drop is not None:
return self._on_drop(*args, **kwargs)
@functools.wraps(func)
async def async_wrapper(*args, **kwargs):
if self.should_be_called:
self._next_call_time = self._timer() + self._period
return await func(*args, **kwargs)
elif self._on_drop is not None:
return self._on_drop(*args, **kwargs)
return async_wrapper if asyncio.iscoroutinefunction(func) else wrapper
rate_limit = RateLimit
class CoalesceCalls:
def __init__(self):
self.call_time = float("-inf")
self.delayed_call = None
def coalesce_calls(self, period, *, done_callback=None):
"""
Decorator to coalesce coroutine calls to one per *period* seconds.
Requests for a coroutine call in a given time period are coalesced:
If t is the time of the last call, then N call requests in the [t,
t+period) time interval results in a single call at the
t+period time iff N>0 i.e.,
if less than *period* seconds have passed since the last call,
then the calls are coalesced: (N-1) requests are dropped, Nth
requests is performed in *period* seconds.
It is unspecified which exact call is made if arguments differ.
If the call is not dropped then *done_callback* is attached
to the task when the coroutine is scheduled with the event loop.
Given `c` is the time of the last [actual] call (`loop.create_task()`)
And `T` is the coalesce time period
When a call request arrives at `t` time
Then
| call pending? | t>c+T | c<=t<=c+T | t<c |
|----------------+--------------------------------+------------+------|
| no p. call | call soon | call at c+T| warn |
| p. call at c+T | cancel the call/warn, call soon| drop call | warn |
"""
def decorator(coro):
@functools.wraps(coro)
async def wrapper(*args, **kwargs):
loop = kwargs.get("loop")
if loop is None:
loop = asyncio.get_event_loop()
if args or kwargs:
args_repr = "*%r, **%r" % (args, kwargs)
else: # special case no args case
args_repr = ""
call_repr = "%s(%s)" % (coro.__name__, args_repr)
def log_exception(task):
"""Log task's error
if any with event's loop exception handler.
CancelledError is not logged.
"""
if not task.cancelled() and task.exception() is not None:
loop.call_exception_handler(
{
"message": "Unhandled exception during "
+ call_repr,
"exception": task.exception(),
"task": task,
}
)
def call_delayed(coro, args, kwargs):
"""Call & schedule the delayed coroutine now."""
logger.info("Schedule call %s", call_repr)
self.call_time = loop.time()
self.delayed_call = None
task = loop.create_task(coro(*args, **kwargs))
task.add_done_callback(
log_exception
if done_callback is None
else done_callback
)
now = loop.time()
if now > (self.call_time + period): # call immediately
if self.delayed_call is not None:
# get string representation for logs
# before cancelling the call
old_delayed_call_repr = str(self.delayed_call)
self.delayed_call.cancel()
self.delayed_call = None
logger.warning(
"There was a scheduled call (%s)"
" but more than period (%r) seconds passed"
" since the last call (%r, now=%r)",
old_delayed_call_repr,
period,
self.call_time,
now,
)
logger.info(
"Satisfy the call request soon: %s. No calls in"
" more than %r seconds since the start",
call_repr,
period,
)
self.delayed_call = loop.call_soon(
call_delayed, coro, args, kwargs
)
elif self.call_time <= now <= (self.call_time + period):
delay = (self.call_time + period) - now
if self.delayed_call is not None: # drop call request
logger.info(
"Drop call request for %s"
", enforcing one call per %r seconds limit"
". Next call is in ~%.2f seconds",
call_repr,
period,
delay,
)
else: # schedule call request
assert self.delayed_call is None
logger.info(
"Delay call request: %s for ~%.2f seconds"
". Enforcing one call per %r seconds limit",
call_repr,
delay,
period,
)
self.delayed_call = loop.call_at(
self.call_time + period,
call_delayed,
coro,
args,
kwargs,
)
else: # now < call_time
logger.warning(
"Drop call request for %s, reason: last call time"
" (%r, now=%r) is in the future",
call_repr,
self.call_time,
now,
)
return wrapper
return decorator
webserver_gracefull_restart = CoalesceCalls()
def get_hostname():
"""Returns readable name of the server.
It is sent to CLN and allows user to sort out his servers.
"""
hostname = socket.getfqdn()
if hostname is None or hostname.lower().startswith("localhost"):
return socket.gethostname()
return hostname
# Everything from there is copied from setuptools package
# Copied from setuptools/_distutils/version.py
class Version:
"""Abstract base class for version numbering classes. Just provides
constructor (__init__) and reproducer (__repr__), because those
seem to be the same for all version numbering classes; and route
rich comparisons to _cmp.
"""
def __init__(self, vstring=None):
if vstring:
self.parse(vstring)
def __repr__(self):
return "{} ('{}')".format(self.__class__.__name__, str(self))
def __eq__(self, other):
c = self._cmp(other)
if c is NotImplemented:
return c
return c == 0
def __lt__(self, other):
c = self._cmp(other)
if c is NotImplemented:
return c
return c < 0
def __le__(self, other):
c = self._cmp(other)
if c is NotImplemented:
return c
return c <= 0
def __gt__(self, other):
c = self._cmp(other)
if c is NotImplemented:
return c
return c > 0
def __ge__(self, other):
c = self._cmp(other)
if c is NotImplemented:
return c
return c >= 0
# Copied from setuptools/_distutils/version.py
class LooseVersion(Version):
"""Version numbering for anarchists and software realists.
Implements the standard interface for version number classes as
described above. A version number consists of a series of numbers,
separated by either periods or strings of letters. When comparing
version numbers, the numeric components will be compared
numerically, and the alphabetic components lexically. The following
are all valid version numbers, in no particular order:
1.5.1
1.5.2b2
161
3.10a
8.02
3.4j
1996.07.12
3.2.pl0
3.1.1.6
2g6
11g
0.960923
2.2beta29
1.13++
5.5.kw
2.0b1pl0
In fact, there is no such thing as an invalid version number under
this scheme; the rules for comparison are simple and predictable,
but may not always give the results you want (for some definition
of "want").
"""
component_re = re.compile(r"(\d+ | [a-z]+ | \.)", re.VERBOSE)
def parse(self, vstring):
# I've given up on thinking I can reconstruct the version string
# from the parsed tuple -- so I just store the string here for
# use by __str__
self.vstring = vstring
components = [
x for x in self.component_re.split(vstring) if x and x != "."
]
for i, obj in enumerate(components):
try:
components[i] = int(obj)
except ValueError:
pass
self.version = components
def __str__(self):
return self.vstring
def __repr__(self):
return "LooseVersion ('%s')" % str(self)
def _cmp(self, other):
if isinstance(other, str):
other = LooseVersion(other)
elif not isinstance(other, LooseVersion):
return NotImplemented
if self.version == other.version:
return 0
if self.version < other.version:
return -1
if self.version > other.version:
return 1
# Copied from setuptools/_distutils/spawn.py
def find_executable(executable, path=None):
"""Tries to find 'executable' in the directories listed in 'path'.
A string listing directories separated by 'os.pathsep'; defaults to
os.environ['PATH']. Returns the complete filename or None if not found.
"""
_, ext = os.path.splitext(executable)
if (sys.platform == "win32") and (ext != ".exe"):
executable = executable + ".exe"
if os.path.isfile(executable):
return executable
if path is None:
path = os.environ.get("PATH", None)
if path is None:
try:
path = os.confstr("CS_PATH")
except (AttributeError, ValueError):
# os.confstr() or CS_PATH is not available
path = os.defpath
# bpo-35755: Don't use os.defpath if the PATH environment variable is
# set to an empty string
# PATH='' doesn't match, whereas PATH=':' looks in the current directory
if not path:
return None
paths = path.split(os.pathsep)
for p in paths:
f = os.path.join(p, executable)
if os.path.isfile(f):
# the file exists, we have a shot at spawn working
return f
return None
defence360agent/utils/completions.py 0000644 0000000 0000000 00000023404 00000000000 014617 0 ustar """
Shell auto-completion script generators for the CLI.
Introspects an argparse parser to enumerate all commands, subcommands, and
flags, then emits completion scripts for bash, zsh, and fish.
"""
import argparse
import re
from typing import Dict, List, Tuple
def _safe_identifier(prog: str) -> str:
"""Convert a prog name to a safe shell identifier (letters, digits, _)."""
return re.sub(r"[^a-zA-Z0-9]", "_", prog)
def _collect_commands(
parser: argparse.ArgumentParser,
) -> Dict[Tuple[str, ...], List[str]]:
"""Walk the parser tree and return {command_path: [flags]} mapping."""
result: Dict[Tuple[str, ...], List[str]] = {}
_walk_parser(parser, (), result)
return result
def _get_flags(parser: argparse.ArgumentParser) -> List[str]:
"""Extract all optional flags from a parser (excluding help)."""
flags = []
for action in parser._actions:
if isinstance(action, argparse._HelpAction):
continue
if isinstance(action, argparse._SubParsersAction):
continue
for opt in action.option_strings:
flags.append(opt)
return sorted(flags)
def _walk_parser(
parser: argparse.ArgumentParser,
path: Tuple[str, ...],
result: Dict[Tuple[str, ...], List[str]],
):
"""Recursively walk subparsers and collect command paths + flags."""
flags = _get_flags(parser)
result[path] = flags
for action in parser._actions:
if isinstance(action, argparse._SubParsersAction):
for name, subparser in action.choices.items():
_walk_parser(subparser, path + (name,), result)
def _get_subcommands(
commands: Dict[Tuple[str, ...], List[str]],
prefix: Tuple[str, ...],
) -> List[str]:
"""Get immediate subcommands of a given prefix."""
subs = set()
for path in commands:
if len(path) == len(prefix) + 1 and path[: len(prefix)] == prefix:
subs.add(path[-1])
return sorted(subs)
def generate_bash(
parser: argparse.ArgumentParser, prog: str = "imunify360-agent"
) -> str:
"""Generate a bash completion script."""
commands = _collect_commands(parser)
lines = []
lines.append(f"# bash completion for {prog}")
lines.append(f"# Auto-generated by {prog} completions bash")
lines.append("")
lines.append(f"_{_safe_identifier(prog)}_completions() {{")
lines.append(" local cur prev words cword")
lines.append(" if type _init_completion &>/dev/null; then")
lines.append(" _init_completion || return")
lines.append(" else")
lines.append(" COMPREPLY=()")
lines.append(' cur="${COMP_WORDS[COMP_CWORD]}"')
lines.append(' prev="${COMP_WORDS[COMP_CWORD-1]}"')
lines.append(' words=("${COMP_WORDS[@]}")')
lines.append(" cword=$COMP_CWORD")
lines.append(" fi")
lines.append("")
lines.append(" # Build the command path from words")
lines.append(' local cmd_path=""')
lines.append(" local i")
lines.append(" for (( i=1; i < cword; i++ )); do")
lines.append(' case "${words[i]}" in')
lines.append(" -*) continue ;;")
lines.append(
' *) cmd_path="${cmd_path:+${cmd_path} }${words[i]}" ;;'
)
lines.append(" esac")
lines.append(" done")
lines.append("")
lines.append(' case "$cmd_path" in')
# Sort by depth (deepest first) so more specific paths match first
all_paths = sorted(commands.keys(), key=lambda p: (-len(p), p))
for path in all_paths:
if not path:
continue
subs = _get_subcommands(commands, path)
flags = commands[path]
completions = " ".join(subs + flags)
pattern = " ".join(path)
lines.append(f' "{pattern}")')
lines.append(
f' COMPREPLY=($(compgen -W "{completions}" -- "$cur"))'
)
lines.append(" return ;;")
# Root level
root_subs = _get_subcommands(commands, ())
root_flags = commands.get((), [])
root_completions = " ".join(root_subs + root_flags)
lines.append(' "")')
lines.append(
f' COMPREPLY=($(compgen -W "{root_completions}" -- "$cur"))'
)
lines.append(" return ;;")
lines.append(" esac")
lines.append("}")
lines.append("")
lines.append(f"complete -F _{_safe_identifier(prog)}_completions {prog}")
lines.append("")
return "\n".join(lines)
def generate_zsh(
parser: argparse.ArgumentParser, prog: str = "imunify360-agent"
) -> str:
"""Generate a zsh completion script."""
commands = _collect_commands(parser)
func_name = f"_{_safe_identifier(prog)}"
lines = []
lines.append(f"#compdef {prog}")
lines.append(f"# zsh completion for {prog}")
lines.append(f"# Auto-generated by {prog} completions zsh")
lines.append("")
lines.append(f"{func_name}() {{")
lines.append(" local -a commands flags")
lines.append(" local cmd_path")
lines.append("")
lines.append(" # Build command path from words")
lines.append(" cmd_path=()")
lines.append(" for word in ${words[2,-1]}; do")
lines.append(" [[ $word == -* ]] && continue")
lines.append(' [[ $word == "$words[$CURRENT]" ]] && continue')
lines.append(" cmd_path+=($word)")
lines.append(" done")
lines.append("")
lines.append(' case "${cmd_path[*]}" in')
all_paths = sorted(commands.keys(), key=lambda p: (-len(p), p))
for path in all_paths:
if not path:
continue
subs = _get_subcommands(commands, path)
flags = commands[path]
pattern = " ".join(path)
lines.append(f' "{pattern}")')
if subs:
desc_list = " ".join(f'"{s}"' for s in subs)
lines.append(f" commands=({desc_list})")
if flags:
flag_list = " ".join(f'"{f}"' for f in flags)
lines.append(f" flags=({flag_list})")
lines.append(
" _describe 'command' commands -- flags && return"
if subs
else f" compadd -- {' '.join(flags)} && return"
)
lines.append(" ;;")
# Root level
root_subs = _get_subcommands(commands, ())
root_flags = commands.get((), [])
root_desc = " ".join(f'"{s}"' for s in root_subs)
lines.append(' "")')
lines.append(f" commands=({root_desc})")
if root_flags:
flag_list = " ".join(f'"{f}"' for f in root_flags)
lines.append(f" flags=({flag_list})")
lines.append(" _describe 'command' commands -- flags && return")
lines.append(" ;;")
lines.append(" esac")
lines.append("}")
lines.append("")
lines.append(f"{func_name}")
lines.append("")
return "\n".join(lines)
def generate_fish(
parser: argparse.ArgumentParser, prog: str = "imunify360-agent"
) -> str:
"""Generate a fish completion script."""
commands = _collect_commands(parser)
lines = []
lines.append(f"# fish completion for {prog}")
lines.append(f"# Auto-generated by {prog} completions fish")
lines.append("")
# For each command path, emit completions
# Fish uses conditions based on what subcommands have been entered
for path in sorted(commands.keys(), key=lambda p: (len(p), p)):
subs = _get_subcommands(commands, path)
flags = commands[path]
if not path:
# Root level subcommands
condition = (
"not __fish_seen_subcommand_from"
f" {' '.join(_get_subcommands(commands, ()))}"
)
for sub in subs:
lines.append(
f"complete -c {prog} -n '{condition}' -f -a '{sub}'"
)
for flag in flags:
if flag.startswith("--"):
lines.append(
f"complete -c {prog} -n '{condition}' -l '{flag[2:]}'"
)
elif flag.startswith("-"):
lines.append(
f"complete -c {prog} -n '{condition}' -s '{flag[1:]}'"
)
else:
# Build condition: must have seen parent commands but not children
seen_parts = []
for p in path:
seen_parts.append(f"__fish_seen_subcommand_from {p}")
condition = " && ".join(seen_parts)
child_subs = subs
if child_subs:
condition += (
" && not __fish_seen_subcommand_from"
f" {' '.join(child_subs)}"
)
for sub in subs:
lines.append(
f"complete -c {prog} -n '{condition}' -f -a '{sub}'"
)
for flag in flags:
if flag.startswith("--"):
lines.append(
f"complete -c {prog} -n '{condition}' -l '{flag[2:]}'"
)
elif flag.startswith("-"):
lines.append(
f"complete -c {prog} -n '{condition}' -s '{flag[1:]}'"
)
lines.append("")
return "\n".join(lines)
GENERATORS = {
"bash": generate_bash,
"zsh": generate_zsh,
"fish": generate_fish,
}
SUPPORTED_SHELLS = sorted(GENERATORS.keys())
def generate_completions(
parser: argparse.ArgumentParser,
shell: str,
prog: str = "imunify360-agent",
) -> str:
"""Generate completion script for the given shell.
Raises ValueError if shell is not supported.
"""
generator = GENERATORS.get(shell)
if generator is None:
raise ValueError(
f"Unsupported shell: {shell}. "
f"Supported shells: {', '.join(SUPPORTED_SHELLS)}"
)
return generator(parser, prog)
defence360agent/utils/config.py 0000644 0000000 0000000 00000003237 00000000000 013532 0 ustar import asyncio
import copy
import time
from logging import getLogger
from defence360agent.contracts import config, messages
from defence360agent.feature_management import checkers
CONFIG_UPDATE_TIMEOUT = config.SimpleRpc.CLIENT_TIMEOUT / 2
logger = getLogger(__name__)
OBSOLETE_SECTION = "KERNELCARE"
OBSOLETE_OPTION = "edf"
def warn_obsolete_option(data):
if OBSOLETE_OPTION in data.get(OBSOLETE_SECTION, dict()):
logger.warning(
"Configuration update with an obsolete kernelcare option 'edf'."
" This option has no effect."
)
def enforce_waf_optin_policy(data):
wordpress = data.get("WORDPRESS")
if not isinstance(wordpress, dict):
return
if (
config.caller_type.get() == config.UserType.NON_ROOT
and wordpress.get("waf_enabled") is True
and not config.Wordpress.WAF_DEFAULT
):
wordpress.pop("waf_enabled", None)
if not wordpress:
data.pop("WORDPRESS", None)
async def update_config(sink, data, user=None):
warn_obsolete_option(data)
checkers.config_validation(data, user)
enforce_waf_optin_policy(data)
conf = config.ConfigFile(user)
conf.dict_to_config(data, without_defaults=True)
updated = asyncio.Event()
await sink.process_message(
messages.ConfigUpdate(
conf=conf,
timestamp=time.time(),
event=updated,
# Snapshot so a caller that reuses/mutates the delta after this
# returns cannot alter what a handler reads as "submitted".
submitted=copy.deepcopy(data),
)
)
await asyncio.wait_for(updated.wait(), timeout=CONFIG_UPDATE_TIMEOUT)
defence360agent/utils/cronjob.py 0000644 0000000 0000000 00000001606 00000000000 013717 0 ustar from typing import Union, Optional
class CronJob(object):
__slots__ = "minute", "hour", "cmd"
def __init__(
self,
*,
minute: Union[int, str, None],
hour: Union[int, str, None],
cmd: Optional[str],
):
self.minute = minute
self.hour = hour
self.cmd = cmd
def __str__(self):
return (
"# DO NOT EDIT. AUTOMATICALLY GENERATED BY IMUNIFY360."
f"\n{self.minute} {self.hour} * * * root {self.cmd}\n"
)
@classmethod
def from_str(cls, data):
minute = hour = cmd = None
lines = [x for x in data.splitlines() if x[0] != "#"]
if lines:
line_members = lines[0].split(" ")
minute = line_members[0]
hour = line_members[1]
cmd = " ".join(line_members[6:])
return CronJob(minute=minute, hour=hour, cmd=cmd)
defence360agent/utils/doctor.py 0000644 0000000 0000000 00000012577 00000000000 013566 0 ustar import asyncio
import logging
import os
import shutil
import stat
import tempfile
import urllib.request
from pathlib import Path
from typing import Optional
from defence360agent.contracts.config import Packaging
from defence360agent.subsys.persistent_state import save_state
from defence360agent.utils import CheckRunError, check_run
_HTTP_TIMEOUT = 30
logger = logging.getLogger(__name__)
_SCRIPT_NAME = "imunify-doctor.sh"
_SCRIPT_URL = (
"https://repo.imunify360.cloudlinux.com/defence360/" + _SCRIPT_NAME
)
_SIG_URL = _SCRIPT_URL + ".sig"
_TMPDIR = Path("/var/imunify360/tmp")
_PUBKEY_PATHS = (
Path("/etc/pki/rpm-gpg/RPM-GPG-KEY-CloudLinux-Imunify"),
Path("/etc/apt/trusted.gpg.d/RPM-GPG-KEY-CloudLinux.gpg"),
)
def _find_pubkey() -> Optional[Path]:
for p in _PUBKEY_PATHS:
if p.is_file() and os.access(str(p), os.R_OK):
return p
return None
def _blocking_download(url: str, dst: Path) -> None:
req = urllib.request.Request(url)
with urllib.request.urlopen(req, timeout=_HTTP_TIMEOUT) as resp, dst.open(
"wb"
) as fp:
shutil.copyfileobj(resp, fp)
def _blocking_setup_workdir():
"""Locate the pubkey + gpg binary and create a validated 0700 workdir.
Returns (pubkey_path, workdir_path) on success or None on failure;
any partial state is removed before returning.
"""
pubkey = _find_pubkey()
if pubkey is None or not shutil.which("gpg"):
return None
try:
_TMPDIR.mkdir(mode=0o700, parents=True, exist_ok=True)
workdir = Path(
tempfile.mkdtemp(prefix="imunify-doctor.", dir=str(_TMPDIR))
)
except OSError as exc:
logger.info("cannot prepare workdir under %s: %s", _TMPDIR, exc)
return None
try:
# Single lstat — atomic snapshot of mode + uid. Path.is_dir() would
# follow symlinks and Path.is_symlink() would issue another lstat, so
# using st.st_mode here both eliminates the extra syscalls and keeps
# the symlink rejection semantically consistent with the lstat.
st = workdir.lstat()
if (
stat.S_ISLNK(st.st_mode)
or not stat.S_ISDIR(st.st_mode)
or st.st_uid != os.geteuid()
):
shutil.rmtree(str(workdir), ignore_errors=True)
return None
(workdir / "gnupg").mkdir(mode=0o700)
except OSError as exc:
logger.info("workdir setup failed: %s", exc)
shutil.rmtree(str(workdir), ignore_errors=True)
return None
return pubkey, workdir
def _blocking_rmtree(p: Path) -> None:
shutil.rmtree(str(p), ignore_errors=True)
def _blocking_chmod(p: Path, mode: int) -> None:
p.chmod(mode)
async def _download(url: str, dst: Path) -> None:
"""Fetch *url* to *dst* without blocking the event loop.
Raises urllib.error.URLError (subclass of OSError) on any HTTP/transport
error, which the caller's `except OSError` already handles.
"""
loop = asyncio.get_event_loop()
await loop.run_in_executor(None, _blocking_download, url, dst)
async def _verified_remote_script() -> Optional[Path]:
"""
Download imunify-doctor.sh + .sig into /var/imunify360/tmp and verify the
detached signature against an ephemeral keyring seeded with the
CloudLinux pubkey. Returns the verified script on success or None on
any failure (so the caller can fall back to the package copy).
"""
loop = asyncio.get_event_loop()
setup = await loop.run_in_executor(None, _blocking_setup_workdir)
if setup is None:
return None
pubkey, workdir = setup
script = workdir / _SCRIPT_NAME
sig = workdir / (_SCRIPT_NAME + ".sig")
gpghome = workdir / "gnupg"
success = False
try:
await _download(_SCRIPT_URL, script)
await _download(_SIG_URL, sig)
env = dict(os.environ, GNUPGHOME=str(gpghome))
await check_run(
["gpg", "--batch", "--quiet", "--import", str(pubkey)],
env=env,
)
await check_run(
["gpg", "--batch", "--quiet", "--verify", str(sig), str(script)],
env=env,
)
await loop.run_in_executor(None, _blocking_chmod, script, 0o700)
success = True
return script
except (CheckRunError, OSError) as exc:
logger.info("signed remote doctor fetch failed: %s", exc)
return None
finally:
if not success:
await loop.run_in_executor(None, _blocking_rmtree, workdir)
async def _repo_get_doctor_key() -> str:
script = await _verified_remote_script()
if script is None:
raise ValueError("Signed remote doctor script not available")
loop = asyncio.get_event_loop()
try:
out = await check_run([str(script)])
finally:
await loop.run_in_executor(None, _blocking_rmtree, script.parent)
key = out.decode().strip()
if not key:
raise ValueError("Doctor key is empty")
return key
async def _package_get_doctor_key() -> str:
dir_ = Packaging.DATADIR
if not Path(dir_).is_dir():
dir_ = "/opt/imunify360/venv/share/imunify360"
out = await check_run([Path(dir_, "scripts", _SCRIPT_NAME)])
key = out.decode().strip()
return key
async def get_doctor_key():
try:
key = await _repo_get_doctor_key()
except (CheckRunError, ValueError, OSError):
key = await _package_get_doctor_key()
save_state("doctor_key", {"doctor_key": key})
return key
defence360agent/utils/fd_ops.py 0000644 0000000 0000000 00000016625 00000000000 013544 0 ustar """fd-based file operations for symlink-attack mitigation.
All helpers in this module use O_NOFOLLOW and dir_fd-relative syscalls
so that no path-based resolution can be redirected by a concurrent
symlink swap.
This module is intentionally kept separate from utils/__init__.py to
avoid loading these OS-specific helpers into every agent component.
"""
import errno
import logging
import os
import stat
from contextlib import contextmanager, suppress
from pathlib import Path
logger = logging.getLogger(__name__)
def rmtree_fd(dir_fd) -> None:
"""Remove all contents of a directory using fd-relative operations.
Every entry is opened with ``O_NOFOLLOW`` so symlinks inside the tree
are unlinked rather than followed. The directory referenced by
*dir_fd* itself is **not** removed — the caller should ``os.rmdir()``
the parent entry after this call returns.
Uses an iterative approach with an explicit stack to avoid hitting
Python's recursion limit on adversarial deeply-nested trees.
*dir_fd* must be an open ``O_RDONLY | O_DIRECTORY`` descriptor.
"""
# Each stack frame is (fd, name_to_rmdir_after_close) where
# name_to_rmdir_after_close is the entry name that should be
# rmdir'd from the parent once this fd is fully processed.
# The initial fd is managed by the caller, so its rmdir entry is None.
stack = [(dir_fd, None)]
try:
while stack:
current_fd, _ = stack[-1]
pushed = False
with os.scandir(current_fd) as entries:
for entry in entries:
if entry.is_dir(follow_symlinks=False):
child_fd = os.open(
entry.name,
os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW,
dir_fd=current_fd,
)
stack.append((child_fd, entry.name))
pushed = True
break # restart scan from the new directory
else:
os.unlink(entry.name, dir_fd=current_fd)
if not pushed:
# All entries in current directory have been removed.
fd, name = stack.pop()
if name is not None:
# Close the child fd and rmdir it from the parent.
os.close(fd)
parent_fd, _ = stack[-1]
os.rmdir(name, dir_fd=parent_fd)
except BaseException:
# On error, close any fds we opened (but not the caller's dir_fd).
for fd, name in stack:
if name is not None:
os.close(fd)
raise
def open_dir_no_symlinks(path) -> int:
"""Open a directory, refusing symlinks at every path component.
Walks the absolute *path* one component at a time, opening each with
``O_NOFOLLOW | O_DIRECTORY`` relative to the parent fd. This guards
against symlink attacks at *any* depth in the hierarchy, not just the
leaf.
Returns an ``O_RDONLY`` file descriptor for the final directory.
The caller is responsible for closing it.
"""
path = os.path.abspath(os.fspath(path))
parts = Path(path).parts # ('/', 'home', 'user', ...)
fd = os.open(parts[0], os.O_RDONLY | os.O_DIRECTORY)
try:
for part in parts[1:]:
new_fd = os.open(
part,
os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW,
dir_fd=fd,
)
os.close(fd)
fd = new_fd
return fd
except BaseException:
os.close(fd)
raise
@contextmanager
def open_nofollow(path, flags=os.O_RDONLY, *, dir_fd=None):
"""Open a file with O_NOFOLLOW, closing the fd on exit.
Yields the raw file descriptor. Rejects symlinks at the leaf
component (raises ELOOP).
When *dir_fd* is provided, *path* is resolved relative to that
directory descriptor.
"""
kw = {"dir_fd": dir_fd} if dir_fd is not None else {}
fd = os.open(str(path), flags | os.O_NOFOLLOW, **kw)
try:
yield fd
finally:
os.close(fd)
@contextmanager
def safe_dir(path):
"""Open a directory with symlink protection, closing the fd on exit.
Walks every path component with O_NOFOLLOW via open_dir_no_symlinks
and yields the resulting fd.
"""
fd = open_dir_no_symlinks(path)
try:
yield fd
finally:
os.close(fd)
def atomic_rewrite_fd(
filename,
data: bytes,
*,
uid,
gid,
allow_empty_content,
permissions,
dir_fd: int,
) -> bool:
"""dir_fd-relative implementation of atomic_rewrite.
The caller opens the directory with O_NOFOLLOW before any file I/O
begins. All file operations use dir_fd so that a concurrent rename
of the directory to a symlink cannot redirect writes to a privileged
path.
"""
_, basename = os.path.split(filename)
# Read current content without following symlinks.
try:
content_fd = os.open(
basename, os.O_RDONLY | os.O_NOFOLLOW, dir_fd=dir_fd
)
with os.fdopen(content_fd, "rb") as f:
old_content = f.read(len(data) + 1)
if old_content == data:
return False
except FileNotFoundError:
pass # file does not exist yet; will be created
except OSError as exc:
if exc.errno == errno.ELOOP:
pass # existing entry is a symlink; overwrite it
else:
raise
if not allow_empty_content and not data:
logger.error("empty content: %r for file: %s", data, filename)
return False
if permissions is None:
try:
st = os.stat(basename, dir_fd=dir_fd, follow_symlinks=False)
if stat.S_ISLNK(st.st_mode):
raise OSError(errno.ELOOP, os.strerror(errno.ELOOP), basename)
permissions = stat.S_IMODE(st.st_mode)
except FileNotFoundError:
current_umask = os.umask(0)
os.umask(current_umask)
permissions = 0o666 & ~current_umask
# Create temp file atomically inside the directory referenced by dir_fd.
# O_NOFOLLOW + O_EXCL ensures the name cannot be a pre-existing symlink.
tmp_basename = None
tmp_fd = -1
for _ in range(100):
tmp_basename = f"{basename}_{os.urandom(4).hex()}.i360edit"
try:
tmp_fd = os.open(
tmp_basename,
os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW,
0o600,
dir_fd=dir_fd,
)
break
except FileExistsError:
continue
else:
raise FileExistsError("Could not create temporary file (100 attempts)")
try:
view = memoryview(data)
written = 0
while written < len(data):
written += os.write(tmp_fd, view[written:])
if uid is not None and gid is not None:
os.chown(tmp_fd, uid, gid)
os.chmod(tmp_fd, permissions)
os.fsync(tmp_fd)
os.close(tmp_fd)
tmp_fd = -1
# Atomic rename entirely within the directory we hold open.
os.rename(tmp_basename, basename, src_dir_fd=dir_fd, dst_dir_fd=dir_fd)
tmp_basename = None # rename succeeded; no cleanup needed
finally:
if tmp_fd >= 0:
os.close(tmp_fd)
if tmp_basename is not None:
with suppress(FileNotFoundError):
os.unlink(tmp_basename, dir_fd=dir_fd)
return True
defence360agent/utils/hyperscan.py 0000644 0000000 0000000 00000000225 00000000000 014253 0 ustar import functools
@functools.lru_cache(maxsize=1)
def is_ssse3_supported():
with open("/proc/cpuinfo") as f:
return "ssse3" in f.read()
defence360agent/utils/importer.py 0000644 0000000 0000000 00000005242 00000000000 014124 0 ustar """
Provides utilities for dynamically loading packages/modules.
"""
import importlib
import importlib.util
import logging
import pkgutil
from pathlib import Path
from typing import Generator, List, Union
logger = logging.getLogger(__name__)
def get_module_by_path(
module_name: str, file_path: Union[str, Path]
) -> "module": # noqa: F821
"""
Execute and return module from *file_path*
"""
# https://docs.python.org/3/library/importlib.html#importing-a-source-file-directly
spec = importlib.util.spec_from_file_location(module_name, file_path)
module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(module)
return module
def iter_modules(
paths: List[Union[str, Path]]
) -> Generator["module", None, None]: # noqa: F821
"""
Yields all modules from *paths*
"""
for module in pkgutil.iter_modules(paths):
if not module.ispkg:
path = Path(module.module_finder.path) / f"{module.name}.py"
yield get_module_by_path(module.name, path)
def load(name: str, missing_ok=False) -> None:
"""
Import *name* module, if *name* is a package import all submodules.
If *name* module/package is not found:
- raise ModuleNotFoundError if *missing_ok* is False
- ignore it if *missing_ok* is True
"""
try:
spec = importlib.util.find_spec(name)
except ModuleNotFoundError:
if not missing_ok:
raise
return
# import *name* itself, for package it is __init__.py
importlib.import_module(name)
if spec.loader.is_package(spec.name):
package = name
for module in pkgutil.iter_modules(spec.submodule_search_locations):
importlib.import_module(f"{package}.{module.name}")
def load_packages(packages: tuple, missing_ok=False) -> None:
for package in packages:
load(package, missing_ok=missing_ok)
def get(*, module, name, default):
"""
Return object with *name* from specific *module*.
If object was not found return *default*
"""
try:
m = importlib.import_module(module)
except ImportError:
return default
return getattr(m, name, default)
def exists(name):
try:
spec = importlib.util.find_spec(name)
except ModuleNotFoundError:
return False
return spec is not None
class LazyImport:
def __init__(self, module_name: str):
self._module_name = module_name
self._module = None
@property
def module(self):
if self._module is None:
self._module = importlib.import_module(self._module_name)
return self._module
def __getattr__(self, attr):
return getattr(self.module, attr)
defence360agent/utils/ipecho.py 0000644 0000000 0000000 00000006257 00000000000 013541 0 ustar """IPEchoAPI - returns real IP address of the host (behind NAT)"""
import asyncio
import functools
import logging
import time
import urllib
from pathlib import Path
from typing import Optional
from async_lru import alru_cache
from defence360agent.api.server import API, APIError
from defence360agent.utils import atomic_rewrite
from defence360agent.utils.validate import IP, IPVersion
logger = logging.getLogger(__name__)
TIMEOUT_FOR_IPECHO_REQUEST = 5 # in seconds
CACHE_TTL_SECONDS = 3 * 60 * 60
CACHE_FILE_PATH = Path("/var/imunify360") / "ipecho_cache"
class IPEchoAPI(API):
"""Make requests to the API for obtain own IP address"""
URL = "/api/ip"
@classmethod
@alru_cache(maxsize=3)
async def get_ip(cls, ip_version: IPVersion = None) -> Optional[str]:
"""Return cached result for resolved IP from echo ip API"""
return await cls.ip_for_version(ip_version)
@classmethod
@functools.lru_cache(maxsize=1)
def server_ip(cls):
"""Return cached result for resolved IP from echo ip API"""
try:
return cls._get_ip()
except Exception as e:
raise APIError from e
@classmethod
async def ip_for_version(
cls, ip_version: IPVersion = None
) -> Optional[str]:
"""Return resolved IP from echo ip API"""
loop = asyncio.get_event_loop()
try:
ip = await asyncio.wait_for(
loop.run_in_executor(None, cls._get_ip),
timeout=TIMEOUT_FOR_IPECHO_REQUEST,
)
if IP.type_of(ip) != ip_version:
raise ValueError("Wrong ip type")
return ip
except (asyncio.TimeoutError, ValueError) as e:
raise APIError from e
@classmethod
def _load_cache(cls) -> Optional[str]:
try:
if not CACHE_FILE_PATH.exists():
return None
mtime = CACHE_FILE_PATH.stat().st_mtime
cache_age = time.time() - mtime
if cache_age < 0:
return None
if cache_age < CACHE_TTL_SECONDS:
ip = CACHE_FILE_PATH.read_text().strip()
return ip
else:
return None
except Exception as e:
logger.error("IPEchoAPI cache read error: %s", e)
return None
@classmethod
def _save_cache(cls, ip: str) -> None:
try:
atomic_rewrite(
CACHE_FILE_PATH,
ip,
backup=False,
permissions=0o644,
)
except Exception as e:
logger.error("IPEchoAPI cache write error: %s", e)
@classmethod
def _get_ip(cls):
"""Get IP from file-based cache or send request to API and process response."""
cached_ip = cls._load_cache()
if cached_ip is not None:
return cached_ip
request = urllib.request.Request(cls._BASE_URL + cls.URL)
response = cls.request(request)
if response.get("status") != "ok":
# time inside sync executor
raise APIError("Unexpected API error")
ip = response.get("ip")
if ip:
cls._save_cache(ip)
return ip
defence360agent/utils/json.py 0000644 0000000 0000000 00000001671 00000000000 013236 0 ustar """JSON encoders to help with sending messages to server."""
import json
from ipaddress import IPv4Address, IPv4Network, IPv6Address, IPv6Network
from playhouse.shortcuts import model_to_dict
from defence360agent.model import Model
def ip_net_to_string(net) -> str:
"""
IPv4Network('192.168.1.1/32') -> '192.168.1.1'
IPv4Network('192.168.1.0/24') -> '192.168.1.0/24'
"""
if not int(net.hostmask):
return str(net.network_address)
return str(net)
class IPEncoder(json.JSONEncoder):
def default(self, obj):
if isinstance(obj, (IPv4Network, IPv6Network)):
return ip_net_to_string(obj)
if isinstance(obj, (IPv4Address, IPv6Address)):
return str(obj)
return json.JSONEncoder.default(self, obj)
class ServerJSONEncoder(IPEncoder):
def default(self, obj):
if isinstance(obj, Model):
return model_to_dict(obj)
return super().default(obj)
defence360agent/utils/kwconfig.py 0000644 0000000 0000000 00000003334 00000000000 014072 0 ustar import re
from typing import Optional
from defence360agent.utils import atomic_rewrite
class KWConfig:
"""
Basic class for working with key-value configuration files
Subclasses must define SEARCH_PATTERN and WRITE_PATTERN
attributes
"""
SEARCH_PATTERN = DEFAULT_FILENAME = WRITE_PATTERN = ""
ALLOW_EMPTY_CONFIG = True
def __init__(self, name, filename=None):
assert self.SEARCH_PATTERN
self._pattern = re.compile(
self.SEARCH_PATTERN.format(name), re.MULTILINE
)
self._filename = filename or self.DEFAULT_FILENAME
self._name = name
def set(self, value) -> Optional[str]:
assert self.WRITE_PATTERN
with open(self._filename) as f:
content = f.read()
old_value = self._parse(content)
if old_value is None:
# If no variable found, just add to the bottom
content += (
"\n" + self.WRITE_PATTERN.format(self._name, value) + "\n"
)
else:
content = self._pattern.sub(
self.WRITE_PATTERN.format(self._name, value), content
)
atomic_rewrite(
self._filename,
content,
allow_empty_content=self.ALLOW_EMPTY_CONFIG,
)
return old_value
def get(self) -> Optional[str]:
with open(self._filename) as f:
content = f.read()
return self._parse(content)
def _parse(self, content) -> Optional[str]:
match = self._pattern.search(content)
return match and match.group(1)
class PureFTPBaseConfig(KWConfig):
SEARCH_PATTERN = r"^\s*?{}\s+(.*?)\s*?$"
WRITE_PATTERN = "{} {}"
DEFAULT_FILENAME = "/etc/pure-ftpd.conf"
defence360agent/utils/net.py 0000644 0000000 0000000 00000001123 00000000000 013043 0 ustar from ipaddress import IPv4Address, IPv4Network, IPv6Address, IPv6Network
from typing import Tuple, Union
TCP = "tcp"
IN, OUT = "in", "out"
def pack_ip_address(ip_address: Union[IPv4Address, IPv6Address]):
if ip_address.version == 6:
return int.from_bytes(ip_address.packed[:8], "big", signed=True)
else:
return int(ip_address)
def pack_ip_network(
ip_network: Union[IPv4Network, IPv6Network]
) -> Tuple[int, int, int]:
net = pack_ip_address(ip_network.network_address)
mask = pack_ip_address(ip_network.netmask)
return net, mask, ip_network.version
defence360agent/utils/net_transport.py 0000644 0000000 0000000 00000030160 00000000000 015162 0 ustar """Networking transport helpers for urllib.
This module provides a small abstraction on top of urllib.request so that
callers can keep using urllib.request.Request, but routing of connections
can be customized:
- hostname resolution is handled in user code;
- selected IP may be randomized or chosen using any complex logic;
- for HTTPS: connects to a chosen IP but keeps correct SNI and certificate
hostname validation for the original hostname (NOT the IP).
Examples:
Default behavior (plain urllib):
from defence360agent.utils.net_transport import UrlTransport
transport = UrlTransport()
req = urllib.request.Request(
"https://files.imunify360.com/static/sigs/v1/description.json"
)
with transport.open(req, timeout=10) as resp:
body = resp.read()
Randomize target IP on each connection (A/AAAA -> random choice):
from defence360agent.utils.net_transport import UrlTransport, RandomIpChooser
chooser = RandomIpChooser()
transport = UrlTransport(ip_chooser=chooser)
req = urllib.request.Request(
"https://files.imunify360.com/static/sigs/v1/description.json"
)
with transport.open(req, timeout=10) as resp:
body = resp.read()
Notes:
- HTTPS: connects to the chosen IP but keeps SNI/cert checks against original
hostname.
- HTTP: Host header stays original hostname because urllib builds it from the
URL.
"""
import http.client
import ipaddress
import random
import socket
import threading
import time
import urllib.request
from abc import ABC, abstractmethod
from logging import getLogger
from typing import Dict, Optional, Tuple, TYPE_CHECKING
if TYPE_CHECKING:
import ssl
logger = getLogger(__name__)
#: default cache TTL for DNS responses
_DNS_DEFAULT_TTL_SECONDS = 300.0
def _is_ipv4(ip: str) -> bool:
"""Return True if *ip* is an IPv4 address string.
Implementation relies solely on ipaddress.ip_address for correctness.
"""
try:
return isinstance(ipaddress.ip_address(ip), ipaddress.IPv4Address)
except ValueError:
return False
class IpChooser(ABC):
"""Select an IP address to connect to for a given hostname and port.
Implementations may be stateful and can keep caches/metrics inside.
"""
@abstractmethod
def choose(self, hostname: str, port: int) -> str:
"""Return an IP address (v4 or v6) for *hostname*:*port*."""
raise NotImplementedError
def __call__(self, hostname: str, port: int) -> str:
return self.choose(hostname, port)
class DnsCacheResolver:
"""DNS cache for socket.getaddrinfo() results.
It caches per (hostname, port, family). This is intentionally small and
local: it is meant only to avoid excessive getaddrinfo() calls.
"""
def __init__(
self,
*,
family: int = socket.AF_UNSPEC,
ttl_seconds: float = _DNS_DEFAULT_TTL_SECONDS,
):
self._family = family
self._ttl_seconds = ttl_seconds
self._cache: Dict[
Tuple[str, int, int], Tuple[float, Tuple[str, ...]]
] = {}
self._lock = threading.Lock()
def get_ips(self, hostname: str, port: int) -> Tuple[str, ...]:
key = (hostname, port, self._family)
now = time.time()
with self._lock:
cached = self._cache.get(key)
if cached is not None:
expires_at, ips = cached
if now < expires_at:
logger.debug(
"DnsCacheResolver cache hit for %s:%s (family=%s)",
hostname,
port,
self._family,
)
return ips
logger.debug(
"DnsCacheResolver cache miss/expired for %s:%s (family=%s)",
hostname,
port,
self._family,
)
infos = socket.getaddrinfo(
hostname,
port,
self._family,
socket.SOCK_STREAM,
)
ips = []
for _, _, _, _, sockaddr in infos:
ip = sockaddr[0]
if ip not in ips:
ips.append(ip)
if not ips:
raise OSError("No IPs resolved for {}:{}".format(hostname, port))
ips_t = tuple(ips)
with self._lock:
self._cache[key] = (now + self._ttl_seconds, ips_t)
logger.debug(
"DnsCacheResolver resolved %s:%s (family=%s) to %s",
hostname,
port,
self._family,
ips_t,
)
return ips_t
class RandomIpChooserWithIPv6Toggle(IpChooser):
"""Resolve hostname and select a random IP.
IPv6 selection can be enabled/disabled at runtime:
- when IPv6 is enabled: choose from IPv4 + IPv6 candidates
- when IPv6 is disabled: choose from IPv4-only candidates
"""
def __init__(
self,
*,
resolver: Optional[DnsCacheResolver] = None,
rng: Optional[random.Random] = None,
ipv6_enabled: bool = True,
):
self._resolver = resolver or DnsCacheResolver()
self._rng = rng or random.Random()
self._ipv6_enabled = ipv6_enabled
self._last_ip: Optional[str] = None
def enable_ipv6(self) -> None:
self._ipv6_enabled = True
def disable_ipv6(self) -> None:
self._ipv6_enabled = False
def is_ipv6_enabled(self) -> bool:
return self._ipv6_enabled
def last_ip(self) -> Optional[str]:
return self._last_ip
def last_ip_was_ipv6(self) -> bool:
return bool(self._last_ip) and (":" in self._last_ip)
def choose(self, hostname: str, port: int) -> str:
ips = self._resolver.get_ips(hostname, port)
if self._ipv6_enabled:
chosen = self._rng.choice(ips)
self._last_ip = chosen
logger.debug(
"RandomIpChooserWithIPv6Toggle selected IP %s for %s:%s "
"(IPv6 enabled)",
chosen,
hostname,
port,
)
return chosen
ipv4_ips = tuple(ip for ip in ips if _is_ipv4(ip))
if not ipv4_ips:
raise OSError(
"No IPv4 IPs resolved for {}:{}".format(hostname, port)
)
chosen = self._rng.choice(ipv4_ips)
self._last_ip = chosen
logger.debug(
"RandomIpChooserWithIPv6Toggle selected IPv4 IP %s for %s:%s "
"(IPv6 disabled)",
chosen,
hostname,
port,
)
return chosen
class RandomIpChooser(IpChooser):
"""Resolve hostname and select a random IP from resolved candidates."""
def __init__(
self,
*,
resolver: Optional[DnsCacheResolver] = None,
rng: Optional[random.Random] = None,
):
self._resolver = resolver or DnsCacheResolver()
self._rng = rng or random.Random()
def choose(self, hostname: str, port: int) -> str:
ips = self._resolver.get_ips(hostname, port)
chosen = self._rng.choice(ips)
logger.debug(
"RandomIpChooser selected IP %s for %s:%s",
chosen,
hostname,
port,
)
return chosen
class ForcedIPHTTPConnection(http.client.HTTPConnection):
"""HTTPConnection that connects to a chosen IP.
Important: urllib builds the request URL with the original hostname,
therefore the Host header stays correct.
"""
def __init__(
self,
hostname: str,
port: Optional[int] = None,
*,
ip_chooser: IpChooser,
timeout=socket._GLOBAL_DEFAULT_TIMEOUT,
source_address=None,
):
super().__init__(
hostname,
port=port,
timeout=timeout,
source_address=source_address,
)
self._ip_chooser = ip_chooser
def connect(self) -> None:
port = self.port or 80
ip = self._ip_chooser.choose(self.host, port)
logger.debug(
"ForcedIPHTTPConnection connecting to %s:%s for hostname %s",
ip,
port,
self.host,
)
self.sock = socket.create_connection(
(ip, port),
self.timeout,
self.source_address,
)
class ForcedIPHTTPSConnection(http.client.HTTPSConnection):
"""HTTPSConnection that connects to a chosen IP.
TLS details:
- Uses original hostname for SNI (server_hostname in wrap_socket)
- Certificate hostname validation is performed for the original hostname
"""
def __init__(
self,
hostname: str,
port: Optional[int] = None,
*,
ip_chooser: IpChooser,
context: "ssl.SSLContext",
timeout=socket._GLOBAL_DEFAULT_TIMEOUT,
source_address=None,
):
super().__init__(
hostname,
port=port,
context=context,
timeout=timeout,
source_address=source_address,
)
self._ip_chooser = ip_chooser
def connect(self) -> None:
port = self.port or 443
ip = self._ip_chooser.choose(self.host, port)
logger.debug(
"ForcedIPHTTPSConnection connecting to %s:%s for hostname %s",
ip,
port,
self.host,
)
raw_sock = socket.create_connection(
(ip, port),
self.timeout,
self.source_address,
)
if self._tunnel_host:
self.sock = raw_sock
self._tunnel()
raw_sock = self.sock
self.sock = self._context.wrap_socket(
raw_sock,
server_hostname=self.host,
)
class ForcedIPHTTPHandler(urllib.request.HTTPHandler):
"""urllib handler that creates ForcedIPHTTPConnection."""
def __init__(self, *, ip_chooser: IpChooser):
super().__init__()
self._ip_chooser = ip_chooser
def http_open(self, req) -> http.client.HTTPResponse:
def factory(host, **kwargs):
return ForcedIPHTTPConnection(
host,
ip_chooser=self._ip_chooser,
timeout=kwargs.get("timeout"),
)
return self.do_open(factory, req)
class ForcedIPHTTPSHandler(urllib.request.HTTPSHandler):
"""urllib handler that creates ForcedIPHTTPSConnection."""
def __init__(self, *, ip_chooser: IpChooser, context: "ssl.SSLContext"):
super().__init__(context=context)
self._ip_chooser = ip_chooser
self._context = context
def https_open(self, req) -> http.client.HTTPResponse:
def factory(host, **kwargs):
return ForcedIPHTTPSConnection(
host,
ip_chooser=self._ip_chooser,
context=self._context,
timeout=kwargs.get("timeout"),
)
return self.do_open(factory, req)
class UrlTransport:
"""Single entrypoint for opening urllib requests.
If *ip_chooser* is provided, the transport will connect to the selected IP
address, while keeping correct Host/SNI/cert validation for the original
hostname. If *ip_chooser* is not provided, it behaves like plain urllib.
"""
def __init__(
self,
*,
ip_chooser: Optional[IpChooser] = None,
ssl_context: Optional["ssl.SSLContext"] = None,
use_proxies: bool = True,
):
import ssl as _ssl
self._ssl_context = ssl_context or _ssl.create_default_context()
handlers: list = []
if not use_proxies:
# empty mapping disables urllib's default env-based proxy
handlers.append(urllib.request.ProxyHandler({}))
if ip_chooser is not None:
handlers += [
ForcedIPHTTPHandler(ip_chooser=ip_chooser),
ForcedIPHTTPSHandler(
ip_chooser=ip_chooser,
context=self._ssl_context,
),
]
self._opener = urllib.request.build_opener(*handlers)
def open(
self,
req: urllib.request.Request,
*,
timeout: Optional[float] = None,
) -> http.client.HTTPResponse:
if timeout is None:
return self._opener.open(req)
return self._opener.open(req, timeout=timeout)
defence360agent/utils/parsers.py 0000644 0000000 0000000 00000027147 00000000000 013752 0 ustar import argparse
import ipaddress
import sys
from functools import lru_cache, partial
from itertools import chain
from typing import Any, Dict, Iterable, Iterator, Mapping, Tuple
from defence360agent.application import app
from defence360agent.contracts.config import Core as Config
from defence360agent.rpc_tools.utils import prepare_schema
from defence360agent.simple_rpc import RpcClient
from defence360agent.utils.cli import EXITCODE_NOT_FOUND
class SchemaToArgparse:
# NOTE: 'default' is a normalization rule, 'required' is a validation rule
OptionType = Iterator[Tuple[str, Any]]
def __init__(self, argument, options):
self._argument: str = argument
self._allowed: Iterable = options.get("allowed")
self._default: Any = options.get("default")
self._envvar: str = options.get("envvar", False)
self._help: str = options.get("help")
self._positional: bool = options.get("positional", False)
self._rename: str = options.get("rename")
self._required: bool = options.get("required", False)
self._type: str = options.get("type")
@property
def argname(self) -> str:
if self._positional:
return self._argument
return "--" + self._argument.replace("_", "-")
@property
def options(self):
argparse_options = dict(
chain(
self.choices(),
self.default(),
self.help(),
self.metavar(),
self.nargs(),
self.required(),
),
)
return argparse_options
def nargs(self) -> OptionType:
option = "nargs"
if self._type == "list":
# FIXME: all positional arguments are not required
# to support `rename`
if not self._positional and self._required and not self._envvar:
yield option, "+"
else:
yield option, "*"
elif self._positional and (self._envvar or self._default is None):
yield option, "?"
def choices(self) -> OptionType:
yield "choices", self._allowed
def help(self) -> OptionType:
yield "help", self._help
def metavar(self) -> OptionType:
option = "metavar"
if self._rename:
yield option, self._rename.upper()
elif self._type == "list":
yield option, self._argument.upper()
def default(self) -> OptionType:
if (
self._default is not None
and not self._envvar
and (self._type == "list" or not self._positional)
):
yield "default", self._default
def required(self):
if (
self._required
and self._type != "list"
and not self._envvar
# 'required' is an invalid argument for positionals
and not self._positional
):
yield "required", True
def schema_to_argparse(parser, argument, options):
if options.get("type") == "boolean":
required = options.get("required") and not options.get("envvar", False)
bool_parser = parser.add_mutually_exclusive_group(required=required)
bool_parser.add_argument(
"--" + argument.replace("_", "-"),
dest=argument,
action="store_true",
)
bool_parser.add_argument(
"--no-" + argument.replace("_", "-"),
dest=argument,
action="store_false",
)
bool_parser.set_defaults(**{argument: options.get("default")})
else:
converter = SchemaToArgparse(argument, options)
parser.add_argument(converter.argname, **converter.options)
class EnvParser:
@staticmethod
def format_help(envvar_parameter_options: Mapping):
if not envvar_parameter_options:
return ""
def format_arg(options):
if "help" in options:
return f"{options['envvar']}\t\t{options['help']}"
return options["envvar"]
return "\nenvironment variables: \n {}".format(
"\n ".join(
format_arg(options)
for options in envvar_parameter_options.values()
)
)
@staticmethod
def _validate(envvar, value, options):
if "isascii" in options:
try:
value.encode("ascii")
except UnicodeEncodeError:
return (
f"error: {envvar}={value} must only contain ascii symbols",
)
return None
@classmethod
def parse(
cls,
environ: Mapping,
command,
envvar_parameter_options,
exclude: Iterable[str],
) -> Dict[str, str]:
kwargs = {}
for parameter, options in envvar_parameter_options.items():
if parameter in exclude:
continue
envvar_name = options["envvar"]
try:
value = kwargs[parameter] = environ[envvar_name]
except KeyError:
if "default" in options:
kwargs[parameter] = options["default"]
continue
if not options.get("required"):
continue
msg = cls._format_error(
command,
envvar_parameter_options,
"error: environment variable {} is not defined".format(
envvar_name
),
)
print(msg, file=sys.stderr)
sys.exit(EXITCODE_NOT_FOUND)
else:
if err := cls._validate(envvar_name, value, options):
msg = cls._format_error(
command, envvar_parameter_options, err
)
print(msg, file=sys.stderr)
sys.exit(EXITCODE_NOT_FOUND)
return kwargs
@classmethod
def _format_error(cls, command, envvar_parameter_options, msg):
return "{command}:\n{help}\n\n{message}".format(
command=" ".join(command),
help=cls.format_help(envvar_parameter_options),
message=msg,
)
def is_valid_ipv4_addr(addr):
try:
ipaddress.IPv4Address(addr)
except ipaddress.AddressValueError:
return False
return True
def _filter_user(schema, user):
for key, values in schema.items():
if user in values.get("cli", {}).get("users", []):
yield key, values
def rpc_endpoint(command, require_rpc, **params):
return RpcClient(require_svc_is_running=require_rpc).cmd(*command)(
**params
)
def generate_endpoint_params(arg_parser_namespace, arguments):
kwargs = {}
for argument in arguments:
arg_parser_argument = argument.replace("-", "_")
value = getattr(arg_parser_namespace, arg_parser_argument, None)
if value is not None:
kwargs[argument] = value
return kwargs
def apply_parser(subparsers, schema):
_subparsers = {}
commands = sorted(schema.keys())
for methods in commands:
values = schema[methods]
assert isinstance(methods, (tuple, list))
parser = None
# generate subparsers
subparser = subparsers
for i, command in enumerate(methods):
# last element
if i == len(methods) - 1:
parser = subparser.add_parser(
name=command,
help=values.get("help"),
formatter_class=argparse.RawDescriptionHelpFormatter,
)
if any(
(c != methods and methods == c[: len(methods)])
for c in commands
):
_subparsers[methods] = parser.add_subparsers(
help="Available commands"
)
else:
# Need to reuse created subparsers for sub-commands, otherwise
# they will be overwritten.
#
# Example:
# For both of the commands:
# * malware on-demand queue put
# * malware on-demand queue remove
# only one subparser is created. We should add `queue`
# subparser only once in order to keep both `put` and `remove`.
hashable = tuple(methods[: i + 1])
exists_subparser = _subparsers.get(hashable)
if not exists_subparser:
subparser = _subparsers[hashable] = subparser.add_parser(
name=command,
help=values.get("help"),
).add_subparsers(help="Available commands", required=True)
else:
subparser = exists_subparser
assert parser, "parser is not defined"
# generate arguments
envvar_parameter_options = {}
for argument, options in values.get("schema", {}).items():
if "envvar" in options:
envvar_parameter_options[argument] = options
if options.get("envvar_only", False):
continue
if "rename" in options:
options.update(**values["schema"][options["rename"]])
options["required"] = False
options["positional"] = False
schema_to_argparse(parser, argument, options)
parser.epilog = EnvParser.format_help(envvar_parameter_options)
parser.add_argument(
"--json", action="store_true", help="return data in JSON format"
)
parser.add_argument("--verbose", "-v", action="count")
require_rpc = values.get("cli", {}).get("require_rpc", "running")
parser.set_defaults(
# Initializing `RpcClient` here for each command will
# inevitably lead to the `ServiceStateError`,
# because some endpoints require the agent to be stopped and
# some require it to be running. So we use `partial` to
# defer initialization until the command is selected.
endpoint=partial(rpc_endpoint, methods, require_rpc),
generate_endpoint_params=partial(
generate_endpoint_params,
arguments=values.get("schema", {}).keys(),
),
envvar_parameter_options=envvar_parameter_options,
command=methods,
)
def _apply_subparsers(subparsers, user):
schema = dict(_filter_user(prepare_schema(app.SCHEMA_PATHS), user))
apply_parser(subparsers, schema)
@lru_cache(maxsize=1)
def create_cli_parser():
parser = argparse.ArgumentParser(description="CLI for %s." % Config.NAME)
parser.add_argument("--log-config", help="logging config filename")
parser.add_argument(
"--console-log-level",
choices=["ERROR", "WARNING", "INFO", "DEBUG"],
help="Level of logging input to the console",
)
parser.add_argument(
"--remote-addr",
type=lambda ip: ip if is_valid_ipv4_addr(ip) else None,
help="Client's IP address for adding it to the whitelist",
)
subparsers = parser.add_subparsers(help="Available commands")
_apply_subparsers(subparsers, "root")
_apply_completions_parser(subparsers)
return parser
def _apply_completions_parser(subparsers):
from defence360agent.utils.completions import SUPPORTED_SHELLS
completions_parser = subparsers.add_parser(
"completions",
help="Generate shell auto-completion scripts",
)
completions_parser.add_argument(
"shell",
choices=SUPPORTED_SHELLS,
help="Shell to generate completions for",
)
completions_parser.set_defaults(completions_command=True)
defence360agent/utils/resource_limits.py 0000644 0000000 0000000 00000012046 00000000000 015473 0 ustar import asyncio
import logging
from contextlib import suppress
from enum import Enum
from os import fsdecode
from pathlib import Path
from typing import List, Optional, Tuple
from defence360agent.utils import OsReleaseInfo
logger = logging.getLogger(__name__)
RUN_WITH_INTENSITY = "/usr/libexec/run-with-intensity"
LVECTL_BIN_PATH = Path("/usr/sbin/lvectl")
PROC_LVE_LIST_PATH = Path("/proc/lve/list")
PROC_PATH = Path("/proc")
CGROUP_PATH = Path("/sys/fs/cgroup")
# cgroup v1 reports "no limit" as a page counter near its maximum
_CGROUP_V1_NO_LIMIT = 1 << 50
class LimitsMethod(Enum):
NICE = "nice"
LVE = "lve"
CGROUPS = "cgroups"
async def get_current_method() -> LimitsMethod:
"""Returns limit method, used in run-with-intensity tool."""
proc = await asyncio.create_subprocess_exec(
RUN_WITH_INTENSITY,
"show",
stdout=asyncio.subprocess.PIPE,
stderr=asyncio.subprocess.PIPE,
)
stdout, stderr = await proc.communicate()
stdout = fsdecode(stdout).strip()
if stdout == "nice":
return LimitsMethod.NICE
if stdout == "lve":
return LimitsMethod.LVE
if stdout == "cgroups":
return LimitsMethod.CGROUPS
raise LookupError(
"Parsing of used limitation method failed\nstdout: {}\nstderr: {}"
.format(stdout, fsdecode(stderr).strip())
)
async def create_subprocess(
cmd: List[str],
key: str,
intensity_cpu: int,
intensity_io: int,
**subprocess_kwargs
) -> asyncio.subprocess.Process:
"""
Creates asyncio.Process with limited resources (cpu & io),
using run-with-intensity tool.
:param cmd: command to execute
:param intensity_cpu: cpu intensity limit
:param intensity_io: io intensity limit
:param subprocess_kwargs: keyword arguments for create_subprocess_exec func
:return: executed Process
"""
limits_cmd = [
RUN_WITH_INTENSITY,
"run",
"--intensity-cpu",
str(intensity_cpu),
"--intensity-io",
str(intensity_io),
]
limits_cmd.extend(["--key", key])
return await asyncio.create_subprocess_exec(
*(limits_cmd + cmd), **subprocess_kwargs
)
def _status_field_kb(pid: int, field: str) -> Optional[int]:
try:
status = (PROC_PATH / str(pid) / "status").read_text()
except OSError:
return None
for line in status.splitlines():
name, _, value = line.partition(":")
if name == field:
with suppress(IndexError, ValueError):
return int(value.split()[0])
return None
def _child_pids(pid: int) -> List[int]:
children: List[int] = []
try:
threads = sorted((PROC_PATH / str(pid) / "task").iterdir())
except OSError:
return children
for thread in threads:
try:
listed = (thread / "children").read_text()
except OSError:
continue
with suppress(ValueError):
children.extend(int(child) for child in listed.split())
return children
def _process_tree(pid: int) -> List[int]:
tree, pending = [], [pid]
while pending:
current = pending.pop()
tree.append(current)
pending.extend(_child_pids(current))
return tree
def peak_rss_kb(pid: int) -> Optional[int]:
"""Peak RSS of the process and its descendants, summed, in kB."""
total = None
for process in _process_tree(pid):
peak = _status_field_kb(process, "VmHWM")
if peak is not None:
total = (total or 0) + peak
return total
def _cgroup_limit_bytes(path: Path) -> Optional[int]:
try:
value = path.read_text().strip()
except OSError:
return None
if value == "max":
return None
with suppress(ValueError):
limit = int(value)
if limit < _CGROUP_V1_NO_LIMIT:
return limit
return None
def memory_bound_kb(pid: int) -> Optional[Tuple[int, str]]:
"""The cgroup memory limit the process runs under, in kB, and its source."""
try:
cgroups = (PROC_PATH / str(pid) / "cgroup").read_text()
except OSError:
return None
for line in cgroups.splitlines():
_, _, rest = line.partition(":")
controllers, _, cgroup = rest.partition(":")
relative = cgroup.lstrip("/")
if not controllers:
limit = _cgroup_limit_bytes(CGROUP_PATH / relative / "memory.max")
source = "cgroup v2"
elif "memory" in controllers.split(","):
limit = _cgroup_limit_bytes(
CGROUP_PATH / "memory" / relative / "memory.limit_in_bytes"
)
source = "cgroup v1"
else:
continue
if limit is not None:
return limit // 1024, source
return None
def is_lve_active() -> bool:
"""Checks that LVE-utils is active resource limiter."""
# to avoid possible errors such as DEF-11941
# make sure that OS is CL
return PROC_LVE_LIST_PATH.exists() and OsReleaseInfo.is_cloudlinux()
def has_lvectl() -> bool:
"""Checks that LVE-utils is installed."""
return LVECTL_BIN_PATH.exists()
defence360agent/utils/safe_fileops.py 0000644 0000000 0000000 00000023520 00000000000 014721 0 ustar import asyncio
import atexit
import functools
import logging
import os
import pathlib
import pwd
import shutil
import stat
from concurrent.futures import ProcessPoolExecutor
from contextlib import contextmanager, suppress
from itertools import chain
from typing import Set, Tuple, Union
from defence360agent import utils
R_FLAGS = os.O_RDONLY
W_FLAGS = os.O_TRUNC | os.O_CREAT | os.O_WRONLY
logger = logging.getLogger(__name__)
# Track active ProcessPoolExecutors so they can be cleaned up during shutdown.
# Each call to drop() permanently changes the worker process identity, so we
# must use a fresh executor per call. We track them to prevent orphaned worker
# processes from blocking agent shutdown (causing systemd SIGKILL).
_active_pools: Set[ProcessPoolExecutor] = set()
async def _run_in_fresh_executor(loop: asyncio.AbstractEventLoop, *args):
pool = ProcessPoolExecutor(max_workers=1)
_active_pools.add(pool)
try:
return await loop.run_in_executor(pool, *args)
finally:
try:
pool.shutdown(wait=False)
finally:
_active_pools.discard(pool)
def shutdown_process_pools() -> None:
"""Shutdown all tracked ProcessPoolExecutors.
Should be called during agent shutdown to ensure clean process termination.
"""
for pool in list(_active_pools):
try:
pool.shutdown(wait=False, cancel_futures=True)
except Exception as e:
logger.warning("Error shutting down ProcessPoolExecutor: %s", e)
_active_pools.clear()
# Register cleanup at exit as a fallback
atexit.register(shutdown_process_pools)
def drop(fun, uid, gid, *args):
os.setgroups([])
os.setgid(gid)
os.setuid(uid)
return fun(*args)
class UnsafeFileOperation(Exception):
pass
def ensure_regular_file(path: str) -> None:
"""Verify path is a regular file; remove and raise FileNotFoundError if not.
Uses os.lstat() to avoid following symlinks. If the file is a FIFO,
symlink, socket, device, etc., it is deleted so the caller can
recreate it as a regular file.
"""
st = os.lstat(path) # raises FileNotFoundError if missing
if not stat.S_ISREG(st.st_mode):
logger.warning(
"Identity file %s is not a regular file (mode=%s), removing",
path,
stat.filemode(st.st_mode),
)
os.unlink(path)
raise FileNotFoundError(f"Removed non-regular identity file: {path}")
def check_non_admin_file(file):
st = os.stat(str(file))
if st.st_uid < utils.get_min_uid():
raise UnsafeFileOperation(
"The file belongs to admin user: " + str(file)
)
return True
def safe(missing_ok=False):
def _safe(fun):
@functools.wraps(fun)
async def wrapper(filename, *args, loop=None):
if not os.path.exists(filename) and not missing_ok:
raise FileNotFoundError(
"No such file or directory: " + filename
)
path = pathlib.Path(filename)
paths = chain(reversed(path.parents), [path])
if missing_ok:
paths = reversed(path.parents)
for p in paths:
st = os.stat(str(p))
if st.st_uid != 0 and st.st_gid != 0:
uid, gid = st.st_uid, st.st_gid
break
else:
raise UnsafeFileOperation(
"Unsafe file operation under root: " + str(path)
)
loop = loop or asyncio.get_event_loop()
return await _run_in_fresh_executor(
loop,
drop,
fun,
uid,
gid,
filename,
*args,
)
return wrapper
return _safe
def _touch(filename: str):
pathlib.Path(filename).touch()
def _write_text(filename: str, data: str):
pathlib.Path(filename).write_text(data)
# This is the only way to make _write_text and _touch pickable.
# If we use decorator syntax instead - it's impossible
# to use them in multiprocessing
async def write_text(filename: str, data: str):
return await safe(missing_ok=True)(_write_text)(filename, data)
async def touch(filename: str):
return await safe(missing_ok=True)(_touch)(filename)
chmod = safe(os.chmod)
unlink = safe(os.unlink)
@contextmanager
def safe_open_file(filename, mode, user, respect_homedir=True):
if "w" in mode:
raise UnsafeFileOperation("'w' mode is not permitted")
with open(filename, mode) as f:
st = os.fstat(f.fileno())
passwd = pwd.getpwnam(user)
real_path = os.readlink(f"/proc/self/fd/{f.fileno()}")
filename_str = str(filename)
# Checking if no symlinks along the pathway...
# Unfortunately, that is going to fail for hosters that mapped
# /home dir to be e.g.
# /home -> /mnt/sdb1/home
if (filename_str != real_path) or (st.st_uid != passwd.pw_uid):
raise UnsafeFileOperation(f"Unable to safely read {filename_str}")
if (
respect_homedir
and pathlib.Path(passwd.pw_dir)
not in pathlib.Path(filename_str).parents
):
raise UnsafeFileOperation(
f"Unable to safely read {filename_str}. "
"File is not in user homedir"
)
yield f
@contextmanager
def open_fd(*args, **kwargs):
"""
Context manager which wraps os.open and close file descriptor at the end
:param args: positional arguments for os.open
:param kwargs: keyword arguments for os.open
"""
fd = os.open(*args, **kwargs)
try:
yield fd
finally:
with suppress(OSError): # fd is already closed
os.close(fd)
@contextmanager
def opendir_fd(name: str, *args, **kwargs):
"""
Context manager to get a directory file descriptor
It also checks if a directory doesn't contain a symlink in the path
:param name: full directory name
:param args: positional arguments for os.open
:param kwargs: keyword arguments for os.open
"""
with open_fd(name, *args, flags=os.O_DIRECTORY, **kwargs) as dir_fd:
real = os.readlink("/proc/self/fd/{}".format(dir_fd))
if name != real:
raise UnsafeFileOperation("Operations on symlinks are prohibited")
yield dir_fd
@contextmanager
def open_fobj(f: Union[str, int], dir_fd=None, flags=0, mode=None):
"""
Context manager to open file object from file name or from file descriptor
File object extended with 'st' attribute that contains os.stat_result of
the opened file
:param f: file name or file descriptor to open
:param dir_fd: directory descriptor, ignored if 'f' is a file descriptor
:param flags: flags for os.open, ignored if 'f' is a file descriptor
:param mode: mode for built-in open
"""
st = None
if isinstance(f, str):
# safe_* == False
with suppress(OSError):
# make a file readable/writable by an owner
st = os.stat(f, dir_fd=dir_fd)
os.chmod(
f, mode=st.st_mode | stat.S_IRUSR | stat.S_IWUSR, dir_fd=dir_fd
)
f = os.open(f, flags=flags, dir_fd=dir_fd)
with open(f, mode=mode) as fo:
fo.st = st or os.stat(f)
try:
yield fo
finally:
if st:
# revert file permissions
with suppress(OSError):
os.chmod(f, mode=st.st_mode)
@contextmanager
def safe_tuple(name: str, dir_fd: int, flags: int, is_safe: bool):
"""
If is_safe flag is True, open file descriptor using name and dir_fd
If is_safe is False, return name and dir_fd as is
"""
if is_safe:
with open_fd(name, dir_fd=dir_fd, flags=flags) as fd:
yield fd, None
else:
yield name, dir_fd
def _move(
src: Union[Tuple[str, int], Tuple[int, None]],
dst: Union[Tuple[str, int], Tuple[int, None]],
src_unlink,
dst_overwrite,
racecall,
):
src_f, src_dir_fd = src
dst_f, dst_dir_fd = dst
w_flags = W_FLAGS | (0 if dst_overwrite else os.O_EXCL)
with open_fobj(
src_f, dir_fd=src_dir_fd, flags=R_FLAGS, mode="rb"
) as src_fo:
with open_fobj(
dst_f, dir_fd=dst_dir_fd, flags=w_flags, mode="wb"
) as dst_fo:
if racecall:
racecall[0]()
shutil.copyfileobj(src_fo, dst_fo)
if isinstance(dst_f, str):
# safe_dst == False
os.chmod(dst_fo.fileno(), mode=src_fo.st.st_mode)
if src_unlink and isinstance(src_f, str):
# safe_src == False
if racecall:
racecall[1]()
os.unlink(src_f, dir_fd=src_dir_fd)
async def safe_move(
src: str,
dst: str,
safe_src=False,
safe_dst=False,
src_unlink=True,
dst_overwrite=False,
racecall=None,
):
src_dir, src_name = os.path.split(src)
dst_dir, dst_name = os.path.split(dst)
with opendir_fd(src_dir) as src_dir_fd, opendir_fd(
dst_dir
) as dst_dir_fd, safe_tuple(
src_name, src_dir_fd, R_FLAGS, safe_src
) as src_tuple, safe_tuple(
dst_name, dst_dir_fd, W_FLAGS, safe_dst
) as dst_tuple:
src_st = os.stat(src_name, dir_fd=src_dir_fd)
loop = asyncio.get_event_loop()
await _run_in_fresh_executor(
loop,
drop,
_move,
src_st.st_uid,
src_st.st_gid,
src_tuple,
dst_tuple,
src_unlink,
dst_overwrite,
racecall,
)
if src_unlink and safe_src:
if racecall:
racecall[1]()
os.unlink(src_name, dir_fd=src_dir_fd)
if safe_dst:
os.chown(dst_name, src_st.st_uid, src_st.st_gid, dir_fd=dst_dir_fd)
os.chmod(dst_name, src_st.st_mode, dir_fd=dst_dir_fd)
defence360agent/utils/safe_sequence.py 0000644 0000000 0000000 00000000553 00000000000 015071 0 ustar import os
def path(p: str):
"""
Make safe sequence from path-like string
Useful if p contains unprintable sequence
If p is safe to be printed (e.g. via logger) return it as is
If it can cause an exception, return bytes instead
"""
try:
p.encode()
except UnicodeEncodeError:
return os.fsencode(p)
return p
defence360agent/utils/serialization.py 0000644 0000000 0000000 00000004552 00000000000 015143 0 ustar """JSON persistence helpers for small agent state files (no pickle at runtime)."""
import collections
import functools
import json
import logging
import os
from asyncio import iscoroutinefunction
from typing import Any, Callable, Union
logger = logging.getLogger(__name__)
def _to_jsonable(obj: Any) -> Any:
if isinstance(obj, collections.deque):
return [_to_jsonable(item) for item in obj]
if isinstance(obj, dict):
return {k: _to_jsonable(v) for k, v in obj.items()}
if isinstance(obj, (list, tuple)):
return [_to_jsonable(item) for item in obj]
return obj
def _dump(path, obj):
"""Atomically write ``obj`` to ``path`` as JSON."""
payload = json.dumps(_to_jsonable(obj))
tmp = "{}.tmp".format(path)
with open(tmp, "w", encoding="utf-8") as w:
w.write(payload)
os.replace(tmp, path)
def serialize_attr(*, path: str, attr: str):
"""Decorator: after the wrapped method runs, persist ``self.<attr>``
to ``path`` as JSON."""
def decorator(f):
@functools.wraps(f)
def wrapper(self, *args, **kwargs):
result = f(self, *args, **kwargs)
obj = getattr(self, attr)
logger.debug("Write %r to %r", obj, path)
_dump(path, obj)
return result
@functools.wraps(f)
async def async_wrapper(self, *args, **kwargs):
result = await f(self, *args, **kwargs)
obj = getattr(self, attr)
logger.debug("Write %r to %r", obj, path)
_dump(path, obj)
return result
if iscoroutinefunction(f):
return async_wrapper
return wrapper
return decorator
def unserialize(*, path: str, fallback: Union[Callable, object] = None):
"""Restore an object from ``path`` (JSON); a top-level list becomes a
deque to match the legacy queue API, and missing/unparseable input
returns ``fallback`` (called if callable)."""
try:
with open(path, "r", encoding="utf-8") as r:
obj = json.load(r)
except FileNotFoundError:
logger.warning("Can't find %s to unserialize", path)
except Exception as e:
logger.error("Unserialize failed with %r. Returning fallback", e)
else:
if isinstance(obj, list):
return collections.deque(obj)
return obj
return fallback() if callable(fallback) else fallback
defence360agent/utils/sshutil.py 0000644 0000000 0000000 00000035506 00000000000 013764 0 ustar import asyncio
import datetime
import errno
import pwd
import re
import stat
import urllib.request
import os
from logging import getLogger
from urllib.error import URLError
from pathlib import Path
from defence360agent.utils import BACKUP_EXTENSION, atomic_rewrite
from defence360agent.utils.fd_ops import open_dir_no_symlinks
logger = getLogger(__name__)
ANALYST_PUB_KEY_URL = (
"https://repo.imunify360.cloudlinux.com/defense360/assisted-cleanup.pub"
)
KEY_PATTERN = r"clsupport@sshbox\.cloudlinux\.com"
SSH_CONFIG_PATH = Path("/etc/ssh/sshd_config")
SSH_CONFIG_DIR = Path("/etc/ssh/sshd_config.d")
# \Z (not $) — $ would accept a trailing newline.
_USERNAME_RE = re.compile(r"^[a-z_][a-z0-9_-]{0,31}\Z")
def _resolve_authorized_keys(username: str) -> Path:
"""Home dir via pwd.getpwnam, not /home/ concatenation, to block path traversal."""
if not isinstance(username, str) or not _USERNAME_RE.match(username):
raise ValueError("invalid username: %r" % (username,))
if username == "root":
return Path("/root/.ssh/authorized_keys")
try:
home = pwd.getpwnam(username).pw_dir
except KeyError as e:
raise ValueError("no such user: %r" % (username,)) from e
# pwd.pw_dir is normally absolute, but panel-driven user creation can
# leave it empty or relative; refuse rather than write under CWD.
if not home or not os.path.isabs(home):
raise ValueError(
"non-absolute home directory for %r: %r" % (username, home)
)
return Path(os.path.join(home, ".ssh", "authorized_keys"))
# The support pub key is shared across every Imunify install, so a leaked
# private counterpart would grant root on the whole fleet. Bound the blast
# radius via restrict + expiry-time options on the authorized_keys line.
DEFAULT_KEY_TTL_DAYS = 7
KEY_TTL_ENV_VAR = "IMUNIFY_ASSISTED_CLEANUP_KEY_TTL_DAYS"
KEY_OPTIONS_BASE = "restrict,pty"
async def get_ssh_port():
"""
Detect SSH port from config and its overrides.
Searches configs in reverse order to find the last override first.
"""
port = 22 # default port
try:
# Collect and sort config files
config_files = [SSH_CONFIG_PATH]
if SSH_CONFIG_DIR.exists():
config_files.extend(sorted(SSH_CONFIG_DIR.glob("*.conf")))
# Process files
for config_file in reversed(config_files):
try:
for line in config_file.read_text().splitlines():
line = line.strip()
if line.startswith("Port ") and not line.startswith("#"):
try:
# return first match
# since we are searching backwards
port = int(line.split()[1])
return port
except (IndexError, ValueError):
continue
except IOError as e:
logger.warning(f"Failed to read {config_file}: {e}")
continue
except Exception as e:
logger.warning(f"Failed to get SSH port: {e}")
finally:
return port
async def check_ssh_connection(port=22):
"""Test if port is actually an SSH port by checking the server banner"""
try:
reader, writer = await asyncio.open_connection("127.0.0.1", port)
try:
banner = await asyncio.wait_for(reader.readline(), timeout=5.0)
banner = banner.decode("utf-8", errors="ignore").strip()
if re.match(r"^SSH-[12]\.", banner):
logger.info(
f"Port {port} is confirmed as SSH (banner: {banner})"
)
return True
else:
logger.warning(
f"Port {port} is open but not SSH (got: {banner})"
)
return False
except asyncio.TimeoutError:
logger.warning(f"Timeout waiting for SSH banner on port {port}")
return False
finally:
writer.close()
await writer.wait_closed()
except (ConnectionRefusedError, OSError) as e:
logger.warning(f"Failed to connect to port {port}: {e}")
return False
except Exception as e:
logger.warning(f"Unexpected error checking SSH port {port}: {e}")
return False
def _key_ttl_days() -> int:
"""Read the assisted-cleanup key TTL from env, falling back to default."""
raw = os.environ.get(KEY_TTL_ENV_VAR, "")
try:
ttl = int(raw)
if ttl > 0:
return ttl
except (TypeError, ValueError):
pass
return DEFAULT_KEY_TTL_DAYS
def _expiry_timestamp(now: "datetime.datetime | None" = None) -> str:
# Bare timestamp (no Z): Z requires OpenSSH >= 9.1; without it sshd
# parses as local time per authorized_keys(5), so convert before format.
base = now or datetime.datetime.now(datetime.timezone.utc)
expiry = base.astimezone() + datetime.timedelta(days=_key_ttl_days())
return expiry.strftime("%Y%m%d%H%M")
_OPENSSH_VERSION_RE = re.compile(r"OpenSSH_(\d+)\.(\d+)")
async def _sshd_supports_expiry_time() -> bool:
# expiry-time keyword exists since OpenSSH 7.7; older sshd (CL7) rejects
# the whole line. Probe failure -> False so we fall back to restrict,pty.
try:
proc = await asyncio.create_subprocess_exec(
"ssh",
"-V",
stdout=asyncio.subprocess.PIPE,
stderr=asyncio.subprocess.PIPE,
)
stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=5)
except (OSError, asyncio.TimeoutError) as e:
logger.warning("ssh -V probe failed: %s", e)
return False
output = (stderr or b"").decode("utf-8", errors="ignore") or (
stdout or b""
).decode("utf-8", errors="ignore")
match = _OPENSSH_VERSION_RE.search(output)
if not match:
logger.warning(
"ssh -V did not match OpenSSH version pattern: %r", output[:200]
)
return False
major, minor = int(match.group(1)), int(match.group(2))
return (major, minor) >= (7, 7)
def build_authorized_key_line(pub_key: str, *, supports_expiry: bool) -> str:
if supports_expiry:
options = f'{KEY_OPTIONS_BASE},expiry-time="{_expiry_timestamp()}"'
else:
options = KEY_OPTIONS_BASE
return f"{options} {pub_key.strip()}"
def _target_uid_gid(username: str):
"""Resolve uid/gid for the target user, or (None, None) when not applicable.
Returning ``(None, None)`` for root or unknown users lets
``atomic_rewrite`` skip its chown step and preserve the existing
file's ownership.
"""
if username == "root":
return None, None
try:
pw = pwd.getpwnam(username)
except KeyError:
logger.warning(
"user %r not found; leaving authorized_keys ownership untouched",
username,
)
return None, None
return pw.pw_uid, pw.pw_gid
def _open_ssh_dir(home_fd, uid, gid, *, create):
"""O_NOFOLLOW fd for .ssh under *home_fd*; a symlinked .ssh raises."""
created = False
if create:
try:
os.mkdir(".ssh", mode=0o700, dir_fd=home_fd)
created = True
except FileExistsError:
pass
ssh_fd = os.open(
".ssh",
os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW,
dir_fd=home_fd,
)
if created:
try:
if uid is not None and gid is not None:
os.chown(ssh_fd, uid, gid)
os.fchmod(ssh_fd, 0o700)
except BaseException:
os.close(ssh_fd)
raise
return ssh_fd
async def install_pub_key(username="root"):
# Idempotent: re-running rotates the expiry and replaces any legacy
# (unguarded or older guarded) copy of the same key.
try:
try:
auth_keys_path = _resolve_authorized_keys(username)
except ValueError as e:
logger.error("install_pub_key: %s", e)
return False
# If not running as root, fail
if os.geteuid() != 0:
logger.error("Function must be run as root")
return False
# Download the public key
try:
pub_key = (
urllib.request.urlopen(ANALYST_PUB_KEY_URL)
.read()
.decode()
.strip()
)
except URLError as e:
logger.error(f"Failed to download public key: {e}")
return False
# A genuine key is single-line; an embedded newline would split into
# a second, option-less authorized_keys entry that bypasses restrict.
if "\n" in pub_key or "\r" in pub_key:
logger.error("Downloaded public key spans multiple lines")
return False
guarded_line = build_authorized_key_line(
pub_key,
supports_expiry=await _sshd_supports_expiry_time(),
)
uid, gid = _target_uid_gid(username)
# Components above the user's home are root-controlled, so one
# realpath is safe; everything below is opened with O_NOFOLLOW
# and operated on dir_fd-relative, leaving no symlink-swap window.
home = os.path.realpath(auth_keys_path.parent.parent)
try:
home_fd = open_dir_no_symlinks(home)
except OSError as e:
logger.error(f"Cannot open home directory {home}: {e}")
return False
try:
try:
ssh_fd = _open_ssh_dir(home_fd, uid, gid, create=True)
except OSError as e:
logger.error(
f"Failed to prepare directory {auth_keys_path.parent}: {e}"
)
return False
try:
permissions = None
try:
keys_fd = os.open(
"authorized_keys",
os.O_RDONLY | os.O_NOFOLLOW,
dir_fd=ssh_fd,
)
except FileNotFoundError:
existing = ""
permissions = 0o600
except OSError as e:
if e.errno != errno.ELOOP:
raise
logger.warning("Replacing symlinked %s", auth_keys_path)
existing = ""
permissions = 0o600
else:
with os.fdopen(keys_fd, "r") as f:
existing = f.read()
# Strip any prior copy of the support key (legacy
# unguarded or older guarded line) so re-running rotates
# options + expiry instead of stacking duplicates.
stripped = re.sub(
r".*" + KEY_PATTERN + r".*\n?",
"",
existing,
)
new_content = stripped
if new_content and not new_content.endswith("\n"):
new_content += "\n"
new_content += guarded_line + "\n"
atomic_rewrite(
"authorized_keys",
new_content,
backup=False,
uid=uid,
gid=gid,
permissions=permissions,
dir_fd=ssh_fd,
)
finally:
os.close(ssh_fd)
finally:
os.close(home_fd)
logger.info(
"Installed assisted-cleanup key for user %s (%s)",
username,
guarded_line.split(" ", 1)[0],
)
return True
except Exception as e:
logger.error(f"Failed to install public key: {e}")
return False
def remove_pub_key(username="root") -> bool:
"""Remove analyst public key for the specified user
This function removes the analyst's public key that was previously
installed using the install_pub_key function.
returns: True if key was successfully removed, False otherwise.
"""
try:
try:
auth_keys_path = _resolve_authorized_keys(username)
except ValueError as e:
logger.error("remove_pub_key: %s", e)
return False
uid, gid = _target_uid_gid(username)
home = os.path.realpath(auth_keys_path.parent.parent)
try:
home_fd = open_dir_no_symlinks(home)
except OSError as e:
logger.warning(f"Cannot open home directory {home}: {e}")
return False
try:
try:
ssh_fd = _open_ssh_dir(home_fd, uid, gid, create=False)
except OSError as e:
logger.warning(
f"Cannot open directory {auth_keys_path.parent}: {e}"
)
return False
try:
try:
keys_fd = os.open(
"authorized_keys",
os.O_RDONLY | os.O_NOFOLLOW,
dir_fd=ssh_fd,
)
except OSError as e:
logger.warning(f"Cannot open {auth_keys_path}: {e}")
return False
with os.fdopen(keys_fd, "r") as f:
permissions = stat.S_IMODE(os.fstat(f.fileno()).st_mode)
content = f.read()
if not re.search(KEY_PATTERN, content):
logger.info(
f"Analyst public key not found in {auth_keys_path}"
)
return False
# Remove the key (including the line it's on)
new_content = re.sub(
r".*" + KEY_PATTERN + r".*\n?", "", content
)
if not new_content.strip():
logger.info(
f"File {auth_keys_path} will be empty after removal"
)
# atomic_rewrite's own backup mode is path-based and thus
# symlink-unsafe; write the backup through the same pinned
# descriptor instead.
atomic_rewrite(
"authorized_keys" + BACKUP_EXTENSION,
content,
backup=False,
uid=uid,
gid=gid,
permissions=permissions,
dir_fd=ssh_fd,
)
atomic_rewrite(
"authorized_keys",
new_content,
backup=False,
uid=uid,
gid=gid,
dir_fd=ssh_fd,
)
logger.info(
"Successfully removed analyst public key from"
f" {auth_keys_path}"
)
return True
finally:
os.close(ssh_fd)
finally:
os.close(home_fd)
except Exception as e:
logger.error(f"Failed to remove public key: {e}")
return False
defence360agent/utils/subprocess.py 0000644 0000000 0000000 00000003042 00000000000 014447 0 ustar """General utilities for working with subprocesses."""
import signal
import subprocess
from subprocess import PIPE # noqa: F401
__all__ = ["PIPE", "CalledProcessError", "check_output"]
class CalledProcessError(subprocess.CalledProcessError):
"""Add stdout,stderr to str representation"""
def __str__(self):
if self.returncode and self.returncode < 0:
try:
return "Command '%s' died with %r.\nStdout: %s\nStderr: %s" % (
self.cmd,
signal.Signals(
-self.returncode
), # noqa E501 pylint: disable=E1101
self.stdout,
self.stderr,
)
except ValueError:
return (
"Command '%s' died with unknown signal %d."
"\nStdout: %s\nStderr: %s"
% (self.cmd, -self.returncode, self.stdout, self.stderr)
)
else:
return (
"Command '%s' returned non-zero exit status %d."
"\nStdout: %s\nStderr: %s"
% (self.cmd, self.returncode, self.stdout, self.stderr)
)
def check_output(*args, **kwargs):
"""A wrapper for stdlib subprocess.check_output.
Include stdout/stderr in error message.
"""
try:
return subprocess.check_output(*args, **kwargs)
except subprocess.CalledProcessError as e:
raise CalledProcessError(
e.returncode, e.cmd, e.stdout, e.stderr
) from None
defence360agent/utils/support.py 0000644 0000000 0000000 00000012321 00000000000 013773 0 ustar import asyncio
import io
import json
import socket
import urllib.parse
import urllib.request
from functools import partial
from logging import getLogger
from pathlib import Path
from defence360agent.contracts.config import ANTIVIRUS_MODE
logger = getLogger(__name__)
class ZendeskAPIError(Exception):
def __init__(self, error, description, details):
self.error = error
self.description = description
self.details = details
super().__init__(description)
_API_URL_TMPL = "https://cloudlinux.zendesk.com/api/v2/{}"
_HC_URL_TMPL = "https://cloudlinux.zendesk.com/hc/requests/{}"
# Identifiers for custom fields in API
_PRODUCT_ID = 33267569
_DOCTOR_ID = 43297669
_CLN_ID = 43148369
_PRIVACY_POLICY_ID = 12355021509788
async def send_request(
sender_email,
subject,
description,
doctor_key=None,
cln=None,
attachments=None,
):
"""
Send request to support of Imunify360 via Zendesk API
"""
# Uploading attachments to Zendesk
upload_token = await _upload_attachments(attachments)
# Creating comment object: setting description and attaching
# uploads token
comment = dict(body=description)
if upload_token is not None:
comment["uploads"] = [upload_token]
# Author of request
requester = dict(name=sender_email, email=sender_email)
# Custom fields for support convenience
custom_fields = [
{
"id": _PRODUCT_ID,
"value": "pr_imunify_av" if ANTIVIRUS_MODE else "pr_im360",
},
{"id": _PRIVACY_POLICY_ID, "value": True},
]
if doctor_key:
custom_fields.append({"id": _DOCTOR_ID, "value": doctor_key})
if cln:
custom_fields.append({"id": _CLN_ID, "value": cln})
# Ready request
request = dict(
requester=requester,
subject=subject,
comment=comment,
custom_fields=custom_fields,
)
return await _post_support_request(request)
def decode_as_json(response):
return json.load(
io.TextIOWrapper(
response,
encoding=response.headers.get_content_charset("utf-8"),
)
)
def parse_params(params, url):
p = urllib.parse.urlparse(url)
query = p.query
if query:
query += "&"
query += urllib.parse.urlencode(params)
url = urllib.parse.urlunparse(
(p.scheme, p.netloc, p.path, p.params, query, p.fragment)
)
return url
def _post_data(url, data: bytes, headers, *, params=None, timeout=None):
"""HTTP POST *data* to *url* with given *headers*.
Add query *params* to the *url* if given.
Return (http_status, decoded_json_response) tuple.
"""
if params: # add params to the url
url = parse_params(params, url)
try:
with urllib.request.urlopen(
urllib.request.Request(url, data=data, headers=headers),
timeout=timeout,
) as response:
return response.code, decode_as_json(response) # http status
except socket.timeout:
raise TimeoutError
except OSError as e:
if not hasattr(e, "code"):
raise
# HTTPError
return e.code, (decode_as_json(e) if e.fp is not None else {})
async def _post_support_request(request):
"""Return url of the support request or None if request is suspended,
because of we not able to obtain the id of the ticket if it suspended.
"""
url = _API_URL_TMPL.format("requests.json")
headers = {"Content-Type": "application/json"}
data = json.dumps(dict(request=request), sort_keys=True).encode("ascii")
loop = asyncio.get_event_loop()
status, result = await loop.run_in_executor(
None, _post_data, url, data, headers
)
if status == 201:
request_data = result.get("request")
if request_data:
return _HC_URL_TMPL.format(request_data["id"])
elif "suspended_ticket" in result.keys():
return None
else:
raise ZendeskAPIError(
"Response error", "UNKNOWN ERROR", "{!r}".format(result)
)
else:
raise ZendeskAPIError(
result.get("error", "UNKNOWN ERROR"),
result.get("description"),
result.get("details", {}),
)
async def _upload_attachments(attachments):
# Uploading attachments to Zendesk
upload_token = None
if attachments is None:
return upload_token
loop = asyncio.get_event_loop()
for attachment in attachments:
path = Path(attachment)
params = {"filename": path.name}
if upload_token is not None:
params["token"] = upload_token
status, result = await loop.run_in_executor(
None,
partial(
_post_data,
_API_URL_TMPL.format("uploads.json"),
data=path.read_bytes(),
headers={"Content-Type": "application/binary"},
params=params,
),
)
if status != 201:
logger.warning(
"Failed to upload file %s to Zendesk: %s",
attachment,
result["error"],
)
continue
if upload_token is None:
upload_token = result["upload"]["token"]
return upload_token
defence360agent/utils/threads.py 0000644 0000000 0000000 00000001755 00000000000 013722 0 ustar """High-level support for working with threads in asyncio
Modified from Python 3.10 stdlib
https://github.com/python/cpython/blob/b11a951f16f0603d98de24fee5c023df83ea552c/Lib/asyncio/threads.py
(the license GPL-compatible but doesn't require to open-source either).
"""
import functools
import contextvars
from asyncio import events
__all__ = ("to_thread",)
async def to_thread(func, /, *args, **kwargs):
"""Asynchronously run function *func* in a separate thread.
Any *args and **kwargs supplied for this function are directly passed
to *func*. Also, the current :class:`contextvars.Context` is propogated,
allowing context variables from the main thread to be accessed in the
separate thread.
Return a coroutine that can be awaited to get the eventual result of *func*
"""
loop = events.get_running_loop()
ctx = contextvars.copy_context()
func_call = functools.partial(ctx.run, func, *args, **kwargs)
return await loop.run_in_executor(None, func_call)
defence360agent/utils/validate.py 0000644 0000000 0000000 00000010427 00000000000 014055 0 ustar from enum import Enum
from ipaddress import (
IPV4LENGTH,
IPV6LENGTH,
AddressValueError,
IPv4Address,
IPv4Network,
IPv6Address,
IPv6Network,
ip_address,
ip_network,
)
from typing import Literal, Optional, Union
IPVersion = Literal["ipv4", "ipv6"]
class LocalhostIP(str, Enum):
ipv4 = "127.0.0.1"
ipv6 = "::1"
def __str__(self):
return self.value
class NumericIPVersion(int, Enum):
"""Example: (IPListRecord.version==NumericIPVersion[ip_version])"""
ipv4 = 4
ipv6 = 6
def __str__(self):
return str(self.value)
@classmethod
def from_ip_version(
cls, ip_version: Optional[IPVersion]
) -> Optional["NumericIPVersion"]:
if ip_version is None:
return None
return cls.ipv4 if ip_version == IP.V4 else cls.ipv6
def is_valid_ipv4_addr(addr):
return IP.is_valid_ipv4_addr(addr)
def is_valid_ipv4_network(addr, strict=False):
return IP.is_valid_ipv4_network(addr, strict)
class IP:
V4: IPVersion = "ipv4"
V6: IPVersion = "ipv6"
@classmethod
def check_ip_ver(cls, version):
return any(version == ver for ver in [cls.V4, cls.V6])
@classmethod
def is_valid_ip(cls, addr):
try:
ip_address(addr)
except ValueError:
return False
return True
@classmethod
def is_valid_ip_network(cls, *args, **kwargs):
return cls.is_valid_ipv4_network(
*args, **kwargs
) or cls.is_valid_ipv6_network(*args, **kwargs)
@classmethod
def is_valid_ipv4_addr(cls, addr):
try:
IPv4Address(addr)
except AddressValueError:
return False
return True
@classmethod
def is_valid_ipv6_addr(cls, addr):
try:
IPv6Address(addr)
except AddressValueError:
return False
return True
@classmethod
def is_valid_ipv4_network(
cls, addr: Union[str, IPv4Network, IPv6Network], strict=False
):
try:
ip = IPv4Network(addr)
except ValueError:
return False
if strict:
# IPV4LENGTH - netmask for host
return ip.prefixlen != IPV4LENGTH
return True
@classmethod
def is_valid_ipv6_network(
cls, addr: Union[str, IPv4Network, IPv6Network], strict=False
):
try:
ip = IPv6Network(addr)
except ValueError:
return False
if strict:
# IPV6LENGTH - netmask for host
return ip.prefixlen != IPV6LENGTH
return True
@classmethod
def type_of(cls, addr):
if cls.is_valid_ipv4_network(addr):
return IP.V4
elif cls.is_valid_ipv6_network(addr):
return IP.V6
raise ValueError("Invalid ip address")
@classmethod
def convert_to_ipv6_network(cls, ip, mask="/64"):
"""Conver ipv6 addr to ipv6 network with mask
:param str ip: ip for converting
:param str mask: ip network mask
"""
network = IPv6Network(ip + mask, strict=False)
return str(network)
@staticmethod
def adopt_to_ipvX_network(
ip_arg: Union[str, IPv4Address, IPv4Network, IPv6Address, IPv6Network]
) -> Union[IPv4Network, IPv6Network]:
"""
Eliminate str from the Union
:raise ValueError: if cannot convert ip_arg str to ip network
"""
if isinstance(ip_arg, (IPv4Network, IPv6Network)):
return ip_arg
elif isinstance(ip_arg, (IPv4Address, IPv6Address)):
prefixlen = IPV4LENGTH if ip_arg.version == 4 else IPV6LENGTH
return ip_network((int(ip_arg), prefixlen))
return ip_network(ip_arg)
@classmethod
def ip_net_to_string(cls, net: Union[IPv4Network, IPv6Network]) -> str:
"""
IPv4Network('192.168.1.1/32') -> '192.168.1.1'
IPv4Network('192.168.1.0/24') -> '192.168.1.0/24'
"""
if not int(net.hostmask):
return str(net.network_address)
return str(net)
@classmethod
def ipv6_to_64network(
cls, ip: Union[IPv4Address, IPv6Address, str]
) -> Union[IPv4Address, IPv6Network]:
if isinstance(ip, IPv6Address):
return IPv6Network(cls.convert_to_ipv6_network(str(ip)))
return ip
defence360agent/utils/whmcs.py 0000644 0000000 0000000 00000017150 00000000000 013405 0 ustar import json
import os
import urllib.parse
import defence360agent.subsys.panels.hosting_panel as hp
from logging import getLogger
from defence360agent.contracts import config
from defence360agent.utils.config import update_config
from defence360agent.myimunify.model import update_users_protection, MyImunify
from defence360agent.utils.wordpress_mu_plugin import (
MU_PLUGIN_INSTALLATION,
ADVICE_EMAIL_NOTIFICATION,
WordPressMuPlugin,
)
logger = getLogger(__name__)
MU_PLUGIN_KEYS = [MU_PLUGIN_INSTALLATION, ADVICE_EMAIL_NOTIFICATION]
class WhmcsConf:
"""
read/write data passed by whmcs
Internal use, for commands called from whcms only
it saves ALL data came from whcms w/o any validation deliberately
in order to simplify compatability with current installed whmcs plugin
"""
path = "/var/imunify360/whmcs_data.json"
def read(self):
if not os.path.exists(self.path):
return {}
try:
with open(self.path, "r") as f:
raw_data = f.read()
except IOError as e:
logger.error("Failed to read whmcs data file: %s", str(e))
return {}
try:
data = json.loads(raw_data)
except (json.JSONDecodeError, ValueError):
logger.error("Malformed file with whmcs data: %s", raw_data)
return {}
return data
def save(self, data):
"""
Saves ALL data passed by WHMCS
it should not have any validations deliberately to be as compatible as possible
with current installed WHMCS plugin
"""
current_data = self.read()
# no validation needed
current_data.update(data)
try:
with open(self.path, "w") as file:
json.dump(current_data, file, indent=4)
except IOError as e:
logger.error("Failed to write whmcs data to file: %s", str(e))
async def sync_billing_data(sink, data):
my_imunify_updates = data.get(config.MY_IMUNIFY_KEY)
return await mi_update(sink, my_imunify_updates)
def convert_to_config_key_value(key, value):
"""
Convert several keys to config key, otherwise just return same key
any key is acceptable
"""
if key == "status":
return (
"enable",
{
"active": True,
"inactive": False,
}[value],
)
elif key == "protection":
return (
"protection",
{
"enabled": True,
"disabled": False,
}[value],
)
elif key == "mu_plugin_installation":
return "smart_advice_allowed", value
return key, value
def convert_from_config_key_value(key, value):
"""
Convert several keys from config format, otherwise just return same key
any key is acceptable
"""
if key == "enable":
return "status", ("active" if value else "inactive")
elif key == "protection":
return "protection", ("enabled" if value else "disabled")
elif key == "smart_advice_allowed":
return "mu_plugin_installation", value
return key, value
async def get_users():
return await hp.HostingPanel().get_users()
async def mi_update(sink, requested_myimunify_data):
"""
Updates supported parameters if passed, otherwise does nothing
updates 2 config parameters (if specified): status and purchase_page_url
updates protection status for users (if specified)
"""
if not requested_myimunify_data:
logger.info("Nothing to update for MyImunify")
return
whmcs_activation_status = requested_myimunify_data.get("status")
if whmcs_activation_status:
# no validation needed
WhmcsConf().save({"status": requested_myimunify_data.get("status")})
await update_configs(sink, requested_myimunify_data)
WordPressMuPlugin().prepare_for_mu_plugin_installation(
whmcs_activation_status,
requested_myimunify_data.get(MU_PLUGIN_INSTALLATION),
)
if not requested_myimunify_data.get("protection"):
return await get_current_whmcs_data([])
all_users = await get_users()
target_users = requested_myimunify_data.get("users", []) or all_users
filtered_passed_users = [
user for user in target_users if user in all_users
]
if filtered_passed_users:
logger.info(
"Updating protection status for users=%s",
str(filtered_passed_users),
)
await update_users_protection(
sink,
filtered_passed_users,
convert_to_config_key_value(
"protection", requested_myimunify_data["protection"]
)[1],
)
else:
logger.warning("No users to update protection for")
return await get_current_whmcs_data(filtered_passed_users)
async def update_configs(sink, requested_myimunify_data):
# those params are stored in config
mi_config_parameters = (
["purchase_page_url"]
if config.is_mi_freemium_license()
else ["purchase_page_url", "status"]
)
mi_config_data = dict(
convert_to_config_key_value(param, value)
for param, value in requested_myimunify_data.items()
if param in mi_config_parameters
)
mu_plugin_data = dict(
convert_to_config_key_value(param, value)
for param, value in requested_myimunify_data.items()
if param in MU_PLUGIN_KEYS
)
config_dict = {}
if mi_config_data:
config_dict[config.MY_IMUNIFY_KEY] = mi_config_data
if mu_plugin_data:
config_dict["CONTROL_PANEL"] = mu_plugin_data
if config_dict:
logger.info("Updating config with data: %s", str(config_dict))
# updates only 2 supported keys: purchase_page_url and status
await update_config(sink, config_dict)
async def get_users_info(users):
"""
Returns information from database based on passed users
if no users passed - returns for all users
"""
result = (
MyImunify.select().where(MyImunify.user.in_(users)).dicts()
if users
else MyImunify.select().dicts()
)
return [
{
"user": item["user"],
"protection": convert_from_config_key_value(
"protection", item["protection"]
)[1],
}
for item in result
]
async def get_current_whmcs_data(users):
"""
Returns the current configuration and user protection status.
{MY_IMUNIFY: {'status': 'active/inactive', 'purchase_page_url': 'SOMEURL', 'protection': []}}
"""
conf_data = config.ConfigFile().config_to_dict()
current_config = dict(
convert_from_config_key_value(param, value)
for param, value in conf_data.get(config.MY_IMUNIFY_KEY, {}).items()
)
cp_data = conf_data.get("CONTROL_PANEL")
current_config[MU_PLUGIN_INSTALLATION] = convert_from_config_key_value(
"smart_advice_allowed", cp_data.get("smart_advice_allowed")
)[1]
current_config[ADVICE_EMAIL_NOTIFICATION] = cp_data.get(
ADVICE_EMAIL_NOTIFICATION
)
current_config["protection"] = await get_users_info(users)
return current_config
def get_upgrade_url_link(username, domain):
purchase_url_link = (
config.MyImunifyConfig.PURCHASE_PAGE_URL.rstrip("/")
+ "/?"
+ urllib.parse.urlencode(
{
"m": "cloudlinux_advantage",
"action": "provisioning",
"suite": "my_imunify_account_protection",
"username": username,
"domain": domain,
"server_ip": hp.HostingPanel().get_server_ip(),
}
)
)
return purchase_url_link
defence360agent/utils/wordpress_mu_plugin.py 0000644 0000000 0000000 00000002640 00000000000 016371 0 ustar import os
from logging import getLogger
logger = getLogger(__name__)
MU_PLUGIN_INSTALLATION = "mu_plugin_installation"
ADVICE_EMAIL_NOTIFICATION = "advice_email_notification"
MU_PLUGIN_KEYS = [MU_PLUGIN_INSTALLATION, ADVICE_EMAIL_NOTIFICATION]
class WordPressMuPlugin:
def prepare_for_mu_plugin_installation(
self, activation_status, mu_plugin_status
):
"""
Must use plugin works only if cl-hosting-smart-advice is installed
So it is a requirement to be sure it is installed
It is expected to be installed by default with Imunify360
"""
if not all([activation_status == "active", mu_plugin_status]):
logger.warning(
"Nothing to prepare for Must Use plugin as settings "
"are not turned on, activation status=%s mu_plugin_status=%s",
str(activation_status),
str(mu_plugin_status),
)
return
if not mu_plugin_status:
logger.warning(
"Nothing to prepare for Must Use plugin "
"as mu_plugin_status=%s",
str(mu_plugin_status),
)
return
if not os.path.exists("/usr/sbin/cl-hosting-smart-advice"):
raise ValueError(
"cl-hosting-smart-advice rpm package is not installed "
"in the system, please install it and try again"
)
defence360agent/utils/zipsafe.py 0000644 0000000 0000000 00000001320 00000000000 013715 0 ustar import zipfile
from pathlib import Path
def safe_extractall(zf: zipfile.ZipFile, dest: Path) -> None:
dest_resolved = Path(dest).resolve()
for member in zf.namelist():
if member.startswith(("/", "\\")):
raise ValueError("Unsafe absolute zip member path: %r" % (member,))
parts = Path(member).parts
if ".." in parts:
raise ValueError(
"Unsafe parent-traversal zip member path: %r" % (member,)
)
target = (dest_resolved / member).resolve()
if target != dest_resolved and dest_resolved not in target.parents:
raise ValueError("Zip member escapes destination: %r" % (member,))
zf.extractall(dest_resolved)
defence360agent/wordpress/ 0000755 0000000 0000000 00000000000 00000000000 012576 5 ustar defence360agent/wordpress/__init__.py 0000644 0000000 0000000 00000002354 00000000000 014713 0 ustar """WordPress incident collection, sending logic, plugin management, and rules.
Available for both AV and IM360 modes.
"""
from defence360agent.wordpress.changelog_processor import (
ChangelogProcessor,
)
from defence360agent.wordpress.incident_collector import (
IncidentCollector,
IncidentRateLimiter,
)
from defence360agent.wordpress.incident_sender import IncidentSender
from defence360agent.wordpress.incident_parser import IncidentFileParser
from defence360agent.wordpress.wp_rules import (
WP_RULES_ZIP_FILENAME,
WP_RULES_VERSION_FILENAME,
find_file_in_index,
extract_wp_rules_yaml,
get_wp_rules_data,
get_wp_ruleset_version,
)
from defence360agent.wordpress.constants import (
PLUGIN_PATH,
PLUGIN_SLUG,
PLUGIN_VERSION_FILE,
WP_CLI_WRAPPER_PATH,
)
__all__ = [
"ChangelogProcessor",
"IncidentCollector",
"IncidentRateLimiter",
"IncidentSender",
"IncidentFileParser",
# wp_rules exports
"WP_RULES_ZIP_FILENAME",
"WP_RULES_VERSION_FILENAME",
"find_file_in_index",
"extract_wp_rules_yaml",
"get_wp_rules_data",
"get_wp_ruleset_version",
# constants exports
"PLUGIN_PATH",
"PLUGIN_SLUG",
"PLUGIN_VERSION_FILE",
"WP_CLI_WRAPPER_PATH",
]
defence360agent/wordpress/__pycache__/ 0000755 0000000 0000000 00000000000 00000000000 015006 5 ustar defence360agent/wordpress/__pycache__/__init__.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002640 00000000000 022210 0 ustar
r_j ~ d Z ddlmZ ddlmZmZ ddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZ ddlmZmZmZmZ g dZd S )
ztWordPress incident collection, sending logic, plugin management, and rules.
Available for both AV and IM360 modes.
)ChangelogProcessor)IncidentCollectorIncidentRateLimiter)IncidentSender)IncidentFileParser)WP_RULES_ZIP_FILENAMEWP_RULES_VERSION_FILENAMEfind_file_in_indexextract_wp_rules_yamlget_wp_rules_dataget_wp_ruleset_version) PLUGIN_PATH PLUGIN_SLUGPLUGIN_VERSION_FILEWP_CLI_WRAPPER_PATH)r r r r r r r r
r r r
r r r r N)__doc__-defence360agent.wordpress.changelog_processorr ,defence360agent.wordpress.incident_collectorr r )defence360agent.wordpress.incident_senderr )defence360agent.wordpress.incident_parserr "defence360agent.wordpress.wp_rulesr r r
r r r
#defence360agent.wordpress.constantsr r r r __all__ W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/__init__.py<module>r s
E D D D D D H H H H H H r defence360agent/wordpress/__pycache__/__init__.cpython-311.pyc 0000644 0000000 0000000 00000002640 00000000000 021251 0 ustar
r_j ~ d Z ddlmZ ddlmZmZ ddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZ ddlmZmZmZmZ g dZd S )
ztWordPress incident collection, sending logic, plugin management, and rules.
Available for both AV and IM360 modes.
)ChangelogProcessor)IncidentCollectorIncidentRateLimiter)IncidentSender)IncidentFileParser)WP_RULES_ZIP_FILENAMEWP_RULES_VERSION_FILENAMEfind_file_in_indexextract_wp_rules_yamlget_wp_rules_dataget_wp_ruleset_version) PLUGIN_PATH PLUGIN_SLUGPLUGIN_VERSION_FILEWP_CLI_WRAPPER_PATH)r r r r r r r r
r r r
r r r r N)__doc__-defence360agent.wordpress.changelog_processorr ,defence360agent.wordpress.incident_collectorr r )defence360agent.wordpress.incident_senderr )defence360agent.wordpress.incident_parserr "defence360agent.wordpress.wp_rulesr r r
r r r
#defence360agent.wordpress.constantsr r r r __all__ W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/__init__.py<module>r s
E D D D D D H H H H H H r defence360agent/wordpress/__pycache__/bot_protection.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000013744 00000000000 023512 0 ustar
r_j
^ d Z ddlZddlZddlZddlZddlmZ ej e Z dZ
dZ dZ ej
dej Z ej
dej Z ej
d ej Z ej
d
ej Zd ed efd
Zd ed efdZd ed efdZdeded ededef
dZdS )as Resolve the AI bot protection state actually applied on a WP site.
Mirrors the precedence the imunify-security plugin applies at runtime
(inc/App/Plugin.php::isBotProtectionActive, inc/App/Bot/Preset.php::resolve):
a site-owner wp-config.php constant or bot-settings.php override wins over
the hoster-written plugin_config.php default. Files are parsed, never
executed.
N)Path)balancedstrictmonitorr i zDdefine\(\s*['"]IMUNIFY_AI_BOT_PROTECTION['"]\s*,\s*(true|false)\s*\)zPdefine\(\s*['\"]IMUNIFY_AI_BOT_PROTECTION_PRESET['\"]\s*,\s*['\"](\w+)['\"]\s*\)z#['"]enabled['"]\s*=>\s*(true|false)z#['"]preset['"]\s*=>\s*['"](\w+)['"]pathuidc < t j | t j t j z t j z }n# t
$ r Y dS w xY w t j | }t j |j r |j
|k r t j | dS t j |t dd t j | S # t
$ r Y t j | dS w xY w# t j | w xY w)zRead a small site-owner config file as root, defensively.
Returns None (so the caller falls back to the hoster default) on a
symlink, FIFO/device, a file not owned by the site user, or any I/O
error. At most _MAX_BYTES are read.
Nzutf-8replace)errors)osopenO_RDONLY
O_NOFOLLOW
O_NONBLOCKOSErrorfstatstatS_ISREGst_modest_uidcloseread
_MAX_BYTESdecode)r r fdinfos ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/bot_protection.py
_safe_readr . s
WT2; 6 F
G
G ttx|||DL)) T[C-?-?
wr:&&--gi-HH
s9 9<
A
A
8C .C
D*D DD Dc t | | }|dS d}t | }|r+| d dk }d}t
| }|rU| d t v r'| d }||fS )zoReturn (enabled, preset) from wp-config.php constants; each is None
when the constant is absent or invalid.N)NN true)r _CONST_ENABLEDsearchgrouplower
_CONST_PRESET
VALID_PRESETS)r r textenabledmatchpresets r _parse_wp_configr, D s dC D |zG ! !$ ' 'E 3++a..&&((F2
F & &E (Q %%''=88Q %%'' F? c t | | }|dS t | }|r+| d dk nd}d}t
| }|rU| d t v r'| d }||fS )zReturn (enabled, preset) from the site-owner bot-settings.php. A
missing/unreadable file means enabled with no explicit preset, matching
the plugin's OptOutFlag default.N)TNr r! T)r _KV_ENABLEDr# r$ r%
_KV_PRESETr' )r r r( r* r) r+ s r _parse_bot_settingsr1 U s dC D |z t $ $E27Aekk!nn""$$..TG
F d # #E (Q %%''=88Q %%'' F?r- docrootdata_dirhoster_enabled
hoster_presetc t t | dz | \ }}t t | dz | \ }}t | o|} |du rd} |||fD ]}
|
t v r| |
fc S | t
fS )a Resolve the effective (enabled, preset) for a site.
enabled: the wp-config constant (if set to false) force-disables;
otherwise it is the AND of the hoster default and the site-owner flag.
preset: first match of wp-config constant, bot-settings.php, hoster.
z
wp-config.phpzbot-settings.phpF)r, r r1 boolr' DEFAULT_PRESET) r2 r3 r r4 r5
const_enabled const_preset bot_enabled
bot_presetr) candidates r resolve_ai_bot_protectionr> e s #3 W
'# # M< 2 X++S K >""2{G "J
> & &
% %I% % % % & N ""r- )__doc__loggingr rer pathlibr getLogger__name__loggerr' r8 r compile
IGNORECASEr" r& r/ r0 intr r, r1 strr7 r> r- r <module>rK s 8 $ $1
OM
M
bj.
RZ.
T ,4 c "
d
#
##
# #
# # # # # #r- defence360agent/wordpress/__pycache__/bot_protection.cpython-311.pyc 0000644 0000000 0000000 00000013744 00000000000 022553 0 ustar
r_j
^ d Z ddlZddlZddlZddlZddlmZ ej e Z dZ
dZ dZ ej
dej Z ej
dej Z ej
d ej Z ej
d
ej Zd ed efd
Zd ed efdZd ed efdZdeded ededef
dZdS )as Resolve the AI bot protection state actually applied on a WP site.
Mirrors the precedence the imunify-security plugin applies at runtime
(inc/App/Plugin.php::isBotProtectionActive, inc/App/Bot/Preset.php::resolve):
a site-owner wp-config.php constant or bot-settings.php override wins over
the hoster-written plugin_config.php default. Files are parsed, never
executed.
N)Path)balancedstrictmonitorr i zDdefine\(\s*['"]IMUNIFY_AI_BOT_PROTECTION['"]\s*,\s*(true|false)\s*\)zPdefine\(\s*['\"]IMUNIFY_AI_BOT_PROTECTION_PRESET['\"]\s*,\s*['\"](\w+)['\"]\s*\)z#['"]enabled['"]\s*=>\s*(true|false)z#['"]preset['"]\s*=>\s*['"](\w+)['"]pathuidc < t j | t j t j z t j z }n# t
$ r Y dS w xY w t j | }t j |j r |j
|k r t j | dS t j |t dd t j | S # t
$ r Y t j | dS w xY w# t j | w xY w)zRead a small site-owner config file as root, defensively.
Returns None (so the caller falls back to the hoster default) on a
symlink, FIFO/device, a file not owned by the site user, or any I/O
error. At most _MAX_BYTES are read.
Nzutf-8replace)errors)osopenO_RDONLY
O_NOFOLLOW
O_NONBLOCKOSErrorfstatstatS_ISREGst_modest_uidcloseread
_MAX_BYTESdecode)r r fdinfos ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/bot_protection.py
_safe_readr . s
WT2; 6 F
G
G ttx|||DL)) T[C-?-?
wr:&&--gi-HH
s9 9<
A
A
8C .C
D*D DD Dc t | | }|dS d}t | }|r+| d dk }d}t
| }|rU| d t v r'| d }||fS )zoReturn (enabled, preset) from wp-config.php constants; each is None
when the constant is absent or invalid.N)NN true)r _CONST_ENABLEDsearchgrouplower
_CONST_PRESET
VALID_PRESETS)r r textenabledmatchpresets r _parse_wp_configr, D s dC D |zG ! !$ ' 'E 3++a..&&((F2
F & &E (Q %%''=88Q %%'' F? c t | | }|dS t | }|r+| d dk nd}d}t
| }|rU| d t v r'| d }||fS )zReturn (enabled, preset) from the site-owner bot-settings.php. A
missing/unreadable file means enabled with no explicit preset, matching
the plugin's OptOutFlag default.N)TNr r! T)r _KV_ENABLEDr# r$ r%
_KV_PRESETr' )r r r( r* r) r+ s r _parse_bot_settingsr1 U s dC D |z t $ $E27Aekk!nn""$$..TG
F d # #E (Q %%''=88Q %%'' F?r- docrootdata_dirhoster_enabled
hoster_presetc t t | dz | \ }}t t | dz | \ }}t | o|} |du rd} |||fD ]}
|
t v r| |
fc S | t
fS )a Resolve the effective (enabled, preset) for a site.
enabled: the wp-config constant (if set to false) force-disables;
otherwise it is the AND of the hoster default and the site-owner flag.
preset: first match of wp-config constant, bot-settings.php, hoster.
z
wp-config.phpzbot-settings.phpF)r, r r1 boolr' DEFAULT_PRESET) r2 r3 r r4 r5
const_enabled const_preset bot_enabled
bot_presetr) candidates r resolve_ai_bot_protectionr> e s #3 W
'# # M< 2 X++S K >""2{G "J
> & &
% %I% % % % & N ""r- )__doc__loggingr rer pathlibr getLogger__name__loggerr' r8 r compile
IGNORECASEr" r& r/ r0 intr r, r1 strr7 r> r- r <module>rK s 8 $ $1
OM
M
bj.
RZ.
T ,4 c "
d
#
##
# #
# # # # # #r- defence360agent/wordpress/__pycache__/changelog_processor.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000041473 00000000000 024506 0 ustar
r_j2 d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m
Z
ddl m Z ddl
mZmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ ej e Z d
Z dZ dZ dZ G d d Z!dS )a Processor for WordPress rule disable/enable changelog files.
The PHP WordPress plugin writes rule change actions to changelog.php when a user
disables or enables protection rules from the WordPress admin panel. This module
reads, parses, and applies those actions to the agent database.
The changelog.php file uses the same format as incident files:
<?php __halt_compiler();
#{base64-encoded JSON for action 1}
#{base64-encoded JSON for action 2}
Each JSON action has the form:
{"action": "disable"|"enable", "rule_id": "xyz", "ts": ...}
The user_id stored with each action is the system UID of the WordPress site
owner (site.uid).
N)Path) MessageType)WP_WAF_RULES_EDIThas_permission) MessageSink)WPSite
WordpressSite)WPDisabledRule)
open_nofollow) get_data_dir)IncidentFileParser) parse_php_with_embedded_jsonz
changelog.phpzdisabled-rules.phpdisableenablec t e Zd ZdZddZdee dedz dee fdZdededz de fd Z
d
e dedee fd Z
d
e dededz de fd Zd
e dedede fdZedededz fd Zedededede fd Zdedede fdZed
e dededz deddf
d Zedede de fd ZdS )ChangelogProcessora Process WordPress rule disable/enable changelog files.
Reads changelog.php from each site's data directory, applies
disable/enable actions to the WPDisabledRule database, reports events
to the correlation server, and deletes the file after processing.
If no changelog exists (or no new entries), checks whether
disabled-rules.php has been modified externally (e.g. backup restore)
and flags the domain for regeneration.
returnNc , t | _ d S )N)r
parser)selfs b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/changelog_processor.py__init__zChangelogProcessor.__init__: s )** sitessinkc K g }|D ]3}| || d{V r| | 4|r(t dt | |S )a- Process changelog.php for all given sites.
Args:
sites: WordPress sites to process.
sink: MessageSink for sending correlation events.
Returns:
Sites whose disabled rules were affected
(needing disabled-rules.php regeneration).
Nz(Changelog processing affected %d site(s))
_process_siteappendloggerinfolen)r r r affectedsites r process_changelogs_for_sitesz/ChangelogProcessor.process_changelogs_for_sites? s "$ & &D''d33333333
&%%% KK:H
r r# c ~ K t | d{V }| sdS |t z }| r | ||| d{V rdS | || rdS n8# t
$ r+}t d|j | Y d}~nd}~ww xY wdS )zProcess changelog.php for a single site.
Args:
site: WordPress site to process.
sink: MessageSink for sending correlation events.
Returns:
True if the site's disabled rules were affected.
NFTz*Error processing changelog for site %s: %s) r existsCHANGELOG_FILENAME_process_changelog_file _is_disabled_rules_file_stale Exceptionr errordocroot)r r# r data_dirchangelog_pathes r r z ChangelogProcessor._process_site\ s( )$ / ///////H??$$
u %(: :N $$&&
55"D$ 411$AA
t
LL<
us" )B ;B ,B
B:!B55B:r. c | j | | d S # t $ r+}t d|j | Y d}~S d}~ww xY w# t t f$ r|}t d|j | g cY d}~ | d S # t $ r+}t d|j | Y d}~S d}~ww xY wd}~ww xY w# | d w # t $ r+}t d|j | Y d}~w d}~ww xY wxY w)zsParse a changelog file and delete it.
The file is deleted regardless of whether parsing succeeds.
T)
missing_okz*Failed to delete changelog for site %s: %sNz)Failed to parse changelog for site %s: %s)r
parse_fileunlinkOSErrorr r+ r,
ValueError)r r. r# r/ s r _consume_changelogz%ChangelogProcessor._consume_changelog s ;)).99
%%%6666
@L
$ LL;
IIIII
%%%6666
@L
%%%6666
@L
s A+ 3
A(!A##A(+C8<"C3 C8 C; $B;;
C0!C++C03C88C; ;E =DE
E !E?E E E c K | || }|sdS t t t |j d{V s0t
dt | |j dS | | }d}|D ]8} t | dd }|dk r.t d| dd d |j |>||k r8t
d
| dd |j || |
||| rd }| |||| d{V # t $ r%} t
d | Y d} ~ d} ~ wt $ r-} t
d
||j | Y d} ~ 2d} ~ ww xY wt
d|j t | | |S )am Parse and apply actions from a changelog file.
The file is always deleted after reading, even on parse errors.
Actions older than the last sync timestamp are skipped to prevent
stale changelog files (e.g. from backup restores) from undoing
more recent changes.
Returns:
True if any DB changes occurred.
FNzSWP WAF rule editing disabled by policy; dropping %d changelog action(s) for site %stsr z:Missing or invalid timestamp in changelog action for rule rule_id? on site zPSkipping stale changelog action for rule %s on site %s (ts=%.0f <= sync_ts=%.0f)Tz$Skipping invalid changelog entry: %sz5Failed to process changelog action %s for site %s: %sz9Processed changelog for site %s: %d action(s), changed=%s)r6 r r struidr r r! r, _get_last_sync_tsfloatgetr5 _process_action_report_actionwarningr* r+ )
r r. r# r actions last_sync_tschangedaction timestampr/ s
r r( z*ChangelogProcessor._process_changelog_file s )).$?? 5 $$5s48}}EEEEEEEE KK3G
5--d33 F
!&**T1"5"5 6 6 >>$3%+ZZ 3%?%?3 3$(L3 3
+ \0I0IKK@
9c22 !$
''i@@ # "G))&$iHHHHHHHHHH
J
J
J EqIIIIIIII
KL
G L LL
s+ BE&.7E&&
G
0F
G
"GG
rG rH c B | d }| d }|r|st d| |t k r| ||| S |t k r| || S t d| d| d|j )a Apply a single changelog action to the database.
Args:
action: Parsed action dict with keys: action, rule_id, ts.
site: The WordPress site the action belongs to.
timestamp: Pre-resolved Unix timestamp for this action.
Returns:
True if the database state was modified.
Raises:
ValueError: If the action is missing required fields or has
an unknown action type.
rG r9 z.Missing action or rule_id in changelog entry: zUnknown changelog action 'z ' for rule r; )r@ r5 ACTION_DISABLE_apply_disable
ACTION_ENABLE
_apply_enabler, )r rG r# rH action_typer9 s r rA z"ChangelogProcessor._process_action s " jj** **Y'' ' III
. ( (&&wi@@ @
M
)
)%%gt44 4 >[ > > $> >/3|> >
r c p t j | j }|j S # t j $ r Y dS w xY w)zGet the last disabled-rules sync timestamp for a site.
Returns None if the site has no DB record or no sync timestamp,
meaning all actions should be processed.
N)r get_by_idr, disabled_rules_sync_ts DoesNotExist)r# db_sites r r> z$ChangelogProcessor._get_last_sync_ts sG #-dl;;G1 1 ) 44 s " 55r9 c j t j | |j gt j |j | }|dk S )zApply a disable action from the changelog.
Returns:
True if a new disable entry was created (not a no-op).
)r9 domainssourceuser_idrH r )r
storedomainSOURCE_WORDPRESSr= )r9 r# rH counts r rK z!ChangelogProcessor._apply_disable s? $[M!2H
qyr c F t j ||j g }|dk S )zvApply an enable action from the changelog.
Returns:
True if a disable entry was removed.
)r9 rU r )r
removerY )r r9 r# r[ s r rM z ChangelogProcessor._apply_enable$ s1 %[M
qyr c
K |dS | d }| d }|t k r
t j }n|t k r
t j }ndS | |d||j g||j t j d{V dS # t $ r-}t d||j
| Y d}~dS d}~ww xY w)zSend a rule change event to the correlation server.
Must only be called for valid actions (after _process_action succeeds).
NrG r9 wordpress) plugin_idrulerU rH rW rV z<Failed to report changelog action for rule %s on site %s: %s)rJ r WPRuleDisabledrL
WPRuleEnabledprocess_messagerY r= r
rZ r* r r+ r, )rG r# r rH rN r9 message_clsr/ s r rB z!ChangelogProcessor._report_action0 s, < F X& # . ( (%4KK
M
)
)%3KK F && ) ![M ' H):
LLN
s
?B
C"B==Cr- c b |t z } t t | 5 }t j t j | dd 5 }| }ddd n # 1 swxY w Y ddd n # 1 swxY w Y nU# t $ r Y dS t $ r<}|j t j
k r t d|| Y d}~dS d}~ww xY w t | }t | dd }n@# t t f$ r,} t d | j | Y d} ~ dS d} ~ ww xY w t' j | j }
n# t& j $ r Y dS w xY w|
j } | du pt/ || z
d
k S ) a Check if disabled-rules.php was modified externally.
Reads the embedded timestamp from the file and compares it against
the stored sync timestamp in the database. If they differ
(e.g. file restored from backup), returns True to trigger regeneration.
rzutf-8)encodingNFzCannot open %s: %sr8 r z.Cannot read disabled-rules.php for site %s: %sg ?)DISABLED_RULES_FILENAMEr r< osfdopendupreadFileNotFoundErrorr4 errnoELOOPr debugr r? r@ r5 rC r, r rP rR rQ abs) r# r- disabled_rules_pathfdfcontentexcdatafile_tsr/ rS db_tss r r) z0ChangelogProcessor._is_disabled_rules_file_stale[ sV ')@ @
s#6 7 788
'BYrvbzz3AAA 'Q ffhhG' ' ' ' ' ' ' ' ' ' ' ' ' ' '
'
'
'
'
'
'
'
'
'
'
'
'
'
'
' ! 55 yEK'' 13FLLL55555
/88DDHHT1 - -..GG$ NN@
55555
#-dl;;GG ) 55 .}:GeO 4 4s ::s B *B
A3' B
3A7 7B
:A7 ;B
> B
BB BB
C(# C(,1C##C(,2D E 0!EE E: :F
F
)r N)__name__
__module__ __qualname____doc__r listr r r$ boolr r dictr6 r( r? rA staticmethodr> r< rK rM rB r) r r r r . sw + + + +
F| D
f :$$ D $
$ $ $ $L "*0
d 4G G G D G
G G G GR "( 5:
D
54<
\
6
e
\
S
4
((( D ( (
( ( ( \(T );););
); ); ); \); ); );r r )"r~ ro loggingrj pathlibr "defence360agent.contracts.messagesr %defence360agent.contracts.permissionsr r !defence360agent.contracts.pluginsr defence360agent.model.wordpressr r &defence360agent.model.wp_disabled_ruler
defence360agent.utils.fd_opsr defence360agent.wordpress.clir )defence360agent.wordpress.incident_parserr
defence360agent.wordpress.utilsr getLoggerr{ r r' ri rJ rL r r r r <module>r sb $
: : : : : : : 9 9 9 9 9 A A A A A A A A A A A A A A 6 6 6 6 6 6 6 6 6 6 6 6 H H H H H H H H H H H H 8 $ $$ .
W; W; W; W; W; W; W; W; W; W;r defence360agent/wordpress/__pycache__/changelog_processor.cpython-311.pyc 0000644 0000000 0000000 00000041473 00000000000 023547 0 ustar
r_j2 d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m
Z
ddl m Z ddl
mZmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ ej e Z d
Z dZ dZ dZ G d d Z!dS )a Processor for WordPress rule disable/enable changelog files.
The PHP WordPress plugin writes rule change actions to changelog.php when a user
disables or enables protection rules from the WordPress admin panel. This module
reads, parses, and applies those actions to the agent database.
The changelog.php file uses the same format as incident files:
<?php __halt_compiler();
#{base64-encoded JSON for action 1}
#{base64-encoded JSON for action 2}
Each JSON action has the form:
{"action": "disable"|"enable", "rule_id": "xyz", "ts": ...}
The user_id stored with each action is the system UID of the WordPress site
owner (site.uid).
N)Path) MessageType)WP_WAF_RULES_EDIThas_permission) MessageSink)WPSite
WordpressSite)WPDisabledRule)
open_nofollow) get_data_dir)IncidentFileParser) parse_php_with_embedded_jsonz
changelog.phpzdisabled-rules.phpdisableenablec t e Zd ZdZddZdee dedz dee fdZdededz de fd Z
d
e dedee fd Z
d
e dededz de fd Zd
e dedede fdZedededz fd Zedededede fd Zdedede fdZed
e dededz deddf
d Zedede de fd ZdS )ChangelogProcessora Process WordPress rule disable/enable changelog files.
Reads changelog.php from each site's data directory, applies
disable/enable actions to the WPDisabledRule database, reports events
to the correlation server, and deletes the file after processing.
If no changelog exists (or no new entries), checks whether
disabled-rules.php has been modified externally (e.g. backup restore)
and flags the domain for regeneration.
returnNc , t | _ d S )N)r
parser)selfs b/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/changelog_processor.py__init__zChangelogProcessor.__init__: s )** sitessinkc K g }|D ]3}| || d{V r| | 4|r(t dt | |S )a- Process changelog.php for all given sites.
Args:
sites: WordPress sites to process.
sink: MessageSink for sending correlation events.
Returns:
Sites whose disabled rules were affected
(needing disabled-rules.php regeneration).
Nz(Changelog processing affected %d site(s))
_process_siteappendloggerinfolen)r r r affectedsites r process_changelogs_for_sitesz/ChangelogProcessor.process_changelogs_for_sites? s "$ & &D''d33333333
&%%% KK:H
r r# c ~ K t | d{V }| sdS |t z }| r | ||| d{V rdS | || rdS n8# t
$ r+}t d|j | Y d}~nd}~ww xY wdS )zProcess changelog.php for a single site.
Args:
site: WordPress site to process.
sink: MessageSink for sending correlation events.
Returns:
True if the site's disabled rules were affected.
NFTz*Error processing changelog for site %s: %s) r existsCHANGELOG_FILENAME_process_changelog_file _is_disabled_rules_file_stale Exceptionr errordocroot)r r# r data_dirchangelog_pathes r r z ChangelogProcessor._process_site\ s( )$ / ///////H??$$
u %(: :N $$&&
55"D$ 411$AA
t
LL<
us" )B ;B ,B
B:!B55B:r. c | j | | d S # t $ r+}t d|j | Y d}~S d}~ww xY w# t t f$ r|}t d|j | g cY d}~ | d S # t $ r+}t d|j | Y d}~S d}~ww xY wd}~ww xY w# | d w # t $ r+}t d|j | Y d}~w d}~ww xY wxY w)zsParse a changelog file and delete it.
The file is deleted regardless of whether parsing succeeds.
T)
missing_okz*Failed to delete changelog for site %s: %sNz)Failed to parse changelog for site %s: %s)r
parse_fileunlinkOSErrorr r+ r,
ValueError)r r. r# r/ s r _consume_changelogz%ChangelogProcessor._consume_changelog s ;)).99
%%%6666
@L
$ LL;
IIIII
%%%6666
@L
%%%6666
@L
s A+ 3
A(!A##A(+C8<"C3 C8 C; $B;;
C0!C++C03C88C; ;E =DE
E !E?E E E c K | || }|sdS t t t |j d{V s0t
dt | |j dS | | }d}|D ]8} t | dd }|dk r.t d| dd d |j |>||k r8t
d
| dd |j || |
||| rd }| |||| d{V # t $ r%} t
d | Y d} ~ d} ~ wt $ r-} t
d
||j | Y d} ~ 2d} ~ ww xY wt
d|j t | | |S )am Parse and apply actions from a changelog file.
The file is always deleted after reading, even on parse errors.
Actions older than the last sync timestamp are skipped to prevent
stale changelog files (e.g. from backup restores) from undoing
more recent changes.
Returns:
True if any DB changes occurred.
FNzSWP WAF rule editing disabled by policy; dropping %d changelog action(s) for site %stsr z:Missing or invalid timestamp in changelog action for rule rule_id? on site zPSkipping stale changelog action for rule %s on site %s (ts=%.0f <= sync_ts=%.0f)Tz$Skipping invalid changelog entry: %sz5Failed to process changelog action %s for site %s: %sz9Processed changelog for site %s: %d action(s), changed=%s)r6 r r struidr r r! r, _get_last_sync_tsfloatgetr5 _process_action_report_actionwarningr* r+ )
r r. r# r actions last_sync_tschangedaction timestampr/ s
r r( z*ChangelogProcessor._process_changelog_file s )).$?? 5 $$5s48}}EEEEEEEE KK3G
5--d33 F
!&**T1"5"5 6 6 >>$3%+ZZ 3%?%?3 3$(L3 3
+ \0I0IKK@
9c22 !$
''i@@ # "G))&$iHHHHHHHHHH
J
J
J EqIIIIIIII
KL
G L LL
s+ BE&.7E&&
G
0F
G
"GG
rG rH c B | d }| d }|r|st d| |t k r| ||| S |t k r| || S t d| d| d|j )a Apply a single changelog action to the database.
Args:
action: Parsed action dict with keys: action, rule_id, ts.
site: The WordPress site the action belongs to.
timestamp: Pre-resolved Unix timestamp for this action.
Returns:
True if the database state was modified.
Raises:
ValueError: If the action is missing required fields or has
an unknown action type.
rG r9 z.Missing action or rule_id in changelog entry: zUnknown changelog action 'z ' for rule r; )r@ r5 ACTION_DISABLE_apply_disable
ACTION_ENABLE
_apply_enabler, )r rG r# rH action_typer9 s r rA z"ChangelogProcessor._process_action s " jj** **Y'' ' III
. ( (&&wi@@ @
M
)
)%%gt44 4 >[ > > $> >/3|> >
r c p t j | j }|j S # t j $ r Y dS w xY w)zGet the last disabled-rules sync timestamp for a site.
Returns None if the site has no DB record or no sync timestamp,
meaning all actions should be processed.
N)r get_by_idr, disabled_rules_sync_ts DoesNotExist)r# db_sites r r> z$ChangelogProcessor._get_last_sync_ts sG #-dl;;G1 1 ) 44 s " 55r9 c j t j | |j gt j |j | }|dk S )zApply a disable action from the changelog.
Returns:
True if a new disable entry was created (not a no-op).
)r9 domainssourceuser_idrH r )r
storedomainSOURCE_WORDPRESSr= )r9 r# rH counts r rK z!ChangelogProcessor._apply_disable s? $[M!2H
qyr c F t j ||j g }|dk S )zvApply an enable action from the changelog.
Returns:
True if a disable entry was removed.
)r9 rU r )r
removerY )r r9 r# r[ s r rM z ChangelogProcessor._apply_enable$ s1 %[M
qyr c
K |dS | d }| d }|t k r
t j }n|t k r
t j }ndS | |d||j g||j t j d{V dS # t $ r-}t d||j
| Y d}~dS d}~ww xY w)zSend a rule change event to the correlation server.
Must only be called for valid actions (after _process_action succeeds).
NrG r9 wordpress) plugin_idrulerU rH rW rV z<Failed to report changelog action for rule %s on site %s: %s)rJ r WPRuleDisabledrL
WPRuleEnabledprocess_messagerY r= r
rZ r* r r+ r, )rG r# r rH rN r9 message_clsr/ s r rB z!ChangelogProcessor._report_action0 s, < F X& # . ( (%4KK
M
)
)%3KK F && ) ![M ' H):
LLN
s
?B
C"B==Cr- c b |t z } t t | 5 }t j t j | dd 5 }| }ddd n # 1 swxY w Y ddd n # 1 swxY w Y nU# t $ r Y dS t $ r<}|j t j
k r t d|| Y d}~dS d}~ww xY w t | }t | dd }n@# t t f$ r,} t d | j | Y d} ~ dS d} ~ ww xY w t' j | j }
n# t& j $ r Y dS w xY w|
j } | du pt/ || z
d
k S ) a Check if disabled-rules.php was modified externally.
Reads the embedded timestamp from the file and compares it against
the stored sync timestamp in the database. If they differ
(e.g. file restored from backup), returns True to trigger regeneration.
rzutf-8)encodingNFzCannot open %s: %sr8 r z.Cannot read disabled-rules.php for site %s: %sg ?)DISABLED_RULES_FILENAMEr r< osfdopendupreadFileNotFoundErrorr4 errnoELOOPr debugr r? r@ r5 rC r, r rP rR rQ abs) r# r- disabled_rules_pathfdfcontentexcdatafile_tsr/ rS db_tss r r) z0ChangelogProcessor._is_disabled_rules_file_stale[ sV ')@ @
s#6 7 788
'BYrvbzz3AAA 'Q ffhhG' ' ' ' ' ' ' ' ' ' ' ' ' ' '
'
'
'
'
'
'
'
'
'
'
'
'
'
'
' ! 55 yEK'' 13FLLL55555
/88DDHHT1 - -..GG$ NN@
55555
#-dl;;GG ) 55 .}:GeO 4 4s ::s B *B
A3' B
3A7 7B
:A7 ;B
> B
BB BB
C(# C(,1C##C(,2D E 0!EE E: :F
F
)r N)__name__
__module__ __qualname____doc__r listr r r$ boolr r dictr6 r( r? rA staticmethodr> r< rK rM rB r) r r r r . sw + + + +
F| D
f :$$ D $
$ $ $ $L "*0
d 4G G G D G
G G G GR "( 5:
D
54<
\
6
e
\
S
4
((( D ( (
( ( ( \(T );););
); ); ); \); ); );r r )"r~ ro loggingrj pathlibr "defence360agent.contracts.messagesr %defence360agent.contracts.permissionsr r !defence360agent.contracts.pluginsr defence360agent.model.wordpressr r &defence360agent.model.wp_disabled_ruler
defence360agent.utils.fd_opsr defence360agent.wordpress.clir )defence360agent.wordpress.incident_parserr
defence360agent.wordpress.utilsr getLoggerr{ r r' ri rJ rL r r r r <module>r sb $
: : : : : : : 9 9 9 9 9 A A A A A A A A A A A A A A 6 6 6 6 6 6 6 6 6 6 6 6 H H H H H H H H H H H H 8 $ $$ .
W; W; W; W; W; W; W; W; W; W;r defence360agent/wordpress/__pycache__/cli.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000037307 00000000000 021230 0 ustar
r_j* d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm Z m
Z
m Z d dl m
Z
mZ d dlmZmZmZ d dlmZ d dlmZ ej e Zd ed
efd Z d ed
efd
Z ded
efdZ defdZ defdZ defdZ!ded
efdZ"defdZ#defdZ$defdZ%defdZ&defdZ' e d defd Z(d Z)defd Z*dS ) N)Path)
StrictVersion) check_run
CheckRunErrorasync_lru_cache) PLUGIN_PATH PLUGIN_SLUG)build_command_for_userget_php_binary_path
wp_wrapper) log_message)WPSite version_strreturnc t | t sdS | }|sdS t | dS # t $ r Y dS w xY w)z1Validate if a string is a valid semantic version.FT)
isinstancestrstripr
ValueError)r trimmed_strs R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/cli.py_validate_semverr su k3 ' ' u ##%%K uk"""t uus A
AAoutputc b | sdS | }|sdS t | dk r+|d }t | r|S t | dk r+|d }t | r|S t dd| iddd
dS ) z
Extract version from WP CLI output, trying both first and last parts.
Args:
output: The raw output from WP CLI
Returns:
The extracted version string or None if no valid version found
Nr zMFailed to extract valid semver version from WP CLI output. Output: '{output}'r warning wordpressz#wp-plugin-version-extraction-failed) format_argslevel component fingerprint)splitlenr r r
)r parts
first_part last_parts r _extract_version_from_outputr( + s t
LLNNE t 5zzA~~1X^^%%
J ' ' 5zzA~~"IOO%% I & & v& 9
4 sitec K t | d{V }|dz dz dz }| sdS t j d } t | 5 }|D ][}| | }|rB| d }t | r|c cddd S ddd dS \ ddd n # 1 swxY w Y n4# t $ r'}t
d|| Y d}~dS d}~ww xY wdS )z
Parse the version of imunify-security plugin by reading the main plugin file.
Args:
site: WordPress site object containing docroot path
Returns:
str: Plugin version or None if not found or invalid
Npluginsimunify-securityzimunify-security.phpz\* Version:\s*([0-9.]+)r z=Failed to read plugin file to determine version number %s: %s) get_content_direxistsrecompileopensearchgroupr Exceptionloggererror) r* content_dir plugin_fileversion_patternflinematchversiones r _parse_version_from_plugin_filer@ W s (--------Ki "447MM tj!;<<O
+
$!
$
$'..t44 $ #kk!nnG'00 $ &
$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $$
$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ K
ttttt
4sU C AC C -C . C ;C = C C
C C
C
D DDc \ K t j | j j }t | | d{V }g t || j ddt t dd}t || }t d| t | d{V dS )zFInstall the Imunify Security WordPress plugin on given WordPress site.Nplugininstall
--activate--forcezInstalling wp plugin
pwdgetpwuiduidpw_namer r docrootr r r
r6 infor r* usernamephp_pathargscommands r plugin_installrR s |DH%%-H(x88888888H Hdl + + K
D %Xt44G
KK111222
G
r) c \ K t j | j j }t | | d{V }g t || j ddt t dd}t || }t d| t | d{V dS )z
Update the Imunify Security WordPress plugin on given WordPress site.
Currently, this is the same as install, but in the future it may differ.
NrB rC rD rE zUpdating wp plugin rF rM s r
plugin_updaterT s |DH%%-H(x88888888H Hdl + + K
D %Xt44G
KK/g//000
G
r) c > K t j | j j }t | | d{V }g t || j ddt d}t || }t
d| t | d{V dS )z<Uninstall the imunify-security wp plugin from given wp site.NrB uninstallz --deactivatezUninstalling wp plugin ) rG rH rI rJ r r rK r r
r6 rL r rM s r plugin_uninstallrW s |DH%%-H(x88888888H Hdl + +
D %Xt44G
KK3'33444
G
r) c K t | d{V dS # t $ r'}t d| | Y d}~dS d}~ww xY w)zAttempt to uninstall the plugin, returning False on failure.
Safe wrapper around plugin_uninstall for use in cleanup paths
where failure should be logged but not raised.
NTz5Failed to uninstall plugin from %s during cleanup: %sF)rW r5 r6 r )r* r7 s r try_plugin_uninstallrY s} t$$$$$$$$$t C
uuuuu
s
A AA c t K t j | j j }t | | d{V }g t || j ddt d}t || }t
d| t | d{V }| d
}t | S # t $ r+}t d|j Y d}~dS d}~wt$ $ r&}t d| Y d}~dS d}~ww xY w) z
Get the version of the imunify-security wp plugin installed on given WordPress site.
Uses WP CLI to get the version.
NrB getz--field=versionzGetting wp plugin version utf-8z0Failed to get wp plugin version. Return code: %sz-Failed to decode wp plugin version output: %s)rG rH rI rJ r r rK r r
r6 rL r decoder r( r r7
returncodeUnicodeDecodeError)r* rN rO rP rQ resultr r? s r _get_plugin_versionra s} |DH%%-H(x88888888H Hdl + +
D %Xt44G
KK6W66777 )))))))) w''--//+F333 >
L
ttttt DaHHHttttts% A
C
D7 D
D7D22D7c K t | d{V }|r|S n2# t $ r%}t d| Y d}~nd}~ww xY wt d t | d{V S )z
Get the version of the imunify-security wp plugin installed on given WordPress site.
First tries to parse the version from the plugin file, then falls back to WP CLI.
Nz,Failed to parse version from plugin file: %sz/Plugin version not found in file, trying WP CLI)r@ r5 r6 r rL ra )r* r> r? s r get_plugin_versionrc s J7======== N J J JEqIIIIIIIIJ KKABBB$T** * * * * * **s
A
AA
c ` K t j | j j }t | | d{V }g t || j ddt }t || }t
d| t | d{V n# t $ r Y dS w xY wdS )zMCheck if the imunify-security wp plugin is installed on given WordPress site.NrB is-installedz#Checking if wp plugin is installed FT)
rG rH rI rJ r r rK r r
r6 rL r r rM s r is_plugin_installedrf s |DH%%-H(x88888888H Hdl + + D %Xt44G
KK?g??@@@ uu
4s B
B+*B+c R K t j | j j }t | | d{V }g t || j dd}t || }t d| t | d{V n# t $ r Y dS w xY wdS )zJCheck if WordPress is installed and given site is accessible using WP CLI.Ncorere z#Checking if WordPress is installed FT) rG rH rI rJ r r rK r
r6 rL r r rM s r is_wordpress_installedri ! s |DH%%-H(x88888888H Hdl + + D
%Xt44G
KK?g??@@@ uu 4s B
B$#B$c K t j | j j }t | | d{V }g t || j dd}t || }t d| t j t | d d{V }|
d S # t j $ r$ t d| j Y dS t" $ r+}t d |j Y d}~dS d}~wt( $ r&}t d
| Y d}~dS d}~ww xY w) z
Get the content directory of the WordPress site using WP CLI.
This should only be used if the default wp-content directory does not exist.
Nevalzecho WP_CONTENT_DIR;zGetting content directory )timeoutr\ z1WP-CLI timed out getting content directory for %sz0Failed to get content directory. Return code: %sz-Failed to decode content directory output: %s)rG rH rI rJ r r rK r
r6 rL asynciowait_forr r] r TimeoutErrorr r r7 r^ r_ )r* rN rO rP rQ r` r? s r _get_content_directoryrq 8 s |DH%%-H(x88888888H Hdl + + D
%Xt44G
KK6W66777 ' '(:(:BGGGGGGGGG}}W%%++--- ?
tt >
L
ttttt DaHHHttttts+ AC /E$ E$ D11
E$>E E$d )maxsizec K t | j dz }| r| s&t | d{V }|rt | }|S )a
Get the WordPress content directory for the given WordPress site.
This function first checks if the default wp-content directory exists at the site's docroot.
If the default path doesn't exist or isn't a directory, it attempts to get the actual
content directory using WordPress CLI's WP_CONTENT_DIR constant.
Returns:
Path: The WordPress content directory path
wp-contentN)r rK r/ is_dirrq )r* r8 wp_content_dirs r r. r. \ s t|$$|3K /{'9'9';'; / 5d ; ;;;;;;; / ~..K r) c 8 t dS )z.Clear the async LRU cache for get_content_dir.N)r. cache_clear r) r clear_get_content_dir_cacher{ t s !!!!!r) c K t | d{V }|st | j dz }t | dz S )zO
Get the Imunify Security data directory for the given WordPress site.
Nru r- )r. r rK )r* r8 s r get_data_dirr} y sW (--------K 84<((<7 1 11r) )+rn loggingrG r0 pathlibr distutils.versionr defence360agent.utilsr r r #defence360agent.wordpress.constantsr r defence360agent.wordpress.utilsr
r r defence360agent.sentryr
defence360agent.model.wordpressr getLogger__name__r6 r boolr r( r@ rR rT rW rY ra rc rf ri rq r. r{ r} rz r) r <module>r s
+ + + + + +
I H H H H H H H
/ . . . . . 2 2 2 2 2 2 8 $ $# $ $) ) ) ) ) )X& &3 & & & &R v * f 2 (V $ F D+6 + + + +&F 0v .!v ! ! ! !H ." " "
2V 2 2 2 2 2 2r) defence360agent/wordpress/__pycache__/cli.cpython-311.pyc 0000644 0000000 0000000 00000037307 00000000000 020271 0 ustar
r_j* d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm Z m
Z
m Z d dl m
Z
mZ d dlmZmZmZ d dlmZ d dlmZ ej e Zd ed
efd Z d ed
efd
Z ded
efdZ defdZ defdZ defdZ!ded
efdZ"defdZ#defdZ$defdZ%defdZ&defdZ' e d defd Z(d Z)defd Z*dS ) N)Path)
StrictVersion) check_run
CheckRunErrorasync_lru_cache) PLUGIN_PATH PLUGIN_SLUG)build_command_for_userget_php_binary_path
wp_wrapper) log_message)WPSite version_strreturnc t | t sdS | }|sdS t | dS # t $ r Y dS w xY w)z1Validate if a string is a valid semantic version.FT)
isinstancestrstripr
ValueError)r trimmed_strs R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/cli.py_validate_semverr su k3 ' ' u ##%%K uk"""t uus A
AAoutputc b | sdS | }|sdS t | dk r+|d }t | r|S t | dk r+|d }t | r|S t dd| iddd
dS ) z
Extract version from WP CLI output, trying both first and last parts.
Args:
output: The raw output from WP CLI
Returns:
The extracted version string or None if no valid version found
Nr zMFailed to extract valid semver version from WP CLI output. Output: '{output}'r warning wordpressz#wp-plugin-version-extraction-failed) format_argslevel component fingerprint)splitlenr r r
)r parts
first_part last_parts r _extract_version_from_outputr( + s t
LLNNE t 5zzA~~1X^^%%
J ' ' 5zzA~~"IOO%% I & & v& 9
4 sitec K t | d{V }|dz dz dz }| sdS t j d } t | 5 }|D ][}| | }|rB| d }t | r|c cddd S ddd dS \ ddd n # 1 swxY w Y n4# t $ r'}t
d|| Y d}~dS d}~ww xY wdS )z
Parse the version of imunify-security plugin by reading the main plugin file.
Args:
site: WordPress site object containing docroot path
Returns:
str: Plugin version or None if not found or invalid
Npluginsimunify-securityzimunify-security.phpz\* Version:\s*([0-9.]+)r z=Failed to read plugin file to determine version number %s: %s) get_content_direxistsrecompileopensearchgroupr Exceptionloggererror) r* content_dir plugin_fileversion_patternflinematchversiones r _parse_version_from_plugin_filer@ W s (--------Ki "447MM tj!;<<O
+
$!
$
$'..t44 $ #kk!nnG'00 $ &
$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $$
$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ K
ttttt
4sU C AC C -C . C ;C = C C
C C
C
D DDc \ K t j | j j }t | | d{V }g t || j ddt t dd}t || }t d| t | d{V dS )zFInstall the Imunify Security WordPress plugin on given WordPress site.Nplugininstall
--activate--forcezInstalling wp plugin
pwdgetpwuiduidpw_namer r docrootr r r
r6 infor r* usernamephp_pathargscommands r plugin_installrR s |DH%%-H(x88888888H Hdl + + K
D %Xt44G
KK111222
G
r) c \ K t j | j j }t | | d{V }g t || j ddt t dd}t || }t d| t | d{V dS )z
Update the Imunify Security WordPress plugin on given WordPress site.
Currently, this is the same as install, but in the future it may differ.
NrB rC rD rE zUpdating wp plugin rF rM s r
plugin_updaterT s |DH%%-H(x88888888H Hdl + + K
D %Xt44G
KK/g//000
G
r) c > K t j | j j }t | | d{V }g t || j ddt d}t || }t
d| t | d{V dS )z<Uninstall the imunify-security wp plugin from given wp site.NrB uninstallz --deactivatezUninstalling wp plugin ) rG rH rI rJ r r rK r r
r6 rL r rM s r plugin_uninstallrW s |DH%%-H(x88888888H Hdl + +
D %Xt44G
KK3'33444
G
r) c K t | d{V dS # t $ r'}t d| | Y d}~dS d}~ww xY w)zAttempt to uninstall the plugin, returning False on failure.
Safe wrapper around plugin_uninstall for use in cleanup paths
where failure should be logged but not raised.
NTz5Failed to uninstall plugin from %s during cleanup: %sF)rW r5 r6 r )r* r7 s r try_plugin_uninstallrY s} t$$$$$$$$$t C
uuuuu
s
A AA c t K t j | j j }t | | d{V }g t || j ddt d}t || }t
d| t | d{V }| d
}t | S # t $ r+}t d|j Y d}~dS d}~wt$ $ r&}t d| Y d}~dS d}~ww xY w) z
Get the version of the imunify-security wp plugin installed on given WordPress site.
Uses WP CLI to get the version.
NrB getz--field=versionzGetting wp plugin version utf-8z0Failed to get wp plugin version. Return code: %sz-Failed to decode wp plugin version output: %s)rG rH rI rJ r r rK r r
r6 rL r decoder r( r r7
returncodeUnicodeDecodeError)r* rN rO rP rQ resultr r? s r _get_plugin_versionra s} |DH%%-H(x88888888H Hdl + +
D %Xt44G
KK6W66777 )))))))) w''--//+F333 >
L
ttttt DaHHHttttts% A
C
D7 D
D7D22D7c K t | d{V }|r|S n2# t $ r%}t d| Y d}~nd}~ww xY wt d t | d{V S )z
Get the version of the imunify-security wp plugin installed on given WordPress site.
First tries to parse the version from the plugin file, then falls back to WP CLI.
Nz,Failed to parse version from plugin file: %sz/Plugin version not found in file, trying WP CLI)r@ r5 r6 r rL ra )r* r> r? s r get_plugin_versionrc s J7======== N J J JEqIIIIIIIIJ KKABBB$T** * * * * * **s
A
AA
c ` K t j | j j }t | | d{V }g t || j ddt }t || }t
d| t | d{V n# t $ r Y dS w xY wdS )zMCheck if the imunify-security wp plugin is installed on given WordPress site.NrB is-installedz#Checking if wp plugin is installed FT)
rG rH rI rJ r r rK r r
r6 rL r r rM s r is_plugin_installedrf s |DH%%-H(x88888888H Hdl + + D %Xt44G
KK?g??@@@ uu
4s B
B+*B+c R K t j | j j }t | | d{V }g t || j dd}t || }t d| t | d{V n# t $ r Y dS w xY wdS )zJCheck if WordPress is installed and given site is accessible using WP CLI.Ncorere z#Checking if WordPress is installed FT) rG rH rI rJ r r rK r
r6 rL r r rM s r is_wordpress_installedri ! s |DH%%-H(x88888888H Hdl + + D
%Xt44G
KK?g??@@@ uu 4s B
B$#B$c K t j | j j }t | | d{V }g t || j dd}t || }t d| t j t | d d{V }|
d S # t j $ r$ t d| j Y dS t" $ r+}t d |j Y d}~dS d}~wt( $ r&}t d
| Y d}~dS d}~ww xY w) z
Get the content directory of the WordPress site using WP CLI.
This should only be used if the default wp-content directory does not exist.
Nevalzecho WP_CONTENT_DIR;zGetting content directory )timeoutr\ z1WP-CLI timed out getting content directory for %sz0Failed to get content directory. Return code: %sz-Failed to decode content directory output: %s)rG rH rI rJ r r rK r
r6 rL asynciowait_forr r] r TimeoutErrorr r r7 r^ r_ )r* rN rO rP rQ r` r? s r _get_content_directoryrq 8 s |DH%%-H(x88888888H Hdl + + D
%Xt44G
KK6W66777 ' '(:(:BGGGGGGGGG}}W%%++--- ?
tt >
L
ttttt DaHHHttttts+ AC /E$ E$ D11
E$>E E$d )maxsizec K t | j dz }| r| s&t | d{V }|rt | }|S )a
Get the WordPress content directory for the given WordPress site.
This function first checks if the default wp-content directory exists at the site's docroot.
If the default path doesn't exist or isn't a directory, it attempts to get the actual
content directory using WordPress CLI's WP_CONTENT_DIR constant.
Returns:
Path: The WordPress content directory path
wp-contentN)r rK r/ is_dirrq )r* r8 wp_content_dirs r r. r. \ s t|$$|3K /{'9'9';'; / 5d ; ;;;;;;; / ~..K r) c 8 t dS )z.Clear the async LRU cache for get_content_dir.N)r. cache_clear r) r clear_get_content_dir_cacher{ t s !!!!!r) c K t | d{V }|st | j dz }t | dz S )zO
Get the Imunify Security data directory for the given WordPress site.
Nru r- )r. r rK )r* r8 s r get_data_dirr} y sW (--------K 84<((<7 1 11r) )+rn loggingrG r0 pathlibr distutils.versionr defence360agent.utilsr r r #defence360agent.wordpress.constantsr r defence360agent.wordpress.utilsr
r r defence360agent.sentryr
defence360agent.model.wordpressr getLogger__name__r6 r boolr r( r@ rR rT rW rY ra rc rf ri rq r. r{ r} rz r) r <module>r s
+ + + + + +
I H H H H H H H
/ . . . . . 2 2 2 2 2 2 8 $ $# $ $) ) ) ) ) )X& &3 & & & &R v * f 2 (V $ F D+6 + + + +&F 0v .!v ! ! ! !H ." " "
2V 2 2 2 2 2 2r) defence360agent/wordpress/__pycache__/constants.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001247 00000000000 022467 0 ustar
r_jZ \ d Z ddlmZ ed ZdZ ed Z ed ZdS )z Constants for WordPress module. )Pathz5/usr/share/imunify360/wp-plugins/imunify-security.zipzimunify-securityz9/usr/share/imunify360/wp-plugins/imunify-security.versionz//usr/share/imunify360/wp-plugins/wp-cli-wrapperN)__doc__pathlibr PLUGIN_PATH PLUGIN_SLUGPLUGIN_VERSION_FILEWP_CLI_WRAPPER_PATH X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/constants.py<module>r
s` % % dJKK d? dLMM r defence360agent/wordpress/__pycache__/constants.cpython-311.pyc 0000644 0000000 0000000 00000001247 00000000000 021530 0 ustar
r_jZ \ d Z ddlmZ ed ZdZ ed Z ed ZdS )z Constants for WordPress module. )Pathz5/usr/share/imunify360/wp-plugins/imunify-security.zipzimunify-securityz9/usr/share/imunify360/wp-plugins/imunify-security.versionz//usr/share/imunify360/wp-plugins/wp-cli-wrapperN)__doc__pathlibr PLUGIN_PATH PLUGIN_SLUGPLUGIN_VERSION_FILEWP_CLI_WRAPPER_PATH X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/constants.py<module>r
s` % % dJKK d? dLMM r defence360agent/wordpress/__pycache__/exception.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000001347 00000000000 022452 0 ustar
r_j^ " G d de ZdS )c e Zd Z fdZ xZS )PHPErrorc J t | d S )N)super__init__)selfmessage __class__s X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/exception.pyr zPHPError.__init__ s!
!!!!! )__name__
__module__ __qualname__r
__classcell__)r s @r
r r s8 " " " " " " " " "r r N) Exceptionr r r
<module>r s9 " " " " "y " " " " "r defence360agent/wordpress/__pycache__/exception.cpython-311.pyc 0000644 0000000 0000000 00000001347 00000000000 021513 0 ustar
r_j^ " G d de ZdS )c e Zd Z fdZ xZS )PHPErrorc J t | d S )N)super__init__)selfmessage __class__s X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/exception.pyr zPHPError.__init__ s!
!!!!! )__name__
__module__ __qualname__r
__classcell__)r s @r
r r s8 " " " " " " " " "r r N) Exceptionr r r
<module>r s9 " " " " "y " " " " "r defence360agent/wordpress/__pycache__/incident_collector.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000060036 00000000000 024317 0 ustar
r_j,S d Z ddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z ddl m
Z
ddlmZ ddlmZ ddlmZmZmZmZ ej e Zd Zd
Zd Z d Z G d
d Z G d d Z dS )z1Collector for WordPress CVE protection incidents. N)Path) defaultdict)WPSite) get_data_dir)IncidentFileParser)aggregate_incident_dicts bulk_create_wordpress_incidentsbuild_incident_dictcountry_readerz.processing.php z .failed.phpz .stored.phpc p e Zd ZdZ ddededefdZd Z dd ed ed
edee ef fdZ
d ed efdZ dS )IncidentRateLimitera
Rate limiter to prevent DoS attacks via incident flooding.
Implements per-rule-per-IP rate limiting as per spec:
- Maximum 100 incidents for each rule from the same IP within 15 minutes
Memory-optimized implementation with bounded entry count using LRU eviction.
d r ' max_incidents_per_rule_per_iptime_window_secondsmax_unique_entriesc || _ || _ || _ t t | _ d| _ t j | _ dS )aI
Initialize the rate limiter.
Args:
max_incidents_per_rule_per_ip: Max incidents per rule per IP (default: 100)
time_window_seconds: Time window in seconds (default: 900 = 15 minutes)
max_unique_entries: Max unique (rule_id, IP) combinations to track (default: 10000)
< N) max_per_rule_per_ip time_windowr r listincident_timescleanup_intervaltime last_cleanup)selfr r r s a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/incident_collector.py__init__z IncidentRateLimiter.__init__5 sK $A ."4 *$ / / " IKK c ~ t j }|| j z
g }| j D ]5\ }} fd|D }|r || j |< | | 6|D ]
}| j |= t | j | j k rt | j d }t dt | j t | j dz z
}|d| D ]
\ }}| j |= t d| j | || _ dS )zHRemove records older than the time window and enforce max entries limit.c g | ]
}|k | S r# .0tscutoffs r
<listcomp>z<IncidentRateLimiter._cleanup_old_records.<locals>.<listcomp>V ===Rfbr c 2 | d r| d d ndS )N r r# )xs r <lambda>z:IncidentRateLimiter._cleanup_old_records.<locals>.<lambda>e s 1 4ad1gg1 r )keyr+ g?NzARate limiter exceeded max entries (%d), removed %d oldest entries)
r r r itemsappendlenr sortedmaxintloggerwarningr )
r nowkeys_to_deleter.
timestampsrecententries_by_age
num_to_remove_r' s
@r _cleanup_old_recordsz(IncidentRateLimiter._cleanup_old_recordsM s ikkt'' # 2 8 8 : : + +OC====:===F
++1#C(( %%c****! ) )C#C(( t" # #d&= = = ##))++44 N D'((3t/F/L+M+MM M ) - 8
-
-Q',, NN'
r r rule_id attacker_ippendingreturnc
t j | j z
| j k r| t j }|| j z
||f}|| j v rB| j | }
fd|D }|r|| j |< t
| }n
| j |= d}nd}||z
}|| j k r#| j dz } dd| d| d| d| j d | d
fS d S ) a
Check if adding an incident would exceed rate limits.
Args:
rule_id: Rule identifier
attacker_ip: IP address of the attacker
pending: Incidents already accepted in the current batch but not
recorded yet, so one file cannot exceed the limit on its own
Returns:
Tuple of (allowed: bool, reason: str)
c g | ]
}|k | S r# r# r$ s r r( z8IncidentRateLimiter.check_rate_limit.<locals>.<listcomp> r) r r r Fz Rate limit exceeded for rule z from IP z: /z within z minutes)TOK)r r r r> r r r1 r ) r r? r@ rA r7 r. r9 r: recent_countwindow_minutesr' s @r check_rate_limitz$IncidentRateLimiter.check_rate_limity sP 9;;* *T-B B B % % ' ' 'ikkt'' $ $% % % ,S1J====:===F
!+1#C( "6{{ ', L 43 3 3 ! - 3N1G 1 1#1 1$1 1'+'?1 1 '1 1 1
zr c t j }||f}|| j vr
|g| j |< dS | j | }t | | j k r| d | | dS )z
Record that an incident was added.
Args:
rule_id: Rule identifier
attacker_ip: IP address
r N)r r r1 r popr0 )r r? r@ r7 r. r9 s r record_incidentz#IncidentRateLimiter.record_incident s ikk $ d) ) )(+uD $ $ $ ,S1J:$":::q!!! c " " " " "r N)r r r )r ) __name__
__module__ __qualname____doc__r4 r r> strtupleboolrI rL r# r r r r + s .1#&"' ( ('*( !( ( ( ( (0* * * Z >?5 55),57:5 tSy 5 5 5 5n#s # # # # # # #r r c
e Zd ZdZd dedz fdZ d!dededefd Z d!d
ee dedefd Z
e d e dee fd
Z
ej d Ze de defd Zdededz dedefdZde de dz fdZede defd Zde dede dz fdZde defdZde defdZdededz fd Zd ee dededz d edef
d Z dS )"IncidentCollectorzM
Collect and persist WordPress incidents from plugin incident files.
N rate_limiterc | |p
t | _ t | _ t | _ dS )z
Initialize the incident collector.
Args:
rate_limiter: Optional rate limiter (creates default if not provided)
N)r rV r parserset_failed)r rV s r r zIncidentCollector.__init__ s6 ) A,?,A,A(** "% r Tsitedelete_after_processingrB c K g } t | d{V }t d|| | s t d| g S | | }t d|| |s t d| g S t dt | | | | }|D ]5}| |||| d{V }| | 6n3# t $ r&} t
d|| Y d} ~ nd} ~ ww xY wt dt | | |S ) ab
Collect incidents from a single WordPress site.
Args:
site: WordPress site to collect incidents from
ruleset_version: Version of the ruleset being used
delete_after_processing: Whether to delete incident files after processing
Returns:
List of collected Incident objects
Nz Data directory for site %s: %sz)Data directory does not exist for site %s Incident files for site %s: %sz#No incident files found for site %sz%Found %d incident file(s) for site %sz*Error collecting incidents for site %s: %sz$Collected %d incident(s) for site %s) r r5 debugexists_get_incident_filesr1 _get_site_username
_process_fileextend Exceptionerrorinfo)
r r[ r\ collected_incidentsdata_dirincident_filesusername
incident_filefile_incidentses
r collect_incidents_for_sitez,IncidentCollector.collect_incidents_for_site s !% )$ / ///////H LL94 J J J??$$
H$OOO ! 5 5h ? ?N LL0$
"
BDIII LL7N##
..t44H!/
;
;
'+'9'9! + ( ( " " " " " " $**>::::
; LL<
2 # $ $
#"s& A!D/ (AD/ 8A6D/ /
E 9 EE sitesc K g }|D ]3}| || d{V }| | 4|r6t dt | t | |S )a
Collect incidents from multiple WordPress sites.
Args:
sites: List of WordPress sites
delete_after_processing: Whether to delete incident files after processing
Returns:
List of collected Incident objects
Nz2Collected %d WordPress incident(s) from %d site(s))ro rd r5 rg r1 )r rp r\ all_collected_incidentsr[ site_incidentss r collect_incidents_for_sitesz-IncidentCollector.collect_incidents_for_sites s #% ; ;D#'#B#B'$ $ N
$ * *> : : : : " KKD+,,E
'&r ri c |dz }t d|| | r| s t d| g S g }| D ]k} t j | }n# t $ r Y $w xY wt j |j
r*| | r| | lt d|| |S )z
Get all incident files in the incidents directory.
Args:
data_dir: Path to the imunify-security data directory
Returns:
List of incident file paths
incidentsz#Incidents directory for site %s: %sz.Incidents directory does not exist for site %sr^ )
r5 r_ r` is_diriterdiroslstatOSError stat_moduleS_ISREGst_mode_is_incident_filer0 )clsri
incidents_dirrj fsts r ra z%IncidentCollector._get_incident_files< s0 !;.
18]
##%% ]-A-A-C-C LL@(
I &&(( ) )A
Xa[[
"2:..
)33H3H3K3K
) %%a((( ,h
s B
B"!B"z/^\d{4}-\d{2}-\d{2}-\d{2}(?:\.processing)?\.php$ file_pathc Z t | j |j S )a3
Check if a file is an incident file based on naming pattern.
Args:
file_path: Path to the file to check
Returns:
True if file matches pattern yyyy-mm-dd-hh.php, with or without
the suffix marking a batch left behind by an earlier cycle
)rS
_FILE_PATTERNmatchname)r r s r r z#IncidentCollector._is_incident_filee s% C%++IN;;<<<r rk c K |r| | }|g S | j | }|)| j t | g S |s9t d|j |r| | g S t
dt | |j | | ||||j }|r| | |S # t $ rW}|r'| j t | t d|j || g cY d }~S d }~ww xY w)Nz No valid incidents in file %sz)Parsed %d incident(s) from %s for site %sz1Error processing incident file %s for site %s: %s) _take_asiderX
parse_filerZ addrQ r5 r6 r _discardr_ r1 _process_file_incidentsre rf )r rl r[ rk r\ rv rh rn s r rc z IncidentCollector._process_files s 2 &
$ 0 0 ? ?
( I ..}==I ]!3!3444
3!& + 1MM-000 LL;I "
#'">"> " # # '
-
m,,,& & &
5 ]!3!3444 LLC "
IIIIII s1 D AD $:D A$D
E%A E E% E%rl c |j t r| | rdS |S | |j dt d t z }| r,| | r| | sdS | | t j
|dd |S )a Move the file out of the plugin's way before reading it.
Returns None when an earlier batch is still pending under the aside
name; that batch is processed in its own turn and the fresh file waits
for the next cycle rather than overwriting it.
N.phpF)follow_symlinks) r endswithPROCESSING_SUFFIX _quarantine with_namer1 r` _pendingrenamery utime)r rl asides r r z IncidentCollector._take_aside s & &'8 9 9 !
..
t '' ~#f++ ~ .1B B
<<>> dmmE 2 2 ##E**
t U### e4444 r r c t j | }n# t $ r Y dS w xY wt j |j o
|j dk S )zWhether an aside still holds a batch waiting to be stored.
Anything the site put there that is not a regular file is not one,
and the rename replaces it.
Fr )ry rz r{ r| r} r~ st_size)r r s r r zIncidentCollector._pending sV % BB 55 "2:..A2:>As
%%pathsuffixc |j }t dfD ]1}| | r|dt | } n2| ||z } | | n9# t $ r,}t d|j | Y d}~dS d}~ww xY w| j
t | |S )zGive a batch a name the collector will not pick up again.
Renaming touches the name, never what it points at, so it stays safe
in a directory the site owns.
r NzFailed to retire %s: %s) r r r r1 r r r{ r5 rf rZ discardrQ )r r r stemknownretiredrn s r _retirezIncidentCollector._retire s y'0 E}}U##
Ms5zzkM*
.. // KK LL2DIq A A A44444
SYY'''s A2 2
B(<!B##B(c \ t | | j vrdS t j t j | j z
}n# t $ r Y dS w xY w|t k rdS | |t }|dS t d|j ||j dS )z@Retire an aside this process has read and still failed to clear.FTNz-Gave up on %s after %d seconds, kept it as %s)
rQ rZ r ry rz st_mtimer{ QUARANTINE_AFTER_SECONDSr
FAILED_SUFFIXr5 rf r )r r ager s r r z IncidentCollector._quarantine s u::T\ ) )5 )++ 88CC 44 ) ) )5,,um44 ?5 ; J L
ts -A
AAc | d | j t | dS # t $ r+}t
d|j | Y d}~nd}~ww xY w| |t }|(| j
t | n&t
d|j |j dS )zDelete a stored batch, reporting whether it is gone.
Emptying one we cannot delete would mean writing through a path the
site owns, so it is retired under a name we never collect instead.
T)
missing_okzFailed to delete %s: %sNz0Could not delete %s, kept the stored batch as %sF) unlinkrZ r rQ r{ r5 rf r r
STORED_SUFFIXr r6 )r rl rn r s r r zIncidentCollector._discard s K D 1 1 1 L ]!3!3 4 4 44 K K K LL2M4F J J J J J J J J K
,,}m<< ? L S / / 0 0 0 0 NNB "
us =A
A6 !A11A6c t j |j }|j S # t $ r-}t
d|j || Y d }~d S d }~ww xY w)Nz.Failed to get username for uid=%d, site %s: %s)pwdgetpwuiduidpw_namere r5 rf )r r[ user_inforn s r rb z$IncidentCollector._get_site_username ss
TX..I $ $ LL@
44444 s "
A"AArv incident_file_namec ^ g }t t }d}t 5 }|D ]} | dd }
| d p| dd } | j |
| ||
| f \ } }
| s"t d||
|dz
}|j |j ||j
d }t | ||
}| | ||
| fxx dz
cc< d d d n # 1 swxY w Y |s t
d || g S t | } t | n:# t $ r- t d t% | |d
w xY w| D ]5\ \ }
} }t) | D ] }| j |
| 6t
d|t% | t% | t% | z
| |S )Nr r? unknown REMOTE_ADDRr@ )rA z#Rate limit exceeded for site %s: %sr+ )domain site_pathrk user_id)
geo_readerz5Processed file %s: 0 stored, 0 aggregated, %d droppedzKFailed to store %d incident(s) from %s, keeping the file for the next cycleT)exc_infoz7Processed file %s: %d stored, %d aggregated, %d dropped)r r4 r getrV rI r5 r6 r docrootr r
r0 rg r r re rf r1 r/ rangerL )r rv r[ rk r incidents_to_insertaccepted
dropped_countr incidentr? r@ allowedreason site_info
incident_data
aggregatedcountr= s r r z)IncidentCollector._process_file_incidents* s ! +C 0 0
" 6 % !
6 !
6",,y)<< &ll= 9 9 X\\!9> > #'"3"D"D $g{%; < #E # # NN=
"Q&M #k!% ( #x !4 iJ! ! !
$**=999';/000A50000C!
6" 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6H # KKG"
I-.ABB
+J 7 7 7 7 LL&'(("
.6^^-=-= H H ) "WkE5\\
H
H!11';GGGG
H E
OO # $ $s: 6
s C"DD DE! !7F)N)T) rM rN rO rP r r r rS r ro rt classmethodr ra recompiler r rQ rc r staticmethodr r r r rb dictr r# r r rU rU s ' '%84%? ' ' ' '" )-?# ?#?# "&?#
?# ?# ?# ?#H )- ' 'F| ' "& '
' ' ' 'B ! 4 ! DJ ! ! ! [! H BJ: M =$ =4 = = = [ =9 9 * 9
"& 9
9 9 9 9v $+ 2
B
B
B
B
B \
BD # $+ , $ 2d t 4 v #* T:T T * T
T
T T T T T Tr rU ) rP loggingry r statr| r r pathlibr collectionsr defence360agent.model.wordpressr defence360agent.wordpress.clir )defence360agent.wordpress.incident_parserr (defence360agent.model.wordpress_incidentr r r
r getLoggerrM r5 r r r r r rU r# r r <module>r sw 7 7
# # # # # # 2 2 2 2 2 2 6 6 6 6 6 6 H H H H H H
8 $ $ &
#
Y# Y# Y# Y# Y# Y# Y# Y#xw w w w w w w w w wr defence360agent/wordpress/__pycache__/incident_collector.cpython-311.pyc 0000644 0000000 0000000 00000060036 00000000000 023360 0 ustar
r_j,S d Z ddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z ddl m
Z
ddlmZ ddlmZ ddlmZmZmZmZ ej e Zd Zd
Zd Z d Z G d
d Z G d d Z dS )z1Collector for WordPress CVE protection incidents. N)Path) defaultdict)WPSite) get_data_dir)IncidentFileParser)aggregate_incident_dicts bulk_create_wordpress_incidentsbuild_incident_dictcountry_readerz.processing.php z .failed.phpz .stored.phpc p e Zd ZdZ ddededefdZd Z dd ed ed
edee ef fdZ
d ed efdZ dS )IncidentRateLimitera
Rate limiter to prevent DoS attacks via incident flooding.
Implements per-rule-per-IP rate limiting as per spec:
- Maximum 100 incidents for each rule from the same IP within 15 minutes
Memory-optimized implementation with bounded entry count using LRU eviction.
d r ' max_incidents_per_rule_per_iptime_window_secondsmax_unique_entriesc || _ || _ || _ t t | _ d| _ t j | _ dS )aI
Initialize the rate limiter.
Args:
max_incidents_per_rule_per_ip: Max incidents per rule per IP (default: 100)
time_window_seconds: Time window in seconds (default: 900 = 15 minutes)
max_unique_entries: Max unique (rule_id, IP) combinations to track (default: 10000)
< N) max_per_rule_per_ip time_windowr r listincident_timescleanup_intervaltime last_cleanup)selfr r r s a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/incident_collector.py__init__z IncidentRateLimiter.__init__5 sK $A ."4 *$ / / " IKK c ~ t j }|| j z
g }| j D ]5\ }} fd|D }|r || j |< | | 6|D ]
}| j |= t | j | j k rt | j d }t dt | j t | j dz z
}|d| D ]
\ }}| j |= t d| j | || _ dS )zHRemove records older than the time window and enforce max entries limit.c g | ]
}|k | S r# .0tscutoffs r
<listcomp>z<IncidentRateLimiter._cleanup_old_records.<locals>.<listcomp>V ===Rfbr c 2 | d r| d d ndS )N r r# )xs r <lambda>z:IncidentRateLimiter._cleanup_old_records.<locals>.<lambda>e s 1 4ad1gg1 r )keyr+ g?NzARate limiter exceeded max entries (%d), removed %d oldest entries)
r r r itemsappendlenr sortedmaxintloggerwarningr )
r nowkeys_to_deleter.
timestampsrecententries_by_age
num_to_remove_r' s
@r _cleanup_old_recordsz(IncidentRateLimiter._cleanup_old_recordsM s ikkt'' # 2 8 8 : : + +OC====:===F
++1#C(( %%c****! ) )C#C(( t" # #d&= = = ##))++44 N D'((3t/F/L+M+MM M ) - 8
-
-Q',, NN'
r r rule_id attacker_ippendingreturnc
t j | j z
| j k r| t j }|| j z
||f}|| j v rB| j | }
fd|D }|r|| j |< t
| }n
| j |= d}nd}||z
}|| j k r#| j dz } dd| d| d| d| j d | d
fS d S ) a
Check if adding an incident would exceed rate limits.
Args:
rule_id: Rule identifier
attacker_ip: IP address of the attacker
pending: Incidents already accepted in the current batch but not
recorded yet, so one file cannot exceed the limit on its own
Returns:
Tuple of (allowed: bool, reason: str)
c g | ]
}|k | S r# r# r$ s r r( z8IncidentRateLimiter.check_rate_limit.<locals>.<listcomp> r) r r r Fz Rate limit exceeded for rule z from IP z: /z within z minutes)TOK)r r r r> r r r1 r ) r r? r@ rA r7 r. r9 r: recent_countwindow_minutesr' s @r check_rate_limitz$IncidentRateLimiter.check_rate_limity sP 9;;* *T-B B B % % ' ' 'ikkt'' $ $% % % ,S1J====:===F
!+1#C( "6{{ ', L 43 3 3 ! - 3N1G 1 1#1 1$1 1'+'?1 1 '1 1 1
zr c t j }||f}|| j vr
|g| j |< dS | j | }t | | j k r| d | | dS )z
Record that an incident was added.
Args:
rule_id: Rule identifier
attacker_ip: IP address
r N)r r r1 r popr0 )r r? r@ r7 r. r9 s r record_incidentz#IncidentRateLimiter.record_incident s ikk $ d) ) )(+uD $ $ $ ,S1J:$":::q!!! c " " " " "r N)r r r )r ) __name__
__module__ __qualname____doc__r4 r r> strtupleboolrI rL r# r r r r + s .1#&"' ( ('*( !( ( ( ( (0* * * Z >?5 55),57:5 tSy 5 5 5 5n#s # # # # # # #r r c
e Zd ZdZd dedz fdZ d!dededefd Z d!d
ee dedefd Z
e d e dee fd
Z
ej d Ze de defd Zdededz dedefdZde de dz fdZede defd Zde dede dz fdZde defdZde defdZdededz fd Zd ee dededz d edef
d Z dS )"IncidentCollectorzM
Collect and persist WordPress incidents from plugin incident files.
N rate_limiterc | |p
t | _ t | _ t | _ dS )z
Initialize the incident collector.
Args:
rate_limiter: Optional rate limiter (creates default if not provided)
N)r rV r parserset_failed)r rV s r r zIncidentCollector.__init__ s6 ) A,?,A,A(** "% r Tsitedelete_after_processingrB c K g } t | d{V }t d|| | s t d| g S | | }t d|| |s t d| g S t dt | | | | }|D ]5}| |||| d{V }| | 6n3# t $ r&} t
d|| Y d} ~ nd} ~ ww xY wt dt | | |S ) ab
Collect incidents from a single WordPress site.
Args:
site: WordPress site to collect incidents from
ruleset_version: Version of the ruleset being used
delete_after_processing: Whether to delete incident files after processing
Returns:
List of collected Incident objects
Nz Data directory for site %s: %sz)Data directory does not exist for site %s Incident files for site %s: %sz#No incident files found for site %sz%Found %d incident file(s) for site %sz*Error collecting incidents for site %s: %sz$Collected %d incident(s) for site %s) r r5 debugexists_get_incident_filesr1 _get_site_username
_process_fileextend Exceptionerrorinfo)
r r[ r\ collected_incidentsdata_dirincident_filesusername
incident_filefile_incidentses
r collect_incidents_for_sitez,IncidentCollector.collect_incidents_for_site s !% )$ / ///////H LL94 J J J??$$
H$OOO ! 5 5h ? ?N LL0$
"
BDIII LL7N##
..t44H!/
;
;
'+'9'9! + ( ( " " " " " " $**>::::
; LL<
2 # $ $
#"s& A!D/ (AD/ 8A6D/ /
E 9 EE sitesc K g }|D ]3}| || d{V }| | 4|r6t dt | t | |S )a
Collect incidents from multiple WordPress sites.
Args:
sites: List of WordPress sites
delete_after_processing: Whether to delete incident files after processing
Returns:
List of collected Incident objects
Nz2Collected %d WordPress incident(s) from %d site(s))ro rd r5 rg r1 )r rp r\ all_collected_incidentsr[ site_incidentss r collect_incidents_for_sitesz-IncidentCollector.collect_incidents_for_sites s #% ; ;D#'#B#B'$ $ N
$ * *> : : : : " KKD+,,E
'&r ri c |dz }t d|| | r| s t d| g S g }| D ]k} t j | }n# t $ r Y $w xY wt j |j
r*| | r| | lt d|| |S )z
Get all incident files in the incidents directory.
Args:
data_dir: Path to the imunify-security data directory
Returns:
List of incident file paths
incidentsz#Incidents directory for site %s: %sz.Incidents directory does not exist for site %sr^ )
r5 r_ r` is_diriterdiroslstatOSError stat_moduleS_ISREGst_mode_is_incident_filer0 )clsri
incidents_dirrj fsts r ra z%IncidentCollector._get_incident_files< s0 !;.
18]
##%% ]-A-A-C-C LL@(
I &&(( ) )A
Xa[[
"2:..
)33H3H3K3K
) %%a((( ,h
s B
B"!B"z/^\d{4}-\d{2}-\d{2}-\d{2}(?:\.processing)?\.php$ file_pathc Z t | j |j S )a3
Check if a file is an incident file based on naming pattern.
Args:
file_path: Path to the file to check
Returns:
True if file matches pattern yyyy-mm-dd-hh.php, with or without
the suffix marking a batch left behind by an earlier cycle
)rS
_FILE_PATTERNmatchname)r r s r r z#IncidentCollector._is_incident_filee s% C%++IN;;<<<r rk c K |r| | }|g S | j | }|)| j t | g S |s9t d|j |r| | g S t
dt | |j | | ||||j }|r| | |S # t $ rW}|r'| j t | t d|j || g cY d }~S d }~ww xY w)Nz No valid incidents in file %sz)Parsed %d incident(s) from %s for site %sz1Error processing incident file %s for site %s: %s) _take_asiderX
parse_filerZ addrQ r5 r6 r _discardr_ r1 _process_file_incidentsre rf )r rl r[ rk r\ rv rh rn s r rc z IncidentCollector._process_files s 2 &
$ 0 0 ? ?
( I ..}==I ]!3!3444
3!& + 1MM-000 LL;I "
#'">"> " # # '
-
m,,,& & &
5 ]!3!3444 LLC "
IIIIII s1 D AD $:D A$D
E%A E E% E%rl c |j t r| | rdS |S | |j dt d t z }| r,| | r| | sdS | | t j
|dd |S )a Move the file out of the plugin's way before reading it.
Returns None when an earlier batch is still pending under the aside
name; that batch is processed in its own turn and the fresh file waits
for the next cycle rather than overwriting it.
N.phpF)follow_symlinks) r endswithPROCESSING_SUFFIX _quarantine with_namer1 r` _pendingrenamery utime)r rl asides r r z IncidentCollector._take_aside s & &'8 9 9 !
..
t '' ~#f++ ~ .1B B
<<>> dmmE 2 2 ##E**
t U### e4444 r r c t j | }n# t $ r Y dS w xY wt j |j o
|j dk S )zWhether an aside still holds a batch waiting to be stored.
Anything the site put there that is not a regular file is not one,
and the rename replaces it.
Fr )ry rz r{ r| r} r~ st_size)r r s r r zIncidentCollector._pending sV % BB 55 "2:..A2:>As
%%pathsuffixc |j }t dfD ]1}| | r|dt | } n2| ||z } | | n9# t $ r,}t d|j | Y d}~dS d}~ww xY w| j
t | |S )zGive a batch a name the collector will not pick up again.
Renaming touches the name, never what it points at, so it stays safe
in a directory the site owns.
r NzFailed to retire %s: %s) r r r r1 r r r{ r5 rf rZ discardrQ )r r r stemknownretiredrn s r _retirezIncidentCollector._retire s y'0 E}}U##
Ms5zzkM*
.. // KK LL2DIq A A A44444
SYY'''s A2 2
B(<!B##B(c \ t | | j vrdS t j t j | j z
}n# t $ r Y dS w xY w|t k rdS | |t }|dS t d|j ||j dS )z@Retire an aside this process has read and still failed to clear.FTNz-Gave up on %s after %d seconds, kept it as %s)
rQ rZ r ry rz st_mtimer{ QUARANTINE_AFTER_SECONDSr
FAILED_SUFFIXr5 rf r )r r ager s r r z IncidentCollector._quarantine s u::T\ ) )5 )++ 88CC 44 ) ) )5,,um44 ?5 ; J L
ts -A
AAc | d | j t | dS # t $ r+}t
d|j | Y d}~nd}~ww xY w| |t }|(| j
t | n&t
d|j |j dS )zDelete a stored batch, reporting whether it is gone.
Emptying one we cannot delete would mean writing through a path the
site owns, so it is retired under a name we never collect instead.
T)
missing_okzFailed to delete %s: %sNz0Could not delete %s, kept the stored batch as %sF) unlinkrZ r rQ r{ r5 rf r r
STORED_SUFFIXr r6 )r rl rn r s r r zIncidentCollector._discard s K D 1 1 1 L ]!3!3 4 4 44 K K K LL2M4F J J J J J J J J K
,,}m<< ? L S / / 0 0 0 0 NNB "
us =A
A6 !A11A6c t j |j }|j S # t $ r-}t
d|j || Y d }~d S d }~ww xY w)Nz.Failed to get username for uid=%d, site %s: %s)pwdgetpwuiduidpw_namere r5 rf )r r[ user_inforn s r rb z$IncidentCollector._get_site_username ss
TX..I $ $ LL@
44444 s "
A"AArv incident_file_namec ^ g }t t }d}t 5 }|D ]} | dd }
| d p| dd } | j |
| ||
| f \ } }
| s"t d||
|dz
}|j |j ||j
d }t | ||
}| | ||
| fxx dz
cc< d d d n # 1 swxY w Y |s t
d || g S t | } t | n:# t $ r- t d t% | |d
w xY w| D ]5\ \ }
} }t) | D ] }| j |
| 6t
d|t% | t% | t% | z
| |S )Nr r? unknown REMOTE_ADDRr@ )rA z#Rate limit exceeded for site %s: %sr+ )domain site_pathrk user_id)
geo_readerz5Processed file %s: 0 stored, 0 aggregated, %d droppedzKFailed to store %d incident(s) from %s, keeping the file for the next cycleT)exc_infoz7Processed file %s: %d stored, %d aggregated, %d dropped)r r4 r getrV rI r5 r6 r docrootr r
r0 rg r r re rf r1 r/ rangerL )r rv r[ rk r incidents_to_insertaccepted
dropped_countr incidentr? r@ allowedreason site_info
incident_data
aggregatedcountr= s r r z)IncidentCollector._process_file_incidents* s ! +C 0 0
" 6 % !
6 !
6",,y)<< &ll= 9 9 X\\!9> > #'"3"D"D $g{%; < #E # # NN=
"Q&M #k!% ( #x !4 iJ! ! !
$**=999';/000A50000C!
6" 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6 " 6H # KKG"
I-.ABB
+J 7 7 7 7 LL&'(("
.6^^-=-= H H ) "WkE5\\
H
H!11';GGGG
H E
OO # $ $s: 6
s C"DD DE! !7F)N)T) rM rN rO rP r r r rS r ro rt classmethodr ra recompiler r rQ rc r staticmethodr r r r rb dictr r# r r rU rU s ' '%84%? ' ' ' '" )-?# ?#?# "&?#
?# ?# ?# ?#H )- ' 'F| ' "& '
' ' ' 'B ! 4 ! DJ ! ! ! [! H BJ: M =$ =4 = = = [ =9 9 * 9
"& 9
9 9 9 9v $+ 2
B
B
B
B
B \
BD # $+ , $ 2d t 4 v #* T:T T * T
T
T T T T T Tr rU ) rP loggingry r statr| r r pathlibr collectionsr defence360agent.model.wordpressr defence360agent.wordpress.clir )defence360agent.wordpress.incident_parserr (defence360agent.model.wordpress_incidentr r r
r getLoggerrM r5 r r r r r rU r# r r <module>r sw 7 7
# # # # # # 2 2 2 2 2 2 6 6 6 6 6 6 H H H H H H
8 $ $ &
#
Y# Y# Y# Y# Y# Y# Y# Y#xw w w w w w w w w wr defence360agent/wordpress/__pycache__/incident_parser.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000015455 00000000000 023632 0 ustar
r_j d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ej
e Z G d d Z
dS )z+Parser for WordPress plugin incident files. N)Path)
open_nofollowc
e Zd ZdZededee dz fd Zede de
dededz fd Z ed e de
dededz fd
Z e
d edefd ZdS )
IncidentFileParsera'
Parse incident files written by the WordPress plugin.
These files have format:
<?php __halt_compiler();
#{base64-encoded JSON data for incident}
#{base64-encoded JSON data for incident}
...
File pattern: wp-content/imunify-security/incidents/yyyy-mm-dd-hh.php
file_pathreturnNc g } t t | 5 }t j t j | dd 5 }t |d D ]G\ }}| }| ||| }|| | H ddd n # 1 swxY w Y ddd n # 1 swxY w Y n4# t $ r'}t d|| Y d}~dS d}~ww xY w|S )a Parse an incident file, or None when it could not be read.
A file that could not be read is not an empty one: the caller keeps
it for the next cycle instead of discarding a batch it never saw.
The file format is:
- First line: <?php __halt_compiler();
- Following lines: #{base64-encoded JSON}
Opens with O_NOFOLLOW to prevent reading arbitrary files if
the incident file was replaced with a symlink.
rutf-8)encoding Nz"Error reading incident file %s: %s) r strosfdopendup enumeratestrip
_process_lineappend Exceptionloggererror) clsr incidentsfdfline_numlineincidentes ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/incident_parser.py
parse_filez IncidentFileParser.parse_file s s9~~..
7"Yrvbzz3AAA 7Q*3Aq// 7 7$ #zz||##4T8Y#O#O#/ % , ,X 6 6 6 77 7 7 7 7 7 7 7 7 7 7 7 7 7 7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7 LL4
44444
s_ C *C
AB0$ C0B4 4C7B4 8C; C C C C C
D C??Dr r c > |sdS | d r#t d||j dS | d s,t d||j |dd dS |dd }| ||| S )aD
Process a single line from an incident file.
Args:
line: The line content (already stripped)
line_num: Line number for logging
file_path: Path to the file being processed
Returns:
Parsed incident dictionary or None if line should be skipped
Nz<?phpz!Skipping PHP header line %d in %s#z&Line %d in %s doesn't start with #: %s2 r
)
startswithr debugname_process_encoded_line)r r r r encoded_datas r! r z IncidentFileParser._process_line? s 4 ??7 # # LL3
4 s## LL8SbS
4 ABBx (( xKKK r* c ( t j | }| d }t j | }t |t s,t d||j |dd dS |
| s7t d||j | d dS |S # t t j
f$ r-}t d||j | Y d}~dS d}~ww xY w)aM
Decode base64-encoded JSON data from an incident line.
Args:
encoded_data: Base64-encoded JSON string
line_num: Line number for logging
file_path: Path to the file being processed
Returns:
Parsed incident dictionary or None if decoding/parsing fails
r z&Line %d in %s is not a JSON object: %sNd z"Line %d in %s has no usable ts: %rtsz,Failed to decode base64 on line %d in %s: %s)base64 b64decodedecodejsonloads
isinstancedictr warningr( _has_valid_timestampgetr JSONDecodeErrorr )r r* r r
decoded_bytes decoded_strr r s r! r) z(IncidentFileParser._process_encoded_linei s+ " ,\ : :M'..w77Kz+..H h--
< N % t++H55
8 N LL&& tO4/0 LL>
44444 s% A<C A
C C D$"D Dr c t | d }n # t t t f$ r Y dS w xY wt j | o|dk S )zThe timestamp decides the aggregation window, so it must be usable.
json.loads accepts Infinity and NaN, which survive a bare > 0 check
and blow up when the window is computed.
r. Fr )floatKeyError TypeError
ValueErrormathisfinite)r r. s r! r7 z'IncidentFileParser._has_valid_timestamp s\ x~&&BB)Z0 55 }R +R!V+s 33)__name__
__module__ __qualname____doc__ classmethodr listr5 r" r intr r) staticmethodboolr7 r+ r! r r s
4 DJ,= [ D 'L'L"%'L26'L
'L 'L 'L ['LR . .*-.:>.
. . . [.`
,t
,
,
,
, \
,
,
,r+ r )rF r/ r2 loggingrA r pathlibr defence360agent.utils.fd_opsr getLoggerrC r r rL r+ r! <module>rQ s 1 1
6 6 6 6 6 6 8 $ $V, V, V, V, V, V, V, V, V, V,r+ defence360agent/wordpress/__pycache__/incident_parser.cpython-311.pyc 0000644 0000000 0000000 00000015455 00000000000 022673 0 ustar
r_j d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ej
e Z G d d Z
dS )z+Parser for WordPress plugin incident files. N)Path)
open_nofollowc
e Zd ZdZededee dz fd Zede de
dededz fd Z ed e de
dededz fd
Z e
d edefd ZdS )
IncidentFileParsera'
Parse incident files written by the WordPress plugin.
These files have format:
<?php __halt_compiler();
#{base64-encoded JSON data for incident}
#{base64-encoded JSON data for incident}
...
File pattern: wp-content/imunify-security/incidents/yyyy-mm-dd-hh.php
file_pathreturnNc g } t t | 5 }t j t j | dd 5 }t |d D ]G\ }}| }| ||| }|| | H ddd n # 1 swxY w Y ddd n # 1 swxY w Y n4# t $ r'}t d|| Y d}~dS d}~ww xY w|S )a Parse an incident file, or None when it could not be read.
A file that could not be read is not an empty one: the caller keeps
it for the next cycle instead of discarding a batch it never saw.
The file format is:
- First line: <?php __halt_compiler();
- Following lines: #{base64-encoded JSON}
Opens with O_NOFOLLOW to prevent reading arbitrary files if
the incident file was replaced with a symlink.
rutf-8)encoding Nz"Error reading incident file %s: %s) r strosfdopendup enumeratestrip
_process_lineappend Exceptionloggererror) clsr incidentsfdfline_numlineincidentes ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/incident_parser.py
parse_filez IncidentFileParser.parse_file s s9~~..
7"Yrvbzz3AAA 7Q*3Aq// 7 7$ #zz||##4T8Y#O#O#/ % , ,X 6 6 6 77 7 7 7 7 7 7 7 7 7 7 7 7 7 7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7 LL4
44444
s_ C *C
AB0$ C0B4 4C7B4 8C; C C C C C
D C??Dr r c > |sdS | d r#t d||j dS | d s,t d||j |dd dS |dd }| ||| S )aD
Process a single line from an incident file.
Args:
line: The line content (already stripped)
line_num: Line number for logging
file_path: Path to the file being processed
Returns:
Parsed incident dictionary or None if line should be skipped
Nz<?phpz!Skipping PHP header line %d in %s#z&Line %d in %s doesn't start with #: %s2 r
)
startswithr debugname_process_encoded_line)r r r r encoded_datas r! r z IncidentFileParser._process_line? s 4 ??7 # # LL3
4 s## LL8SbS
4 ABBx (( xKKK r* c ( t j | }| d }t j | }t |t s,t d||j |dd dS |
| s7t d||j | d dS |S # t t j
f$ r-}t d||j | Y d}~dS d}~ww xY w)aM
Decode base64-encoded JSON data from an incident line.
Args:
encoded_data: Base64-encoded JSON string
line_num: Line number for logging
file_path: Path to the file being processed
Returns:
Parsed incident dictionary or None if decoding/parsing fails
r z&Line %d in %s is not a JSON object: %sNd z"Line %d in %s has no usable ts: %rtsz,Failed to decode base64 on line %d in %s: %s)base64 b64decodedecodejsonloads
isinstancedictr warningr( _has_valid_timestampgetr JSONDecodeErrorr )r r* r r
decoded_bytes decoded_strr r s r! r) z(IncidentFileParser._process_encoded_linei s+ " ,\ : :M'..w77Kz+..H h--
< N % t++H55
8 N LL&& tO4/0 LL>
44444 s% A<C A
C C D$"D Dr c t | d }n # t t t f$ r Y dS w xY wt j | o|dk S )zThe timestamp decides the aggregation window, so it must be usable.
json.loads accepts Infinity and NaN, which survive a bare > 0 check
and blow up when the window is computed.
r. Fr )floatKeyError TypeError
ValueErrormathisfinite)r r. s r! r7 z'IncidentFileParser._has_valid_timestamp s\ x~&&BB)Z0 55 }R +R!V+s 33)__name__
__module__ __qualname____doc__ classmethodr listr5 r" r intr r) staticmethodboolr7 r+ r! r r s
4 DJ,= [ D 'L'L"%'L26'L
'L 'L 'L ['LR . .*-.:>.
. . . [.`
,t
,
,
,
, \
,
,
,r+ r )rF r/ r2 loggingrA r pathlibr defence360agent.utils.fd_opsr getLoggerrC r r rL r+ r! <module>rQ s 1 1
6 6 6 6 6 6 8 $ $V, V, V, V, V, V, V, V, V, V,r+ defence360agent/wordpress/__pycache__/incident_sender.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000035113 00000000000 023607 0 ustar
r_jY* d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
m Z ddl m
Z
mZ ddlmZ dd lmZ dd
lmZ dd lmZmZ ej e Z G d d
ZdS )z3Send WordPress incidents to the correlation server. N)datetime)partial) monotonic)MappingProxyType)AnyMapping)SensorWordpressIncidentList) MessageSink) delivery_ack) get_unsent_wordpress_incidents#settle_wordpress_incidents_reportedc X e Zd ZdZdZdZddZdedeee f fdZ
d ede e fd
Z d e
dz defd Zd e
dz d
e e defdZ ei fd e
de e deeef fdZdedeeef ddfdZdeddfdZdedeeef ddfdZddZdee fdZdS )IncidentSenderai
Send WordPress incidents to the correlation server.
WordPress incidents are already in the Incident table (visible to UI).
This class sends them to correlation via Reportable messages, which are
handled by the SendToServer/SendToServerNATS/SendToServerFGW plugins.
Those plugins queue a message rather than deliver it, and a send round
can lose its batch or be force-cancelled mid-publish while the agent
shuts down. Each incident therefore keeps a count of the occurrences the
transport has not acknowledged, and every collection cycle sends whatever
is still outstanding.
i i, returnNc i | _ d S N) _inflightselfs ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/incident_sender.py__init__zIncidentSender.__init__/ s
BD incidentc t d| | d pi }t | d pd }t | }|r't j | d nd}i d|d|d| d d
| d
pd d | d d
| d d| d d| d pdd| d pdd| d pdd| d pdd| d pdd| d pdd | d r| d d k nd d | d pdd!| d" pdd#| | | d$ pd| d% pd| d& pd| d' pd|d(S ))aJ
Prepare an incident for sending to the correlation server.
WordPress incidents use extra_info JSON field to store plugin-specific data.
Args:
incident: WordpressIncident dictionary (with extra_info populated)
Returns:
Dictionary formatted for correlation server
z&Preparing incident for correlation: %s
extra_info timestampr z%Y-%m-%d dt plugin_idpluginruleunknownnamemessage descriptionseverity attackers_ipabuserdomainretriesunsent_retries uri request_uri
user_agenthttp_user_agent http_methodrequest_methoduser_logged_intrueN file_path site_pathuserusernametagtargetslugversionmode)r: r; r< r= details) loggerinfogetfloatintr
fromtimestampstrftime _build_tags)r r extratimestamp_valuer r s r !_prepare_incident_for_correlationz0IncidentSender._prepare_incident_for_correlation3 s <hGGG ll<006B "'x||K'@'@'EA!F!F((
H "? 3 3 < <Z H H H
"
h//
HLL((5I
HLL((
x||M22
Z00
HLL 2 2 8b
hll8,,2
x||$455:
599]++1r
%))$566<"
599%566<"!
"
yy)** eii(8 9 9V C C'
(
;//52)
*
EIIj))/R+
,
4##E**-
0 ii))/RIIf%%+ yy++1rIIf%%+ 9
r rG c : ddg}| d r| |d | d r | d|d | d r | d|d |S )N wordpresscver: target_r= mode_)rA append)r rG tagss r rF zIncidentSender._build_tagsm s U# 99U & KKe % % % 99X 5 KK3%/33 4 4 4 99V 1 KK/f
// 0 0 0 r sinkc K | t d dS | t | j | }| || d{V S )a Send every incident the server has not acknowledged.
Runs once per collection cycle, after the freshly collected
incidents were stored, so one pass covers both the new rows and the
ones whose earlier message never left the agent.
N+No sink provided, skipping incident sendingr )limit exclude_ids)r? warning_expire_inflightr MAX_INCIDENTS_PER_CYCLE
_inflight_idssend_incidents)r rQ incidentss r send_pending_incidentsz%IncidentSender.send_pending_incidentsy s < NNH I I I1 2. **,,
((y999999999r r[ c K | t d dS t | dk r t d dS t dt | fd|D }t d |D }t
j | D ]I} ||d t j
|t | D d{V Jt | S ) aC
Send WordPress incidents to the correlation server.
Since incidents are already in the WordpressIncident table (visible to UI),
we just need to send them to correlation.
Args:
incidents: List of incidents to send
Returns:
Number of incidents sent
NrS r z No incidents to send, skippingz*Sending %d incidents to correlation serverc : g | ]} | S )rI ).0r r s r
<listcomp>z1IncidentSender.send_incidents.<locals>.<listcomp> s7
2 28 < <
r c f g | ].}| d | d pdf/S )idr+ r, )rA )r` r s r ra z1IncidentSender.send_incidents.<locals>.<listcomp> sK
d##X\\2B%C%C%HqI
r c i | ]
\ }}||| S r r_ )r` incident_id occurrencess r
<dictcomp>z1IncidentSender.send_incidents.<locals>.<dictcomp> s2 0 [ #. /..r ) r? rV lendebugr@ iterr batched _send_batch itertoolsislice)r rQ r[ correlation_batchpendingbatchs ` r rZ z IncidentSender.send_incidents si < NNH I I I1 y>>Q LL9 : : :1 8#i..
%
)
189JKK E"" 4=4D U5 5
$%%%r ro reportedc K t dt | t dt j |d t | }t
j t j t | |gd
}||d< | || |
| d{V t d t | | dS # t $ r6}| | t d
| d}~ww xY w) zSend a batch of incidents to correlation server.
Uses SensorIncidentList Reportable message which is sent to
correlation via the SendToServer/SendToServerNATS/SendToServerFGW
plugins.
z3Sending batch of %d incidents to correlation serverzCorrelation batch json: %s )indentT) sort_keys
message_idNzCQueued %d wordpress incident(s) for correlation server (message %s)z"Failed to queue incident batch: %s)r? r@ rh jsondumpsr hashlibsha1sorteditemsencode hexdigest_watchprocess_message Exception_unwatcherror)r rQ ro rr r$ rw es r rl zIncidentSender._send_batch s A ! " "
( J( 3 3 3
..?@@
\ J(())+<=
fhh
)++
!+ J))) &&w// / / / / / / / KK %&&
MM* % % % LL4
s 2AD8 8
E81E33E8rw c |sd S t | }|t | j z f| j |< t j |t | j || d S r ) dictr ACK_TIMEOUTr r registrywatchr
_on_delivered)r rw rr s r r zIncidentSender._watch sv F>> KK$* *&
z" ## D&
H = =
r c z | j |d t j | d S r )r popr r unwatch)r rw s r r zIncidentSender._unwatch s7 :t,,, %%j11111r c | j |d t | }t d| d S )Nz<Discounted %d wordpress incident(s) delivered to correlation)r r r
r? r@ )r rw rr settleds r r z IncidentSender._on_delivered sO
:t,,,5h?? J
r c N t fd| j D }|D ]m}| j | \ }}t j | t dt | || j
ndS )zqGive up on batches the transport never acknowledged, so their
incidents become eligible to be sent again.c , g | ]\ }\ }}|k |S r_ r_ )r` rw _deadlinenows r ra z3IncidentSender._expire_inflight.<locals>.<listcomp> s2
)
MQ3
r z]No delivery confirmation for %d wordpress incident(s) (message %s) in %ds, sending them againN) r r r} r r r r r? rV rh r )r expiredrw rr r r s @r rW z IncidentSender._expire_inflight s kk
-1^-A-A-C-C
" J .,,Z88KHa ! ) )* 5 5 5 NN;H
r c H d | j D S )Nc " h | ] \ }}|D ]}|
S r_ r_ )r` rr r re s r <setcomp>z/IncidentSender._inflight_ids.<locals>.<setcomp>& sC
! '
r )r valuesr s r rY z IncidentSender._inflight_ids% s1
#~ 4 4 6 6
r )r N)__name__
__module__ __qualname____doc__rX r r r strr rI listrF r
rC r\ rZ r r rl r r r rW setrY r_ r r r r s # KE E E E8
8
c3h 8
8
8
8
t
$s)
:t1C : : : : :(2& $&2&37:2& 2& 2& 2& 2&p '7&6r&:&: 2 22 :2 #s(# 2 2 2 2h
S0A
d
23 24 2 2 2 2
tCH~
$
(
s3x
r r ) r rz rm rx loggingr functoolsr timer typesr typingr r "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr
defence360agent.internalsr (defence360agent.model.wordpress_incidentr r
getLoggerr r? r r_ r r <module>r s@ 9 9 " " " " " " J J J J J J 9 9 9 9 9 9 2 2 2 2 2 2
8 $ $R
R
R
R
R
R
R
R
R
R
r defence360agent/wordpress/__pycache__/incident_sender.cpython-311.pyc 0000644 0000000 0000000 00000035113 00000000000 022650 0 ustar
r_jY* d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
m Z ddl m
Z
mZ ddlmZ dd lmZ dd
lmZ dd lmZmZ ej e Z G d d
ZdS )z3Send WordPress incidents to the correlation server. N)datetime)partial) monotonic)MappingProxyType)AnyMapping)SensorWordpressIncidentList) MessageSink) delivery_ack) get_unsent_wordpress_incidents#settle_wordpress_incidents_reportedc X e Zd ZdZdZdZddZdedeee f fdZ
d ede e fd
Z d e
dz defd Zd e
dz d
e e defdZ ei fd e
de e deeef fdZdedeeef ddfdZdeddfdZdedeeef ddfdZddZdee fdZdS )IncidentSenderai
Send WordPress incidents to the correlation server.
WordPress incidents are already in the Incident table (visible to UI).
This class sends them to correlation via Reportable messages, which are
handled by the SendToServer/SendToServerNATS/SendToServerFGW plugins.
Those plugins queue a message rather than deliver it, and a send round
can lose its batch or be force-cancelled mid-publish while the agent
shuts down. Each incident therefore keeps a count of the occurrences the
transport has not acknowledged, and every collection cycle sends whatever
is still outstanding.
i i, returnNc i | _ d S N) _inflightselfs ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/incident_sender.py__init__zIncidentSender.__init__/ s
BD incidentc t d| | d pi }t | d pd }t | }|r't j | d nd}i d|d|d| d d
| d
pd d | d d
| d d| d d| d pdd| d pdd| d pdd| d pdd| d pdd| d pdd | d r| d d k nd d | d pdd!| d" pdd#| | | d$ pd| d% pd| d& pd| d' pd|d(S ))aJ
Prepare an incident for sending to the correlation server.
WordPress incidents use extra_info JSON field to store plugin-specific data.
Args:
incident: WordpressIncident dictionary (with extra_info populated)
Returns:
Dictionary formatted for correlation server
z&Preparing incident for correlation: %s
extra_info timestampr z%Y-%m-%d dt plugin_idpluginruleunknownnamemessage descriptionseverity attackers_ipabuserdomainretriesunsent_retries uri request_uri
user_agenthttp_user_agent http_methodrequest_methoduser_logged_intrueN file_path site_pathuserusernametagtargetslugversionmode)r: r; r< r= details) loggerinfogetfloatintr
fromtimestampstrftime _build_tags)r r extratimestamp_valuer r s r !_prepare_incident_for_correlationz0IncidentSender._prepare_incident_for_correlation3 s <hGGG ll<006B "'x||K'@'@'EA!F!F((
H "? 3 3 < <Z H H H
"
h//
HLL((5I
HLL((
x||M22
Z00
HLL 2 2 8b
hll8,,2
x||$455:
599]++1r
%))$566<"
599%566<"!
"
yy)** eii(8 9 9V C C'
(
;//52)
*
EIIj))/R+
,
4##E**-
0 ii))/RIIf%%+ yy++1rIIf%%+ 9
r rG c : ddg}| d r| |d | d r | d|d | d r | d|d |S )N wordpresscver: target_r= mode_)rA append)r rG tagss r rF zIncidentSender._build_tagsm s U# 99U & KKe % % % 99X 5 KK3%/33 4 4 4 99V 1 KK/f
// 0 0 0 r sinkc K | t d dS | t | j | }| || d{V S )a Send every incident the server has not acknowledged.
Runs once per collection cycle, after the freshly collected
incidents were stored, so one pass covers both the new rows and the
ones whose earlier message never left the agent.
N+No sink provided, skipping incident sendingr )limit exclude_ids)r? warning_expire_inflightr MAX_INCIDENTS_PER_CYCLE
_inflight_idssend_incidents)r rQ incidentss r send_pending_incidentsz%IncidentSender.send_pending_incidentsy s < NNH I I I1 2. **,,
((y999999999r r[ c K | t d dS t | dk r t d dS t dt | fd|D }t d |D }t
j | D ]I} ||d t j
|t | D d{V Jt | S ) aC
Send WordPress incidents to the correlation server.
Since incidents are already in the WordpressIncident table (visible to UI),
we just need to send them to correlation.
Args:
incidents: List of incidents to send
Returns:
Number of incidents sent
NrS r z No incidents to send, skippingz*Sending %d incidents to correlation serverc : g | ]} | S )rI ).0r r s r
<listcomp>z1IncidentSender.send_incidents.<locals>.<listcomp> s7
2 28 < <
r c f g | ].}| d | d pdf/S )idr+ r, )rA )r` r s r ra z1IncidentSender.send_incidents.<locals>.<listcomp> sK
d##X\\2B%C%C%HqI
r c i | ]
\ }}||| S r r_ )r` incident_id occurrencess r
<dictcomp>z1IncidentSender.send_incidents.<locals>.<dictcomp> s2 0 [ #. /..r ) r? rV lendebugr@ iterr batched _send_batch itertoolsislice)r rQ r[ correlation_batchpendingbatchs ` r rZ z IncidentSender.send_incidents si < NNH I I I1 y>>Q LL9 : : :1 8#i..
%
)
189JKK E"" 4=4D U5 5
$%%%r ro reportedc K t dt | t dt j |d t | }t
j t j t | |gd
}||d< | || |
| d{V t d t | | dS # t $ r6}| | t d
| d}~ww xY w) zSend a batch of incidents to correlation server.
Uses SensorIncidentList Reportable message which is sent to
correlation via the SendToServer/SendToServerNATS/SendToServerFGW
plugins.
z3Sending batch of %d incidents to correlation serverzCorrelation batch json: %s )indentT) sort_keys
message_idNzCQueued %d wordpress incident(s) for correlation server (message %s)z"Failed to queue incident batch: %s)r? r@ rh jsondumpsr hashlibsha1sorteditemsencode hexdigest_watchprocess_message Exception_unwatcherror)r rQ ro rr r$ rw es r rl zIncidentSender._send_batch s A ! " "
( J( 3 3 3
..?@@
\ J(())+<=
fhh
)++
!+ J))) &&w// / / / / / / / KK %&&
MM* % % % LL4
s 2AD8 8
E81E33E8rw c |sd S t | }|t | j z f| j |< t j |t | j || d S r ) dictr ACK_TIMEOUTr r registrywatchr
_on_delivered)r rw rr s r r zIncidentSender._watch sv F>> KK$* *&
z" ## D&
H = =
r c z | j |d t j | d S r )r popr r unwatch)r rw s r r zIncidentSender._unwatch s7 :t,,, %%j11111r c | j |d t | }t d| d S )Nz<Discounted %d wordpress incident(s) delivered to correlation)r r r
r? r@ )r rw rr settleds r r z IncidentSender._on_delivered sO
:t,,,5h?? J
r c N t fd| j D }|D ]m}| j | \ }}t j | t dt | || j
ndS )zqGive up on batches the transport never acknowledged, so their
incidents become eligible to be sent again.c , g | ]\ }\ }}|k |S r_ r_ )r` rw _deadlinenows r ra z3IncidentSender._expire_inflight.<locals>.<listcomp> s2
)
MQ3
r z]No delivery confirmation for %d wordpress incident(s) (message %s) in %ds, sending them againN) r r r} r r r r r? rV rh r )r expiredrw rr r r s @r rW z IncidentSender._expire_inflight s kk
-1^-A-A-C-C
" J .,,Z88KHa ! ) )* 5 5 5 NN;H
r c H d | j D S )Nc " h | ] \ }}|D ]}|
S r_ r_ )r` rr r re s r <setcomp>z/IncidentSender._inflight_ids.<locals>.<setcomp>& sC
! '
r )r valuesr s r rY z IncidentSender._inflight_ids% s1
#~ 4 4 6 6
r )r N)__name__
__module__ __qualname____doc__rX r r r strr rI listrF r
rC r\ rZ r r rl r r r rW setrY r_ r r r r s # KE E E E8
8
c3h 8
8
8
8
t
$s)
:t1C : : : : :(2& $&2&37:2& 2& 2& 2& 2&p '7&6r&:&: 2 22 :2 #s(# 2 2 2 2h
S0A
d
23 24 2 2 2 2
tCH~
$
(
s3x
r r ) r rz rm rx loggingr functoolsr timer typesr typingr r "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr
defence360agent.internalsr (defence360agent.model.wordpress_incidentr r
getLoggerr r? r r_ r r <module>r s@ 9 9 " " " " " " J J J J J J 9 9 9 9 9 9 2 2 2 2 2 2
8 $ $R
R
R
R
R
R
R
R
R
R
r defence360agent/wordpress/__pycache__/plugin.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000260572 00000000000 021761 0 ustar
r_jI(
d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm Z m
Z
d dl m Z d dl
mZ d dlmZ d dlmZ d dlmZmZmZmZmZ d d lmZm Z d d
l m Z d d l m Z d d l!m"Z"m#Z#m$Z$m%Z% d d
lm&Z& d dl'm(Z( d dl)m*Z*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0 d dl1m2Z2m3Z3 d dl4m5Z5 d dl6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZA d dlBmCZCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZO d dlPmQZQ ejR eS ZTed ZUdZV e jW ZXdaYdZZdZ[de\fd Z]de\fd Z^de\fd Z_de\fd Z`deafd Zbd!Zcd"Zdd#Zedefe\e\e\f fd$Zgd%eadefe\eaf fd&Zhd%eade\fd'Zid%eade\fd(Zjd%eade\fd)Zk ed* Zld%ead+efd,Zmd-edendz fd.Zod/ Zpd0end1ejq denfd2Zrd1ejq d+efd3Zsd4e jt fd5Zudvd7evfd8Zwd9 Zxd: Zyd; Zzdeafd<Z{d= Z|d>e.fd?Z}d>e.de~fd@ZdA ZdB Z dwdCee. fdDZdEeve. fdFZdddGd>e.dHeadIend1ejq dz dJedz ddf dKZdddGd>e.dLend1ejq dz dJedz fdMZdddGd>e.dNend1ejq dz dJedz ddf
dOZdEeve. de~fdPZd>e.d1ejq dQeadRedSeddf dTZ dxdEeve. dUe
e.ejq eege d f dVeadWeadXe\ddf dYZdwdQeaddfdZZd-ed[e\ddfd\Z e jW Zdadyd]Zdyd^Zd_eaddfd`ZdEeve. ddfdaZd%eaddfdbZd%eaddfdcZdyddZdydeZdfeadgedeafdhZd>e.d1ejq dgedRedSeddf diZ dzdjevea dz ddfdkZdwdlZdm Zd>e.de\fdnZd>e.doe~de\fdpZdq Z G dr ds Z G dt due ZdS ){ N) defaultdict) AwaitableCallable) LooseVersion)cache)Path)
inactivity)MalwareScanScheduleInterval SystemConfigANTIVIRUS_MODEUserTypechoose_value_from_config)IndexWP_RULES) log_message)importer)open_dir_no_symlinks
open_nofollow rmtree_fdsafe_dir) Wordpress)
hosting_panel)get_wp_rules_dataget_wp_ruleset_version)
WordpressSiteWPSite)WPDisabledRule)cli telemetry)PLUGIN_VERSION_FILE) _validate_preset calculate_next_scan_timestamp$clear_get_cagefs_enabled_users_cacheensure_site_data_directory format_php_with_embedded_json get_imunify_package_versions
get_last_scanget_malware_historyprepare_plugin_configprepare_scan_data!write_plugin_data_file_atomically)
clear_manually_deleted_flag delete_site get_installed_sites_by_domainsget_outdated_sitesget_sites_for_userget_sites_to_adoptget_sites_to_install%get_sites_to_mark_as_manually_deletedget_installed_sitesinsert_installed_sites mark_site_as_manually_deletedupdate_site_identityupdate_site_version)setup_site_authenticationc 0 t j ddd S )Nz(imav.malwarelib.plugins.schedule_watcherget_user_schedule_config)modulenamedefault)r get U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/plugin.py _get_user_schedule_config_imavrC K s$ <9
' rA TFbalancedreturnc d t t j S # t $ r
t cY S w xY wN)boolr WAF_ENABLEDKeyError_LEGACY_WAF_FALLBACKr@ rA rB _get_global_waf_enabledrL c ? $I)*** $ $ $####$ //c d t t j S # t $ r
t cY S w xY wrG )rH r WAF_DEFAULTrJ rK r@ rA rB _get_waf_defaultrQ j rM rN c X t t j S # t $ r Y dS w xY w)NF)rH r SECURITY_PLUGIN_ENABLEDrJ r@ rA rB _get_security_plugin_enabledrT q s:
I5666 uus
))c d t t j S # t $ r
t cY S w xY w)uS Read WORDPRESS.ai_bot_protection from config, defaulting to False.
Returns _AI_BOT_PROTECTION_DEFAULT when the config key is missing
— e.g. the ai_bot_protection field hasn't rolled out to this
install's imunify360 yet, or a sibling package is still on an
older schema. Keeps the feature off in all ambiguous cases.
)rH r AI_BOT_PROTECTIONrJ _AI_BOT_PROTECTION_DEFAULTr@ rA rB _get_global_ai_bot_protectionrX | s? *I/000 * * *))))*rN c j t j } n# t $ r
t cY S w xY wt | S )u Read WORDPRESS.ai_bot_protection_preset from config, defaulting to
"balanced".
Two layers of safety: KeyError on a missing key (older schema, agent
upgrade in progress) and _validate_preset() on the value itself
(hand-edited override file, future preset rolled in via a sibling
package this version doesn't recognise). Both fall back to the same
canonical default so all layers — schema, agent, plugin — agree.
)r AI_BOT_PROTECTION_PRESETrJ !_AI_BOT_PROTECTION_PRESET_DEFAULTr! )raws rB $_get_global_ai_bot_protection_presetr] sF 10 1 1 100001 C s ##r> overridezglobal kill switchc T t t t fS )a Read the three server-wide WAF flags in one call.
Returns (security_plugin_enabled, global_waf_enabled, waf_default), each
guarded against a missing config key (schema version skew during an
agent/imunify-antivirus upgrade) the same way the individual accessors are.
)rT rL rQ r@ rA rB waf_global_snapshotr` s) %&& !! rA usernamec t s dt fS t dd| \ }}n%# t $ r t t
fcY S w xY w|t j k rt t
fS t | t fS )NF WORDPRESS waf_enabledra )
rL WAF_SOURCE_KILL_SWITCHr rJ rQ WAF_SOURCE_DEFAULTr
ROOTrH WAF_SOURCE_OVERRIDE)ra valuesources rB #waf_status_and_source_for_user_syncrl s " $ $ -,,,60
vv 6 6 6 !!#555556
!!#555 ;;+ ++s / AAc * t | \ }}|S rG )rl )ra enabled_s rB _is_waf_enabled_for_user_syncrp s 4X>>JGQ NrA c p K t j }| dt | d{V S )u3 Async wrapper — runs config file I/O in executor.N)asyncioget_running_looprun_in_executorrp )ra loops rB is_waf_enabled_for_userrv sR # % %D%% +X rA c r t dd| \ }}n# t $ r Y dS w xY w|t j k S )Nrc rd re F)r rJ r
rh )ra ro rk s rB $_user_has_explicit_waf_override_syncrx sY ,
66 uu X] ""s
&&zD/var/lib/cloudlinux-app-version-detector/components_versions.sqlite3 admin_configc t }|*t d t j dddfS || | S )z
Get user-specific schedule configuration with lazy import fallback.
Returns default values if imav.malwarelib is not available.
Nz@imav.malwarelib not available, returning default schedule configr )rC loggerdebugIntervalNONE)ra ry r; s rB _get_user_schedule_configr sU > ? ? ' N
}aA%% # #Hl ; ;;rA indexc t | }|dS t r | D ]
\ }}d|d< t t j r fd| D }|S )uI
Retrieve WordPress rules with ANTIVIRUS_MODE handling and global disable filtering.
In ANTIVIRUS_MODE, all rules are set to monitoring mode ("pass").
Globally disabled rules are filtered out entirely — they should not
appear in rules.php. Domain-specific disables are handled separately
via disabled-rules.php.
Args:
index: The Index object used to locate the wp-rules.zip file.
Returns:
The parsed wp-rules data with mode adjusted for ANTIVIRUS_MODE
and globally disabled rules removed, or None if rules cannot be loaded.
Npassmodec $ i | ] \ }}|v ||
S r@ r@ ).0cveparamsglobally_disableds rB
<dictcomp>z-get_updated_wp_rules_data.<locals>.<dictcomp> s5
V+++
+++rA )r r itemssetr get_global_disabled)r
rules_datar r r s @rB get_updated_wp_rules_datar s #5))Jt $%++-- $ $KC #F6NN N > @ @AA
) / / 1 1
rA c H t t j dS )z#Clear all WordPress-related caches.N)r# r clear_get_content_dir_cacher@ rA rB clear_cachesr s# (***#%%%%%rA r user_infoc t | }d |D }| D ]Dfd|D }|r1t |t }|| E|S )Nc i | ]}|g S r@ r@ )r paths rB r z site_search.<locals>.<dictcomp> s
.
.
.4dB
.
.
.rA c , g | ]} | |S r@ r@ )r r itemmatchers rB
<listcomp>z site_search.<locals>.<listcomp> s* MMM4t9L9LM$MMMrA )key)r0 maxlenappend)r r r
user_sitesresultmatching_sitesmost_specific_siter s ` @rB site_searchr s #I..J
.
.:
.
.
.F 4 4MMMMM:MMM 4!$^!=!=!= % & - -d 3 3 3 MrA c : K t | |j d {V }| dd }t |j | \ }}}}d } |t j k rt
|||| } t |j }
t |
|d } || | fS )N scan_datec P | d dk o| d | S )N
resource_typefile)
startswith)r r s rB <lambda>z)_get_scan_data_for_user.<locals>.<lambda>> s- 40F: * L # #D ) ) rA ) r' pw_namer? r r~ r r" r( r ) sinkr ry last_scanlast_scan_timeintervalhour day_of_month day_of_weeknext_scan_timemalware_historymalware_by_sites rB _get_scan_data_for_userr " s $D)*;<<<<<<<<I ]];55N 1J<1 1-HdL+ N8= 6 dL+
*)*;<<O " * * O >? ::rA semaphorec K |4 d {V | d {V n4# t $ r'}t d| Y d }~nd }~ww xY wd d d d {V d S # 1 d {V swxY w Y d S )NzTelemetry task failed: ) Exceptionr| error)coror es rB _send_telemetry_taskr E s+ 8 8 8 8 8 8 8 8 8JJJJJJJJ 8 8 8 LL6166 7 7 7 7 7 7 7 7 88 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8s5 A A
A AA AA
A'*A'
coroutinesc K | sdS t j | fd| D } t j | d{V dS # t $ r(}t d| Y d}~dS d}~ww xY w)zK
Process a list of telemetry coroutines with a concurrency limit.s
Nc T g | ]$}t j t | %S r@ )rr create_taskr )r r r s rB r z+process_telemetry_tasks.<locals>.<listcomp>U s?
0y A ABB
rA z Some telemetry tasks failed: )rr Semaphoregatherr r| r )r concurrencytasksr r s @rB process_telemetry_tasksr M s !+..I
E
:ne$$$$$$$$$$ : : : 8Q88999999999:s A
A3 A..A3c p K t t d } | d{V t | }n3# t $ r&}t
d| Y d}~dS d}~ww xY w|s t
d dS t | }||d}t | S )z
Load WordPress rules from the index and format them as PHP.
Returns:
str or None: PHP-formatted rules data, or None if rules could not be loaded.
F)integrity_checkNz>Failed to load wp-rules index: %s, skipping rules installationz<valid WordPress rules not found, skipping rules installationversionrules) r r updater r r| warningr r% )wp_rules_index
wp_rules_datar wp_rules_version ruleset_dicts rB load_wp_rules_phpr ` s x??? ##%%%%%%%%%1.AA
L
ttttt J
t .n==# L ) 6 66s ?A
A4A//A4c v K t }t | | }| d{V S )zLInstall the imunify-security plugin for all sites where it is not installed.N)r2 WordPressSiteInstallerrun)r sites installers rB install_everywherer s@ " "E&tU33I rA c v K t }t | | }| d{V S )a
Adopt WordPress sites where the plugin is installed but not tracked in our database
or flagged as manually removed.
This handles scenarios like:
- Sites copied/migrated from another location
- Sites migrated from another server
- Sites where the manually_deleted flag was incorrectly set (past bugs)
- Sites where the user installed the plugin from wordpress.org
N)r1 WordPressSiteAdopterr )r r processors rB adopt_found_sitesr sB
E$T511I rA c t j s"t dt dS t j S # t $ r&} t d| Y d} ~ dS d} ~ ww xY w)zLGet the latest version of the imunify-security plugin from the version file.z&Plugin version file does not exist: %sNz&Failed to read plugin version file: %s)r existsr| r read_textstripr )r s rB get_latest_plugin_versionr s ")++ LL8:M
4",..44666 =qAAAttttts 3A $A
B &BB c K t }|s t d dS t d| t }g }t
j d 5 t | }t dt | d |s# t | d{V ddd dS t }t d{V }t t }|D ]"}||j | #| D ],\ } }
t% j | } | j } n3# t* $ r&}
t d| |
Y d}
~
Nd}
~
ww xY wt- | | | d{V \ }}}t/ | }|
D ]}t1 | | d{V r t3 j | d{V s t d| Qt7 ||| ||| }t9 || d{V }t; ||| |
d{V t= ||| |
d{V t3 j | d{V | | t3 j! | d{V }|r{|j" }tG || |$ | }tK | tK | k }| tM j' | |rd nd ||
v# t* $ r'}
t d||
Y d}
~
d}
~
ww xY w.t dt | nf# tP j) $ r+ t dt | Y n-t* $ r!}
t d|
d}
~
ww xY wt | d{V n# t | d{V w xY w ddd dS # 1 swxY w Y dS )zFUpdate the imunify-security plugin on all sites where it is installed.z)Could not determine latest plugin versionNz<Updating imunify-security wp plugin to the latest version %szwp-plugin-updatezFound z outdated sites+Failed to get username for uid=%d. error=%sz#WordPress site no longer exists: %sversionsr data_dirdowngraded_by_imunifyupdated_by_imunifyr eventsiter z+Failed to update plugin on site=%s error=%sz.Updated imunify-security wp plugin on %d siteszRUpdate of imunify-security wp plugin was cancelled. Plugin was updated on %d sitesz-Error occurred during plugin update. error=%s)*r r| r infor r tracktaskr/ r r r r& r listuidr r pwdgetpwuidr r r r) remove_site_if_missingr is_wordpress_installedr* r$ update_scan_data_fileupdate_plugin_config_file
plugin_updateaddget_plugin_versionr r8 build_with_versionr r
send_eventrr CancelledError)r latest_versionupdatedtelemetry_corosoutdated_sitesry r
sites_by_userr r r r ra r r r r
plugin_config scan_datar r original_version is_downgrades rB update_everywherer s .00N @AAA
KKF
eeGO 1 2 2 R; R;Q ; / ? ?N KKE^!4!4EEE F F F!
V */:: : : : : : : :eR; R; R; R; R; R; R; R; (>>L 9 ; ;;;;;;;H ( - -M&
5
5 dh'..t4444 , 1 1 3 3 k
k
U # S 1 1I ( 0HH LLE
HHHH
2)\ ""# !6h ? ?
! U UD 3D$ ? ??????? ! R%(%?%E%E E E E E E E % "KK Et % %6 * * $ +%-
% % % *D )* * $ $ $ $ $ $
4 %&/%- 8 )&/%- " / 5 55555555 D))) ),(>t(D(D"D"D"D"D"D"D" /3| , 0g > > > $(#:#:7#C#CD ,8 ', , ,-= > >,?L
, 2 2 ) 4)- ,8)B(?(?-A)-,3 !" !" !" % I ! aUn
KK@G
% KK+G
LL?
*/:: : : : : : : : :)/:: : : : : : : : : :eR; R; R; R; R; R; R; R; R; R; R; R; R; R; R; R; R; R;s 9Q;<N 8QA5N E,+N ,
F 6 FN F A N &5MN D#M?N
M2 M- 'N -M2 2-N P 7PP P" O>>PP Q P33QQ Qr c K t j | d {V } t | }nn# t $ ra}|j t j k rY d }~d S |j t j t j fv r!t d| Y d }~d S d }~ww xY w t |j 5 } t j
t | d {V t j | d}n# t j | d}w xY wt j |j | d d d d S # 1 swxY w Y d S # t& $ r |dk rt j | w xY w)Nz/Skipping rmtree: data directory %s is a symlinkdir_fdr )r get_data_dirr OSErrorerrnoENOENTELOOPENOTDIRr| r r parentrr to_threadr osclosermdirr=
BaseException)r r r exc parent_fds rB delete_plugin_filesr I s %d++++++++H
%h// 9 $ $ FFFFF 9em4 4 4 NNA8
FFFFF
ho
&
& 6)
' 6::::::::: HX]9 5 5 5 5 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 Q;; HV
sh .
BB:BBB D: 1D-3 C*D-*D D- D: -D11D: 4D15D: :&E c K t j | d{V }|s+t | t j || d{V dS t j | d{V }t j | d{V t
| d{V t | }| t j
|d| | |S # t $ r'}t
d| | Y d}~dS d}~ww xY w)a7
Remove the imunify-security plugin from a single site, including all cleanup and telemetry.
Returns the number of affected sites (should be 1 if deletion was successful).
This function is intended to be protected with asyncio.shield to ensure it completes even if the parent task is cancelled.
Nr uninstalled_by_imunifyr z"Failed to remove plugin from %s %s)r is_plugin_installed process_manually_deleted_plugintimer plugin_uninstallr r- r r r r r| r )r r r is_installedr affectedr s rB remove_from_single_siter$ h sz # 4T : ::::::: 1dikk4
1 .t44444444 "4((((((((( "$''''''''' t$$ .
94GGGqqqqqs AC BC
D C<<Dc
K t d g }d}t j d 5 t t
}|D ]m} |t j t || | d{V z
}0# t j
$ r, t d|t | Y jw xY wn.# t $ r!}t
d| d}~ww xY w t d| t | d{V n5# t d| t | d{V w xY w ddd dS # 1 swxY w Y dS )zHRemove the imunify-security plugin from all sites where it is installed.z#Deleting imunify-security wp pluginr zwp-plugin-removalNz_Deleting imunify-security wp plugin was cancelled. Plugin was deleted from %d sites (out of %d)z)Error occurred during plugin deleting. %sz0Removed imunify-security wp plugin from %s sites)r| r r r r r r4 rr shieldr$ r r r r r )r r r# to_remover r s rB remove_all_installedr( s5
KK5666OH 2 3 3 ; ; ; NNN+--I!
gn/dOLL' ' ! ! ! ! ! ! HH - KKH I
LLDe L L L
KKB
*/:: : : : : : : : :
KKB
*/:: : : : : : : : : :9 ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;sl E2 C#,BC8C C
C CD/
C: C55C::D/>1E2/2E!!E22E69E6c K t | | t | d{V | t j |d| | j dS # t $ r'}t d| | Y d}~dS d}~ww xY w)a
Process the manually deleted plugin for a single site.
Args:
site: The site to process.
now: The current time.
sink: The telemetry/event sink.
telemetry_coros: The list of telemetry coroutines to add the event to.
The process includes:
- marking the site as manually deleted in the database
- removing plugin data files
- sending telemetry for manual removal
Nremoved_by_userr z>Failed to process manually deleted plugin for site=%s error=%s) r6 r r r r r r r| r )r nowr r r s rB r r s
%dC000 "$''''''''' '
L
s AA
B % BB freshly_installed_sitesc d K g } t | }|r0t j }|D ]}t ||| | d{V n2# t $ r%}t d| Y d}~nd}~ww xY w|rt
| d{V dS dS # |rt
| d{V w w xY w)a>
Tidy up sites that have been manually deleted by the user.
Args:
sink: The telemetry/event sink.
freshly_installed_sites: Optional set of sites that were just installed and should be excluded
from being marked as manually deleted to avoid race conditions.
Nz&Error occurred during site tidy up. %s)r3 r r r r| r r )r r, r to_mark_as_manually_removedr+ r r s rB tidy_up_manually_deletedr/ s> O;&K #'
'
# ' )++C3
5#t_ F F F =uEEEEEEEEF ;)/:: : : : : : : : : : ; ;? ;)/:: : : : : : : : : ;s0 AA B
A7A2-B 2A77B B/r c
N K |sd S t }t d {V }t t }|D ]"}||j | #| D ]-\ }} t j | }|j }n3# t $ r&} t d|| Y d } ~ Nd } ~ ww xY wt | || d {V \ }
} } t | }
|D ]}t | | d {V r t! |
| ||| | }t# || d {V }t% |||| d {V t' ||
|| d {V x# t $ r&} t d|| Y d } ~ d } ~ ww xY w/d S )Nr r r z.Failed to update site data on site=%s error=%s)r r& r r r r r r r r r r| r r r) r r* r$ r r )r r ry r r r r r ra r r r r r r r s rB update_data_on_sitesr1 s >>L133333333H %%M - -dh &&t,,,, $))++ 2 2
U S))I (HH LL=
HHHH
*$ <HH H H H H H H
-h77
D+D$77777777
-"" # %
"<D)!L!LLLLLLL ,)y8
0-9x
D
5 '2 2s1 =B
C # CC A E00
F : FF r filenamedatar c K |t j | j }|t | | d{V }t | }t ||z || j |j dS )a Write ``data`` as embedded JSON to ``<site data dir>/<filename>``.
A caller writing several files into one site's directory can resolve
``user_info`` and ``data_dir`` once and pass them in, so the owner
lookup and directory-ensure are not repeated per file.
Nr gid)r r r r$ r% r+ pw_gid)r r2 r3 r r php_contents rB _write_json_php_data_filer9 B s L** 3D)DDDDDDDD/55K%8[dhI<L rA r c > K t | d||| d {V d S )N
scan_data.phpr r9 )r r r r s rB r r Z sV $ rA r c > K t | d||| d{V dS )z
Write plugin_config.php for a single WordPress site.
Separate file from scan_data.php so a config toggle doesn't force
rewriting the malware list, and so the mu-plugin hot path loads
only what it needs per request.
plugin_config.phpr Nr< )r r r r s rB r r j sV $ rA c & K | sdS d}t t }| D ]"}||j | #| D ]\ }} t j | }|j }n3# t $ r&}t
d|| Y d}~Md}~ww xY wt | } |D ]S} t || | d{V |dz
}!# t $ r&}t
d|| Y d}~Ld}~ww xY w|S )us
Rewrite plugin_config.php on every managed site in one pass.
Used by the ConfigUpdate handler that reacts to
WORDPRESS.ai_bot_protection toggles. Writes only plugin_config.php
— scan_data.php is untouched, so a toggle doesn't churn the
(potentially large) malware payload or wait on a scan cycle.
No sink is needed: unlike update_data_on_sites we emit no
telemetry here — the per-site write loop just needs local file
I/O plus the process-level logger for errors.
Returns the number of sites successfully updated so the caller
can decide whether to advance its cached state.
r r N)r r{ z6Failed to update plugin_config.php on site=%s error=%s)
r r r r r r r r r r| r r) r )
r r r r r r r ra r r s
rB update_plugin_config_on_sitesr@ s qG
.9->->M - -dh &&t,,,,(..00 Z S))I (HH LL=
HHHH
.h77
D
/-9 1
L
Ns0 A88
B( B##B(? C
D
' DD
wp_rules_phpr failedc K |j } t | | d{V }|dz }t ||| j | | | t
d| j dS # t $ rA}| | t
d| j | Y d}~dS d}~ww xY w)a=
Deploy wp-rules to a single WordPress site and track the result.
Args:
site: WordPress site to deploy to
user_info: User information from pwd
wp_rules_php: Formatted PHP rules content
updated: Set to add site to if successful
failed: Set to add site to if failed
N rules.phpr5 z Updated wp-rules for site %sz)Failed to update wp-rules for site %s: %s)
r7 r$ r+ r r r| r docrootr r ) r r rA r rB r6 r
rules_pathr s rB update_wp_rules_for_siterG s "
C
3D)DDDDDDDD +
) $(
D 2DLAAAAA
4 7 L
s A(A5 5
C ?6B;;C make_task task_name fingerprintskip_waf_disabledc K t }t }t j | 5 t j }t t } | D ]"}
| |
j |
#g } | D ]+\ } }
t j | }|j }nW# t $ rJ}t d|t |
| |ddd| |
D ]}
| |
Y d}~rd}~ww xY w|rr t# | d{V }n/# t $ r" t$ d|d d}Y nw xY w|s*t$ d
|t |
|
D ]:}
t+ ||
d{V r| ||
||| ;-d }t- d t | | D ]&}| |||z }t/ j |d
di d{V 't j |z
}t$ d|t | t | | nh# t. j $ r, t$ d|t | Y n.t $ r"}t$ d|| d}~ww xY wddd dS # 1 swxY w Y dS )a6
Run a per-site async deployment over a list of WordPress sites.
Groups sites by user, resolves UIDs, then runs tasks concurrently
in batches.
Args:
sites: WordPress sites to deploy to
make_task: Callable that creates a coroutine for one site.
Signature: (site, user_info, updated_set, failed_set) -> awaitable
task_name: Human-readable name for logging and inactivity tracking
fingerprint: Sentry fingerprint for user-lookup failures
sink: Optional telemetry sink for remove_site_if_missing
zwSkipping {task} update for {count} site(s) belonging to user {user} because username retrieval failed. Reason: {reason})r countuserreasonr wordpress format_argslevel componentrJ NBCould not check WAF status for user %s, proceeding with deploymentTexc_infoz-WAF disabled for user %s, skipping %d site(s)r r return_exceptionsz@%s deployment complete. Updated: %d, Failed: %d, Duration: %.2fsz-%s deployment was cancelled. Updated %d sitesz-Error occurred during %s deployment. error=%s)r r r r r r r r r r r r r r r r r rv r| r r r rangerr r r r )r rH rI rJ rK r r rB
start_timer r r r r r ra r rd max_concurrentibatchelapseds rB _deploy_to_sitesr_ s 0 eeG
UUF y ) ) S SR J ' - -M
5
5 dh'..t4444E#0#6#6#8#8 -
N -
NZ # S 1 1I ( 0HH > %.%(__$'&+ % % ("-$/
!+ ) )
4(((( HHHH# & % ! +,CH,M,M&M&M&M&M&M&M $ + + + : $%) ' '+ + ' ! K $
OO
! & N ND 3D$ ? ??????? ! LL4GV!L!LMMMMN
N1c%jj.99
E
E a!n"4 45 neDtDDDDDDDDDDikkJ.G KK#G F
% KK?G
LL?
[S S S S S S S S S S S S S S S S S Ss K A(I%)CI%
DA DI%DI% D54I%5)E! I% E!!DI%$K%8K
K K
( KK
KK !K c K t t }|s t d dS fd}t ||ddd| d{V dS )zHDeploy pre-formatted wp-rules PHP content to all active WordPress sites.z No active WordPress sites foundNc * t | ||| S rG )rG )r r r rB rA s rB rH z'_deploy_wp_rules_php.<locals>.make_taskY s ' )\7F
rA zwp-ruleszwp-rules-update-skip-userTrI rJ rK r )r r4 r| r} r_ )rA r installed_sitesrH s ` rB _deploy_wp_rules_phprd P s NNN)++O 6777
/
rA
is_updatedc K t j s t d dS |s t d dS t d t | }|s t d dS t
| }||d}t | }t | d{V dS )z
Hook that runs when wp-rules files are updated.
Extracts wp-rules.yaml from wp-rules.zip and deploys to all active WordPress sites.
Args:
index: Index object for wp-rules
is_updated: Whether files were actually updated
zCwordpress security plugin not enabled, skipping wp-rules deploymentNz)wp-rules not updated, skipping deploymentz/Starting wp-rules deployment to WordPress sitesz,No valid wp-rules found, skipping deploymentr ) r rS r| r r r r r% rd )r re r r r rA s rB update_wp_rules_on_sitesrg h s ,
?@@@
KKABBB-e44M CDDD .e44# L 1 >>L
|
,
,,,,,,,,,,rA c ` K t j s t d dS t r dat d dS t 4 d{V dat d t d{V } | s.t d ddd d{V dS t | d{V t snt d ddd d{V dS # 1 d{V swxY w Y dS ) aN
Re-deploy rules.php to all WordPress sites.
Used when globally disabled rules change, requiring rules.php
to be regenerated with updated rule filtering.
Uses a coalescing lock: if a redeployment is already running,
the request is merged into the current run rather than starting
a duplicate deployment.
zEwordpress security plugin not enabled, skipping wp-rules redeploymentNTz5wp-rules redeployment already in progress, coalescingFz6Starting wp-rules redeployment (global disable change)z(Could not load wp-rules for redeploymentz4Re-running wp-rules redeployment (coalesced request))
r rS r| r _redeploy_rules_php_locklocked_redeploy_rules_php_pendingr r rd )rA s rB redeploy_rules_phprl sS ,
&&(( &*# KLLL' P P P P P P P P P*/ ' KKH
"3!4!4444444L
IJJJP P P P P P P P P P P P P P '|44 4 4 4 4 4 4 4.
KKN O O O! P PP P P P P P P P P P P P P P P P P P P P P P P P P P P P P Ps /AD 8D
D'*D'c Z K t d{V t d{V dS )a9 Global WAF turn-on: deploy rules.php and disabled-rules.php (stamping
disabled_rules_sync_ts) to all sites, matching install-with-WAF-on.
Wraps rather than extends redeploy_rules_php, which is also the
global-rule-change path where restamping sync_ts would skip unconsumed
changelog actions.
N)rl update_disabled_rules_on_sitesr@ rA rB redeploy_waf_for_all_sitesro sJ
(
*
**********rA rE c t t | }n# t $ r Y dS t $ rg}|j t j t j fv r!t d| Y d}~dS t d|| Y d}~dS d}~ww xY w dD ]t} t j
|| t d|| 6# t $ r Y Bt $ r'}t d||| Y d}~md}~ww xY w t j | dS # t j | w xY w)z9Remove WAF files from data_dir via a symlink-safe dir fd.Nz3Skipping WAF file removal: data dir %s is a symlinkz"Failed to open data dir for %s: %s)rD disabled-rules.phpr z!Removed %s from %s (WAF disabled)z Failed to remove %s from %s: %s)
r FileNotFoundErrorr r r r r| r r r remover r )r rE r r r2 r s rB _remove_waf_files_for_dirrt s %h// 9em4 4 4 NNE
FFFFF 97CHHH; H
(62222 77 %
5x!
sa
B B:B
( B
BD! 2C
D!
DD! D D=D! DD! !D7c K | D ]|} t j | d{V }n8# t $ r+}t d|j | Y d}~Nd}~ww xY wt
j t ||j d{V }dS )a Remove WAF files (rules.php, disabled-rules.php) from the given sites.
Deletion goes through open_dir_no_symlinks + dir_fd so a site owner
cannot redirect the root agent's removal via a symlinked data dir, the
same symlink-safe pattern as delete_plugin_files.
Nz%Failed to resolve data dir for %s: %s) r r
r r| r rE rr r rt )r r r r s rB _remove_waf_files_from_sitesrv s
-d 3 3333333HH LL7 q
HHHH
%x
s #
A!AAc
t K t j sdS t j } | dt
j | d{V n,# t $ r t d| Y dS w xY w| dt d{V } fd|D }|sdS t }t }t d{V }|r |D ]}t | ||| d{V nt d t j }t } t }
|D ]}t | || |
d{V t d| t# | t# | t# | t# |
dS )u\ Deploy rules.php and disabled-rules.php for a user's sites (WAF turn-on).
Caller must have confirmed WAF is enabled for the user. disabled-rules.php
is deployed even if the ruleset fails to load, because it stamps
disabled_rules_sync_ts — matching install, which writes it whenever WAF is
on regardless of rules.php content.
Nz.User %s not found, skipping WAF rules redeployc 4 g | ]}|j j k |S r@ r pw_uidr sr s rB r z)redeploy_waf_for_user.<locals>.<listcomp> ( @@@aey/?&?&?!&?&?&?rA z)Could not load wp-rules for user redeployz[Redeployed WAF artifacts for user %s: rules %d ok/%d failed, disabled-rules %d ok/%d failed)r rS rr rs rt r getpwnamrJ r| r r4 r r rG r update_disabled_rules_for_siter r ) ra ru r r r rB rA r disabled_rules_ts
dr_updated dr_failedr s @rB redeploy_waf_for_userr sE , # % %D ..tS\8LLLLLLLL <h
&&t-@AA A A A A A AE@@@@U@@@J eeG
UUF*,,,,,,,,L D D*i w
BCCC JI
, ) .
I
KK * G F J I s 'A %A76A7c d K t j } | dt j | d{V n,# t
$ r t d| Y dS w xY w| dt d{V }fd|D }t | d{V dS )z4Remove WAF files from all sites belonging to a user.Nz-User %s not found, skipping WAF rules removalc 4 g | ]}|j j k |S r@ ry r{ s rB r z-remove_waf_rules_for_user.<locals>.<listcomp>D r} rA )
rr rs rt r r~ rJ r| r r4 rv )ra ru r r r s @rB remove_waf_rules_for_userr 8 s # % %D ..tS\8LLLLLLLL ;X
&&t-@AA A A A A A AE@@@@U@@@J
&z
2
2222222222s 'A %A)(A)c K t j } | dt d{V }t dt
| t | d{V dS )z?Remove WAF files from all installed sites (global WAF disable).Nz7Global WAF disabled, removing WAF files from %d site(s))rr rs rt r4 r| r r rv )ru r s rB remove_waf_rules_for_all_sitesr H s # % %D&&t-@AA A A A A A AE
KKA E
'u
-
----------rA c 6 K t j sdS t r dat
d dS t 4 d{V dat s ddd d{V dS t } t j
d{V }t j
}|D ]} | dt | d{V r&| rt! | d{V nt# | d{V T# t$ $ r&}t
d|| Y d}~d}~ww xY wt sn t
d ddd d{V dS # 1 d{V swxY w Y dS )zMRedeploy/remove rules.php for users without an explicit waf_enabled override.NTz2waf_default change already in progress, coalescingFz2Failed to apply waf_default change for user %s: %sz1Re-running waf_default change (coalesced request))r rS _apply_waf_default_lockrj _apply_waf_default_pendingr| r rL rQ r HostingPanel get_usersrr rs rt rx r r r r ) new_default usernamesru ra r s rB apply_waf_default_changer S s , %%'' %)" HIII& M M M M M M M M M). &*,,
M M M M M M M M M M M M M M +,,K + 8 : : D D F FFFFFFFI+--D %
! 1 1 < !
!" B 3H = ========= 7 A AAAAAAAA NNL .
KKK L L L? M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M MsO F;AF "D .F/-D F
E
' EFE
'F
FFdomain timestampc p t j | d }|t | d}t | S )a|
Generate the disabled-rules.php content for a specific domain.
Only includes domain-specific disabled rules. Globally disabled rules
are handled separately by filtering them out of rules.php.
Args:
domain: The domain to generate disabled rules for
timestamp: Unix timestamp to embed in the file
Returns:
PHP file content string
F)include_global)tsr )r get_domain_disabledsortedr% )r r disabled_rule_idsr3 s rB generate_disabled_rules_phpr sN ':u )** D ) . ..rA c J K |j } t | | d{V }|dz }t | j | }t ||| j | t
j | t j | j k
| | t
d| j dS # t $ rA} | | t d| j | Y d} ~ dS d} ~ ww xY w)a[
Deploy disabled-rules.php to a single WordPress site and track the result.
Args:
site: WordPress site to deploy to
user_info: User information from pwd
timestamp: Unix timestamp for both file content and DB record
updated: Set to add site to if successful
failed: Set to add site to if failed
Nrq r5 disabled_rules_sync_tsz"Updated disabled-rules for site %sz/Failed to update disabled-rules for site %s: %s)r7 r$ r r r+ r r r whererE executer r| r r r )
r r r r rB r6 r disabled_rules_pathr8 r s
rB r r sO "
C
3D)DDDDDDDD &)= =1$+yII ) $(
I>>>DD !T\ 1
'))) D 8$,GGGGG
4 = L
s C
C
D"!6D D"domainsc b K t j s t d dS t d t | rt | }nt
}|s t d dS d }t ||ddd| d{V dS )
ai
Deploy disabled-rules.php to WordPress sites.
If domains are specified, only updates sites for those domains.
If domains is None, updates all installed sites (e.g., after a global
disable/enable).
Args:
domains: List of domains to update, or None for all sites
sink: Optional telemetry sink for remove_site_if_missing
zIwordpress security plugin not enabled, skipping disabled-rules deploymentNz5Starting disabled-rules deployment to WordPress sitesz6No WordPress sites found for disabled-rules deploymentc J t | |t j || S rG )r r )r r r rB s rB rH z1update_disabled_rules_on_sites.<locals>.make_task s% - )TY[['6
rA zdisabled-rulesz disabled-rules-update-skip-userTrb )r rS r| r r r. r4 r_ )r r r rH s rB rn rn s ,
KKGHHHNNN &.w77#%% LMMM
"5
rA c
K t d t }t }t j d 5 t
t }|s(t d ddd dS t t }|D ]"}||j
| #g }| D ]\ }} t j | } n<# t $ r/}
t! dt# | ||
dddd
Y d}
~
Od}
~
ww xY w|D ]@}t% | | d{V rt' || || } | | Ad } t) d t# | | D ]&}
||
|
| z }t+ j |d
di d{V 't dt# | t# | nf# t* j $ r+ t dt# | Y n-t $ r!}
t d|
d}
~
ww xY wddd dS # 1 swxY w Y dS )z7Update auth.php files for all existing WordPress sites.z4Updating auth.php files for existing WordPress siteszwp-auth-updatez"No installed WordPress sites foundNzSkipping auth update for WordPress sites on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}rM rN rO r rP z wp-plugin-auth-update-skip-userrQ r r rX Tz8Updated auth.php files for %d WordPress sites, %d failedzLAuth update for WordPress sites was cancelled. Auth was updated for %d sitesz+Error occurred during auth update. error=%s)r| r r r r r r r4 r r r r r r r r r r r update_site_authrY rr r r r )r r rB rc r r r r r r r r r[ r\ r] s rB update_auth_everywherer s
KKFGGGeeG
UUF / 0 0 @ @? NNN 2 3 3O"
@AAA@ @ @ @ @ @ @ @ ( - -M'
5
5 dh'..t4444 E + 1 1 3 3
'
'
U # S 1 1II D
&)ZZ$'&+% %
("-$E
HHHH " " ' 'D 3D$ ? ??????? ! +D)WfMMDLL&&&& ' N1c%jj.99
E
E a!n"4 45 neDtDDDDDDDDDD KKJG F
% KK(G
LLF N N N }@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @st I;8H AH5D
H
E%D>9H>ECHI;7I+?I; I+
I&&I++I;;I?I?c K t | | d{V | | dS # t $ r<}| | t d| | Y d}~dS d}~ww xY w)z/Process authentication setup for a single site.Nz*Failed to update auth for site=%s error=%s)r9 r r r| r )r r r rB r s rB r r > s
'i888888888 D
4 8
s +1
A71A22A7c . K t j |j rdS t | }|dk r&| #t j | d||j d{V n1t d| t dd|id d
d d
S )a
Checks if the site directory exists. If not, removes the site from the local database and sends a 'site_removed' telemetry event only if deletion is successful.
Returns True if the site was removed (directory missing), False otherwise.
Parameters:
sink: The telemetry/event sink.
site: The WPSite object to check and potentially remove.
Side effect: If the site is missing and successfully deleted from database, a telemetry event will be sent.
Fr N site_removedr z@Failed to delete missing site %s from database, no rows affectedz2Failed to delete missing site {site} from databaser r rP z wp-plugin-site-delete-failedrQ T) r r isdirrE r- r r r r| r r )r r rows_deleteds rB r r L s
w}}T\"" u t$$L a &$
N
@ !6
4rA file_permissionsc K t j | d{V } t | }nC# t $ r6}|j t j t j t j fv rY d}~dS d}~ww xY w t j | j
dz }|dk rt j |d dD ]} t || 5 }t j
| }|j
dz |k rt j || ddd n # 1 swxY w Y d# t $ r Y pt $ r<}|j t j k r!t d|| Y d}~ d}~ww xY w t j | n# t j | w xY wdS # t$ $ r'} t d | | Y d} ~ dS d} ~ ww xY w)
z6Fix data file permissions for a single WordPress site.NFi i )r; r> zauth.phprD rq r z"Skipping chmod: %s/%s is a symlinkTz.Failed to fix permissions for site=%s error=%s)r r
r r r r r r r statst_modechmodr fstatrr r| r r r r )
r r r r r current_dir_mode file_namefile_fdstr s
rB fix_site_data_file_permissionsr u s{ 1 )$//////// )(33FF yU\5;
FFF uuuuu
!wv 6 > 5(('''
&y@@@ @G Xg . . :-1AAA HW.> ? ? ?@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ ) H yEK// @ $ %
!
0
HV BHV t <
uuuuu
s F / F
A/*A*#F )A**A//F 3;E: /D 8D8 DD D D DE:
E!E: E!%1E E: E E!!E: %F :FF
G GGc \ K t }t }t j d 5 t t }|s ddd dS ddlm} ddlm } | j
|j
k rdnd}|D ]\}t | | d{V rt || d{V }|r|
| G|
| ]t dt! | t! | nj# t" j $ r+ t d t! | Y n1t& $ r%} t d
| Y d} ~ nd} ~ ww xY wddd dS # 1 swxY w Y dS ) z
Fix data file permissions for all WordPress sites with imunify-security plugin installed.
Args:
sink: The telemetry/event sink
zwp-plugin-fix-permissionsNr )r )Pleski z=Fixed data file permissions for %d WordPress sites, %d failedzOFixing data file permissions was cancelled. Permissions were fixed for %d sitesz1Error occurred during permission fixing. error=%s)r r r r r r4 +defence360agent.subsys.panels.hosting_panelr #defence360agent.subsys.panels.pleskr NAMEr r r r| r r rr r r r )
r fixedrB rc r r r r successr s
rB $fix_data_file_permissions_everywherer s
EEE
UUF : ; ; 0 0/ NNN 2 3 3O"
0 0 0 0 0 0 0 0
B A A A A A & ,
::
(
%
%/d;;;;;;;; >*! ! %IIdOOOOJJt$$$$ KKE
F
% KK&E
LLCU
[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0sN F! D*,B=D*)F!*7F!F!# F,F F! FF!!F%(F%c d e Zd ZdZdZdZdZdZdddd d
d d d
Zd Z d Z
d Z d Z de
ddfdZd ZdS )r z
Handles installation of imunify-security plugin on WordPress sites.
This class processes WordPress sites and installs the imunify-security
plugin, including setting up authentication, scan data files, and rules.
Tinstalled_by_imunifyzwp-plugin-installationzwp-plugin-install-skip-userz%Installing imunify-security wp pluginz5Installed imunify-security wp plugin on {count} sitesz&Found {count} site(s) for installationz5Failed to install plugin to site={site} error={error}z`Installation of imunify-security wp plugin was cancelled. Plugin was installed for {count} sitesz8Error occurred during plugin installation. error={error}zSkipping installation of WordPress plugin on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}startcompletefoundr cancelled exception skip_userc H || _ || _ t | _ t | _ t | _ t | _ t | _ t | _ d | _ t | _
d | _ d S rG ) r r r processed
authenticatedrules_installedfailed_rules_updatesdisabled_rules_installed failed_disabled_rules_updatesr failed_auth
_current_site)selfr r s rB __init__z WordPressSiteInstaller.__init__
sy
UU "uu $'EE!(+%-0UU*/3 55,0rA c K t j | d{V }|s3t d| t dd|iddd d S d
S ) a
Check if site is ready for processing.
Override in subclasses to implement different readiness checks.
Args:
site: The WordPress site to check.
Returns:
bool: True if the site is ready for processing, False otherwise.
Nz6WordPress site is not accessible using WP CLI. site=%sz:WordPress site is not accessible using WP CLI. site={site}r r rP z wp-plugin-cli-not-accessiblerQ FT)r r r| r r )r r r s rB
is_site_readyz$WordPressSiteInstaller.is_site_ready s (+'A$'G'G!G!G!G!G!G!G % NNH
L #TN % :
5trA c | j | t |h | | dS )u
Record a successfully processed site and persist it to the database.
Each site is inserted immediately so that it is tracked in the DB
at all times — even if the overall installation loop is cancelled
mid-run.
Override in subclasses to implement different recording logic.
Args:
site: The WordPress site that was processed.
version: The plugin version installed on the site.
N)r r r5 _stamp_disabled_rules_sync_tsr r r s rB _record_processed_sitez-WordPressSiteInstaller._record_processed_site3 sD
4 v&&& **400000rA c K | j }d| _ t | d{V n3# t $ r&}t d|| Y d}~nd}~ww xY w| j r t
j | d{V dS dS )a Revert the site that was mid-processing when cancellation occurred.
Deletes data files and, if this processor installs plugins,
attempts to uninstall the partially-installed plugin.
Each step runs independently so one failure doesn't skip the other.
Nz5Failed to delete data files for in-flight site %s: %s)r r r r| r install_pluginr try_plugin_uninstall)r r r s rB _revert_in_flight_sitez-WordPressSiteInstaller._revert_in_flight_siteE s ! ! %d++ + + + + + + + + NNG
1*400 0 0 0 0 0 0 0 0 0 1 1s (
A AAr rE Nc || j vrdS | j dS t j | j t j |j k dS )z
Stamp disabled_rules_sync_ts for a single site after it has been
inserted into the DB.
Called from ``_record_processed_site`` so the DB row already exists.
Nr )r r r r r rE r )r r s rB r z4WordPressSiteInstaller._stamp_disabled_rules_sync_tsY se t4 4 4 F ! ) F #'#9
%
% 5
6
6wwyyyyyrA c
K t | j d g }t j | j 5 t | j s{t d | j |rLt j |ddi d{V }|D ]2}t |t rt d| 3cddd S t | j d t! | j t# }t% d{V }t' j | _ t+ d{V }t- t. }| j D ]"}||j | #| D ]B\ } }
t7 j | } | j } nL# t $ r?}
t= | j d t! |
| |
d
d d | j
Y d}
~
gd}
~
ww xY w tA | d{V }n/# t $ r" t d| d d}Y nw xY w|s)t d| t! |
tC | j" | | d{V \ }}}tG | }|
D ]/}tI | j" | d{V r | % | d{V s<|| _& tO ||| ||| }tQ || d{V }tS ||| | d{V tU ||| | d{V tW || | j, | j- d{V |r%|r#t] || || j/ | j0 d{V |r(tc || | j | j2 | j3 d{V | j4 rtk j6 | d{V tk j7 | d{V }|rtq j9 || }| : || d| _& | t j; ty j= | j" | j> || # t $ rY}
d| _& t ? | j d |t |
Y d}
~
)d}
~
ww xY wDt | j d t! | j | j- r-t dt! | j- | j0 r-t dt! | j0 | j3 r-t dt! | j3 n# t jA $ ro | j& r| B d{V t | j d t! | j Y nXt $ rL}
t ? | j d t |
d}
~
ww xY w|rLt j |ddi d{V }|D ]2}t |t rt d| 3nT# |rLt j |ddi d{V }|D ]3}t |t rt d| 3w w xY wddd n # 1 swxY w Y | j S ) z
Process WordPress sites for imunify-security plugin operations.
Returns:
set: The set of successfully processed sites.
r z'No WordPress sites found, nothing to dorX TNz Failed to send telemetry: %sr )rM r r r rP rQ rU rV zFWAF disabled for user %s, skipping WAF rules deployment for %d site(s)r r r r )r r r z Failed to authenticate %d sitesz&Failed to install wp-rules on %d sitesz,Failed to install disabled-rules on %d sitesr r )r )Cr| r messagesr r r rI r r r rr r
isinstancer r formatr r r r r r& r r r r r r r r r log_fingerprint_skip_userrv r r r) r r r r* r$ r r r r r rG r r r r r r r plugin_installr r r r r r r telemetry_eventr reprr r )r telemetry_tasksresultsr ry rA r r r r r r ra r rd r r r r r r r s rB r zWordPressSiteInstaller.runh s
DM'*+++
"
"4>
2
2 W W V
z *KK IJJJ >R # $+N(%<@% % G #* %fi88 "NN > kW W W W W W W W M'*11DJ1HH
,~~ &7%8%8 8 8 8 8 8 8 *.&!=!?!??????? !,D 1 1
J 9 9D!$(+2248888 #0"5"5"7"7 O O JC!$'L$5$5 #,#4$ ! ! !# M+ 6),U(+*/) )
#,&1(,(F
! ! +,CH,M,M&M&M&M&M&M&M $ + + + : $%) ' '+ + ' ? $ JJ 6 9l &&' %:($C$CM % b b !7 4!H!HHHHHHH % $^ )-););D)A)A#A#A#A#A#A#A ) (15D . ): . . ( $ /)1
) ) ) I .H $i. . ( ( ( ( ( ( H
#8 $ )*3)1 # # # #< $ -*3)1 # # # #3 $ ) $ 2 $ 0 # # , " "&>$($-$0$($8$($= '" '" !" !" !" !" !" !" !" + "&D$($-$($:$($A$($F '" '" !" !" !" !" !" !" !" $ 2 ?&)&8&>&> > > > > > > > -0,B4,H,H&H&H&H&H&H&HG & P'-'@w'O'O ! 7 7g F F F15D . + 2 2 ' 3$-$8-1Y.2.B-107 %& %& %&!" !" ) 15D . "LL $
g 6 = =)-T%[[ !> !" !" yb F M*-443t~;N;N4OO # NN9D ,-- , NN@D 566 5 NNFD >??
)
% 8 55777777777 M+.55 !$. 1 1 6
M+.55DKK5HH
# $+N(%<@% % G #* %fi88 "NN >
# $+N(%<@% % G #* %fi88 "NN >
gW W W W W W W W W W W W W W W r ~ s ];5W7A]; C1W7G.-W7.
H785H2-W72H77W7;IW7)I=:W7<I==A>W7<R'W7F
R'%W7'
T
1AT ?W7T
C,W76\7A;[ 2\4 [ =A[[ \ A];A],,];;]?]?)__name__
__module__ __qualname____doc__r r rI r r r r r r r r r r@ rA rB r r s N,O(I = 8K9H
5
G
7 H( 1 1 1 81 1 1$1 1 1(
A&
AT
A
A
A
A c c c c c rA r c V e Zd ZdZdZdZdZdZdddd d
d d d
Z fdZ d Z
fdZ xZ S )r z
Handles adoption of existing WordPress sites with imunify-security plugin.
Adoption is a special case of installation where the site already has
the plugin installed but is not tracked in our database.
F
site_foundzwp-plugin-adoptionzwp-plugin-adopt-skip-userz#Adopting imunify-security wp pluginz3Adopted imunify-security wp plugin on {count} sitesz"Found {count} site(s) for adoptionz3Failed to adopt plugin to site={site} error={error}zZAdoption of imunify-security wp plugin was cancelled. Plugin was adopted for {count} sitesz4Error occurred during plugin adoption. error={error}zSkipping adoption of WordPress plugin on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}r c t || d t j t j D | _ d S )Nc h | ] }|j
S r@ )rE )r rs rB <setcomp>z0WordPressSiteAdopter.__init__.<locals>.<setcomp>o s' "
"
"
AI"
"
"
rA )superr r selectrE existing_docroots)r r r __class__s rB r z WordPressSiteAdopter.__init__l sR
u%%%"
"
, 3M4I J J"
"
"
rA c | j | |j | j v r1t | t | |rt
|| nt |h | | dS )a
Record a successfully adopted site and persist it immediately.
For adoption, sites that already exist in the database (flagged as
manually deleted) have their flag cleared. New sites are inserted
into the database right away.
Args:
site: The WordPress site that was processed.
version: The plugin version installed on the site.
N) r r rE r r, r7 r8 r5 r r s rB r z+WordPressSiteAdopter._record_processed_sites s
4 <41 1 1 ' - - - & & &
3#D'222 "D6 * * * **400000rA c K t | d{V sdS t j | d{V }|s t d| dS dS )z
Check if site is ready for adoption.
Args:
site: The WordPress site to check.
Returns:
bool: True if the site is ready for adoption, False otherwise.
NFz2Plugin not installed on site %s, skipping adoptionT)r r r r r| r )r r r" r s rB r z"WordPressSiteAdopter.is_site_ready s WW**400000000 5 ! 4T : ::::::: NND
5trA )
r r r r r r rI r r r r r
__classcell__)r s @rB r r N s N"O$I ; 6I5F
3 L
7 H$
1 1 1. rA r )r rG )FN)rE N)NN)rr r loggingr r r collectionsr collections.abcr r distutils.versionr functoolsr pathlibr defence360agent.apir defence360agent.contracts.configr
r~ r r r
r defence360agent.filesr r defence360agent.sentryr defence360agent.utilsr defence360agent.utils.fd_opsr r r r r defence360agent.subsys.panelsr "defence360agent.wordpress.wp_rulesr r defence360agent.model.wordpressr r &defence360agent.model.wp_disabled_ruler defence360agent.wordpressr r #defence360agent.wordpress.constantsr defence360agent.wordpress.utilsr! r" r# r$ r% r& r' r( r) r* r+ )defence360agent.wordpress.site_repositoryr, r- r. r/ r0 r1 r2 r3 r4 r5 r6 r7 r8 $defence360agent.wordpress.proxy_authr9 getLoggerr r| rC rK Lockr r rW r[ rH rL rQ rT rX strr] rg ri rf tupler` rl rp rv rx COMPONENTS_DB_PATHr dictr r
struct_passwdr r r r r r r r r r r r intr$ r( r r r/ r1 r9 r r r@ rG r_ rd rg ri rk rl ro rt rv r r r r floatr r rn r r r r r r r r@ rA rB <module>r s
# # # # # # / / / / / / / / * * * * * * * * * * * * 2 1 1 1 1 1 1 1 . . . . . . * * * * * * 7 6 6 6 6 6 7 7 7 7 7 7 B A A A A A A A A A A A A A 4 4 4 4 4 4 4 4 C C C C C C K J J J J J 8 $ $ &',.. " # $. !$ $ $ $ $$$ $ $ $ $d *t * * * * !c ! ! ! !" - U4t#3 4 ,# ,%c :J , , , , C D
C D #3 #4 # # # # TJ
< << < < < < "U "td{ " " " "J& & &
t
(9
t
;& ;6B ; ; ; ;F80A 8 8 8 8: :d : : : :& 7 7 7B! ! !
!
!
! 3 `; `; `;F F >) )# ) ) ) )X"; "; ";J$
$
$
P 26; ;#&v;; ; ; ;<ADL A A A AR +/
4' Tk
8 +/
4'
Tk
( +/
4'
Tk
.7tF| 7 7 7 7 7t!
!
!
!
!
!
!
!
!
!
V $
n n <n "C-y>n
n
n n
n n n nb S 0#-% #-T #-d #- #- #- #-L (7<>> $ *P *P *P *PZ + + + + @
d6l
t
(4# 4$ 4 4 4 4n
3c
3d
3
3
3
3 . . . .,M ,M ,M ,M^/ / /# / / / /0%
%
%
%
%
%
%
%
%
%
R !%
/ /
#Y
/
/ / / /dG G G GT
&V & & & & &R5
5$'5 5 5 5 5p: : :za a a a a a a a H R R R R R1 R R R R RrA defence360agent/wordpress/__pycache__/plugin.cpython-311.pyc 0000644 0000000 0000000 00000260572 00000000000 021022 0 ustar
r_jI(
d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm Z m
Z
d dl m Z d dl
mZ d dlmZ d dlmZ d dlmZmZmZmZmZ d d lmZm Z d d
l m Z d d l m Z d d l!m"Z"m#Z#m$Z$m%Z% d d
lm&Z& d dl'm(Z( d dl)m*Z*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0 d dl1m2Z2m3Z3 d dl4m5Z5 d dl6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZA d dlBmCZCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZO d dlPmQZQ ejR eS ZTed ZUdZV e jW ZXdaYdZZdZ[de\fd Z]de\fd Z^de\fd Z_de\fd Z`deafd Zbd!Zcd"Zdd#Zedefe\e\e\f fd$Zgd%eadefe\eaf fd&Zhd%eade\fd'Zid%eade\fd(Zjd%eade\fd)Zk ed* Zld%ead+efd,Zmd-edendz fd.Zod/ Zpd0end1ejq denfd2Zrd1ejq d+efd3Zsd4e jt fd5Zudvd7evfd8Zwd9 Zxd: Zyd; Zzdeafd<Z{d= Z|d>e.fd?Z}d>e.de~fd@ZdA ZdB Z dwdCee. fdDZdEeve. fdFZdddGd>e.dHeadIend1ejq dz dJedz ddf dKZdddGd>e.dLend1ejq dz dJedz fdMZdddGd>e.dNend1ejq dz dJedz ddf
dOZdEeve. de~fdPZd>e.d1ejq dQeadRedSeddf dTZ dxdEeve. dUe
e.ejq eege d f dVeadWeadXe\ddf dYZdwdQeaddfdZZd-ed[e\ddfd\Z e jW Zdadyd]Zdyd^Zd_eaddfd`ZdEeve. ddfdaZd%eaddfdbZd%eaddfdcZdyddZdydeZdfeadgedeafdhZd>e.d1ejq dgedRedSeddf diZ dzdjevea dz ddfdkZdwdlZdm Zd>e.de\fdnZd>e.doe~de\fdpZdq Z G dr ds Z G dt due ZdS ){ N) defaultdict) AwaitableCallable) LooseVersion)cache)Path)
inactivity)MalwareScanScheduleInterval SystemConfigANTIVIRUS_MODEUserTypechoose_value_from_config)IndexWP_RULES) log_message)importer)open_dir_no_symlinks
open_nofollow rmtree_fdsafe_dir) Wordpress)
hosting_panel)get_wp_rules_dataget_wp_ruleset_version)
WordpressSiteWPSite)WPDisabledRule)cli telemetry)PLUGIN_VERSION_FILE) _validate_preset calculate_next_scan_timestamp$clear_get_cagefs_enabled_users_cacheensure_site_data_directory format_php_with_embedded_json get_imunify_package_versions
get_last_scanget_malware_historyprepare_plugin_configprepare_scan_data!write_plugin_data_file_atomically)
clear_manually_deleted_flag delete_site get_installed_sites_by_domainsget_outdated_sitesget_sites_for_userget_sites_to_adoptget_sites_to_install%get_sites_to_mark_as_manually_deletedget_installed_sitesinsert_installed_sites mark_site_as_manually_deletedupdate_site_identityupdate_site_version)setup_site_authenticationc 0 t j ddd S )Nz(imav.malwarelib.plugins.schedule_watcherget_user_schedule_config)modulenamedefault)r get U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/plugin.py _get_user_schedule_config_imavrC K s$ <9
' rA TFbalancedreturnc d t t j S # t $ r
t cY S w xY wN)boolr WAF_ENABLEDKeyError_LEGACY_WAF_FALLBACKr@ rA rB _get_global_waf_enabledrL c ? $I)*** $ $ $####$ //c d t t j S # t $ r
t cY S w xY wrG )rH r WAF_DEFAULTrJ rK r@ rA rB _get_waf_defaultrQ j rM rN c X t t j S # t $ r Y dS w xY w)NF)rH r SECURITY_PLUGIN_ENABLEDrJ r@ rA rB _get_security_plugin_enabledrT q s:
I5666 uus
))c d t t j S # t $ r
t cY S w xY w)uS Read WORDPRESS.ai_bot_protection from config, defaulting to False.
Returns _AI_BOT_PROTECTION_DEFAULT when the config key is missing
— e.g. the ai_bot_protection field hasn't rolled out to this
install's imunify360 yet, or a sibling package is still on an
older schema. Keeps the feature off in all ambiguous cases.
)rH r AI_BOT_PROTECTIONrJ _AI_BOT_PROTECTION_DEFAULTr@ rA rB _get_global_ai_bot_protectionrX | s? *I/000 * * *))))*rN c j t j } n# t $ r
t cY S w xY wt | S )u Read WORDPRESS.ai_bot_protection_preset from config, defaulting to
"balanced".
Two layers of safety: KeyError on a missing key (older schema, agent
upgrade in progress) and _validate_preset() on the value itself
(hand-edited override file, future preset rolled in via a sibling
package this version doesn't recognise). Both fall back to the same
canonical default so all layers — schema, agent, plugin — agree.
)r AI_BOT_PROTECTION_PRESETrJ !_AI_BOT_PROTECTION_PRESET_DEFAULTr! )raws rB $_get_global_ai_bot_protection_presetr] sF 10 1 1 100001 C s ##r> overridezglobal kill switchc T t t t fS )a Read the three server-wide WAF flags in one call.
Returns (security_plugin_enabled, global_waf_enabled, waf_default), each
guarded against a missing config key (schema version skew during an
agent/imunify-antivirus upgrade) the same way the individual accessors are.
)rT rL rQ r@ rA rB waf_global_snapshotr` s) %&& !! rA usernamec t s dt fS t dd| \ }}n%# t $ r t t
fcY S w xY w|t j k rt t
fS t | t fS )NF WORDPRESS waf_enabledra )
rL WAF_SOURCE_KILL_SWITCHr rJ rQ WAF_SOURCE_DEFAULTr
ROOTrH WAF_SOURCE_OVERRIDE)ra valuesources rB #waf_status_and_source_for_user_syncrl s " $ $ -,,,60
vv 6 6 6 !!#555556
!!#555 ;;+ ++s / AAc * t | \ }}|S rG )rl )ra enabled_s rB _is_waf_enabled_for_user_syncrp s 4X>>JGQ NrA c p K t j }| dt | d{V S )u3 Async wrapper — runs config file I/O in executor.N)asyncioget_running_looprun_in_executorrp )ra loops rB is_waf_enabled_for_userrv sR # % %D%% +X rA c r t dd| \ }}n# t $ r Y dS w xY w|t j k S )Nrc rd re F)r rJ r
rh )ra ro rk s rB $_user_has_explicit_waf_override_syncrx sY ,
66 uu X] ""s
&&zD/var/lib/cloudlinux-app-version-detector/components_versions.sqlite3 admin_configc t }|*t d t j dddfS || | S )z
Get user-specific schedule configuration with lazy import fallback.
Returns default values if imav.malwarelib is not available.
Nz@imav.malwarelib not available, returning default schedule configr )rC loggerdebugIntervalNONE)ra ry r; s rB _get_user_schedule_configr sU > ? ? ' N
}aA%% # #Hl ; ;;rA indexc t | }|dS t r | D ]
\ }}d|d< t t j r fd| D }|S )uI
Retrieve WordPress rules with ANTIVIRUS_MODE handling and global disable filtering.
In ANTIVIRUS_MODE, all rules are set to monitoring mode ("pass").
Globally disabled rules are filtered out entirely — they should not
appear in rules.php. Domain-specific disables are handled separately
via disabled-rules.php.
Args:
index: The Index object used to locate the wp-rules.zip file.
Returns:
The parsed wp-rules data with mode adjusted for ANTIVIRUS_MODE
and globally disabled rules removed, or None if rules cannot be loaded.
Npassmodec $ i | ] \ }}|v ||
S r@ r@ ).0cveparamsglobally_disableds rB
<dictcomp>z-get_updated_wp_rules_data.<locals>.<dictcomp> s5
V+++
+++rA )r r itemssetr get_global_disabled)r
rules_datar r r s @rB get_updated_wp_rules_datar s #5))Jt $%++-- $ $KC #F6NN N > @ @AA
) / / 1 1
rA c H t t j dS )z#Clear all WordPress-related caches.N)r# r clear_get_content_dir_cacher@ rA rB clear_cachesr s# (***#%%%%%rA r user_infoc t | }d |D }| D ]Dfd|D }|r1t |t }|| E|S )Nc i | ]}|g S r@ r@ )r paths rB r z site_search.<locals>.<dictcomp> s
.
.
.4dB
.
.
.rA c , g | ]} | |S r@ r@ )r r itemmatchers rB
<listcomp>z site_search.<locals>.<listcomp> s* MMM4t9L9LM$MMMrA )key)r0 maxlenappend)r r r
user_sitesresultmatching_sitesmost_specific_siter s ` @rB site_searchr s #I..J
.
.:
.
.
.F 4 4MMMMM:MMM 4!$^!=!=!= % & - -d 3 3 3 MrA c : K t | |j d {V }| dd }t |j | \ }}}}d } |t j k rt
|||| } t |j }
t |
|d } || | fS )N scan_datec P | d dk o| d | S )N
resource_typefile)
startswith)r r s rB <lambda>z)_get_scan_data_for_user.<locals>.<lambda>> s- 40F: * L # #D ) ) rA ) r' pw_namer? r r~ r r" r( r ) sinkr ry last_scanlast_scan_timeintervalhour day_of_month day_of_weeknext_scan_timemalware_historymalware_by_sites rB _get_scan_data_for_userr " s $D)*;<<<<<<<<I ]];55N 1J<1 1-HdL+ N8= 6 dL+
*)*;<<O " * * O >? ::rA semaphorec K |4 d {V | d {V n4# t $ r'}t d| Y d }~nd }~ww xY wd d d d {V d S # 1 d {V swxY w Y d S )NzTelemetry task failed: ) Exceptionr| error)coror es rB _send_telemetry_taskr E s+ 8 8 8 8 8 8 8 8 8JJJJJJJJ 8 8 8 LL6166 7 7 7 7 7 7 7 7 88 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8s5 A A
A AA AA
A'*A'
coroutinesc K | sdS t j | fd| D } t j | d{V dS # t $ r(}t d| Y d}~dS d}~ww xY w)zK
Process a list of telemetry coroutines with a concurrency limit.s
Nc T g | ]$}t j t | %S r@ )rr create_taskr )r r r s rB r z+process_telemetry_tasks.<locals>.<listcomp>U s?
0y A ABB
rA z Some telemetry tasks failed: )rr Semaphoregatherr r| r )r concurrencytasksr r s @rB process_telemetry_tasksr M s !+..I
E
:ne$$$$$$$$$$ : : : 8Q88999999999:s A
A3 A..A3c p K t t d } | d{V t | }n3# t $ r&}t
d| Y d}~dS d}~ww xY w|s t
d dS t | }||d}t | S )z
Load WordPress rules from the index and format them as PHP.
Returns:
str or None: PHP-formatted rules data, or None if rules could not be loaded.
F)integrity_checkNz>Failed to load wp-rules index: %s, skipping rules installationz<valid WordPress rules not found, skipping rules installationversionrules) r r updater r r| warningr r% )wp_rules_index
wp_rules_datar wp_rules_version ruleset_dicts rB load_wp_rules_phpr ` s x??? ##%%%%%%%%%1.AA
L
ttttt J
t .n==# L ) 6 66s ?A
A4A//A4c v K t }t | | }| d{V S )zLInstall the imunify-security plugin for all sites where it is not installed.N)r2 WordPressSiteInstallerrun)r sites installers rB install_everywherer s@ " "E&tU33I rA c v K t }t | | }| d{V S )a
Adopt WordPress sites where the plugin is installed but not tracked in our database
or flagged as manually removed.
This handles scenarios like:
- Sites copied/migrated from another location
- Sites migrated from another server
- Sites where the manually_deleted flag was incorrectly set (past bugs)
- Sites where the user installed the plugin from wordpress.org
N)r1 WordPressSiteAdopterr )r r processors rB adopt_found_sitesr sB
E$T511I rA c t j s"t dt dS t j S # t $ r&} t d| Y d} ~ dS d} ~ ww xY w)zLGet the latest version of the imunify-security plugin from the version file.z&Plugin version file does not exist: %sNz&Failed to read plugin version file: %s)r existsr| r read_textstripr )r s rB get_latest_plugin_versionr s ")++ LL8:M
4",..44666 =qAAAttttts 3A $A
B &BB c K t }|s t d dS t d| t }g }t
j d 5 t | }t dt | d |s# t | d{V ddd dS t }t d{V }t t }|D ]"}||j | #| D ],\ } }
t% j | } | j } n3# t* $ r&}
t d| |
Y d}
~
Nd}
~
ww xY wt- | | | d{V \ }}}t/ | }|
D ]}t1 | | d{V r t3 j | d{V s t d| Qt7 ||| ||| }t9 || d{V }t; ||| |
d{V t= ||| |
d{V t3 j | d{V | | t3 j! | d{V }|r{|j" }tG || |$ | }tK | tK | k }| tM j' | |rd nd ||
v# t* $ r'}
t d||
Y d}
~
d}
~
ww xY w.t dt | nf# tP j) $ r+ t dt | Y n-t* $ r!}
t d|
d}
~
ww xY wt | d{V n# t | d{V w xY w ddd dS # 1 swxY w Y dS )zFUpdate the imunify-security plugin on all sites where it is installed.z)Could not determine latest plugin versionNz<Updating imunify-security wp plugin to the latest version %szwp-plugin-updatezFound z outdated sites+Failed to get username for uid=%d. error=%sz#WordPress site no longer exists: %sversionsr data_dirdowngraded_by_imunifyupdated_by_imunifyr eventsiter z+Failed to update plugin on site=%s error=%sz.Updated imunify-security wp plugin on %d siteszRUpdate of imunify-security wp plugin was cancelled. Plugin was updated on %d sitesz-Error occurred during plugin update. error=%s)*r r| r infor r tracktaskr/ r r r r& r listuidr r pwdgetpwuidr r r r) remove_site_if_missingr is_wordpress_installedr* r$ update_scan_data_fileupdate_plugin_config_file
plugin_updateaddget_plugin_versionr r8 build_with_versionr r
send_eventrr CancelledError)r latest_versionupdatedtelemetry_corosoutdated_sitesry r
sites_by_userr r r r ra r r r r
plugin_config scan_datar r original_version is_downgrades rB update_everywherer s .00N @AAA
KKF
eeGO 1 2 2 R; R;Q ; / ? ?N KKE^!4!4EEE F F F!
V */:: : : : : : : :eR; R; R; R; R; R; R; R; (>>L 9 ; ;;;;;;;H ( - -M&
5
5 dh'..t4444 , 1 1 3 3 k
k
U # S 1 1I ( 0HH LLE
HHHH
2)\ ""# !6h ? ?
! U UD 3D$ ? ??????? ! R%(%?%E%E E E E E E E % "KK Et % %6 * * $ +%-
% % % *D )* * $ $ $ $ $ $
4 %&/%- 8 )&/%- " / 5 55555555 D))) ),(>t(D(D"D"D"D"D"D"D" /3| , 0g > > > $(#:#:7#C#CD ,8 ', , ,-= > >,?L
, 2 2 ) 4)- ,8)B(?(?-A)-,3 !" !" !" % I ! aUn
KK@G
% KK+G
LL?
*/:: : : : : : : : :)/:: : : : : : : : : :eR; R; R; R; R; R; R; R; R; R; R; R; R; R; R; R; R; R;s 9Q;<N 8QA5N E,+N ,
F 6 FN F A N &5MN D#M?N
M2 M- 'N -M2 2-N P 7PP P" O>>PP Q P33QQ Qr c K t j | d {V } t | }nn# t $ ra}|j t j k rY d }~d S |j t j t j fv r!t d| Y d }~d S d }~ww xY w t |j 5 } t j
t | d {V t j | d}n# t j | d}w xY wt j |j | d d d d S # 1 swxY w Y d S # t& $ r |dk rt j | w xY w)Nz/Skipping rmtree: data directory %s is a symlinkdir_fdr )r get_data_dirr OSErrorerrnoENOENTELOOPENOTDIRr| r r parentrr to_threadr osclosermdirr=
BaseException)r r r exc parent_fds rB delete_plugin_filesr I s %d++++++++H
%h// 9 $ $ FFFFF 9em4 4 4 NNA8
FFFFF
ho
&
& 6)
' 6::::::::: HX]9 5 5 5 5 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 Q;; HV
sh .
BB:BBB D: 1D-3 C*D-*D D- D: -D11D: 4D15D: :&E c K t j | d{V }|s+t | t j || d{V dS t j | d{V }t j | d{V t
| d{V t | }| t j
|d| | |S # t $ r'}t
d| | Y d}~dS d}~ww xY w)a7
Remove the imunify-security plugin from a single site, including all cleanup and telemetry.
Returns the number of affected sites (should be 1 if deletion was successful).
This function is intended to be protected with asyncio.shield to ensure it completes even if the parent task is cancelled.
Nr uninstalled_by_imunifyr z"Failed to remove plugin from %s %s)r is_plugin_installed process_manually_deleted_plugintimer plugin_uninstallr r- r r r r r| r )r r r is_installedr affectedr s rB remove_from_single_siter$ h sz # 4T : ::::::: 1dikk4
1 .t44444444 "4((((((((( "$''''''''' t$$ .
94GGGqqqqqs AC BC
D C<<Dc
K t d g }d}t j d 5 t t
}|D ]m} |t j t || | d{V z
}0# t j
$ r, t d|t | Y jw xY wn.# t $ r!}t
d| d}~ww xY w t d| t | d{V n5# t d| t | d{V w xY w ddd dS # 1 swxY w Y dS )zHRemove the imunify-security plugin from all sites where it is installed.z#Deleting imunify-security wp pluginr zwp-plugin-removalNz_Deleting imunify-security wp plugin was cancelled. Plugin was deleted from %d sites (out of %d)z)Error occurred during plugin deleting. %sz0Removed imunify-security wp plugin from %s sites)r| r r r r r r4 rr shieldr$ r r r r r )r r r# to_remover r s rB remove_all_installedr( s5
KK5666OH 2 3 3 ; ; ; NNN+--I!
gn/dOLL' ' ! ! ! ! ! ! HH - KKH I
LLDe L L L
KKB
*/:: : : : : : : : :
KKB
*/:: : : : : : : : : :9 ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;sl E2 C#,BC8C C
C CD/
C: C55C::D/>1E2/2E!!E22E69E6c K t | | t | d{V | t j |d| | j dS # t $ r'}t d| | Y d}~dS d}~ww xY w)a
Process the manually deleted plugin for a single site.
Args:
site: The site to process.
now: The current time.
sink: The telemetry/event sink.
telemetry_coros: The list of telemetry coroutines to add the event to.
The process includes:
- marking the site as manually deleted in the database
- removing plugin data files
- sending telemetry for manual removal
Nremoved_by_userr z>Failed to process manually deleted plugin for site=%s error=%s) r6 r r r r r r r| r )r nowr r r s rB r r s
%dC000 "$''''''''' '
L
s AA
B % BB freshly_installed_sitesc d K g } t | }|r0t j }|D ]}t ||| | d{V n2# t $ r%}t d| Y d}~nd}~ww xY w|rt
| d{V dS dS # |rt
| d{V w w xY w)a>
Tidy up sites that have been manually deleted by the user.
Args:
sink: The telemetry/event sink.
freshly_installed_sites: Optional set of sites that were just installed and should be excluded
from being marked as manually deleted to avoid race conditions.
Nz&Error occurred during site tidy up. %s)r3 r r r r| r r )r r, r to_mark_as_manually_removedr+ r r s rB tidy_up_manually_deletedr/ s> O;&K #'
'
# ' )++C3
5#t_ F F F =uEEEEEEEEF ;)/:: : : : : : : : : : ; ;? ;)/:: : : : : : : : : ;s0 AA B
A7A2-B 2A77B B/r c
N K |sd S t }t d {V }t t }|D ]"}||j | #| D ]-\ }} t j | }|j }n3# t $ r&} t d|| Y d } ~ Nd } ~ ww xY wt | || d {V \ }
} } t | }
|D ]}t | | d {V r t! |
| ||| | }t# || d {V }t% |||| d {V t' ||
|| d {V x# t $ r&} t d|| Y d } ~ d } ~ ww xY w/d S )Nr r r z.Failed to update site data on site=%s error=%s)r r& r r r r r r r r r r| r r r) r r* r$ r r )r r ry r r r r r ra r r r r r r r s rB update_data_on_sitesr1 s >>L133333333H %%M - -dh &&t,,,, $))++ 2 2
U S))I (HH LL=
HHHH
*$ <HH H H H H H H
-h77
D+D$77777777
-"" # %
"<D)!L!LLLLLLL ,)y8
0-9x
D
5 '2 2s1 =B
C # CC A E00
F : FF r filenamedatar c K |t j | j }|t | | d{V }t | }t ||z || j |j dS )a Write ``data`` as embedded JSON to ``<site data dir>/<filename>``.
A caller writing several files into one site's directory can resolve
``user_info`` and ``data_dir`` once and pass them in, so the owner
lookup and directory-ensure are not repeated per file.
Nr gid)r r r r$ r% r+ pw_gid)r r2 r3 r r php_contents rB _write_json_php_data_filer9 B s L** 3D)DDDDDDDD/55K%8[dhI<L rA r c > K t | d||| d {V d S )N
scan_data.phpr r9 )r r r r s rB r r Z sV $ rA r c > K t | d||| d{V dS )z
Write plugin_config.php for a single WordPress site.
Separate file from scan_data.php so a config toggle doesn't force
rewriting the malware list, and so the mu-plugin hot path loads
only what it needs per request.
plugin_config.phpr Nr< )r r r r s rB r r j sV $ rA c & K | sdS d}t t }| D ]"}||j | #| D ]\ }} t j | }|j }n3# t $ r&}t
d|| Y d}~Md}~ww xY wt | } |D ]S} t || | d{V |dz
}!# t $ r&}t
d|| Y d}~Ld}~ww xY w|S )us
Rewrite plugin_config.php on every managed site in one pass.
Used by the ConfigUpdate handler that reacts to
WORDPRESS.ai_bot_protection toggles. Writes only plugin_config.php
— scan_data.php is untouched, so a toggle doesn't churn the
(potentially large) malware payload or wait on a scan cycle.
No sink is needed: unlike update_data_on_sites we emit no
telemetry here — the per-site write loop just needs local file
I/O plus the process-level logger for errors.
Returns the number of sites successfully updated so the caller
can decide whether to advance its cached state.
r r N)r r{ z6Failed to update plugin_config.php on site=%s error=%s)
r r r r r r r r r r| r r) r )
r r r r r r r ra r r s
rB update_plugin_config_on_sitesr@ s qG
.9->->M - -dh &&t,,,,(..00 Z S))I (HH LL=
HHHH
.h77
D
/-9 1
L
Ns0 A88
B( B##B(? C
D
' DD
wp_rules_phpr failedc K |j } t | | d{V }|dz }t ||| j | | | t
d| j dS # t $ rA}| | t
d| j | Y d}~dS d}~ww xY w)a=
Deploy wp-rules to a single WordPress site and track the result.
Args:
site: WordPress site to deploy to
user_info: User information from pwd
wp_rules_php: Formatted PHP rules content
updated: Set to add site to if successful
failed: Set to add site to if failed
N rules.phpr5 z Updated wp-rules for site %sz)Failed to update wp-rules for site %s: %s)
r7 r$ r+ r r r| r docrootr r ) r r rA r rB r6 r
rules_pathr s rB update_wp_rules_for_siterG s "
C
3D)DDDDDDDD +
) $(
D 2DLAAAAA
4 7 L
s A(A5 5
C ?6B;;C make_task task_name fingerprintskip_waf_disabledc K t }t }t j | 5 t j }t t } | D ]"}
| |
j |
#g } | D ]+\ } }
t j | }|j }nW# t $ rJ}t d|t |
| |ddd| |
D ]}
| |
Y d}~rd}~ww xY w|rr t# | d{V }n/# t $ r" t$ d|d d}Y nw xY w|s*t$ d
|t |
|
D ]:}
t+ ||
d{V r| ||
||| ;-d }t- d t | | D ]&}| |||z }t/ j |d
di d{V 't j |z
}t$ d|t | t | | nh# t. j $ r, t$ d|t | Y n.t $ r"}t$ d|| d}~ww xY wddd dS # 1 swxY w Y dS )a6
Run a per-site async deployment over a list of WordPress sites.
Groups sites by user, resolves UIDs, then runs tasks concurrently
in batches.
Args:
sites: WordPress sites to deploy to
make_task: Callable that creates a coroutine for one site.
Signature: (site, user_info, updated_set, failed_set) -> awaitable
task_name: Human-readable name for logging and inactivity tracking
fingerprint: Sentry fingerprint for user-lookup failures
sink: Optional telemetry sink for remove_site_if_missing
zwSkipping {task} update for {count} site(s) belonging to user {user} because username retrieval failed. Reason: {reason})r countuserreasonr wordpress format_argslevel componentrJ NBCould not check WAF status for user %s, proceeding with deploymentTexc_infoz-WAF disabled for user %s, skipping %d site(s)r r return_exceptionsz@%s deployment complete. Updated: %d, Failed: %d, Duration: %.2fsz-%s deployment was cancelled. Updated %d sitesz-Error occurred during %s deployment. error=%s)r r r r r r r r r r r r r r r r r rv r| r r r rangerr r r r )r rH rI rJ rK r r rB
start_timer r r r r r ra r rd max_concurrentibatchelapseds rB _deploy_to_sitesr_ s 0 eeG
UUF y ) ) S SR J ' - -M
5
5 dh'..t4444E#0#6#6#8#8 -
N -
NZ # S 1 1I ( 0HH > %.%(__$'&+ % % ("-$/
!+ ) )
4(((( HHHH# & % ! +,CH,M,M&M&M&M&M&M&M $ + + + : $%) ' '+ + ' ! K $
OO
! & N ND 3D$ ? ??????? ! LL4GV!L!LMMMMN
N1c%jj.99
E
E a!n"4 45 neDtDDDDDDDDDDikkJ.G KK#G F
% KK?G
LL?
[S S S S S S S S S S S S S S S S S Ss K A(I%)CI%
DA DI%DI% D54I%5)E! I% E!!DI%$K%8K
K K
( KK
KK !K c K t t }|s t d dS fd}t ||ddd| d{V dS )zHDeploy pre-formatted wp-rules PHP content to all active WordPress sites.z No active WordPress sites foundNc * t | ||| S rG )rG )r r r rB rA s rB rH z'_deploy_wp_rules_php.<locals>.make_taskY s ' )\7F
rA zwp-ruleszwp-rules-update-skip-userTrI rJ rK r )r r4 r| r} r_ )rA r installed_sitesrH s ` rB _deploy_wp_rules_phprd P s NNN)++O 6777
/
rA
is_updatedc K t j s t d dS |s t d dS t d t | }|s t d dS t
| }||d}t | }t | d{V dS )z
Hook that runs when wp-rules files are updated.
Extracts wp-rules.yaml from wp-rules.zip and deploys to all active WordPress sites.
Args:
index: Index object for wp-rules
is_updated: Whether files were actually updated
zCwordpress security plugin not enabled, skipping wp-rules deploymentNz)wp-rules not updated, skipping deploymentz/Starting wp-rules deployment to WordPress sitesz,No valid wp-rules found, skipping deploymentr ) r rS r| r r r r r% rd )r re r r r rA s rB update_wp_rules_on_sitesrg h s ,
?@@@
KKABBB-e44M CDDD .e44# L 1 >>L
|
,
,,,,,,,,,,rA c ` K t j s t d dS t r dat d dS t 4 d{V dat d t d{V } | s.t d ddd d{V dS t | d{V t snt d ddd d{V dS # 1 d{V swxY w Y dS ) aN
Re-deploy rules.php to all WordPress sites.
Used when globally disabled rules change, requiring rules.php
to be regenerated with updated rule filtering.
Uses a coalescing lock: if a redeployment is already running,
the request is merged into the current run rather than starting
a duplicate deployment.
zEwordpress security plugin not enabled, skipping wp-rules redeploymentNTz5wp-rules redeployment already in progress, coalescingFz6Starting wp-rules redeployment (global disable change)z(Could not load wp-rules for redeploymentz4Re-running wp-rules redeployment (coalesced request))
r rS r| r _redeploy_rules_php_locklocked_redeploy_rules_php_pendingr r rd )rA s rB redeploy_rules_phprl sS ,
&&(( &*# KLLL' P P P P P P P P P*/ ' KKH
"3!4!4444444L
IJJJP P P P P P P P P P P P P P '|44 4 4 4 4 4 4 4.
KKN O O O! P PP P P P P P P P P P P P P P P P P P P P P P P P P P P P P Ps /AD 8D
D'*D'c Z K t d{V t d{V dS )a9 Global WAF turn-on: deploy rules.php and disabled-rules.php (stamping
disabled_rules_sync_ts) to all sites, matching install-with-WAF-on.
Wraps rather than extends redeploy_rules_php, which is also the
global-rule-change path where restamping sync_ts would skip unconsumed
changelog actions.
N)rl update_disabled_rules_on_sitesr@ rA rB redeploy_waf_for_all_sitesro sJ
(
*
**********rA rE c t t | }n# t $ r Y dS t $ rg}|j t j t j fv r!t d| Y d}~dS t d|| Y d}~dS d}~ww xY w dD ]t} t j
|| t d|| 6# t $ r Y Bt $ r'}t d||| Y d}~md}~ww xY w t j | dS # t j | w xY w)z9Remove WAF files from data_dir via a symlink-safe dir fd.Nz3Skipping WAF file removal: data dir %s is a symlinkz"Failed to open data dir for %s: %s)rD disabled-rules.phpr z!Removed %s from %s (WAF disabled)z Failed to remove %s from %s: %s)
r FileNotFoundErrorr r r r r| r r r remover r )r rE r r r2 r s rB _remove_waf_files_for_dirrt s %h// 9em4 4 4 NNE
FFFFF 97CHHH; H
(62222 77 %
5x!
sa
B B:B
( B
BD! 2C
D!
DD! D D=D! DD! !D7c K | D ]|} t j | d{V }n8# t $ r+}t d|j | Y d}~Nd}~ww xY wt
j t ||j d{V }dS )a Remove WAF files (rules.php, disabled-rules.php) from the given sites.
Deletion goes through open_dir_no_symlinks + dir_fd so a site owner
cannot redirect the root agent's removal via a symlinked data dir, the
same symlink-safe pattern as delete_plugin_files.
Nz%Failed to resolve data dir for %s: %s) r r
r r| r rE rr r rt )r r r r s rB _remove_waf_files_from_sitesrv s
-d 3 3333333HH LL7 q
HHHH
%x
s #
A!AAc
t K t j sdS t j } | dt
j | d{V n,# t $ r t d| Y dS w xY w| dt d{V } fd|D }|sdS t }t }t d{V }|r |D ]}t | ||| d{V nt d t j }t } t }
|D ]}t | || |
d{V t d| t# | t# | t# | t# |
dS )u\ Deploy rules.php and disabled-rules.php for a user's sites (WAF turn-on).
Caller must have confirmed WAF is enabled for the user. disabled-rules.php
is deployed even if the ruleset fails to load, because it stamps
disabled_rules_sync_ts — matching install, which writes it whenever WAF is
on regardless of rules.php content.
Nz.User %s not found, skipping WAF rules redeployc 4 g | ]}|j j k |S r@ r pw_uidr sr s rB r z)redeploy_waf_for_user.<locals>.<listcomp> ( @@@aey/?&?&?!&?&?&?rA z)Could not load wp-rules for user redeployz[Redeployed WAF artifacts for user %s: rules %d ok/%d failed, disabled-rules %d ok/%d failed)r rS rr rs rt r getpwnamrJ r| r r4 r r rG r update_disabled_rules_for_siter r ) ra ru r r r rB rA r disabled_rules_ts
dr_updated dr_failedr s @rB redeploy_waf_for_userr sE , # % %D ..tS\8LLLLLLLL <h
&&t-@AA A A A A A AE@@@@U@@@J eeG
UUF*,,,,,,,,L D D*i w
BCCC JI
, ) .
I
KK * G F J I s 'A %A76A7c d K t j } | dt j | d{V n,# t
$ r t d| Y dS w xY w| dt d{V }fd|D }t | d{V dS )z4Remove WAF files from all sites belonging to a user.Nz-User %s not found, skipping WAF rules removalc 4 g | ]}|j j k |S r@ ry r{ s rB r z-remove_waf_rules_for_user.<locals>.<listcomp>D r} rA )
rr rs rt r r~ rJ r| r r4 rv )ra ru r r r s @rB remove_waf_rules_for_userr 8 s # % %D ..tS\8LLLLLLLL ;X
&&t-@AA A A A A A AE@@@@U@@@J
&z
2
2222222222s 'A %A)(A)c K t j } | dt d{V }t dt
| t | d{V dS )z?Remove WAF files from all installed sites (global WAF disable).Nz7Global WAF disabled, removing WAF files from %d site(s))rr rs rt r4 r| r r rv )ru r s rB remove_waf_rules_for_all_sitesr H s # % %D&&t-@AA A A A A A AE
KKA E
'u
-
----------rA c 6 K t j sdS t r dat
d dS t 4 d{V dat s ddd d{V dS t } t j
d{V }t j
}|D ]} | dt | d{V r&| rt! | d{V nt# | d{V T# t$ $ r&}t
d|| Y d}~d}~ww xY wt sn t
d ddd d{V dS # 1 d{V swxY w Y dS )zMRedeploy/remove rules.php for users without an explicit waf_enabled override.NTz2waf_default change already in progress, coalescingFz2Failed to apply waf_default change for user %s: %sz1Re-running waf_default change (coalesced request))r rS _apply_waf_default_lockrj _apply_waf_default_pendingr| r rL rQ r HostingPanel get_usersrr rs rt rx r r r r ) new_default usernamesru ra r s rB apply_waf_default_changer S s , %%'' %)" HIII& M M M M M M M M M). &*,,
M M M M M M M M M M M M M M +,,K + 8 : : D D F FFFFFFFI+--D %
! 1 1 < !
!" B 3H = ========= 7 A AAAAAAAA NNL .
KKK L L L? M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M MsO F;AF "D .F/-D F
E
' EFE
'F
FFdomain timestampc p t j | d }|t | d}t | S )a|
Generate the disabled-rules.php content for a specific domain.
Only includes domain-specific disabled rules. Globally disabled rules
are handled separately by filtering them out of rules.php.
Args:
domain: The domain to generate disabled rules for
timestamp: Unix timestamp to embed in the file
Returns:
PHP file content string
F)include_global)tsr )r get_domain_disabledsortedr% )r r disabled_rule_idsr3 s rB generate_disabled_rules_phpr sN ':u )** D ) . ..rA c J K |j } t | | d{V }|dz }t | j | }t ||| j | t
j | t j | j k
| | t
d| j dS # t $ rA} | | t d| j | Y d} ~ dS d} ~ ww xY w)a[
Deploy disabled-rules.php to a single WordPress site and track the result.
Args:
site: WordPress site to deploy to
user_info: User information from pwd
timestamp: Unix timestamp for both file content and DB record
updated: Set to add site to if successful
failed: Set to add site to if failed
Nrq r5 disabled_rules_sync_tsz"Updated disabled-rules for site %sz/Failed to update disabled-rules for site %s: %s)r7 r$ r r r+ r r r whererE executer r| r r r )
r r r r rB r6 r disabled_rules_pathr8 r s
rB r r sO "
C
3D)DDDDDDDD &)= =1$+yII ) $(
I>>>DD !T\ 1
'))) D 8$,GGGGG
4 = L
s C
C
D"!6D D"domainsc b K t j s t d dS t d t | rt | }nt
}|s t d dS d }t ||ddd| d{V dS )
ai
Deploy disabled-rules.php to WordPress sites.
If domains are specified, only updates sites for those domains.
If domains is None, updates all installed sites (e.g., after a global
disable/enable).
Args:
domains: List of domains to update, or None for all sites
sink: Optional telemetry sink for remove_site_if_missing
zIwordpress security plugin not enabled, skipping disabled-rules deploymentNz5Starting disabled-rules deployment to WordPress sitesz6No WordPress sites found for disabled-rules deploymentc J t | |t j || S rG )r r )r r r rB s rB rH z1update_disabled_rules_on_sites.<locals>.make_task s% - )TY[['6
rA zdisabled-rulesz disabled-rules-update-skip-userTrb )r rS r| r r r. r4 r_ )r r r rH s rB rn rn s ,
KKGHHHNNN &.w77#%% LMMM
"5
rA c
K t d t }t }t j d 5 t
t }|s(t d ddd dS t t }|D ]"}||j
| #g }| D ]\ }} t j | } n<# t $ r/}
t! dt# | ||
dddd
Y d}
~
Od}
~
ww xY w|D ]@}t% | | d{V rt' || || } | | Ad } t) d t# | | D ]&}
||
|
| z }t+ j |d
di d{V 't dt# | t# | nf# t* j $ r+ t dt# | Y n-t $ r!}
t d|
d}
~
ww xY wddd dS # 1 swxY w Y dS )z7Update auth.php files for all existing WordPress sites.z4Updating auth.php files for existing WordPress siteszwp-auth-updatez"No installed WordPress sites foundNzSkipping auth update for WordPress sites on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}rM rN rO r rP z wp-plugin-auth-update-skip-userrQ r r rX Tz8Updated auth.php files for %d WordPress sites, %d failedzLAuth update for WordPress sites was cancelled. Auth was updated for %d sitesz+Error occurred during auth update. error=%s)r| r r r r r r r4 r r r r r r r r r r r update_site_authrY rr r r r )r r rB rc r r r r r r r r r[ r\ r] s rB update_auth_everywherer s
KKFGGGeeG
UUF / 0 0 @ @? NNN 2 3 3O"
@AAA@ @ @ @ @ @ @ @ ( - -M'
5
5 dh'..t4444 E + 1 1 3 3
'
'
U # S 1 1II D
&)ZZ$'&+% %
("-$E
HHHH " " ' 'D 3D$ ? ??????? ! +D)WfMMDLL&&&& ' N1c%jj.99
E
E a!n"4 45 neDtDDDDDDDDDD KKJG F
% KK(G
LLF N N N }@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @st I;8H AH5D
H
E%D>9H>ECHI;7I+?I; I+
I&&I++I;;I?I?c K t | | d{V | | dS # t $ r<}| | t d| | Y d}~dS d}~ww xY w)z/Process authentication setup for a single site.Nz*Failed to update auth for site=%s error=%s)r9 r r r| r )r r r rB r s rB r r > s
'i888888888 D
4 8
s +1
A71A22A7c . K t j |j rdS t | }|dk r&| #t j | d||j d{V n1t d| t dd|id d
d d
S )a
Checks if the site directory exists. If not, removes the site from the local database and sends a 'site_removed' telemetry event only if deletion is successful.
Returns True if the site was removed (directory missing), False otherwise.
Parameters:
sink: The telemetry/event sink.
site: The WPSite object to check and potentially remove.
Side effect: If the site is missing and successfully deleted from database, a telemetry event will be sent.
Fr N site_removedr z@Failed to delete missing site %s from database, no rows affectedz2Failed to delete missing site {site} from databaser r rP z wp-plugin-site-delete-failedrQ T) r r isdirrE r- r r r r| r r )r r rows_deleteds rB r r L s
w}}T\"" u t$$L a &$
N
@ !6
4rA file_permissionsc K t j | d{V } t | }nC# t $ r6}|j t j t j t j fv rY d}~dS d}~ww xY w t j | j
dz }|dk rt j |d dD ]} t || 5 }t j
| }|j
dz |k rt j || ddd n # 1 swxY w Y d# t $ r Y pt $ r<}|j t j k r!t d|| Y d}~ d}~ww xY w t j | n# t j | w xY wdS # t$ $ r'} t d | | Y d} ~ dS d} ~ ww xY w)
z6Fix data file permissions for a single WordPress site.NFi i )r; r> zauth.phprD rq r z"Skipping chmod: %s/%s is a symlinkTz.Failed to fix permissions for site=%s error=%s)r r
r r r r r r r statst_modechmodr fstatrr r| r r r r )
r r r r r current_dir_mode file_namefile_fdstr s
rB fix_site_data_file_permissionsr u s{ 1 )$//////// )(33FF yU\5;
FFF uuuuu
!wv 6 > 5(('''
&y@@@ @G Xg . . :-1AAA HW.> ? ? ?@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ ) H yEK// @ $ %
!
0
HV BHV t <
uuuuu
s F / F
A/*A*#F )A**A//F 3;E: /D 8D8 DD D D DE:
E!E: E!%1E E: E E!!E: %F :FF
G GGc \ K t }t }t j d 5 t t }|s ddd dS ddlm} ddlm } | j
|j
k rdnd}|D ]\}t | | d{V rt || d{V }|r|
| G|
| ]t dt! | t! | nj# t" j $ r+ t d t! | Y n1t& $ r%} t d
| Y d} ~ nd} ~ ww xY wddd dS # 1 swxY w Y dS ) z
Fix data file permissions for all WordPress sites with imunify-security plugin installed.
Args:
sink: The telemetry/event sink
zwp-plugin-fix-permissionsNr )r )Pleski z=Fixed data file permissions for %d WordPress sites, %d failedzOFixing data file permissions was cancelled. Permissions were fixed for %d sitesz1Error occurred during permission fixing. error=%s)r r r r r r4 +defence360agent.subsys.panels.hosting_panelr #defence360agent.subsys.panels.pleskr NAMEr r r r| r r rr r r r )
r fixedrB rc r r r r successr s
rB $fix_data_file_permissions_everywherer s
EEE
UUF : ; ; 0 0/ NNN 2 3 3O"
0 0 0 0 0 0 0 0
B A A A A A & ,
::
(
%
%/d;;;;;;;; >*! ! %IIdOOOOJJt$$$$ KKE
F
% KK&E
LLCU
[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0sN F! D*,B=D*)F!*7F!F!# F,F F! FF!!F%(F%c d e Zd ZdZdZdZdZdZdddd d
d d d
Zd Z d Z
d Z d Z de
ddfdZd ZdS )r z
Handles installation of imunify-security plugin on WordPress sites.
This class processes WordPress sites and installs the imunify-security
plugin, including setting up authentication, scan data files, and rules.
Tinstalled_by_imunifyzwp-plugin-installationzwp-plugin-install-skip-userz%Installing imunify-security wp pluginz5Installed imunify-security wp plugin on {count} sitesz&Found {count} site(s) for installationz5Failed to install plugin to site={site} error={error}z`Installation of imunify-security wp plugin was cancelled. Plugin was installed for {count} sitesz8Error occurred during plugin installation. error={error}zSkipping installation of WordPress plugin on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}startcompletefoundr cancelled exception skip_userc H || _ || _ t | _ t | _ t | _ t | _ t | _ t | _ d | _ t | _
d | _ d S rG ) r r r processed
authenticatedrules_installedfailed_rules_updatesdisabled_rules_installed failed_disabled_rules_updatesr failed_auth
_current_site)selfr r s rB __init__z WordPressSiteInstaller.__init__
sy
UU "uu $'EE!(+%-0UU*/3 55,0rA c K t j | d{V }|s3t d| t dd|iddd d S d
S ) a
Check if site is ready for processing.
Override in subclasses to implement different readiness checks.
Args:
site: The WordPress site to check.
Returns:
bool: True if the site is ready for processing, False otherwise.
Nz6WordPress site is not accessible using WP CLI. site=%sz:WordPress site is not accessible using WP CLI. site={site}r r rP z wp-plugin-cli-not-accessiblerQ FT)r r r| r r )r r r s rB
is_site_readyz$WordPressSiteInstaller.is_site_ready s (+'A$'G'G!G!G!G!G!G!G % NNH
L #TN % :
5trA c | j | t |h | | dS )u
Record a successfully processed site and persist it to the database.
Each site is inserted immediately so that it is tracked in the DB
at all times — even if the overall installation loop is cancelled
mid-run.
Override in subclasses to implement different recording logic.
Args:
site: The WordPress site that was processed.
version: The plugin version installed on the site.
N)r r r5 _stamp_disabled_rules_sync_tsr r r s rB _record_processed_sitez-WordPressSiteInstaller._record_processed_site3 sD
4 v&&& **400000rA c K | j }d| _ t | d{V n3# t $ r&}t d|| Y d}~nd}~ww xY w| j r t
j | d{V dS dS )a Revert the site that was mid-processing when cancellation occurred.
Deletes data files and, if this processor installs plugins,
attempts to uninstall the partially-installed plugin.
Each step runs independently so one failure doesn't skip the other.
Nz5Failed to delete data files for in-flight site %s: %s)r r r r| r install_pluginr try_plugin_uninstall)r r r s rB _revert_in_flight_sitez-WordPressSiteInstaller._revert_in_flight_siteE s ! ! %d++ + + + + + + + + NNG
1*400 0 0 0 0 0 0 0 0 0 1 1s (
A AAr rE Nc || j vrdS | j dS t j | j t j |j k dS )z
Stamp disabled_rules_sync_ts for a single site after it has been
inserted into the DB.
Called from ``_record_processed_site`` so the DB row already exists.
Nr )r r r r r rE r )r r s rB r z4WordPressSiteInstaller._stamp_disabled_rules_sync_tsY se t4 4 4 F ! ) F #'#9
%
% 5
6
6wwyyyyyrA c
K t | j d g }t j | j 5 t | j s{t d | j |rLt j |ddi d{V }|D ]2}t |t rt d| 3cddd S t | j d t! | j t# }t% d{V }t' j | _ t+ d{V }t- t. }| j D ]"}||j | #| D ]B\ } }
t7 j | } | j } nL# t $ r?}
t= | j d t! |
| |
d
d d | j
Y d}
~
gd}
~
ww xY w tA | d{V }n/# t $ r" t d| d d}Y nw xY w|s)t d| t! |
tC | j" | | d{V \ }}}tG | }|
D ]/}tI | j" | d{V r | % | d{V s<|| _& tO ||| ||| }tQ || d{V }tS ||| | d{V tU ||| | d{V tW || | j, | j- d{V |r%|r#t] || || j/ | j0 d{V |r(tc || | j | j2 | j3 d{V | j4 rtk j6 | d{V tk j7 | d{V }|rtq j9 || }| : || d| _& | t j; ty j= | j" | j> || # t $ rY}
d| _& t ? | j d |t |
Y d}
~
)d}
~
ww xY wDt | j d t! | j | j- r-t dt! | j- | j0 r-t dt! | j0 | j3 r-t dt! | j3 n# t jA $ ro | j& r| B d{V t | j d t! | j Y nXt $ rL}
t ? | j d t |
d}
~
ww xY w|rLt j |ddi d{V }|D ]2}t |t rt d| 3nT# |rLt j |ddi d{V }|D ]3}t |t rt d| 3w w xY wddd n # 1 swxY w Y | j S ) z
Process WordPress sites for imunify-security plugin operations.
Returns:
set: The set of successfully processed sites.
r z'No WordPress sites found, nothing to dorX TNz Failed to send telemetry: %sr )rM r r r rP rQ rU rV zFWAF disabled for user %s, skipping WAF rules deployment for %d site(s)r r r r )r r r z Failed to authenticate %d sitesz&Failed to install wp-rules on %d sitesz,Failed to install disabled-rules on %d sitesr r )r )Cr| r messagesr r r rI r r r rr r
isinstancer r formatr r r r r r& r r r r r r r r r log_fingerprint_skip_userrv r r r) r r r r* r$ r r r r r rG r r r r r r r plugin_installr r r r r r r telemetry_eventr reprr r )r telemetry_tasksresultsr ry rA r r r r r r ra r rd r r r r r r r s rB r zWordPressSiteInstaller.runh s
DM'*+++
"
"4>
2
2 W W V
z *KK IJJJ >R # $+N(%<@% % G #* %fi88 "NN > kW W W W W W W W M'*11DJ1HH
,~~ &7%8%8 8 8 8 8 8 8 *.&!=!?!??????? !,D 1 1
J 9 9D!$(+2248888 #0"5"5"7"7 O O JC!$'L$5$5 #,#4$ ! ! !# M+ 6),U(+*/) )
#,&1(,(F
! ! +,CH,M,M&M&M&M&M&M&M $ + + + : $%) ' '+ + ' ? $ JJ 6 9l &&' %:($C$CM % b b !7 4!H!HHHHHHH % $^ )-););D)A)A#A#A#A#A#A#A ) (15D . ): . . ( $ /)1
) ) ) I .H $i. . ( ( ( ( ( ( H
#8 $ )*3)1 # # # #< $ -*3)1 # # # #3 $ ) $ 2 $ 0 # # , " "&>$($-$0$($8$($= '" '" !" !" !" !" !" !" !" + "&D$($-$($:$($A$($F '" '" !" !" !" !" !" !" !" $ 2 ?&)&8&>&> > > > > > > > -0,B4,H,H&H&H&H&H&H&HG & P'-'@w'O'O ! 7 7g F F F15D . + 2 2 ' 3$-$8-1Y.2.B-107 %& %& %&!" !" ) 15D . "LL $
g 6 = =)-T%[[ !> !" !" yb F M*-443t~;N;N4OO # NN9D ,-- , NN@D 566 5 NNFD >??
)
% 8 55777777777 M+.55 !$. 1 1 6
M+.55DKK5HH
# $+N(%<@% % G #* %fi88 "NN >
# $+N(%<@% % G #* %fi88 "NN >
gW W W W W W W W W W W W W W W r ~ s ];5W7A]; C1W7G.-W7.
H785H2-W72H77W7;IW7)I=:W7<I==A>W7<R'W7F
R'%W7'
T
1AT ?W7T
C,W76\7A;[ 2\4 [ =A[[ \ A];A],,];;]?]?)__name__
__module__ __qualname____doc__r r rI r r r r r r r r r r@ rA rB r r s N,O(I = 8K9H
5
G
7 H( 1 1 1 81 1 1$1 1 1(
A&
AT
A
A
A
A c c c c c rA r c V e Zd ZdZdZdZdZdZdddd d
d d d
Z fdZ d Z
fdZ xZ S )r z
Handles adoption of existing WordPress sites with imunify-security plugin.
Adoption is a special case of installation where the site already has
the plugin installed but is not tracked in our database.
F
site_foundzwp-plugin-adoptionzwp-plugin-adopt-skip-userz#Adopting imunify-security wp pluginz3Adopted imunify-security wp plugin on {count} sitesz"Found {count} site(s) for adoptionz3Failed to adopt plugin to site={site} error={error}zZAdoption of imunify-security wp plugin was cancelled. Plugin was adopted for {count} sitesz4Error occurred during plugin adoption. error={error}zSkipping adoption of WordPress plugin on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}r c t || d t j t j D | _ d S )Nc h | ] }|j
S r@ )rE )r rs rB <setcomp>z0WordPressSiteAdopter.__init__.<locals>.<setcomp>o s' "
"
"
AI"
"
"
rA )superr r selectrE existing_docroots)r r r __class__s rB r z WordPressSiteAdopter.__init__l sR
u%%%"
"
, 3M4I J J"
"
"
rA c | j | |j | j v r1t | t | |rt
|| nt |h | | dS )a
Record a successfully adopted site and persist it immediately.
For adoption, sites that already exist in the database (flagged as
manually deleted) have their flag cleared. New sites are inserted
into the database right away.
Args:
site: The WordPress site that was processed.
version: The plugin version installed on the site.
N) r r rE r r, r7 r8 r5 r r s rB r z+WordPressSiteAdopter._record_processed_sites s
4 <41 1 1 ' - - - & & &
3#D'222 "D6 * * * **400000rA c K t | d{V sdS t j | d{V }|s t d| dS dS )z
Check if site is ready for adoption.
Args:
site: The WordPress site to check.
Returns:
bool: True if the site is ready for adoption, False otherwise.
NFz2Plugin not installed on site %s, skipping adoptionT)r r r r r| r )r r r" r s rB r z"WordPressSiteAdopter.is_site_ready s WW**400000000 5 ! 4T : ::::::: NND
5trA )
r r r r r r rI r r r r r
__classcell__)r s @rB r r N s N"O$I ; 6I5F
3 L
7 H$
1 1 1. rA r )r rG )FN)rE N)NN)rr r loggingr r r collectionsr collections.abcr r distutils.versionr functoolsr pathlibr defence360agent.apir defence360agent.contracts.configr
r~ r r r
r defence360agent.filesr r defence360agent.sentryr defence360agent.utilsr defence360agent.utils.fd_opsr r r r r defence360agent.subsys.panelsr "defence360agent.wordpress.wp_rulesr r defence360agent.model.wordpressr r &defence360agent.model.wp_disabled_ruler defence360agent.wordpressr r #defence360agent.wordpress.constantsr defence360agent.wordpress.utilsr! r" r# r$ r% r& r' r( r) r* r+ )defence360agent.wordpress.site_repositoryr, r- r. r/ r0 r1 r2 r3 r4 r5 r6 r7 r8 $defence360agent.wordpress.proxy_authr9 getLoggerr r| rC rK Lockr r rW r[ rH rL rQ rT rX strr] rg ri rf tupler` rl rp rv rx COMPONENTS_DB_PATHr dictr r
struct_passwdr r r r r r r r r r r r intr$ r( r r r/ r1 r9 r r r@ rG r_ rd rg ri rk rl ro rt rv r r r r floatr r rn r r r r r r r r@ rA rB <module>r s
# # # # # # / / / / / / / / * * * * * * * * * * * * 2 1 1 1 1 1 1 1 . . . . . . * * * * * * 7 6 6 6 6 6 7 7 7 7 7 7 B A A A A A A A A A A A A A 4 4 4 4 4 4 4 4 C C C C C C K J J J J J 8 $ $ &',.. " # $. !$ $ $ $ $$$ $ $ $ $d *t * * * * !c ! ! ! !" - U4t#3 4 ,# ,%c :J , , , , C D
C D #3 #4 # # # # TJ
< << < < < < "U "td{ " " " "J& & &
t
(9
t
;& ;6B ; ; ; ;F80A 8 8 8 8: :d : : : :& 7 7 7B! ! !
!
!
! 3 `; `; `;F F >) )# ) ) ) )X"; "; ";J$
$
$
P 26; ;#&v;; ; ; ;<ADL A A A AR +/
4' Tk
8 +/
4'
Tk
( +/
4'
Tk
.7tF| 7 7 7 7 7t!
!
!
!
!
!
!
!
!
!
V $
n n <n "C-y>n
n
n n
n n n nb S 0#-% #-T #-d #- #- #- #-L (7<>> $ *P *P *P *PZ + + + + @
d6l
t
(4# 4$ 4 4 4 4n
3c
3d
3
3
3
3 . . . .,M ,M ,M ,M^/ / /# / / / /0%
%
%
%
%
%
%
%
%
%
R !%
/ /
#Y
/
/ / / /dG G G GT
&V & & & & &R5
5$'5 5 5 5 5p: : :za a a a a a a a H R R R R R1 R R R R RrA defence360agent/wordpress/__pycache__/proxy_auth.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000016623 00000000000 022661 0 ustar
r_jH N d dl Z d dlZd dlZd dlZd dlZd dlmZmZ d dlmZ d dl m
Z
d dl m Z d dl
mZmZmZ ej e Z ed Zd Zd
Zd Z ed
Zd Zd Z ed defd Z de de de fdZ de de ddfdZ dej! ddfdZ"dS ) N)datetime timedelta) lru_cache)Path)atomic_rewrite)ensure_site_data_directory format_php_with_embedded_json!write_plugin_data_file_atomicallyH )hoursz#/etc/imunify-agent-proxy/jwt-secretz'/etc/imunify-agent-proxy/jwt-secret.oldzimunify-agent-proxy )daysc t j t } | j }n# t $ r d}Y nw xY wt j |z
t k S )Ng )
osstatJWT_SECRET_PATHst_mtimeFileNotFoundErrorr now timestampSECRET_EXPIRATION_TTL
total_seconds)r r s Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/proxy_auth.pyis_secret_expiredr s| !w'' = ""X-
-
-
/
/ 0s # 22c K t t } t d t j d }| j ddd | d t | |dt t d t
d S # t $ r(}t d
|d Y d }~d S d }~ww xY w)
zRotate the proxy JWT secret on disk: backup current to .old and
write a fresh 32-byte secret atomically. Invalidates the in-process
cache so subsequent generate_token() calls read the new secret.
zRotating proxy auth secret i T)modeparentsexist_oki )r )uidbackup permissionsz'Got error while rotating the secret: %s)exc_infoN)r r loggerinfosecrets token_bytesparentmkdirtouchr strJWT_SECRET_PATH_OLDload_secret_from_file cache_clear Exceptionerror) secret_path stub_secretes r
rotate_secretr5 * s
''K
0111 )"-- eTD IIIu%%% *++
))+++++
5q4
s B B: :
C, C''C, returnc ^ t t d 5 } | cddd S # 1 swxY w Y dS # t $ r" t
dt t $ r!}t
d| d}~ww xY w)z.Load JWT secret from the configured file path.rbNz JWT secret file not found at %sz Failed to read JWT secret: %s)openr readstripr r% r1 r0 )fr4 s r r. r. C s
/4
(
( $A6688>>## $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ 6HHH
4a888
s9 A &A
A
AA AA 4B, B''B,usernamedocrootc t j t z }|| |d} ddl}| |t d }|S # t $ r!}t d| d}~ww xY w)z
Generate a JWT token for the given username and docroots.
Args:
username: The username for the token
docroot: document root paths the user has access to
Returns:
The JWT token string
)expr> site_pathr NHS256) algorithmz Failed to generate JWT token: %s) r utcnowDEFAULT_TOKEN_EXPIRATIONjwtencoder. r0 r% r1 )r> r? exp_timeclaimsrG tokenr4 s r generate_tokenrL Q s #;;H 8'
J
JF
6#8#:#:g
NN 7;;;
s )A
A8 A33A8rK gidc l K t j | }t | | d{V }|dz }d|i}t | }t j t |||| d{V t d| | dS # t $ r"} t
d| | d} ~ ww xY w)z
Create the auth.php file in the site's imunify-security directory.
Args:
site: WPSite instance
token: JWT token string
uid, gid: int used for file creation
Nzauth.phprK z'Created auth.php file for site %s at %sz.Failed to create auth.php file for site %s: %s) pwdgetpwuidr r asyncio to_threadr
r% r& r0 r1 )
siterK r! rM user_infodata_dirauth_file_path auth_data php_contentr4 s
r create_auth_php_filerY m s L%% 4D)DDDDDDDD!J. e$ 3I>> -
5t^
EtQOOO
s BB
B3 B..B3rT c 2 K t |j t | j }t | ||j |j d{V t d| dS # t $ r"}t
d| | d}~ww xY w)z
Set up authentication for a site by creating JWT token and auth.php file.
Args:
site: WPSite instance
user_info: pwd.struct_passwd data
Nz.Successfully set up authentication for site %sz/Failed to set up authentication for site %s: %s) rL pw_namer, r? rY pw_uidpw_gidr% r& r0 r1 )rS rT rK r4 s r setup_site_authenticationr^ s y 0#dl2C2CDD" %)9+;
DdKKKKK =tQ
s A$A* *
B4 BB)#rQ loggingr rO r' r r functoolsr pathlibr defence360agent.utilsr defence360agent.wordpress.utilsr r r
getLogger__name__r% rF r r- PROXY_SERVICE_NAMEr r r5 bytesr. r, rL intrY
struct_passwdr^ r <module>rl s
( ( ( ( ( ( ( ( 0 0 0 0 0 0
8 $ $$92... 7? * ! q)))
2 1
u
S 3 3 8%C %3 %4 % % % %P& rk defence360agent/wordpress/__pycache__/proxy_auth.cpython-311.pyc 0000644 0000000 0000000 00000016623 00000000000 021722 0 ustar
r_jH N d dl Z d dlZd dlZd dlZd dlZd dlmZmZ d dlmZ d dl m
Z
d dl m Z d dl
mZmZmZ ej e Z ed Zd Zd
Zd Z ed
Zd Zd Z ed defd Z de de de fdZ de de ddfdZ dej! ddfdZ"dS ) N)datetime timedelta) lru_cache)Path)atomic_rewrite)ensure_site_data_directory format_php_with_embedded_json!write_plugin_data_file_atomicallyH )hoursz#/etc/imunify-agent-proxy/jwt-secretz'/etc/imunify-agent-proxy/jwt-secret.oldzimunify-agent-proxy )daysc t j t } | j }n# t $ r d}Y nw xY wt j |z
t k S )Ng )
osstatJWT_SECRET_PATHst_mtimeFileNotFoundErrorr now timestampSECRET_EXPIRATION_TTL
total_seconds)r r s Y/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/proxy_auth.pyis_secret_expiredr s| !w'' = ""X-
-
-
/
/ 0s # 22c K t t } t d t j d }| j ddd | d t | |dt t d t
d S # t $ r(}t d
|d Y d }~d S d }~ww xY w)
zRotate the proxy JWT secret on disk: backup current to .old and
write a fresh 32-byte secret atomically. Invalidates the in-process
cache so subsequent generate_token() calls read the new secret.
zRotating proxy auth secret i T)modeparentsexist_oki )r )uidbackup permissionsz'Got error while rotating the secret: %s)exc_infoN)r r loggerinfosecrets token_bytesparentmkdirtouchr strJWT_SECRET_PATH_OLDload_secret_from_file cache_clear Exceptionerror) secret_path stub_secretes r
rotate_secretr5 * s
''K
0111 )"-- eTD IIIu%%% *++
))+++++
5q4
s B B: :
C, C''C, returnc ^ t t d 5 } | cddd S # 1 swxY w Y dS # t $ r" t
dt t $ r!}t
d| d}~ww xY w)z.Load JWT secret from the configured file path.rbNz JWT secret file not found at %sz Failed to read JWT secret: %s)openr readstripr r% r1 r0 )fr4 s r r. r. C s
/4
(
( $A6688>>## $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ 6HHH
4a888
s9 A &A
A
AA AA 4B, B''B,usernamedocrootc t j t z }|| |d} ddl}| |t d }|S # t $ r!}t d| d}~ww xY w)z
Generate a JWT token for the given username and docroots.
Args:
username: The username for the token
docroot: document root paths the user has access to
Returns:
The JWT token string
)expr> site_pathr NHS256) algorithmz Failed to generate JWT token: %s) r utcnowDEFAULT_TOKEN_EXPIRATIONjwtencoder. r0 r% r1 )r> r? exp_timeclaimsrG tokenr4 s r generate_tokenrL Q s #;;H 8'
J
JF
6#8#:#:g
NN 7;;;
s )A
A8 A33A8rK gidc l K t j | }t | | d{V }|dz }d|i}t | }t j t |||| d{V t d| | dS # t $ r"} t
d| | d} ~ ww xY w)z
Create the auth.php file in the site's imunify-security directory.
Args:
site: WPSite instance
token: JWT token string
uid, gid: int used for file creation
Nzauth.phprK z'Created auth.php file for site %s at %sz.Failed to create auth.php file for site %s: %s) pwdgetpwuidr r asyncio to_threadr
r% r& r0 r1 )
siterK r! rM user_infodata_dirauth_file_path auth_data php_contentr4 s
r create_auth_php_filerY m s L%% 4D)DDDDDDDD!J. e$ 3I>> -
5t^
EtQOOO
s BB
B3 B..B3rT c 2 K t |j t | j }t | ||j |j d{V t d| dS # t $ r"}t
d| | d}~ww xY w)z
Set up authentication for a site by creating JWT token and auth.php file.
Args:
site: WPSite instance
user_info: pwd.struct_passwd data
Nz.Successfully set up authentication for site %sz/Failed to set up authentication for site %s: %s) rL pw_namer, r? rY pw_uidpw_gidr% r& r0 r1 )rS rT rK r4 s r setup_site_authenticationr^ s y 0#dl2C2CDD" %)9+;
DdKKKKK =tQ
s A$A* *
B4 BB)#rQ loggingr rO r' r r functoolsr pathlibr defence360agent.utilsr defence360agent.wordpress.utilsr r r
getLogger__name__r% rF r r- PROXY_SERVICE_NAMEr r r5 bytesr. r, rL intrY
struct_passwdr^ r <module>rl s
( ( ( ( ( ( ( ( 0 0 0 0 0 0
8 $ $$92... 7? * ! q)))
2 1
u
S 3 3 8%C %3 %4 % % % %P& rk defence360agent/wordpress/__pycache__/site_repository.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000063554 00000000000 023727 0 ustar
r_jG d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m
Z
d dl m Z m
Z
d dlmZ ej e Z ed Zded ee fd
Zd ej d ee fd Zd ee fd
Zd ee fdZdee d dfdZ ded ee fdZ de de d dfdZ d,dee d ee fdZ de ded dfdZ!de d dfdZ" d-de#dz d e#dz d e#d e$e#ee f fd Z%d e&e#e#f fd Z'd ee fd Z(d!ee d ee fd"Z)d# Z* e
ed$d%d&e*' de d e#fd( Z+d ee fd)Z,d ee fd*Z-de d dfd+Z.dS ). N)Path)SqliteDatabaseOperationalErrorfn)retry_on)WPSite
WordpressSite) PLUGIN_SLUGzD/var/lib/cloudlinux-app-version-detector/components_versions.sqlite3pathreturnc < t s;t dt t t S t
t d| d }d | D S )a
Get a list of WordPress sites that match the given path.
Args:
path: The path to search for WordPress sites.
Note: The same WordPress site (real_path) can appear in multiple reports
if it was scanned directly and also as part of a parent folder scan.
We use only the entry from the latest report for each real_path.
Returns:
A list of WPSite objects that match the path.
-App detector database '%s' couldn't be found.a
WITH latest_reports AS (
SELECT id, uid, domain, dir
FROM report
WHERE id IN (
SELECT MAX(id)
FROM report
WHERE domain IS NOT NULL
AND domain != ''
GROUP BY dir
)
),
-- Get all WordPress sites with their report IDs
all_wp_sites AS (
SELECT wp.real_path, lr.domain, lr.uid, lr.id as report_id
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE 'a %'
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
)
-- For each real_path, keep only the entry from the latest report
SELECT real_path, domain, uid
FROM all_wp_sites
WHERE (real_path, report_id) IN (
SELECT real_path, MAX(report_id)
FROM all_wp_sites
GROUP BY real_path
)
c
p g | ]3}t |d |d t |d 4S r )docrootdomainuidr int.0rows ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/site_repository.py
<listcomp>z%get_sites_by_path.<locals>.<listcomp>I I s1vc!f#c!f++>>> ) COMPONENTS_DB_PATHexistsloggererrorstrlistr execute_sqlfetchall)r cursors r get_sites_by_pathr( s $ $ & & ; " # #
vv
.
/
/
;
; ( )-) ! !FD ??$$ r user_infoc t r| ;t dt t t S | (t d t S t
t d| j d }d | D S )aq
Get a set of paths to WordPress sites belonging to a particular user. Paths are sorted by their length to make sure
that the main site is the last one in the list.
The data is pulled from the app-version-detector database.
Args:
user_info: The user info with ID to get sites for.
Returns:
A list of paths to WordPress sites.
Nr z'No user info provided for getting sitesz
WITH latest_reports AS (
SELECT MAX(id) as id, dir
FROM report
WHERE uid = a
GROUP BY dir
)
SELECT wp.real_path
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
GROUP BY wp.real_path
ORDER BY length(wp.real_path) DESC
c g | ]
}|d S )r r s r r z&get_sites_for_user.<locals>.<listcomp>z s 0 0 0sCF 0 0 0r )
r r r! r" r# r$ r r% pw_uidr& )r) r' s r get_sites_for_userr. O s $ $ & & )*; ; " # #
vv
5
vv
.
/
/
;
; ' - F& 1 0foo / / 0 0 00r c b t s;t dt t t S t
t dt j dd d } d |
D S )a
Get a set of wp sites where imunify-security plugin is not installed.
The data is pulled from the app-version-detector database.
Note: The same WordPress site (real_path) can appear in multiple reports
if it was scanned directly and also as part of a parent folder scan.
We use only the entry from the latest report for each real_path.
Returns:
A set of WPSite objects where the plugin is not installed.
r a
WITH latest_reports AS (
SELECT id, uid, domain, dir
FROM report
WHERE id IN (
SELECT MAX(id)
FROM report
WHERE domain IS NOT NULL
AND domain != ''
GROUP BY dir
)
),
-- Get all WordPress sites with their report IDs.
-- The real_path LIKE guard filters out orphaned apps rows
-- left behind when AVD rescans and rebuilds the report table.
all_wp_sites AS (
SELECT wp.id as wp_id, wp.real_path, lr.domain, lr.uid,
lr.id as report_id
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
),
-- For each real_path, keep only the entry from the latest report
latest_wp_sites AS (
SELECT wp_id, real_path, domain, uid, report_id
FROM all_wp_sites
WHERE (real_path, report_id) IN (
SELECT real_path, MAX(report_id)
FROM all_wp_sites
GROUP BY real_path
)
)
SELECT real_path, domain, uid
FROM latest_wp_sites lws
WHERE NOT EXISTS (
SELECT 1
FROM apps AS plugin
WHERE plugin.parent_id = lws.wp_id
AND plugin.title = 'wp_plugin_-_'
)
c
p h | ]3}t |d |d t |d 4S r r r s r <setcomp>z+get_sites_without_plugin.<locals>.<setcomp> r r r r r! r" r# setr r% r
replacer& r' s r get_sites_without_pluginr9 } $ $ & & ; " # #
uu
.
/
/
;
;+ R 0;/B3/L/LS+ + + - -F\ ??$$ r c t } d t j t j D fd| D S )a
Get a set of WordPress sites where we need to install the plugin.
This is determined by finding sites that don't have the plugin installed
and are not already tracked in our database.
Returns:
A set of WPSite objects where the plugin needs to be installed.
c h | ] }|j
S r, r r rs r r4 z'get_sites_to_install.<locals>.<setcomp> s' r c & h | ]
}|j v |S r, r= )r sexisting_docrootss r r4 z'get_sites_to_install.<locals>.<setcomp> s- 19<M+M+M+M+M+Mr )r9 r selectr )sites_without_pluginrB s @r get_sites_to_installrE si 455 (/
0EFF ' r sitesc n | sdS t j d | D dS )z
Insert a set of installed WordPress sites into the database.
This is used to track which sites have the plugin installed.
Args:
sites: A set of WPSite objects representing sites where the plugin was installed.
Nc F g | ] }|j |j |j |j d d S )N)r r r versionmanually_deleted_at)r r r rI r sites r r z*insert_installed_sites.<locals>.<listcomp> sH
+ <x <'+
r )r insert_manyexecute)rF s r insert_installed_sitesrO sP
giiiiir latest_versionc | s t d g S d t j t j t j | k D S )a
Get a list of WordPress sites that have outdated plugin versions.
Args:
latest_version: The latest available plugin version to compare against.
Returns:
A list of WPSite objects that have versions older than latest_version.
z8Cannot get outdated sites without a valid latest versionc 6 g | ]}t j | S r, r from_wordpress_siter> s r r z&get_outdated_sites.<locals>.<listcomp> 3
"1%% r )r! r" r rC whererJ is_nullrI )rP s r get_outdated_sitesrX s F
%''-- - 5 5 7 7 !^ 3
r rL timestampc t d| | t j | t j | j k dS )z
Mark a WordPress site as manually deleted in the database.
Args:
site: The WPSite object to mark as deleted
timestamp: The timestamp when the site was deleted
z:Mark site %s as manually deleted at %s (WP-Plugin removed)rJ Nr! infor updaterV r rN )rL rY s r mark_site_as_manually_deletedr_ s\ KKD ;;; }$ 4 5 5 r freshly_installed_sitesc 2 t }d |D }d t j t j D |t
z }| r|d | D z }fd|D S )a
Get a set of WordPress sites that should be marked as manually deleted.
These are sites that are in our database but no longer have the plugin installed.
Args:
freshly_installed_sites: Optional set of sites that were just installed and should be excluded
from being marked as manually deleted to avoid race conditions.
Returns:
set[WPSite]: A set of WordPress sites that should be marked as manually deleted
c h | ] }|j
S r, r= r rA s r r4 z8get_sites_to_mark_as_manually_deleted.<locals>.<setcomp>- s G G GQqy G G Gr c B i | ] }|j t j | S r, )r r rT r> s r
<dictcomp>z9get_sites_to_mark_as_manually_deleted.<locals>.<dictcomp>0 s7
6-a00 r c h | ] }|j
S r, r= rc s r r4 z8get_sites_to_mark_as_manually_deleted.<locals>.<setcomp>< s H H H1QY H H Hr c h | ]
}| S r, r, )r dactive_db_sitess r r4 z8get_sites_to_mark_as_manually_deleted.<locals>.<setcomp>> s 9 9 91OA 9 9 9r )r9 r rC rV rJ rW r6 )r` rD docroots_without_plugindocroots_to_markri s @r %get_sites_to_mark_as_manually_deletedrl s 455 G G2F G G G %''-- - 5 5 7 7
O /_1E1EE I H H0G H H HH 9 9 9 9(8 9 9 99r rI c t j | t j | j k dS )z
Update the version of a WordPress site in the database.
Args:
site: The WPSite object to update
version: The new version to set
)rI N)r r^ rV r rN )rL rI s r update_site_versionrn A sA )))// -
giiiiir c t j | j | j t j | j k dS )z
Update the domain and uid of a WordPress site in the database
to match what AVD currently reports.
Args:
site: The WPSite object with the current domain and uid from AVD.
)r r N)r r^ r r rV r rN rL s r update_site_identityrq N sG :::@@ -
giiiiir r limitoffsetc ~ t j t j d }| #| t j | k }| }|| | }|dk r| | }d |D }||fS )a/
Get active installed WordPress sites with optional filtering and pagination.
Args:
uid: Optional user ID to filter sites by owner
limit: Maximum number of sites to return
offset: Number of sites to skip
Returns:
Tuple of (total_count, paginated_sites)
TNr c 6 g | ]}t j | S r, rS rK s r r z1get_installed_sites_paginated.<locals>.<listcomp>x s# @ @ @$V
'
-
- @ @ @r ) r rC rV rJ rW r countrr rs )r rr rs query total_countrF s r get_installed_sites_paginatedry [ s
" " ( ()11$77
E M - 455++--K E""
zz V$$ @ @% @ @ @E r c t t j t j t j t j d t j d
t j } d | D S )aK
Count active installed WordPress sites per owner uid in one query.
Mirrors get_installed_sites_paginated's active-site filter
(manually_deleted_at IS NULL). Uids with no active sites are absent
from the result rather than mapped to 0.
Returns:
Mapping of uid -> number of active installed sites.
rv Tc , i | ]}|d |d S )r rv r, r s r re z0count_installed_sites_by_uid.<locals>.<dictcomp> s" 6 6 6CJG 6 6 6r ) r rC r r COUNTr aliasrV rJ rW group_bydicts)rw s r count_installed_sites_by_uidr | s H]* + + 1 1' : :
}088>> ? ? -# $ $
7 6 6 6 66r c ( t \ } }|S )z
Get a list of active installed WordPress sites.
These are sites that haven't been marked as manually deleted.
Returns:
A list of WPSite objects representing non-deleted sites.
)ry )r1 rF s r get_installed_sitesr s -..HAu Lr domainsc | sg S d t j t j d t j | D S )z
Get active installed WordPress sites filtered by domain names.
Args:
domains: List of domain names to filter by
Returns:
List of WPSite objects matching the given domains
c 6 g | ]}t j | S r, rS r> s r r z2get_installed_sites_by_domains.<locals>.<listcomp> rU r T)r rC rV rJ rW r in_)r s r get_installed_sites_by_domainsr ss %''-- - 5 5d ; ; $ $W - -
r c > K t j d d {V d S )Ng ?)asynciosleep) exceptionattempts r sleep_on_errorr s.
-
r TF) max_triessilentlogon_errorc t j t j | j k S )a"
Delete a WordPress site from the database with retry logic.
Will retry up to 3 times on database operational errors with 0.5s delay between attempts.
Args:
site: The WPSite object to delete
Returns:
The number of rows affected by the delete operation
)r deleterV r rN rp s r delete_siter s5 & }$ 4 5 5 r c b t s;t dt t t S t
t dt j dd d } d |
D S )a
Get a set of WordPress sites where the imunify-security plugin is installed.
The data is pulled from the app-version-detector database.
Note: The same WordPress site (real_path) can appear in multiple reports
if it was scanned directly and also as part of a parent folder scan.
We use only the entry from the latest report for each real_path.
Returns:
A set of WPSite objects where the plugin is installed.
r a
WITH latest_reports AS (
SELECT id, uid, domain, dir
FROM report
WHERE id IN (
SELECT MAX(id)
FROM report
WHERE domain IS NOT NULL
AND domain != ''
GROUP BY dir
)
),
-- Get all WordPress sites with their report IDs.
-- The real_path LIKE guard filters out orphaned apps rows
-- left behind when AVD rescans and rebuilds the report table.
all_wp_sites AS (
SELECT wp.id as wp_id, wp.real_path, lr.domain, lr.uid,
lr.id as report_id
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
),
-- For each real_path, keep only the entry from the latest report
latest_wp_sites AS (
SELECT wp_id, real_path, domain, uid, report_id
FROM all_wp_sites
WHERE (real_path, report_id) IN (
SELECT real_path, MAX(report_id)
FROM all_wp_sites
GROUP BY real_path
)
)
SELECT real_path, domain, uid
FROM latest_wp_sites lws
WHERE EXISTS (
SELECT 1
FROM apps AS plugin
WHERE plugin.parent_id = lws.wp_id
AND plugin.title = 'wp_plugin_r0 r1 r2 c
p h | ]3}t |d |d t |d 4S r r r s r r4 z(get_sites_with_plugin.<locals>.<setcomp> r r r5 r8 s r get_sites_with_pluginr r: r c t } d t j t j t j d D fd| D S )aI
Get a set of WordPress sites that should be adopted.
These are sites where the plugin is installed but either:
- Not tracked in our database (e.g., copied/migrated sites)
- Flagged as manually removed (from past bugs or manual reinstall)
Returns:
A set of WPSite objects that should be adopted.
c h | ] }|j
S r, r= r> s r r4 z%get_sites_to_adopt.<locals>.<setcomp>' s*
r Tc & h | ]
}|j v |S r, r= )r rA tracked_docrootss r r4 z%get_sites_to_adopt.<locals>.<setcomp>. s& N N N!AI=M,M,MA,M,M,Mr )r r rC r rV rJ rW )sites_with_pluginr s @r get_sites_to_adoptr s .// %m&;<<BB - 5 5d ; ;
O N N N( N N NNr c t d| t j d t j | j k dS )z
Clear the manually_deleted_at flag for a WordPress site.
This is used when adopting a site that was previously marked as manually deleted.
Args:
site: The WPSite object to clear the flag for
z<Clearing manually_deleted_at flag for site %s (plugin found)Nr[ r\ rp s r clear_manually_deleted_flagr 1 sY KKF
666 }$ 4 5 5 r )N)NNr )/r loggingpwdpathlibr peeweer r r defence360agent.utilsr defence360agent.model.wordpressr r #defence360agent.wordpress.constantsr
getLogger__name__r! r r# r$ r(
struct_passwdr. r6 r9 rE rO rX floatr_ rl rn rq r tuplery dictr r r r r r r r r, r r <module>r s
7 7 7 7 7 7 7 7 7 7 * * * * * * A A A A A A A A ; ; ; ; ; ; 8 $ $TJ
:C :DL : : : :z+1#"3 +1S +1 +1 +1 +1\E#f+ E E E EPc&k $#f+ $ 2s tF| 2 5 T * ,0!: !: [!:[!: !: !: !:H
f
s
t
v
$
t :
3V B7d38n 7 7 7 7. T&\ DI $v, ,
f $Es6{ E E E EPOCK O O O O.f r defence360agent/wordpress/__pycache__/site_repository.cpython-311.pyc 0000644 0000000 0000000 00000063554 00000000000 022770 0 ustar
r_jG d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m
Z
d dl m Z m
Z
d dlmZ ej e Z ed Zded ee fd
Zd ej d ee fd Zd ee fd
Zd ee fdZdee d dfdZ ded ee fdZ de de d dfdZ d,dee d ee fdZ de ded dfdZ!de d dfdZ" d-de#dz d e#dz d e#d e$e#ee f fd Z%d e&e#e#f fd Z'd ee fd Z(d!ee d ee fd"Z)d# Z* e
ed$d%d&e*' de d e#fd( Z+d ee fd)Z,d ee fd*Z-de d dfd+Z.dS ). N)Path)SqliteDatabaseOperationalErrorfn)retry_on)WPSite
WordpressSite) PLUGIN_SLUGzD/var/lib/cloudlinux-app-version-detector/components_versions.sqlite3pathreturnc < t s;t dt t t S t
t d| d }d | D S )a
Get a list of WordPress sites that match the given path.
Args:
path: The path to search for WordPress sites.
Note: The same WordPress site (real_path) can appear in multiple reports
if it was scanned directly and also as part of a parent folder scan.
We use only the entry from the latest report for each real_path.
Returns:
A list of WPSite objects that match the path.
-App detector database '%s' couldn't be found.a
WITH latest_reports AS (
SELECT id, uid, domain, dir
FROM report
WHERE id IN (
SELECT MAX(id)
FROM report
WHERE domain IS NOT NULL
AND domain != ''
GROUP BY dir
)
),
-- Get all WordPress sites with their report IDs
all_wp_sites AS (
SELECT wp.real_path, lr.domain, lr.uid, lr.id as report_id
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE 'a %'
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
)
-- For each real_path, keep only the entry from the latest report
SELECT real_path, domain, uid
FROM all_wp_sites
WHERE (real_path, report_id) IN (
SELECT real_path, MAX(report_id)
FROM all_wp_sites
GROUP BY real_path
)
c
p g | ]3}t |d |d t |d 4S r )docrootdomainuidr int.0rows ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/site_repository.py
<listcomp>z%get_sites_by_path.<locals>.<listcomp>I I s1vc!f#c!f++>>> ) COMPONENTS_DB_PATHexistsloggererrorstrlistr execute_sqlfetchall)r cursors r get_sites_by_pathr( s $ $ & & ; " # #
vv
.
/
/
;
; ( )-) ! !FD ??$$ r user_infoc t r| ;t dt t t S | (t d t S t
t d| j d }d | D S )aq
Get a set of paths to WordPress sites belonging to a particular user. Paths are sorted by their length to make sure
that the main site is the last one in the list.
The data is pulled from the app-version-detector database.
Args:
user_info: The user info with ID to get sites for.
Returns:
A list of paths to WordPress sites.
Nr z'No user info provided for getting sitesz
WITH latest_reports AS (
SELECT MAX(id) as id, dir
FROM report
WHERE uid = a
GROUP BY dir
)
SELECT wp.real_path
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
GROUP BY wp.real_path
ORDER BY length(wp.real_path) DESC
c g | ]
}|d S )r r s r r z&get_sites_for_user.<locals>.<listcomp>z s 0 0 0sCF 0 0 0r )
r r r! r" r# r$ r r% pw_uidr& )r) r' s r get_sites_for_userr. O s $ $ & & )*; ; " # #
vv
5
vv
.
/
/
;
; ' - F& 1 0foo / / 0 0 00r c b t s;t dt t t S t
t dt j dd d } d |
D S )a
Get a set of wp sites where imunify-security plugin is not installed.
The data is pulled from the app-version-detector database.
Note: The same WordPress site (real_path) can appear in multiple reports
if it was scanned directly and also as part of a parent folder scan.
We use only the entry from the latest report for each real_path.
Returns:
A set of WPSite objects where the plugin is not installed.
r a
WITH latest_reports AS (
SELECT id, uid, domain, dir
FROM report
WHERE id IN (
SELECT MAX(id)
FROM report
WHERE domain IS NOT NULL
AND domain != ''
GROUP BY dir
)
),
-- Get all WordPress sites with their report IDs.
-- The real_path LIKE guard filters out orphaned apps rows
-- left behind when AVD rescans and rebuilds the report table.
all_wp_sites AS (
SELECT wp.id as wp_id, wp.real_path, lr.domain, lr.uid,
lr.id as report_id
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
),
-- For each real_path, keep only the entry from the latest report
latest_wp_sites AS (
SELECT wp_id, real_path, domain, uid, report_id
FROM all_wp_sites
WHERE (real_path, report_id) IN (
SELECT real_path, MAX(report_id)
FROM all_wp_sites
GROUP BY real_path
)
)
SELECT real_path, domain, uid
FROM latest_wp_sites lws
WHERE NOT EXISTS (
SELECT 1
FROM apps AS plugin
WHERE plugin.parent_id = lws.wp_id
AND plugin.title = 'wp_plugin_-_'
)
c
p h | ]3}t |d |d t |d 4S r r r s r <setcomp>z+get_sites_without_plugin.<locals>.<setcomp> r r r r r! r" r# setr r% r
replacer& r' s r get_sites_without_pluginr9 } $ $ & & ; " # #
uu
.
/
/
;
;+ R 0;/B3/L/LS+ + + - -F\ ??$$ r c t } d t j t j D fd| D S )a
Get a set of WordPress sites where we need to install the plugin.
This is determined by finding sites that don't have the plugin installed
and are not already tracked in our database.
Returns:
A set of WPSite objects where the plugin needs to be installed.
c h | ] }|j
S r, r r rs r r4 z'get_sites_to_install.<locals>.<setcomp> s' r c & h | ]
}|j v |S r, r= )r sexisting_docrootss r r4 z'get_sites_to_install.<locals>.<setcomp> s- 19<M+M+M+M+M+Mr )r9 r selectr )sites_without_pluginrB s @r get_sites_to_installrE si 455 (/
0EFF ' r sitesc n | sdS t j d | D dS )z
Insert a set of installed WordPress sites into the database.
This is used to track which sites have the plugin installed.
Args:
sites: A set of WPSite objects representing sites where the plugin was installed.
Nc F g | ] }|j |j |j |j d d S )N)r r r versionmanually_deleted_at)r r r rI r sites r r z*insert_installed_sites.<locals>.<listcomp> sH
+ <x <'+
r )r insert_manyexecute)rF s r insert_installed_sitesrO sP
giiiiir latest_versionc | s t d g S d t j t j t j | k D S )a
Get a list of WordPress sites that have outdated plugin versions.
Args:
latest_version: The latest available plugin version to compare against.
Returns:
A list of WPSite objects that have versions older than latest_version.
z8Cannot get outdated sites without a valid latest versionc 6 g | ]}t j | S r, r from_wordpress_siter> s r r z&get_outdated_sites.<locals>.<listcomp> 3
"1%% r )r! r" r rC whererJ is_nullrI )rP s r get_outdated_sitesrX s F
%''-- - 5 5 7 7 !^ 3
r rL timestampc t d| | t j | t j | j k dS )z
Mark a WordPress site as manually deleted in the database.
Args:
site: The WPSite object to mark as deleted
timestamp: The timestamp when the site was deleted
z:Mark site %s as manually deleted at %s (WP-Plugin removed)rJ Nr! infor updaterV r rN )rL rY s r mark_site_as_manually_deletedr_ s\ KKD ;;; }$ 4 5 5 r freshly_installed_sitesc 2 t }d |D }d t j t j D |t
z }| r|d | D z }fd|D S )a
Get a set of WordPress sites that should be marked as manually deleted.
These are sites that are in our database but no longer have the plugin installed.
Args:
freshly_installed_sites: Optional set of sites that were just installed and should be excluded
from being marked as manually deleted to avoid race conditions.
Returns:
set[WPSite]: A set of WordPress sites that should be marked as manually deleted
c h | ] }|j
S r, r= r rA s r r4 z8get_sites_to_mark_as_manually_deleted.<locals>.<setcomp>- s G G GQqy G G Gr c B i | ] }|j t j | S r, )r r rT r> s r
<dictcomp>z9get_sites_to_mark_as_manually_deleted.<locals>.<dictcomp>0 s7
6-a00 r c h | ] }|j
S r, r= rc s r r4 z8get_sites_to_mark_as_manually_deleted.<locals>.<setcomp>< s H H H1QY H H Hr c h | ]
}| S r, r, )r dactive_db_sitess r r4 z8get_sites_to_mark_as_manually_deleted.<locals>.<setcomp>> s 9 9 91OA 9 9 9r )r9 r rC rV rJ rW r6 )r` rD docroots_without_plugindocroots_to_markri s @r %get_sites_to_mark_as_manually_deletedrl s 455 G G2F G G G %''-- - 5 5 7 7
O /_1E1EE I H H0G H H HH 9 9 9 9(8 9 9 99r rI c t j | t j | j k dS )z
Update the version of a WordPress site in the database.
Args:
site: The WPSite object to update
version: The new version to set
)rI N)r r^ rV r rN )rL rI s r update_site_versionrn A sA )))// -
giiiiir c t j | j | j t j | j k dS )z
Update the domain and uid of a WordPress site in the database
to match what AVD currently reports.
Args:
site: The WPSite object with the current domain and uid from AVD.
)r r N)r r^ r r rV r rN rL s r update_site_identityrq N sG :::@@ -
giiiiir r limitoffsetc ~ t j t j d }| #| t j | k }| }|| | }|dk r| | }d |D }||fS )a/
Get active installed WordPress sites with optional filtering and pagination.
Args:
uid: Optional user ID to filter sites by owner
limit: Maximum number of sites to return
offset: Number of sites to skip
Returns:
Tuple of (total_count, paginated_sites)
TNr c 6 g | ]}t j | S r, rS rK s r r z1get_installed_sites_paginated.<locals>.<listcomp>x s# @ @ @$V
'
-
- @ @ @r ) r rC rV rJ rW r countrr rs )r rr rs query total_countrF s r get_installed_sites_paginatedry [ s
" " ( ()11$77
E M - 455++--K E""
zz V$$ @ @% @ @ @E r c t t j t j t j t j d t j d
t j } d | D S )aK
Count active installed WordPress sites per owner uid in one query.
Mirrors get_installed_sites_paginated's active-site filter
(manually_deleted_at IS NULL). Uids with no active sites are absent
from the result rather than mapped to 0.
Returns:
Mapping of uid -> number of active installed sites.
rv Tc , i | ]}|d |d S )r rv r, r s r re z0count_installed_sites_by_uid.<locals>.<dictcomp> s" 6 6 6CJG 6 6 6r ) r rC r r COUNTr aliasrV rJ rW group_bydicts)rw s r count_installed_sites_by_uidr | s H]* + + 1 1' : :
}088>> ? ? -# $ $
7 6 6 6 66r c ( t \ } }|S )z
Get a list of active installed WordPress sites.
These are sites that haven't been marked as manually deleted.
Returns:
A list of WPSite objects representing non-deleted sites.
)ry )r1 rF s r get_installed_sitesr s -..HAu Lr domainsc | sg S d t j t j d t j | D S )z
Get active installed WordPress sites filtered by domain names.
Args:
domains: List of domain names to filter by
Returns:
List of WPSite objects matching the given domains
c 6 g | ]}t j | S r, rS r> s r r z2get_installed_sites_by_domains.<locals>.<listcomp> rU r T)r rC rV rJ rW r in_)r s r get_installed_sites_by_domainsr ss %''-- - 5 5d ; ; $ $W - -
r c > K t j d d {V d S )Ng ?)asynciosleep) exceptionattempts r sleep_on_errorr s.
-
r TF) max_triessilentlogon_errorc t j t j | j k S )a"
Delete a WordPress site from the database with retry logic.
Will retry up to 3 times on database operational errors with 0.5s delay between attempts.
Args:
site: The WPSite object to delete
Returns:
The number of rows affected by the delete operation
)r deleterV r rN rp s r delete_siter s5 & }$ 4 5 5 r c b t s;t dt t t S t
t dt j dd d } d |
D S )a
Get a set of WordPress sites where the imunify-security plugin is installed.
The data is pulled from the app-version-detector database.
Note: The same WordPress site (real_path) can appear in multiple reports
if it was scanned directly and also as part of a parent folder scan.
We use only the entry from the latest report for each real_path.
Returns:
A set of WPSite objects where the plugin is installed.
r a
WITH latest_reports AS (
SELECT id, uid, domain, dir
FROM report
WHERE id IN (
SELECT MAX(id)
FROM report
WHERE domain IS NOT NULL
AND domain != ''
GROUP BY dir
)
),
-- Get all WordPress sites with their report IDs.
-- The real_path LIKE guard filters out orphaned apps rows
-- left behind when AVD rescans and rebuilds the report table.
all_wp_sites AS (
SELECT wp.id as wp_id, wp.real_path, lr.domain, lr.uid,
lr.id as report_id
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
),
-- For each real_path, keep only the entry from the latest report
latest_wp_sites AS (
SELECT wp_id, real_path, domain, uid, report_id
FROM all_wp_sites
WHERE (real_path, report_id) IN (
SELECT real_path, MAX(report_id)
FROM all_wp_sites
GROUP BY real_path
)
)
SELECT real_path, domain, uid
FROM latest_wp_sites lws
WHERE EXISTS (
SELECT 1
FROM apps AS plugin
WHERE plugin.parent_id = lws.wp_id
AND plugin.title = 'wp_plugin_r0 r1 r2 c
p h | ]3}t |d |d t |d 4S r r r s r r4 z(get_sites_with_plugin.<locals>.<setcomp> r r r5 r8 s r get_sites_with_pluginr r: r c t } d t j t j t j d D fd| D S )aI
Get a set of WordPress sites that should be adopted.
These are sites where the plugin is installed but either:
- Not tracked in our database (e.g., copied/migrated sites)
- Flagged as manually removed (from past bugs or manual reinstall)
Returns:
A set of WPSite objects that should be adopted.
c h | ] }|j
S r, r= r> s r r4 z%get_sites_to_adopt.<locals>.<setcomp>' s*
r Tc & h | ]
}|j v |S r, r= )r rA tracked_docrootss r r4 z%get_sites_to_adopt.<locals>.<setcomp>. s& N N N!AI=M,M,MA,M,M,Mr )r r rC r rV rJ rW )sites_with_pluginr s @r get_sites_to_adoptr s .// %m&;<<BB - 5 5d ; ;
O N N N( N N NNr c t d| t j d t j | j k dS )z
Clear the manually_deleted_at flag for a WordPress site.
This is used when adopting a site that was previously marked as manually deleted.
Args:
site: The WPSite object to clear the flag for
z<Clearing manually_deleted_at flag for site %s (plugin found)Nr[ r\ rp s r clear_manually_deleted_flagr 1 sY KKF
666 }$ 4 5 5 r )N)NNr )/r loggingpwdpathlibr peeweer r r defence360agent.utilsr defence360agent.model.wordpressr r #defence360agent.wordpress.constantsr
getLogger__name__r! r r# r$ r(
struct_passwdr. r6 r9 rE rO rX floatr_ rl rn rq r tuplery dictr r r r r r r r r, r r <module>r s
7 7 7 7 7 7 7 7 7 7 * * * * * * A A A A A A A A ; ; ; ; ; ; 8 $ $TJ
:C :DL : : : :z+1#"3 +1S +1 +1 +1 +1\E#f+ E E E EPc&k $#f+ $ 2s tF| 2 5 T * ,0!: !: [!:[!: !: !: !:H
f
s
t
v
$
t :
3V B7d38n 7 7 7 7. T&\ DI $v, ,
f $Es6{ E E E EPOCK O O O O.f r defence360agent/wordpress/__pycache__/telemetry.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000002046 00000000000 022463 0 ustar
r_j \ d dl Z d dlmZ d dlmZ e j e ZddededefdZ dS ) N) MessageType)WPSiteeventsiteversionc K |d}| t j ||j |j |j | d {V d S )Nz1.0.0)r domain site_pathuserplugin_version)process_messager WordpressPluginTelemetryr docrootuid)sinkr r r s X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/telemetry.py
send_eventr sz
,;l"
)N)
logging"defence360agent.contracts.messagesr defence360agent.model.wordpressr getLogger__name__loggerstrr r r <module>r s| : : : : : : 2 2 2 2 2 2 8 $ $ # V c r defence360agent/wordpress/__pycache__/telemetry.cpython-311.pyc 0000644 0000000 0000000 00000002046 00000000000 021524 0 ustar
r_j \ d dl Z d dlmZ d dlmZ e j e ZddededefdZ dS ) N) MessageType)WPSiteeventsiteversionc K |d}| t j ||j |j |j | d {V d S )Nz1.0.0)r domain site_pathuserplugin_version)process_messager WordpressPluginTelemetryr docrootuid)sinkr r r s X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/telemetry.py
send_eventr sz
,;l"
)N)
logging"defence360agent.contracts.messagesr defence360agent.model.wordpressr getLogger__name__loggerstrr r r <module>r s| : : : : : : 2 2 2 2 2 2 8 $ $ # V c r defence360agent/wordpress/__pycache__/utils.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000066022 00000000000 021615 0 ustar
r_jX d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl m Z m
Z
d dl m Z m
Z
d dlmZ d dlmZ d dlmZmZ d dlmZ d d lmZ d d
lmZ d d l m Z m Z m Z m Z m!Z!m"Z" d d l#m$Z$m%Z% d d
l&m'Z' d dl(m)Z) d dl*m+Z+ dZ,dZ- e!j. ddd Z/e d Z0e d Z1e d Z2 e3d Z4 ej5 e6 Z7de8de9fdZ: e d de;e9e<e9 f fd Z=d e9d e9de<fd!Z> e
d"# de?fd$ Z@d% ZAd&e9d'e<de<fd(ZBd e9d)e9de<e9 fd*ZCd+e'd&e9dee9 fd,ZDd&e9de<fd-ZEd&e9de;fd.ZFd/ ZGde;e9e9dz f fd0ZH dId1eId2eId&e9d+e'd3e;d4e;e9e9dz f dz de;fd5ZJd&e9de;fd6ZKd&e9de;fd7ZLdd8d9e9d:eMd;eMd<eMdz ddf
d=ZNd>e9de9fd?ZOd@e9de9fdAZPdBe;de9fdCZQd9e9de;fdDZRdEed:eMd;eMd<eMddf
dFZSd+e'dGejT defdHZUdS )J N) defaultdict)datetime timedelta)cache lru_cache)Path)Optional)choose_value_from_configMalwareScanScheduleInterval)
LicenseCLN) HostingPanel)Plesk)IMUNIFY_PACKAGE_NAMESasync_lru_cacheatomic_rewrite check_runimportersystem_packages_info)open_dir_no_symlinkssafe_dir)WPSite)WP_CLI_WRAPPER_PATH)PHPErrorz/usr/sbin/cagefs_enter_userz/usr/sbin/cagefsctlzimav.malwarelib.model
MalwareHitmodulenamedefaultc 0 t j ddd S )Nz*imav.malwarelib.scan.queue_supervisor_syncQueueSupervisorSyncr r get T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/utils.py_queue_supervisor_clsr& , s$ <;
" r$ c 0 t j ddd S )N imav.malwarelib.utils.user_listfetch_user_listr r! r# r$ r% _fetch_user_list_fnr* 5 s$ <0
r$ c 0 t j ddd S )Nr( sortr r! r# r$ r% _sort_user_list_fnr- > s$ <0
r$ )balancedstrictmonitorvaluereturnc F t | t r | t v r| S dS )u Coerce a config-read preset value to a canonical preset string.
Returns "balanced" for anything outside _VALID_PRESETS — including
None, non-strings, and hand-edited values like "extreme" or
"BALANCED". The agent always writes lowercase canonical values, so
a non-canonical read indicates either a manual edit or a future
preset that this version doesn't recognise; "balanced" is the safe
fallback in both cases.
r. )
isinstancestr_VALID_PRESETS)r1 s r% _validate_presetr7 L s* % %>"9"9 :r$ < )ttlc K t } | d{V }t t }| D ]%\ }}|D ] }|| | &|S )zN
Get a mapping of docroots to their associated domains, with caching.
N)r
get_domain_pathsr listitemsappend)
hosting_panel panel_paths docroot_mapdomaindocrootsdocroots r% r; r; [ s
!NNM%6688888888K d##K ' - - / / 0 0 0 0G ' ' / / / / 0 r$ php_pathrD c 0 t t | |gS )z Get wp cli common command list)r5 r )rE rD s r%
wp_wrapperrG i s # $ $h 88r$ )maxsizec t j t r$t j t t j st
S t j t dgdd } | j dk rt
S | j
d }t
|dd S )z)Get the list of users enabled for CageFS.z--list-enabledT)capture_outputtextr
rH N)
ospathisfileCAGEFS_CTL_PATHaccessX_OKset
subprocessrun
returncodestdoutstripsplit)resultliness r% get_cagefs_enabled_usersr] n s 7>>/ * * ")3 3 uu
^ *+Dt F A uu M ! ! ' ' - -E uQRRy>>r$ c 8 t dS )z-Clear the cache for get_cagefs_enabled_users.N)r] cache_clearr# r$ r% $clear_get_cagefs_enabled_users_cacher` s ((*****r$ usernameargsc | t v rTt j t r0t j t t j r t d| g|S ddd| dt j | gS )zNBuild the necessary command to run the given cmdline args with specified user.z--no-io-and-memory-limitsuz-sz /bin/bashz-c) r] rN rO rP CAGEFS_ENTER_PATHrR rS shlexjoin)ra rb s r% build_command_for_userrh s +----
7>>+ , , rw2
2
"*
4
r$ domain_to_excludec x K t d{V }| | g }fd|D S )z
Get all domains associated with a given document root, excluding one domain.
It's panel-agnostic and uses a cached mapping.
Nc g | ]
}|k | S r# r# ).0rB ri s r%
<listcomp>z+get_domains_for_docroot.<locals>.<listcomp> s$ L L Lv:K0K0KF0K0K0Kr$ )r; r" )rD ri rA all_domainss ` r% get_domains_for_docrootro sS )********K //'2..K L L L L L L LLr$ sitec P K ddl m}m} | | dt dt t f fd } || j }|r|S t
| j | j d{V }|D ]} || }|r|c S t d| j d )
z/Determine PHP binary path for the given WPSite.r )get_domains_php_infoget_installed_php_versionsrB r2 c | }|r| d k rd S | d }|sd S D ]2}| d |k r| d c S 3d S )Nra display_version
identifierbin)r" )rB domain_infophp_display_version php_versiondomains_php_infoinstalled_php_versionsra s r% find_php_binary_for_domainz7get_php_binary_path.<locals>.find_php_binary_for_domain s &**622 kooj 9 9X E E4 )oo.? @ @" 41 . .K|,,0CCC"u----- Dtr$ )ri Nz+PHP binary was not identified for docroot: z , username: ) clcommon.cpapirr rs r5 r rB ro rD r )
rp ra rr rs r} php_binary_pathdomainsrB r{ r| s
` @@r% get_php_binary_pathr sX
,+-- 7 7 9 9 3 8C= 10==O , G # #44V<< #" " " " # dl r$ c t t d g S t | \ }}|S )z
Get malware history for the specified user.
This is an equivalent of calling `imunify360-agent malware history list --user {username}`.
Returns empty list if imav malware module is not available.
Nz>imav.malwarelib not available, returning empty malware history)user)r loggerdebugmalicious_list)ra max_counthitss r% get_malware_historyr sJ L
"11x1@@Y Kr$ c K t }t }t }||| t d i S || } ||j |h d{V \ }}|si S ||dd }|d S )z
Get the last scan for the specified user.
This is an equivalent of calling `imunify360-agent malware user list --user {username}`.
Returns empty dict if imav malware module is not available.
Nz8imav.malwarelib not available, returning empty last scan)match scan_dateT)descr )r& r* r- r r get_scans_from_paths)sinkra queue_supervisor_clsr) sort_user_listqueue_userss r%
get_last_scanr s 122)++O'))N $ " ! F
& &E$_
"8* HAu N5+D 9 9 9E 8Or$ c h t j }| t j k rF| |ddd }||k r|t d z
}| S | t j k rt|| dz dz z
dz dz }|dk r
|j |k rd}|t | z }| |ddd S | t j
k rddl m fd}|j
|k p5|j
|k o
|j |k p | |j |j d k } | r7 ||j |j | \ }
} | || |
|ddd }n| ||ddd }| S d
S ) a
Calculate the next scan timestamp based on schedule configuration.
Args:
interval: Scan interval (DAY, WEEK, MONTH, or NONE)
hour: Hour of day to run scan (0-23)
day_of_month: Day of month to run scan (1-31)
day_of_week: Day of week to run scan (0-6, where 0=Sunday)
Returns:
Timestamp of next scan, or None if interval is NONE
r )hourminutesecond microsecondrH )days )
monthrangec | |}}|dz
}|dk rd}|dz
} || d }||k r||fS |dz
}|dk rd}|dz
}/)z;Find the next month that has at least given number of days.rH r# )yearmonthr current_year
current_month
days_in_monthr s r% find_next_suitable_monthz?calculate_next_scan_timestamp.<locals>.find_next_suitable_month/ s *.-L
Q M r!! !
!
& *
< G G J
=((' 66 "
2%%$%M A%L
&r$ )dayr r r r r r )r r r r r N)r utcnowIntervalDAYreplacer timestampWEEKweekdayr MONTHcalendarr r r r )
intervalr day_of_month day_of_weektoday next_scan
days_aheadnext_scan_dater should_advance_month next_year
next_monthr s
@r% calculate_next_scan_timestampr s9
O E8< MM "
I *** *I""$$$8= "U]]__q%8A$==AQF
??uzT 1 1J
!;!;!;; %%aq &
)++ 8>!!'''''' & & & & &0
I $
E \)@ejD.@
E jjU[ A A! DD
$<$<
EK % % !Iz #]] + NN #]] + N '')))w "!r$ c : K t t d{V S )zFetch installed versions of Imunify packages.
Returns a dict mapping package name to version string,
with None for packages that are not installed.
Intended to be called once per sync cycle (not per site).
N)r r r# r$ r% get_imunify_package_versionsr j s) &&;<< < < < < < <<r$ last_scan_timenext_scan_timemalware_by_siteversionsc g d}i }|D ]B\ }} ||vri ||< t || | \ }
} n# t $ r d}
Y nw xY w|
|| | < C| ||| |j g |t j d} ||| d< | S )aE
Prepare scan data JSON for a WordPress site.
Args:
last_scan_time: Timestamp of the last scan
next_scan_time: Timestamp of the next scheduled scan
username: Username of the site owner
site: WordPress site object
malware_by_site: Dictionary mapping site docroots to their malware hits
versions: Optional dict mapping Imunify package names to version
strings (None for uninstalled packages). When provided, included
in the output as a ``versions`` key.
Returns:
dict: JSON data ready to be written to scan_data.php. The response includes:
- lastScanTimestamp: Timestamp of the last scan
- nextScanTimestamp: Timestamp of the next scheduled scan
- username: Username of the site owner
- malware: List of malware hits for the site
- config: Configuration items for the site
- license: License information including status and eligibility for Imunify patch
- versions: (optional) Installed Imunify package versions
))MALWARE_SCANNINGenable_scan_cpanel)r default_action)PROACTIVE_DEFENCEblamerra N)lastScanTimestampnextScanTimestampra malwareconfiglicenser )r
KeyErrorr" rD r license_info)
r r ra rp r r config_sections config_itemssectionoptionr1 r r[ s
r% prepare_scan_datar t s @ O L* . . , & &$&L ! /! HE11
EEE (- W f%% , + "&&t|R88 *,,
F %z Ms . ==c t dd| \ }}n# t $ r d}Y nw xY w t dd| \ }}n# t $ r d}Y nw xY wt | t | dS )zThe WP-plugin-facing WORDPRESS toggles, without the license read.
Split from prepare_plugin_config so callers that only need the admin
toggles (e.g. stats collection) don't trigger a license-token read.
WORDPRESSai_bot_protectionr Fai_bot_protection_presetr. )r preset)r
r boolr7 )ra r r r s r% _prepare_ai_bot_settingsr s " 7
11
" " " !" , &
""3 4 4"6** s ''A AAc P t | }t j |d< |S )u
Prepare the plugin_config.php payload.
Dedicated channel for WP-plugin-facing configuration that the
mu-plugin reads on the request hot path. Kept separate from
scan_data.php so that a config toggle doesn't force rewriting the
(potentially large) malware list, and so the mu-plugin loads only
the data it actually needs per request.
Forward compatibility: the plugin ships with the agent, so their
versions are in lockstep. Any forward-compat gating lives here on
the writer side — the agent simply omits a field it doesn't know
about, and the plugin treats missing fields as "unset, use safe
default". No per-field version stamp is needed in the file itself.
Args:
username: Owner of the WP site.
Returns:
Dict ready to be encoded as PHP via format_php_with_embedded_json:
- ai_bot_protection: bool — admin WORDPRESS.ai_bot_protection
- preset: str — admin WORDPRESS.ai_bot_protection_preset,
normalised via _validate_preset to one of
"balanced"/"strict"/"monitor". Falls back to "balanced"
when the schema lacks the key (older agent) or the
configured value is non-canonical (manual edit, future
preset).
- license_type: str | None — server license edition
(imunify360 / imunify360Trial / imunifyAV / imunifyAVPlus),
or None when it can't be determined; the plugin treats None
as "do not gate".
license_type)r r get_license_type)ra settingss r% prepare_plugin_configr s* B (11H ) : < <H^ Or$ )dir_fdcontentuidgidr c
t j t j k rdnd}|t | |d|||| dS t | j 5 }t | |d|||| ddd dS # 1 swxY w Y dS )zWrite a plugin data file atomically.
When *dir_fd* is supplied by the caller (e.g. from
ensure_site_data_directory) it is used directly; otherwise the parent
directory is opened with symlink protection.
i NF)backupr r permissionsr )r
NAMEr r r parent) file_pathr r r r r owned_dir_fds r% !write_plugin_data_file_atomicallyr s (>>.%*<<%%%K
#
)" # #
| #
s A88A<?A<json_strc V | dd dd S )a
Escape a JSON string for embedding inside a PHP single-quoted string.
PHP single-quoted strings only recognise two escape sequences:
``\\`` (literal backslash) and ``\'`` (literal single quote).
All other backslash sequences are kept verbatim. That means we must
double every ``\`` *before* we escape ``'``, otherwise PHP will
consume JSON backslashes (e.g. ``\\s`` in JSON becomes ``\s``
after PHP parsing, which is not a valid JSON escape).
\\\'\'r )r s r% )_escape_json_for_php_single_quoted_stringr s* D& ) ) 1 1#u = ==r$ escapedc V | dd dd S )z\
Reverse the escaping applied by :func:`_escape_json_for_php_single_quoted_string`.
r r r r r )r s r% _unescape_php_single_quoted_jsonr , s( ??5# & & . .vt < <<r$ datac P dt t j | z dz S )al
Format a dictionary as a PHP file that returns JSON-decoded data.
This creates a WordPress-safe PHP file that:
1. Checks if it's being included from WordPress (WPINC defined)
2. Returns the data as a decoded JSON string
Args:
data: Dictionary to embed in the PHP file
Returns:
Formatted PHP file content as a string
zB<?php
if ( ! defined( 'WPINC' ) ) {
exit;
}
return json_decode( 'z
', true );)r jsondumps)r s r% format_php_with_embedded_jsonr 3 s3
4DJt4D4D
E
E F
r$ c * d}| | }|dk rt d |t | z
}| d| }|dk rt d t | || }t j | S )a)
Parse a PHP file generated by format_php_with_embedded_json.
Extracts and returns the embedded JSON data.
Args:
content: PHP file content string
Returns:
Parsed JSON data as a dict
Raises:
ValueError: If the JSON data cannot be found or parsed
zjson_decode( 'z%No embedded JSON found in PHP contentz ', true )z&Malformed embedded JSON in PHP content)find
ValueErrorlenr r loads)r markerstartendr s r% parse_php_with_embedded_jsonr L s F LL E {{@AAA S[[E
,,{E
*
*C
byyABBB/c 0BCCH :h r$ data_dirc x dddd}| D ] \ }}| |z }t ||||| dS )a}
Ensure directory listing protection files exist in the data directory.
Creates .htaccess, index.php, and index.html files to prevent directory
listing. All writes use the caller-supplied *dir_fd* so that no
path-based symlink check is required. atomic_rewrite skips the write
when the file already contains the expected content, preserving idempotency.
z2DirectoryIndex index.php index.html
deny from all
z+<?php
// This file is intentionally blank.
z+<!-- This file is intentionally blank. -->
)z .htaccessz index.phpz
index.htmlr r r N)r= r )r r r r protection_filesfilenamer r s r% #ensure_directory_listing_protectionr i sx LDD . 3 3 5 5
' x' ) wCS
r$ user_infoc * K ddl m} | | d{V }d} t | }n# t $ r t |j ddt | g }t | d{V t | }n[# t $ rN}|j
t j t j fv rt d| d |t d | d
| |d}~ww xY wd }Y nEt $ r9}|j
t j t j fv rt d| d | d}~ww xY w |rt j |d t! || j |j |
t j | n# t j | w xY w|S )a Ensure the site's data directory exists with correct permissions.
The directory is opened with symlink protection after creation
(or if it already exists) to obtain a stable file descriptor.
All subsequent operations use that descriptor.
Args:
site: WordPress site
user_info: User information from pwd
Returns:
Path to data directory
Raises:
Exception: If the data directory is a symlink or cannot be created
r )cliNFmkdirz-pzData directory z is a symlink, skipping.z Failed to open data directory z: Ti r )defence360agent.wordpressr get_data_dirr FileNotFoundErrorrh pw_namer5 r OSErrorerrnoELOOPENOTDIR ExceptionrN chmodr r pw_gidclose)rp r
r r
newly_createdr commandexcs r% ensure_site_data_directoryr s% & .-----%%d++++++++HM%h// )
dCMM *
)(33FF yU[%- 888 HhHHH BBBSBB
9em4 4 4D(DDD
$ HVU # # #+ $( (8
OsM 7 AD-<B D-
C$A C C$$D-+ D-44D((D-14E: :F)N)Vr r loggingrN pwdrf rU collectionsr r r functoolsr r pathlibr typingr defence360agent.contracts.configr
r r !defence360agent.contracts.licenser +defence360agent.subsys.panels.hosting_panelr
#defence360agent.subsys.panels.pleskr defence360agent.utilsr r r r r r defence360agent.utils.fd_opsr r defence360agent.model.wordpressr #defence360agent.wordpress.constantsr #defence360agent.wordpress.exceptionr re rQ r" r r& r* r- frozensetr6 getLogger__name__r objectr5 r7 dictr< r; rG rT r] r` rh ro r r r r r floatr r r intr r r r r r
struct_passwdr r# r$ r% <module>r8 s?
# # # # # # ( ( ( ( ( ( ( ( & & & & & & & & 9 8 8 8 8 8 D D D D D D 5 5 5 5 5 5 H G G G G G G G 2 2 2 2 2 2 C C C C C C 8 8 8 8 8 81 '
X\ " t
<== 8 $ $ F s R
S$s)^ 4
9 9s 9t 9 9 9 9
1# "+ + +
S . M
M%( M #Y M M M M)F )c )hsm ) ) ) )X# $ " Ba* a* a*H=DcDj ,A = = = = .2
@ @@@ @ @
@ 3d
?#d*
@
@ @ @ @Fs t <#C #D # # # #N JN
"%
,/
<?$J
F > > > > > > =c =c = = = = 2 # $ :
#&
36
0>
> .> > > > > > >r$ defence360agent/wordpress/__pycache__/utils.cpython-311.pyc 0000644 0000000 0000000 00000066022 00000000000 020656 0 ustar
r_jX d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl m Z m
Z
d dl m Z m
Z
d dlmZ d dlmZ d dlmZmZ d dlmZ d d lmZ d d
lmZ d d l m Z m Z m Z m Z m!Z!m"Z" d d l#m$Z$m%Z% d d
l&m'Z' d dl(m)Z) d dl*m+Z+ dZ,dZ- e!j. ddd Z/e d Z0e d Z1e d Z2 e3d Z4 ej5 e6 Z7de8de9fdZ: e d de;e9e<e9 f fd Z=d e9d e9de<fd!Z> e
d"# de?fd$ Z@d% ZAd&e9d'e<de<fd(ZBd e9d)e9de<e9 fd*ZCd+e'd&e9dee9 fd,ZDd&e9de<fd-ZEd&e9de;fd.ZFd/ ZGde;e9e9dz f fd0ZH dId1eId2eId&e9d+e'd3e;d4e;e9e9dz f dz de;fd5ZJd&e9de;fd6ZKd&e9de;fd7ZLdd8d9e9d:eMd;eMd<eMdz ddf
d=ZNd>e9de9fd?ZOd@e9de9fdAZPdBe;de9fdCZQd9e9de;fdDZRdEed:eMd;eMd<eMddf
dFZSd+e'dGejT defdHZUdS )J N) defaultdict)datetime timedelta)cache lru_cache)Path)Optional)choose_value_from_configMalwareScanScheduleInterval)
LicenseCLN) HostingPanel)Plesk)IMUNIFY_PACKAGE_NAMESasync_lru_cacheatomic_rewrite check_runimportersystem_packages_info)open_dir_no_symlinkssafe_dir)WPSite)WP_CLI_WRAPPER_PATH)PHPErrorz/usr/sbin/cagefs_enter_userz/usr/sbin/cagefsctlzimav.malwarelib.model
MalwareHitmodulenamedefaultc 0 t j ddd S )Nz*imav.malwarelib.scan.queue_supervisor_syncQueueSupervisorSyncr r get T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/utils.py_queue_supervisor_clsr& , s$ <;
" r$ c 0 t j ddd S )N imav.malwarelib.utils.user_listfetch_user_listr r! r# r$ r% _fetch_user_list_fnr* 5 s$ <0
r$ c 0 t j ddd S )Nr( sortr r! r# r$ r% _sort_user_list_fnr- > s$ <0
r$ )balancedstrictmonitorvaluereturnc F t | t r | t v r| S dS )u Coerce a config-read preset value to a canonical preset string.
Returns "balanced" for anything outside _VALID_PRESETS — including
None, non-strings, and hand-edited values like "extreme" or
"BALANCED". The agent always writes lowercase canonical values, so
a non-canonical read indicates either a manual edit or a future
preset that this version doesn't recognise; "balanced" is the safe
fallback in both cases.
r. )
isinstancestr_VALID_PRESETS)r1 s r% _validate_presetr7 L s* % %>"9"9 :r$ < )ttlc K t } | d{V }t t }| D ]%\ }}|D ] }|| | &|S )zN
Get a mapping of docroots to their associated domains, with caching.
N)r
get_domain_pathsr listitemsappend)
hosting_panel panel_paths docroot_mapdomaindocrootsdocroots r% r; r; [ s
!NNM%6688888888K d##K ' - - / / 0 0 0 0G ' ' / / / / 0 r$ php_pathrD c 0 t t | |gS )z Get wp cli common command list)r5 r )rE rD s r%
wp_wrapperrG i s # $ $h 88r$ )maxsizec t j t r$t j t t j st
S t j t dgdd } | j dk rt
S | j
d }t
|dd S )z)Get the list of users enabled for CageFS.z--list-enabledT)capture_outputtextr
rH N)
ospathisfileCAGEFS_CTL_PATHaccessX_OKset
subprocessrun
returncodestdoutstripsplit)resultliness r% get_cagefs_enabled_usersr] n s 7>>/ * * ")3 3 uu
^ *+Dt F A uu M ! ! ' ' - -E uQRRy>>r$ c 8 t dS )z-Clear the cache for get_cagefs_enabled_users.N)r] cache_clearr# r$ r% $clear_get_cagefs_enabled_users_cacher` s ((*****r$ usernameargsc | t v rTt j t r0t j t t j r t d| g|S ddd| dt j | gS )zNBuild the necessary command to run the given cmdline args with specified user.z--no-io-and-memory-limitsuz-sz /bin/bashz-c) r] rN rO rP CAGEFS_ENTER_PATHrR rS shlexjoin)ra rb s r% build_command_for_userrh s +----
7>>+ , , rw2
2
"*
4
r$ domain_to_excludec x K t d{V }| | g }fd|D S )z
Get all domains associated with a given document root, excluding one domain.
It's panel-agnostic and uses a cached mapping.
Nc g | ]
}|k | S r# r# ).0rB ri s r%
<listcomp>z+get_domains_for_docroot.<locals>.<listcomp> s$ L L Lv:K0K0KF0K0K0Kr$ )r; r" )rD ri rA all_domainss ` r% get_domains_for_docrootro sS )********K //'2..K L L L L L L LLr$ sitec P K ddl m}m} | | dt dt t f fd } || j }|r|S t
| j | j d{V }|D ]} || }|r|c S t d| j d )
z/Determine PHP binary path for the given WPSite.r )get_domains_php_infoget_installed_php_versionsrB r2 c | }|r| d k rd S | d }|sd S D ]2}| d |k r| d c S 3d S )Nra display_version
identifierbin)r" )rB domain_infophp_display_version php_versiondomains_php_infoinstalled_php_versionsra s r% find_php_binary_for_domainz7get_php_binary_path.<locals>.find_php_binary_for_domain s &**622 kooj 9 9X E E4 )oo.? @ @" 41 . .K|,,0CCC"u----- Dtr$ )ri Nz+PHP binary was not identified for docroot: z , username: ) clcommon.cpapirr rs r5 r rB ro rD r )
rp ra rr rs r} php_binary_pathdomainsrB r{ r| s
` @@r% get_php_binary_pathr sX
,+-- 7 7 9 9 3 8C= 10==O , G # #44V<< #" " " " # dl r$ c t t d g S t | \ }}|S )z
Get malware history for the specified user.
This is an equivalent of calling `imunify360-agent malware history list --user {username}`.
Returns empty list if imav malware module is not available.
Nz>imav.malwarelib not available, returning empty malware history)user)r loggerdebugmalicious_list)ra max_counthitss r% get_malware_historyr sJ L
"11x1@@Y Kr$ c K t }t }t }||| t d i S || } ||j |h d{V \ }}|si S ||dd }|d S )z
Get the last scan for the specified user.
This is an equivalent of calling `imunify360-agent malware user list --user {username}`.
Returns empty dict if imav malware module is not available.
Nz8imav.malwarelib not available, returning empty last scan)match scan_dateT)descr )r& r* r- r r get_scans_from_paths)sinkra queue_supervisor_clsr) sort_user_listqueue_userss r%
get_last_scanr s 122)++O'))N $ " ! F
& &E$_
"8* HAu N5+D 9 9 9E 8Or$ c h t j }| t j k rF| |ddd }||k r|t d z
}| S | t j k rt|| dz dz z
dz dz }|dk r
|j |k rd}|t | z }| |ddd S | t j
k rddl m fd}|j
|k p5|j
|k o
|j |k p | |j |j d k } | r7 ||j |j | \ }
} | || |
|ddd }n| ||ddd }| S d
S ) a
Calculate the next scan timestamp based on schedule configuration.
Args:
interval: Scan interval (DAY, WEEK, MONTH, or NONE)
hour: Hour of day to run scan (0-23)
day_of_month: Day of month to run scan (1-31)
day_of_week: Day of week to run scan (0-6, where 0=Sunday)
Returns:
Timestamp of next scan, or None if interval is NONE
r )hourminutesecond microsecondrH )days )
monthrangec | |}}|dz
}|dk rd}|dz
} || d }||k r||fS |dz
}|dk rd}|dz
}/)z;Find the next month that has at least given number of days.rH r# )yearmonthr current_year
current_month
days_in_monthr s r% find_next_suitable_monthz?calculate_next_scan_timestamp.<locals>.find_next_suitable_month/ s *.-L
Q M r!! !
!
& *
< G G J
=((' 66 "
2%%$%M A%L
&r$ )dayr r r r r r )r r r r r N)r utcnowIntervalDAYreplacer timestampWEEKweekdayr MONTHcalendarr r r r )
intervalr day_of_month day_of_weektoday next_scan
days_aheadnext_scan_dater should_advance_month next_year
next_monthr s
@r% calculate_next_scan_timestampr s9
O E8< MM "
I *** *I""$$$8= "U]]__q%8A$==AQF
??uzT 1 1J
!;!;!;; %%aq &
)++ 8>!!'''''' & & & & &0
I $
E \)@ejD.@
E jjU[ A A! DD
$<$<
EK % % !Iz #]] + NN #]] + N '')))w "!r$ c : K t t d{V S )zFetch installed versions of Imunify packages.
Returns a dict mapping package name to version string,
with None for packages that are not installed.
Intended to be called once per sync cycle (not per site).
N)r r r# r$ r% get_imunify_package_versionsr j s) &&;<< < < < < < <<r$ last_scan_timenext_scan_timemalware_by_siteversionsc g d}i }|D ]B\ }} ||vri ||< t || | \ }
} n# t $ r d}
Y nw xY w|
|| | < C| ||| |j g |t j d} ||| d< | S )aE
Prepare scan data JSON for a WordPress site.
Args:
last_scan_time: Timestamp of the last scan
next_scan_time: Timestamp of the next scheduled scan
username: Username of the site owner
site: WordPress site object
malware_by_site: Dictionary mapping site docroots to their malware hits
versions: Optional dict mapping Imunify package names to version
strings (None for uninstalled packages). When provided, included
in the output as a ``versions`` key.
Returns:
dict: JSON data ready to be written to scan_data.php. The response includes:
- lastScanTimestamp: Timestamp of the last scan
- nextScanTimestamp: Timestamp of the next scheduled scan
- username: Username of the site owner
- malware: List of malware hits for the site
- config: Configuration items for the site
- license: License information including status and eligibility for Imunify patch
- versions: (optional) Installed Imunify package versions
))MALWARE_SCANNINGenable_scan_cpanel)r default_action)PROACTIVE_DEFENCEblamerra N)lastScanTimestampnextScanTimestampra malwareconfiglicenser )r
KeyErrorr" rD r license_info)
r r ra rp r r config_sections config_itemssectionoptionr1 r r[ s
r% prepare_scan_datar t s @ O L* . . , & &$&L ! /! HE11
EEE (- W f%% , + "&&t|R88 *,,
F %z Ms . ==c t dd| \ }}n# t $ r d}Y nw xY w t dd| \ }}n# t $ r d}Y nw xY wt | t | dS )zThe WP-plugin-facing WORDPRESS toggles, without the license read.
Split from prepare_plugin_config so callers that only need the admin
toggles (e.g. stats collection) don't trigger a license-token read.
WORDPRESSai_bot_protectionr Fai_bot_protection_presetr. )r preset)r
r boolr7 )ra r r r s r% _prepare_ai_bot_settingsr s " 7
11
" " " !" , &
""3 4 4"6** s ''A AAc P t | }t j |d< |S )u
Prepare the plugin_config.php payload.
Dedicated channel for WP-plugin-facing configuration that the
mu-plugin reads on the request hot path. Kept separate from
scan_data.php so that a config toggle doesn't force rewriting the
(potentially large) malware list, and so the mu-plugin loads only
the data it actually needs per request.
Forward compatibility: the plugin ships with the agent, so their
versions are in lockstep. Any forward-compat gating lives here on
the writer side — the agent simply omits a field it doesn't know
about, and the plugin treats missing fields as "unset, use safe
default". No per-field version stamp is needed in the file itself.
Args:
username: Owner of the WP site.
Returns:
Dict ready to be encoded as PHP via format_php_with_embedded_json:
- ai_bot_protection: bool — admin WORDPRESS.ai_bot_protection
- preset: str — admin WORDPRESS.ai_bot_protection_preset,
normalised via _validate_preset to one of
"balanced"/"strict"/"monitor". Falls back to "balanced"
when the schema lacks the key (older agent) or the
configured value is non-canonical (manual edit, future
preset).
- license_type: str | None — server license edition
(imunify360 / imunify360Trial / imunifyAV / imunifyAVPlus),
or None when it can't be determined; the plugin treats None
as "do not gate".
license_type)r r get_license_type)ra settingss r% prepare_plugin_configr s* B (11H ) : < <H^ Or$ )dir_fdcontentuidgidr c
t j t j k rdnd}|t | |d|||| dS t | j 5 }t | |d|||| ddd dS # 1 swxY w Y dS )zWrite a plugin data file atomically.
When *dir_fd* is supplied by the caller (e.g. from
ensure_site_data_directory) it is used directly; otherwise the parent
directory is opened with symlink protection.
i NF)backupr r permissionsr )r
NAMEr r r parent) file_pathr r r r r owned_dir_fds r% !write_plugin_data_file_atomicallyr s (>>.%*<<%%%K
#
)" # #
| #
s A88A<?A<json_strc V | dd dd S )a
Escape a JSON string for embedding inside a PHP single-quoted string.
PHP single-quoted strings only recognise two escape sequences:
``\\`` (literal backslash) and ``\'`` (literal single quote).
All other backslash sequences are kept verbatim. That means we must
double every ``\`` *before* we escape ``'``, otherwise PHP will
consume JSON backslashes (e.g. ``\\s`` in JSON becomes ``\s``
after PHP parsing, which is not a valid JSON escape).
\\\'\'r )r s r% )_escape_json_for_php_single_quoted_stringr s* D& ) ) 1 1#u = ==r$ escapedc V | dd dd S )z\
Reverse the escaping applied by :func:`_escape_json_for_php_single_quoted_string`.
r r r r r )r s r% _unescape_php_single_quoted_jsonr , s( ??5# & & . .vt < <<r$ datac P dt t j | z dz S )al
Format a dictionary as a PHP file that returns JSON-decoded data.
This creates a WordPress-safe PHP file that:
1. Checks if it's being included from WordPress (WPINC defined)
2. Returns the data as a decoded JSON string
Args:
data: Dictionary to embed in the PHP file
Returns:
Formatted PHP file content as a string
zB<?php
if ( ! defined( 'WPINC' ) ) {
exit;
}
return json_decode( 'z
', true );)r jsondumps)r s r% format_php_with_embedded_jsonr 3 s3
4DJt4D4D
E
E F
r$ c * d}| | }|dk rt d |t | z
}| d| }|dk rt d t | || }t j | S )a)
Parse a PHP file generated by format_php_with_embedded_json.
Extracts and returns the embedded JSON data.
Args:
content: PHP file content string
Returns:
Parsed JSON data as a dict
Raises:
ValueError: If the JSON data cannot be found or parsed
zjson_decode( 'z%No embedded JSON found in PHP contentz ', true )z&Malformed embedded JSON in PHP content)find
ValueErrorlenr r loads)r markerstartendr s r% parse_php_with_embedded_jsonr L s F LL E {{@AAA S[[E
,,{E
*
*C
byyABBB/c 0BCCH :h r$ data_dirc x dddd}| D ] \ }}| |z }t ||||| dS )a}
Ensure directory listing protection files exist in the data directory.
Creates .htaccess, index.php, and index.html files to prevent directory
listing. All writes use the caller-supplied *dir_fd* so that no
path-based symlink check is required. atomic_rewrite skips the write
when the file already contains the expected content, preserving idempotency.
z2DirectoryIndex index.php index.html
deny from all
z+<?php
// This file is intentionally blank.
z+<!-- This file is intentionally blank. -->
)z .htaccessz index.phpz
index.htmlr r r N)r= r )r r r r protection_filesfilenamer r s r% #ensure_directory_listing_protectionr i sx LDD . 3 3 5 5
' x' ) wCS
r$ user_infoc * K ddl m} | | d{V }d} t | }n# t $ r t |j ddt | g }t | d{V t | }n[# t $ rN}|j
t j t j fv rt d| d |t d | d
| |d}~ww xY wd }Y nEt $ r9}|j
t j t j fv rt d| d | d}~ww xY w |rt j |d t! || j |j |
t j | n# t j | w xY w|S )a Ensure the site's data directory exists with correct permissions.
The directory is opened with symlink protection after creation
(or if it already exists) to obtain a stable file descriptor.
All subsequent operations use that descriptor.
Args:
site: WordPress site
user_info: User information from pwd
Returns:
Path to data directory
Raises:
Exception: If the data directory is a symlink or cannot be created
r )cliNFmkdirz-pzData directory z is a symlink, skipping.z Failed to open data directory z: Ti r )defence360agent.wordpressr get_data_dirr FileNotFoundErrorrh pw_namer5 r OSErrorerrnoELOOPENOTDIR ExceptionrN chmodr r pw_gidclose)rp r
r r
newly_createdr commandexcs r% ensure_site_data_directoryr s% & .-----%%d++++++++HM%h// )
dCMM *
)(33FF yU[%- 888 HhHHH BBBSBB
9em4 4 4D(DDD
$ HVU # # #+ $( (8
OsM 7 AD-<B D-
C$A C C$$D-+ D-44D((D-14E: :F)N)Vr r loggingrN pwdrf rU collectionsr r r functoolsr r pathlibr typingr defence360agent.contracts.configr
r r !defence360agent.contracts.licenser +defence360agent.subsys.panels.hosting_panelr
#defence360agent.subsys.panels.pleskr defence360agent.utilsr r r r r r defence360agent.utils.fd_opsr r defence360agent.model.wordpressr #defence360agent.wordpress.constantsr #defence360agent.wordpress.exceptionr re rQ r" r r& r* r- frozensetr6 getLogger__name__r objectr5 r7 dictr< r; rG rT r] r` rh ro r r r r r floatr r r intr r r r r r
struct_passwdr r# r$ r% <module>r8 s?
# # # # # # ( ( ( ( ( ( ( ( & & & & & & & & 9 8 8 8 8 8 D D D D D D 5 5 5 5 5 5 H G G G G G G G 2 2 2 2 2 2 C C C C C C 8 8 8 8 8 81 '
X\ " t
<== 8 $ $ F s R
S$s)^ 4
9 9s 9t 9 9 9 9
1# "+ + +
S . M
M%( M #Y M M M M)F )c )hsm ) ) ) )X# $ " Ba* a* a*H=DcDj ,A = = = = .2
@ @@@ @ @
@ 3d
?#d*
@
@ @ @ @Fs t <#C #D # # # #N JN
"%
,/
<?$J
F > > > > > > =c =c = = = = 2 # $ :
#&
36
0>
> .> > > > > > >r$ defence360agent/wordpress/__pycache__/wp_rules.cpython-311.opt-1.pyc 0000644 0000000 0000000 00000012375 00000000000 022317 0 ustar
r_j
d Z ddlZddlZddlZddlmZ ddlmZ ej e Z
dZ dZ dede
d edz fd
Zd ed edz fd Zded edz fd
Zded e
fdZdS )zWordPress rules file management.
This module provides utilities for loading and parsing wp-rules.yaml
from the files.imunify360.com index system.
Available for both AV and IM360 modes.
N)Path)Indexz wp-rules.zipVERSIONindexfilenamereturnc 4 | D ]N}|d |k r@t | |d }| r|c S Ot d|| | j dS )z
Find a file path from the index by filename.
Args:
index: files.Index object
filename: Name of the file to find (e.g., WP_RULES_ZIP_FILENAME)
Returns:
Path to the file or None if not found
nameurlz%s not found in %sN)itemsr
localfilepathexistsloggererror
files_pathtype)r r item file_paths W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/wp_rules.pyfind_file_in_indexr s
! ! <8 # # U 0 0e = =>>I !!
!
LL%x1A1A%*1M1MNNN 4 zip_pathc t j | d 5 }| d 5 }t j | }ddd n # 1 swxY w Y ddd n # 1 swxY w Y nJ# t j t t j f$ r&}t d| Y d}~dS d}~ww xY wt |t s t d| dS |S )z
Extract and parse wp-rules.yaml from the zip file.
Args:
zip_path: Path to wp-rules.zip file
Returns:
Parsed YAML data as dict or None if extraction/parsing fails
rz
wp-rules.yamlNz,Failed to extract or parse wp-rules.yaml: %sz Invalid wp-rules.yaml format: %s) zipfileZipFileopenyaml safe_load
BadZipFileKeyError YAMLErrorr r
isinstancedict)r zip_file yaml_file
rules_dataes r extract_wp_rules_yamlr) , sb
_Xs
+
+ 7x //
79 !^I 6 6
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7
$. 9 CQGGGttttt j$ ' ' 7DDDt s] A1 A%A A%A A%A A% A1 %A))A1 ,A)-A1 1!B8B33B8c t | t }|sdS t | }|sdS t d |S )a
Retrieve the latest WordPress rules and return them as a dictionary.
Args:
index: The files.Index object used to locate the wp-rules.zip file.
Returns:
The parsed wp-rules data as a dictionary.
If the wp-rules archive or data cannot be found or parsed, returns None.
Note:
This function returns the raw rules data. Callers that need to modify
rules based on product mode (e.g., ANTIVIRUS_MODE) should do so after
calling this function.
Nz!Successfully parsed wp-rules.yaml)r WP_RULES_ZIP_FILENAMEr) r info)r r r' s r get_wp_rules_datar- D sV " "%)>??H t 'x00J t
KK3444 r c " t | t }|sdS | }t d| |S # t $ r&}t d| Y d}~dS d}~ww xY w)a#
Retrieve the WordPress ruleset version string from the VERSION file.
Args:
index: The files.Index object used to locate the VERSION file.
Returns:
The version string from the VERSION file.
If the VERSION file cannot be found or read, returns "NA".
NAz&Successfully read wp-rules version: %sz Failed to read VERSION file: %sN)r WP_RULES_VERSION_FILENAME read_textstripr r, Exceptionr )r version_pathversion_stringr( s r get_wp_ruleset_versionr6 b s &e-FGGL t%//117799 <nMMM 6:::ttttts AA
B(B B)__doc__loggingr r pathlibr defence360agent.filesr getLogger__name__r r+ r0 strr r$ r) r- r6 r r <module>r? s ' ' ' ' ' ' 8 $ $ ' % e s td{ *D TD[ 0U td{ <% C r defence360agent/wordpress/__pycache__/wp_rules.cpython-311.pyc 0000644 0000000 0000000 00000012375 00000000000 021360 0 ustar
r_j
d Z ddlZddlZddlZddlmZ ddlmZ ej e Z
dZ dZ dede
d edz fd
Zd ed edz fd Zded edz fd
Zded e
fdZdS )zWordPress rules file management.
This module provides utilities for loading and parsing wp-rules.yaml
from the files.imunify360.com index system.
Available for both AV and IM360 modes.
N)Path)Indexz wp-rules.zipVERSIONindexfilenamereturnc 4 | D ]N}|d |k r@t | |d }| r|c S Ot d|| | j dS )z
Find a file path from the index by filename.
Args:
index: files.Index object
filename: Name of the file to find (e.g., WP_RULES_ZIP_FILENAME)
Returns:
Path to the file or None if not found
nameurlz%s not found in %sN)itemsr
localfilepathexistsloggererror
files_pathtype)r r item file_paths W/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/wp_rules.pyfind_file_in_indexr s
! ! <8 # # U 0 0e = =>>I !!
!
LL%x1A1A%*1M1MNNN 4 zip_pathc t j | d 5 }| d 5 }t j | }ddd n # 1 swxY w Y ddd n # 1 swxY w Y nJ# t j t t j f$ r&}t d| Y d}~dS d}~ww xY wt |t s t d| dS |S )z
Extract and parse wp-rules.yaml from the zip file.
Args:
zip_path: Path to wp-rules.zip file
Returns:
Parsed YAML data as dict or None if extraction/parsing fails
rz
wp-rules.yamlNz,Failed to extract or parse wp-rules.yaml: %sz Invalid wp-rules.yaml format: %s) zipfileZipFileopenyaml safe_load
BadZipFileKeyError YAMLErrorr r
isinstancedict)r zip_file yaml_file
rules_dataes r extract_wp_rules_yamlr) , sb
_Xs
+
+ 7x //
79 !^I 6 6
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7
$. 9 CQGGGttttt j$ ' ' 7DDDt s] A1 A%A A%A A%A A% A1 %A))A1 ,A)-A1 1!B8B33B8c t | t }|sdS t | }|sdS t d |S )a
Retrieve the latest WordPress rules and return them as a dictionary.
Args:
index: The files.Index object used to locate the wp-rules.zip file.
Returns:
The parsed wp-rules data as a dictionary.
If the wp-rules archive or data cannot be found or parsed, returns None.
Note:
This function returns the raw rules data. Callers that need to modify
rules based on product mode (e.g., ANTIVIRUS_MODE) should do so after
calling this function.
Nz!Successfully parsed wp-rules.yaml)r WP_RULES_ZIP_FILENAMEr) r info)r r r' s r get_wp_rules_datar- D sV " "%)>??H t 'x00J t
KK3444 r c " t | t }|sdS | }t d| |S # t $ r&}t d| Y d}~dS d}~ww xY w)a#
Retrieve the WordPress ruleset version string from the VERSION file.
Args:
index: The files.Index object used to locate the VERSION file.
Returns:
The version string from the VERSION file.
If the VERSION file cannot be found or read, returns "NA".
NAz&Successfully read wp-rules version: %sz Failed to read VERSION file: %sN)r WP_RULES_VERSION_FILENAME read_textstripr r, Exceptionr )r version_pathversion_stringr( s r get_wp_ruleset_versionr6 b s &e-FGGL t%//117799 <nMMM 6:::ttttts AA
B(B B)__doc__loggingr r pathlibr defence360agent.filesr getLogger__name__r r+ r0 strr r$ r) r- r6 r r <module>r? s ' ' ' ' ' ' 8 $ $ ' % e s td{ *D TD[ 0U td{ <% C r defence360agent/wordpress/bot_protection.py 0000644 0000000 0000000 00000010333 00000000000 016202 0 ustar """Resolve the AI bot protection state actually applied on a WP site.
Mirrors the precedence the imunify-security plugin applies at runtime
(inc/App/Plugin.php::isBotProtectionActive, inc/App/Bot/Preset.php::resolve):
a site-owner wp-config.php constant or bot-settings.php override wins over
the hoster-written plugin_config.php default. Files are parsed, never
executed.
"""
import logging
import os
import re
import stat
from pathlib import Path
logger = logging.getLogger(__name__)
VALID_PRESETS = ("balanced", "strict", "monitor")
DEFAULT_PRESET = "balanced"
# These config files live under a hosting user's document root and are read
# by the root agent, so the read is defensive: no symlink follow, no FIFO
# block, regular file owned by the site user only, and a small byte cap so a
# hostile file (huge / /dev/zero) cannot OOM or stall the agent.
_MAX_BYTES = 64 * 1024
# define('IMUNIFY_AI_BOT_PROTECTION', false) — the quote right after the name
# keeps this from also matching the *_PRESET constant.
_CONST_ENABLED = re.compile(
r"""define\(\s*['"]IMUNIFY_AI_BOT_PROTECTION['"]\s*,\s*(true|false)\s*\)""",
re.IGNORECASE,
)
_CONST_PRESET = re.compile(
r"define\(\s*['\"]IMUNIFY_AI_BOT_PROTECTION_PRESET['\"]\s*,"
r"\s*['\"](\w+)['\"]\s*\)",
re.IGNORECASE,
)
# bot-settings.php is a PHP `return array('enabled' => .., 'preset' => '..')`.
_KV_ENABLED = re.compile(
r"""['"]enabled['"]\s*=>\s*(true|false)""", re.IGNORECASE
)
_KV_PRESET = re.compile(
r"""['"]preset['"]\s*=>\s*['"](\w+)['"]""", re.IGNORECASE
)
def _safe_read(path: Path, uid: int):
"""Read a small site-owner config file as root, defensively.
Returns None (so the caller falls back to the hoster default) on a
symlink, FIFO/device, a file not owned by the site user, or any I/O
error. At most _MAX_BYTES are read.
"""
try:
fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
except OSError:
return None
try:
info = os.fstat(fd)
if not stat.S_ISREG(info.st_mode) or info.st_uid != uid:
return None
return os.read(fd, _MAX_BYTES).decode("utf-8", errors="replace")
except OSError:
return None
finally:
os.close(fd)
def _parse_wp_config(path: Path, uid: int):
"""Return (enabled, preset) from wp-config.php constants; each is None
when the constant is absent or invalid."""
text = _safe_read(path, uid)
if text is None:
return None, None
enabled = None
match = _CONST_ENABLED.search(text)
if match:
enabled = match.group(1).lower() == "true"
preset = None
match = _CONST_PRESET.search(text)
if match and match.group(1).lower() in VALID_PRESETS:
preset = match.group(1).lower()
return enabled, preset
def _parse_bot_settings(path: Path, uid: int):
"""Return (enabled, preset) from the site-owner bot-settings.php. A
missing/unreadable file means enabled with no explicit preset, matching
the plugin's OptOutFlag default."""
text = _safe_read(path, uid)
if text is None:
return True, None
match = _KV_ENABLED.search(text)
enabled = match.group(1).lower() == "true" if match else True
preset = None
match = _KV_PRESET.search(text)
if match and match.group(1).lower() in VALID_PRESETS:
preset = match.group(1).lower()
return enabled, preset
def resolve_ai_bot_protection(
docroot: str,
data_dir: Path,
uid: int,
hoster_enabled: bool,
hoster_preset: str,
):
"""Resolve the effective (enabled, preset) for a site.
enabled: the wp-config constant (if set to false) force-disables;
otherwise it is the AND of the hoster default and the site-owner flag.
preset: first match of wp-config constant, bot-settings.php, hoster.
"""
const_enabled, const_preset = _parse_wp_config(
Path(docroot) / "wp-config.php", uid
)
bot_enabled, bot_preset = _parse_bot_settings(
Path(data_dir) / "bot-settings.php", uid
)
enabled = bool(hoster_enabled) and bot_enabled
if const_enabled is False:
enabled = False
for candidate in (const_preset, bot_preset, hoster_preset):
if candidate in VALID_PRESETS:
return enabled, candidate
return enabled, DEFAULT_PRESET
defence360agent/wordpress/changelog_processor.py 0000644 0000000 0000000 00000031177 00000000000 017207 0 ustar """Processor for WordPress rule disable/enable changelog files.
The PHP WordPress plugin writes rule change actions to changelog.php when a user
disables or enables protection rules from the WordPress admin panel. This module
reads, parses, and applies those actions to the agent database.
The changelog.php file uses the same format as incident files:
<?php __halt_compiler();
#{base64-encoded JSON for action 1}
#{base64-encoded JSON for action 2}
Each JSON action has the form:
{"action": "disable"|"enable", "rule_id": "xyz", "ts": ...}
The user_id stored with each action is the system UID of the WordPress site
owner (site.uid).
"""
import errno
import logging
import os
from pathlib import Path
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.permissions import (
WP_WAF_RULES_EDIT,
has_permission,
)
from defence360agent.contracts.plugins import MessageSink
from defence360agent.model.wordpress import WPSite, WordpressSite
from defence360agent.model.wp_disabled_rule import WPDisabledRule
from defence360agent.utils.fd_ops import open_nofollow
from defence360agent.wordpress.cli import get_data_dir
from defence360agent.wordpress.incident_parser import IncidentFileParser
from defence360agent.wordpress.utils import parse_php_with_embedded_json
logger = logging.getLogger(__name__)
CHANGELOG_FILENAME = "changelog.php"
DISABLED_RULES_FILENAME = "disabled-rules.php"
ACTION_DISABLE = "disable"
ACTION_ENABLE = "enable"
class ChangelogProcessor:
"""Process WordPress rule disable/enable changelog files.
Reads changelog.php from each site's data directory, applies
disable/enable actions to the WPDisabledRule database, reports events
to the correlation server, and deletes the file after processing.
If no changelog exists (or no new entries), checks whether
disabled-rules.php has been modified externally (e.g. backup restore)
and flags the domain for regeneration.
"""
def __init__(self) -> None:
# changelog.php uses the same format as incident files
# (base64-encoded JSON lines wrapped in PHP), so we reuse the parser
self.parser = IncidentFileParser()
async def process_changelogs_for_sites(
self,
sites: list[WPSite],
sink: MessageSink | None,
) -> list[WPSite]:
"""Process changelog.php for all given sites.
Args:
sites: WordPress sites to process.
sink: MessageSink for sending correlation events.
Returns:
Sites whose disabled rules were affected
(needing disabled-rules.php regeneration).
"""
affected: list[WPSite] = []
for site in sites:
if await self._process_site(site, sink):
affected.append(site)
if affected:
logger.info(
"Changelog processing affected %d site(s)",
len(affected),
)
return affected
async def _process_site(
self,
site: WPSite,
sink: MessageSink | None,
) -> bool:
"""Process changelog.php for a single site.
Args:
site: WordPress site to process.
sink: MessageSink for sending correlation events.
Returns:
True if the site's disabled rules were affected.
"""
try:
data_dir = await get_data_dir(site)
if not data_dir.exists():
return False
changelog_path = data_dir / CHANGELOG_FILENAME
if changelog_path.exists():
if await self._process_changelog_file(
changelog_path, site, sink
):
return True
if self._is_disabled_rules_file_stale(site, data_dir):
return True
except Exception as e:
logger.error(
"Error processing changelog for site %s: %s",
site.docroot,
e,
)
return False
def _consume_changelog(
self, changelog_path: Path, site: WPSite
) -> list[dict]:
"""Parse a changelog file and delete it.
The file is deleted regardless of whether parsing succeeds.
"""
try:
return self.parser.parse_file(changelog_path)
except (OSError, ValueError) as e:
logger.error(
"Failed to parse changelog for site %s: %s",
site.docroot,
e,
)
return []
finally:
try:
changelog_path.unlink(missing_ok=True)
except OSError as e:
logger.error(
"Failed to delete changelog for site %s: %s",
site.docroot,
e,
)
async def _process_changelog_file(
self,
changelog_path: Path,
site: WPSite,
sink: MessageSink | None,
) -> bool:
"""Parse and apply actions from a changelog file.
The file is always deleted after reading, even on parse errors.
Actions older than the last sync timestamp are skipped to prevent
stale changelog files (e.g. from backup restores) from undoing
more recent changes.
Returns:
True if any DB changes occurred.
"""
actions = self._consume_changelog(changelog_path, site)
if not actions:
return False
# str(site.uid): non-None sentinel (unused); avoids the root bypass
if not await has_permission(WP_WAF_RULES_EDIT, str(site.uid)):
logger.info(
"WP WAF rule editing disabled by policy; dropping %d"
" changelog action(s) for site %s",
len(actions),
site.docroot,
)
return False
last_sync_ts = self._get_last_sync_ts(site)
changed = False
for action in actions:
try:
timestamp = float(action.get("ts", 0))
if timestamp <= 0:
raise ValueError(
"Missing or invalid timestamp in changelog action"
f" for rule {action.get('rule_id', '?')}"
f" on site {site.docroot}"
)
if last_sync_ts is not None and timestamp <= last_sync_ts:
logger.info(
"Skipping stale changelog action for rule %s"
" on site %s (ts=%.0f <= sync_ts=%.0f)",
action.get("rule_id", "?"),
site.docroot,
timestamp,
last_sync_ts,
)
continue
if self._process_action(action, site, timestamp):
changed = True
await self._report_action(action, site, sink, timestamp)
except ValueError as e:
logger.warning("Skipping invalid changelog entry: %s", e)
except Exception as e:
logger.error(
"Failed to process changelog action %s for site %s: %s",
action,
site.docroot,
e,
)
logger.info(
"Processed changelog for site %s: %d action(s), changed=%s",
site.docroot,
len(actions),
changed,
)
return changed
def _process_action(
self, action: dict, site: WPSite, timestamp: float
) -> bool:
"""Apply a single changelog action to the database.
Args:
action: Parsed action dict with keys: action, rule_id, ts.
site: The WordPress site the action belongs to.
timestamp: Pre-resolved Unix timestamp for this action.
Returns:
True if the database state was modified.
Raises:
ValueError: If the action is missing required fields or has
an unknown action type.
"""
action_type = action.get("action")
rule_id = action.get("rule_id")
if not action_type or not rule_id:
raise ValueError(
f"Missing action or rule_id in changelog entry: {action}"
)
if action_type == ACTION_DISABLE:
return self._apply_disable(rule_id, site, timestamp)
elif action_type == ACTION_ENABLE:
return self._apply_enable(rule_id, site)
else:
raise ValueError(
f"Unknown changelog action '{action_type}'"
f" for rule {rule_id} on site {site.docroot}"
)
@staticmethod
def _get_last_sync_ts(site: WPSite) -> float | None:
"""Get the last disabled-rules sync timestamp for a site.
Returns None if the site has no DB record or no sync timestamp,
meaning all actions should be processed.
"""
try:
db_site = WordpressSite.get_by_id(site.docroot)
return db_site.disabled_rules_sync_ts
except WordpressSite.DoesNotExist:
return None
@staticmethod
def _apply_disable(rule_id: str, site: WPSite, timestamp: float) -> bool:
"""Apply a disable action from the changelog.
Returns:
True if a new disable entry was created (not a no-op).
"""
count = WPDisabledRule.store(
rule_id=rule_id,
domains=[site.domain],
source=WPDisabledRule.SOURCE_WORDPRESS,
user_id=site.uid,
timestamp=timestamp,
)
return count > 0
def _apply_enable(self, rule_id: str, site: WPSite) -> bool:
"""Apply an enable action from the changelog.
Returns:
True if a disable entry was removed.
"""
count = WPDisabledRule.remove(
rule_id=rule_id,
domains=[site.domain],
)
return count > 0
@staticmethod
async def _report_action(
action: dict,
site: WPSite,
sink: MessageSink | None,
timestamp: float,
) -> None:
"""Send a rule change event to the correlation server.
Must only be called for valid actions (after _process_action succeeds).
"""
if sink is None:
return
action_type = action["action"]
rule_id = action["rule_id"]
if action_type == ACTION_DISABLE:
message_cls = MessageType.WPRuleDisabled
elif action_type == ACTION_ENABLE:
message_cls = MessageType.WPRuleEnabled
else:
return
try:
await sink.process_message(
message_cls(
plugin_id="wordpress",
rule=rule_id,
domains=[site.domain],
timestamp=timestamp,
user_id=site.uid,
source=WPDisabledRule.SOURCE_WORDPRESS,
)
)
except Exception as e:
logger.error(
"Failed to report changelog action for rule %s on site %s: %s",
rule_id,
site.docroot,
e,
)
@staticmethod
def _is_disabled_rules_file_stale(
site: WPSite,
data_dir: Path,
) -> bool:
"""Check if disabled-rules.php was modified externally.
Reads the embedded timestamp from the file and compares it against
the stored sync timestamp in the database. If they differ
(e.g. file restored from backup), returns True to trigger regeneration.
"""
disabled_rules_path = data_dir / DISABLED_RULES_FILENAME
try:
with open_nofollow(str(disabled_rules_path)) as fd:
# dup: fdopen takes ownership, but open_nofollow also closes fd
with os.fdopen(os.dup(fd), "r", encoding="utf-8") as f:
content = f.read()
except FileNotFoundError:
return False
except OSError as exc:
if exc.errno != errno.ELOOP:
logger.debug("Cannot open %s: %s", disabled_rules_path, exc)
return False
try:
data = parse_php_with_embedded_json(content)
file_ts = float(data.get("ts", 0))
except (OSError, ValueError) as e:
logger.warning(
"Cannot read disabled-rules.php for site %s: %s",
site.docroot,
e,
)
return False
try:
db_site = WordpressSite.get_by_id(site.docroot)
except WordpressSite.DoesNotExist:
return False
db_ts = db_site.disabled_rules_sync_ts
return db_ts is None or abs(file_ts - db_ts) > 1.0
defence360agent/wordpress/cli.py 0000644 0000000 0000000 00000025330 00000000000 013722 0 ustar import asyncio
import logging
import pwd
import re
from pathlib import Path
from distutils.version import StrictVersion
from defence360agent.utils import (
check_run,
CheckRunError,
async_lru_cache,
)
from defence360agent.wordpress.constants import PLUGIN_PATH, PLUGIN_SLUG
from defence360agent.wordpress.utils import (
build_command_for_user,
get_php_binary_path,
wp_wrapper,
)
from defence360agent.sentry import log_message
from defence360agent.model.wordpress import WPSite
logger = logging.getLogger(__name__)
def _validate_semver(version_str: str) -> bool:
"""Validate if a string is a valid semantic version."""
# Handle None and non-string inputs
if not isinstance(version_str, str):
return False
# Trim the string and return False if empty
trimmed_str = version_str.strip()
if not trimmed_str:
return False
try:
StrictVersion(trimmed_str)
return True
except ValueError:
return False
def _extract_version_from_output(output: str) -> str:
"""
Extract version from WP CLI output, trying both first and last parts.
Args:
output: The raw output from WP CLI
Returns:
The extracted version string or None if no valid version found
"""
if not output:
return None
# Split the output into parts
parts = output.split()
if not parts:
return None
# Try the first part
if len(parts) > 0:
first_part = parts[0].strip()
if _validate_semver(first_part):
return first_part
# Try the last part
if len(parts) > 1:
last_part = parts[-1].strip()
if _validate_semver(last_part):
return last_part
# If neither first nor last part is valid semver, log to sentry
log_message(
"Failed to extract valid semver version from WP CLI output. Output:"
" '{output}'",
format_args={"output": output},
level="warning",
component="wordpress",
fingerprint="wp-plugin-version-extraction-failed",
)
# Return None when no valid semver is found
return None
async def _parse_version_from_plugin_file(site: WPSite) -> str:
"""
Parse the version of imunify-security plugin by reading the main plugin file.
Args:
site: WordPress site object containing docroot path
Returns:
str: Plugin version or None if not found or invalid
"""
content_dir = await get_content_dir(site)
plugin_file = (
content_dir / "plugins" / "imunify-security" / "imunify-security.php"
)
if not plugin_file.exists():
return None
version_pattern = re.compile(r"\* Version:\s*([0-9.]+)")
try:
with open(plugin_file) as f:
for line in f:
match = version_pattern.search(line)
if match:
version = match.group(1)
if _validate_semver(version):
return version
else:
return None
except Exception as e:
logger.error(
"Failed to read plugin file to determine version number %s: %s",
plugin_file,
e,
)
return None
return None
async def plugin_install(site: WPSite):
"""Install the Imunify Security WordPress plugin on given WordPress site."""
username = pwd.getpwuid(site.uid).pw_name
php_path = await get_php_binary_path(site, username)
args = [
*wp_wrapper(php_path, site.docroot),
"plugin",
"install",
str(PLUGIN_PATH),
"--activate",
"--force",
]
command = build_command_for_user(username, args)
logger.info(f"Installing wp plugin {command}")
await check_run(command)
async def plugin_update(site: WPSite):
"""
Update the Imunify Security WordPress plugin on given WordPress site.
Currently, this is the same as install, but in the future it may differ.
"""
username = pwd.getpwuid(site.uid).pw_name
php_path = await get_php_binary_path(site, username)
args = [
*wp_wrapper(php_path, site.docroot),
"plugin",
"install",
str(PLUGIN_PATH),
"--activate",
"--force",
]
command = build_command_for_user(username, args)
logger.info(f"Updating wp plugin {command}")
await check_run(command)
async def plugin_uninstall(site: WPSite):
"""Uninstall the imunify-security wp plugin from given wp site."""
username = pwd.getpwuid(site.uid).pw_name
php_path = await get_php_binary_path(site, username)
args = [
*wp_wrapper(php_path, site.docroot),
"plugin",
"uninstall",
PLUGIN_SLUG,
"--deactivate",
]
command = build_command_for_user(username, args)
logger.info(f"Uninstalling wp plugin {command}")
await check_run(command)
async def try_plugin_uninstall(site: WPSite) -> bool:
"""Attempt to uninstall the plugin, returning False on failure.
Safe wrapper around plugin_uninstall for use in cleanup paths
where failure should be logged but not raised.
"""
try:
await plugin_uninstall(site)
return True
except Exception as error:
logger.warning(
"Failed to uninstall plugin from %s during cleanup: %s",
site,
error,
)
return False
async def _get_plugin_version(site: WPSite):
"""
Get the version of the imunify-security wp plugin installed on given WordPress site.
Uses WP CLI to get the version.
"""
username = pwd.getpwuid(site.uid).pw_name
php_path = await get_php_binary_path(site, username)
args = [
*wp_wrapper(php_path, site.docroot),
"plugin",
"get",
PLUGIN_SLUG,
"--field=version",
]
command = build_command_for_user(username, args)
logger.info(f"Getting wp plugin version {command}")
try:
result = await check_run(command)
output = result.decode("utf-8").strip()
return _extract_version_from_output(output)
except CheckRunError as e:
logger.error(
"Failed to get wp plugin version. Return code: %s",
e.returncode,
)
return None
except UnicodeDecodeError as e:
logger.error("Failed to decode wp plugin version output: %s", e)
return None
async def get_plugin_version(site: WPSite):
"""
Get the version of the imunify-security wp plugin installed on given WordPress site.
First tries to parse the version from the plugin file, then falls back to WP CLI.
"""
# First try to parse version from plugin file
try:
version = await _parse_version_from_plugin_file(site)
if version:
return version
except Exception as e:
logger.warning("Failed to parse version from plugin file: %s", e)
# Fall back to WP CLI if file parsing fails
logger.info("Plugin version not found in file, trying WP CLI")
return await _get_plugin_version(site)
async def is_plugin_installed(site: WPSite):
"""Check if the imunify-security wp plugin is installed on given WordPress site."""
username = pwd.getpwuid(site.uid).pw_name
php_path = await get_php_binary_path(site, username)
args = [
*wp_wrapper(php_path, site.docroot),
"plugin",
"is-installed",
PLUGIN_SLUG,
]
command = build_command_for_user(username, args)
logger.info(f"Checking if wp plugin is installed {command}")
try:
await check_run(command)
except CheckRunError:
# exit code other than 0 means plugin is not installed or there is an error
return False
# exit code 0 means plugin is installed
return True
async def is_wordpress_installed(site: WPSite):
"""Check if WordPress is installed and given site is accessible using WP CLI."""
username = pwd.getpwuid(site.uid).pw_name
php_path = await get_php_binary_path(site, username)
args = [
*wp_wrapper(php_path, site.docroot),
"core",
"is-installed",
]
command = build_command_for_user(username, args)
logger.info(f"Checking if WordPress is installed {command}")
try:
# exit code other than 0 means WordPress is not installed or there is an error
await check_run(command)
except CheckRunError:
return False
# exit code 0 means WordPress is installed
return True
async def _get_content_directory(site: WPSite):
"""
Get the content directory of the WordPress site using WP CLI.
This should only be used if the default wp-content directory does not exist.
"""
username = pwd.getpwuid(site.uid).pw_name
php_path = await get_php_binary_path(site, username)
args = [
*wp_wrapper(php_path, site.docroot),
"eval",
"echo WP_CONTENT_DIR;",
]
command = build_command_for_user(username, args)
logger.info(f"Getting content directory {command}")
try:
result = await asyncio.wait_for(check_run(command), timeout=30)
return result.decode("utf-8").strip()
except asyncio.TimeoutError:
logger.warning(
"WP-CLI timed out getting content directory for %s", site.docroot
)
return None
except CheckRunError as e:
logger.error(
"Failed to get content directory. Return code: %s",
e.returncode,
)
return None
except UnicodeDecodeError as e:
logger.error("Failed to decode content directory output: %s", e)
return None
@async_lru_cache(maxsize=100)
async def get_content_dir(site: WPSite):
"""
Get the WordPress content directory for the given WordPress site.
This function first checks if the default wp-content directory exists at the site's docroot.
If the default path doesn't exist or isn't a directory, it attempts to get the actual
content directory using WordPress CLI's WP_CONTENT_DIR constant.
Returns:
Path: The WordPress content directory path
"""
content_dir = Path(site.docroot) / "wp-content"
# First check if content_dir exists and is a folder
if not content_dir.exists() or not content_dir.is_dir():
# If not, try to get the content directory using WP CLI
wp_content_dir = await _get_content_directory(site)
if wp_content_dir:
content_dir = Path(wp_content_dir)
return content_dir
def clear_get_content_dir_cache():
"""Clear the async LRU cache for get_content_dir."""
get_content_dir.cache_clear()
async def get_data_dir(site: WPSite):
"""
Get the Imunify Security data directory for the given WordPress site.
"""
content_dir = await get_content_dir(site)
if not content_dir:
content_dir = Path(site.docroot) / "wp-content"
return Path(content_dir) / "imunify-security"
defence360agent/wordpress/constants.py 0000644 0000000 0000000 00000000532 00000000000 015164 0 ustar """Constants for WordPress module."""
from pathlib import Path
PLUGIN_PATH = Path("/usr/share/imunify360/wp-plugins/imunify-security.zip")
PLUGIN_SLUG = "imunify-security"
PLUGIN_VERSION_FILE = Path(
"/usr/share/imunify360/wp-plugins/imunify-security.version"
)
WP_CLI_WRAPPER_PATH = Path("/usr/share/imunify360/wp-plugins/wp-cli-wrapper")
defence360agent/wordpress/exception.py 0000644 0000000 0000000 00000000136 00000000000 015146 0 ustar class PHPError(Exception):
def __init__(self, message):
super().__init__(message)
defence360agent/wordpress/incident_collector.py 0000644 0000000 0000000 00000051454 00000000000 017024 0 ustar """Collector for WordPress CVE protection incidents."""
import logging
import os
import pwd
import stat as stat_module
import time
import re
from pathlib import Path
from collections import defaultdict
from defence360agent.model.wordpress import WPSite
from defence360agent.wordpress.cli import get_data_dir
from defence360agent.wordpress.incident_parser import IncidentFileParser
from defence360agent.model.wordpress_incident import (
aggregate_incident_dicts,
bulk_create_wordpress_incidents,
build_incident_dict,
country_reader,
)
logger = logging.getLogger(__name__)
#: Marks a file taken aside for processing. The plugin keeps appending to a
#: freshly created file under the original name, so nothing written during the
#: batch is lost, and a file left behind is retried on the next cycle. The
#: .php extension stays last: a webserver that only hands *.php to the
#: interpreter would serve any other extension as readable text.
PROCESSING_SUFFIX = ".processing.php"
#: A batch this old has failed every cycle since it was set aside. Retiring it
#: stops the retry from repeating forever and unblocks the same-hour file it
#: would otherwise keep out of collection.
QUARANTINE_AFTER_SECONDS = 15 * 60
#: Terminal names for a batch the collector must not pick up again. Neither
#: is matched by the pattern, and both keep .php last for the same reason
#: PROCESSING_SUFFIX does. A stored batch says so: its incidents are safe.
FAILED_SUFFIX = ".failed.php"
STORED_SUFFIX = ".stored.php"
class IncidentRateLimiter:
"""
Rate limiter to prevent DoS attacks via incident flooding.
Implements per-rule-per-IP rate limiting as per spec:
- Maximum 100 incidents for each rule from the same IP within 15 minutes
Memory-optimized implementation with bounded entry count using LRU eviction.
"""
def __init__(
self,
max_incidents_per_rule_per_ip: int = 100,
time_window_seconds: int = 900, # 15 minutes
max_unique_entries: int = 10000, # Limit total unique (rule_id, IP) combinations
):
"""
Initialize the rate limiter.
Args:
max_incidents_per_rule_per_ip: Max incidents per rule per IP (default: 100)
time_window_seconds: Time window in seconds (default: 900 = 15 minutes)
max_unique_entries: Max unique (rule_id, IP) combinations to track (default: 10000)
"""
self.max_per_rule_per_ip = max_incidents_per_rule_per_ip
self.time_window = time_window_seconds
self.max_unique_entries = max_unique_entries
# Track incident timestamps: {(rule_id, ip): [timestamp1, timestamp2, ...]}
self.incident_times = defaultdict(list)
self.cleanup_interval = 60 # Clean up old records every minute
self.last_cleanup = time.time()
def _cleanup_old_records(self):
"""Remove records older than the time window and enforce max entries limit."""
now = time.time()
cutoff = now - self.time_window
# Clean expired timestamps from all entries
keys_to_delete = []
for key, timestamps in self.incident_times.items():
# Filter out timestamps older than the window
recent = [ts for ts in timestamps if ts > cutoff]
if recent:
self.incident_times[key] = recent
else:
keys_to_delete.append(key)
for key in keys_to_delete:
del self.incident_times[key]
# Enforce max unique entries limit using LRU eviction
if len(self.incident_times) > self.max_unique_entries:
# Find oldest entries (those with oldest timestamp)
entries_by_age = sorted(
self.incident_times.items(),
key=lambda x: x[1][0] if x[1] else 0,
)
# Remove oldest 10% of entries to avoid frequent evictions
num_to_remove = max(
1,
len(self.incident_times) - int(self.max_unique_entries * 0.9),
)
for key, _ in entries_by_age[:num_to_remove]:
del self.incident_times[key]
logger.warning(
"Rate limiter exceeded max entries (%d), removed %d oldest"
" entries",
self.max_unique_entries,
num_to_remove,
)
self.last_cleanup = now
def check_rate_limit(
self, rule_id: str, attacker_ip: str, pending: int = 0
) -> tuple[bool, str]:
"""
Check if adding an incident would exceed rate limits.
Args:
rule_id: Rule identifier
attacker_ip: IP address of the attacker
pending: Incidents already accepted in the current batch but not
recorded yet, so one file cannot exceed the limit on its own
Returns:
Tuple of (allowed: bool, reason: str)
"""
# Periodic cleanup
if time.time() - self.last_cleanup > self.cleanup_interval:
self._cleanup_old_records()
now = time.time()
cutoff = now - self.time_window
key = (rule_id, attacker_ip)
# Lazy cleanup: remove expired entries on access
if key in self.incident_times:
timestamps = self.incident_times[key]
# Filter out old timestamps
recent = [ts for ts in timestamps if ts > cutoff]
if recent:
self.incident_times[key] = recent
recent_count = len(recent)
else:
# All timestamps expired, remove entry
del self.incident_times[key]
recent_count = 0
else:
recent_count = 0
# Check if limit exceeded
recent_count += pending
if recent_count >= self.max_per_rule_per_ip:
window_minutes = self.time_window // 60
return (
False,
(
f"Rate limit exceeded for rule {rule_id} from IP"
f" {attacker_ip}:"
f" {recent_count}/{self.max_per_rule_per_ip} within"
f" {window_minutes} minutes"
),
)
return True, "OK"
def record_incident(self, rule_id: str, attacker_ip: str):
"""
Record that an incident was added.
Args:
rule_id: Rule identifier
attacker_ip: IP address
"""
now = time.time()
key = (rule_id, attacker_ip)
# Create list if it doesn't exist, or append to existing
if key not in self.incident_times:
self.incident_times[key] = [now]
else:
# Limit list size to prevent unbounded growth
timestamps = self.incident_times[key]
if len(timestamps) >= self.max_per_rule_per_ip:
# Remove oldest timestamp when at limit
timestamps.pop(0)
timestamps.append(now)
class IncidentCollector:
"""
Collect and persist WordPress incidents from plugin incident files.
"""
def __init__(self, rate_limiter: IncidentRateLimiter | None = None):
"""
Initialize the incident collector.
Args:
rate_limiter: Optional rate limiter (creates default if not provided)
"""
self.rate_limiter = rate_limiter or IncidentRateLimiter()
self.parser = IncidentFileParser()
#: Batches this process read and failed to clear. The agent idles out
#: after minutes of quiet, so age alone would retire one that was
#: never retried.
self._failed: set[str] = set()
async def collect_incidents_for_site(
self,
site: WPSite,
delete_after_processing: bool = True,
) -> list:
"""
Collect incidents from a single WordPress site.
Args:
site: WordPress site to collect incidents from
ruleset_version: Version of the ruleset being used
delete_after_processing: Whether to delete incident files after processing
Returns:
List of collected Incident objects
"""
collected_incidents = []
try:
data_dir = await get_data_dir(site)
logger.debug("Data directory for site %s: %s", site, data_dir)
if not data_dir.exists():
logger.debug("Data directory does not exist for site %s", site)
return []
incident_files = self._get_incident_files(data_dir)
logger.debug(
"Incident files for site %s: %s", site, incident_files
)
if not incident_files:
logger.debug("No incident files found for site %s", site)
return []
logger.debug(
"Found %d incident file(s) for site %s",
len(incident_files),
site,
)
username = self._get_site_username(site)
for incident_file in incident_files:
file_incidents = await self._process_file(
incident_file,
site,
username,
delete_after_processing,
)
collected_incidents.extend(file_incidents)
except Exception as e:
logger.error(
"Error collecting incidents for site %s: %s",
site,
e,
)
logger.info(
"Collected %d incident(s) for site %s",
len(collected_incidents),
site,
)
return collected_incidents
async def collect_incidents_for_sites(
self,
sites: list[WPSite],
delete_after_processing: bool = True,
) -> list:
"""
Collect incidents from multiple WordPress sites.
Args:
sites: List of WordPress sites
delete_after_processing: Whether to delete incident files after processing
Returns:
List of collected Incident objects
"""
all_collected_incidents = []
for site in sites:
site_incidents = await self.collect_incidents_for_site(
site,
delete_after_processing,
)
all_collected_incidents.extend(site_incidents)
if all_collected_incidents:
logger.info(
"Collected %d WordPress incident(s) from %d site(s)",
len(all_collected_incidents),
len(sites),
)
return all_collected_incidents
@classmethod
def _get_incident_files(cls, data_dir: Path) -> list[Path]:
"""
Get all incident files in the incidents directory.
Args:
data_dir: Path to the imunify-security data directory
Returns:
List of incident file paths
"""
incidents_dir = data_dir / "incidents"
logger.debug(
"Incidents directory for site %s: %s", data_dir, incidents_dir
)
if not incidents_dir.exists() or not incidents_dir.is_dir():
logger.debug(
"Incidents directory does not exist for site %s", data_dir
)
return []
# Use lstat (not Path.is_file) to identify regular files without following symlinks.
incident_files = []
for f in incidents_dir.iterdir():
try:
st = os.lstat(f)
except OSError:
continue
if stat_module.S_ISREG(st.st_mode) and cls._is_incident_file(f):
incident_files.append(f)
logger.debug(
"Incident files for site %s: %s", data_dir, incident_files
)
return incident_files
# Pattern for incident files: yyyy-mm-dd-hh.php, optionally taken aside
_FILE_PATTERN = re.compile(
r"^\d{4}-\d{2}-\d{2}-\d{2}(?:\.processing)?\.php$"
)
@classmethod
def _is_incident_file(cls, file_path: Path) -> bool:
"""
Check if a file is an incident file based on naming pattern.
Args:
file_path: Path to the file to check
Returns:
True if file matches pattern yyyy-mm-dd-hh.php, with or without
the suffix marking a batch left behind by an earlier cycle
"""
return bool(cls._FILE_PATTERN.match(file_path.name))
async def _process_file(
self,
incident_file,
site: WPSite,
username: str | None,
delete_after_processing: bool,
) -> list:
try:
if delete_after_processing:
incident_file = self._take_aside(incident_file)
if incident_file is None:
return []
incidents = self.parser.parse_file(incident_file)
if incidents is None:
self._failed.add(str(incident_file))
return []
if not incidents:
logger.warning(
"No valid incidents in file %s",
incident_file.name,
)
if delete_after_processing:
self._discard(incident_file)
return []
logger.debug(
"Parsed %d incident(s) from %s for site %s",
len(incidents),
incident_file.name,
site,
)
collected_incidents = self._process_file_incidents(
incidents,
site,
username,
incident_file.name,
)
if delete_after_processing:
self._discard(incident_file)
return collected_incidents
except Exception as e:
if delete_after_processing:
self._failed.add(str(incident_file))
logger.error(
"Error processing incident file %s for site %s: %s",
incident_file.name,
site,
e,
)
return []
def _take_aside(self, incident_file: Path) -> Path | None:
"""Move the file out of the plugin's way before reading it.
Returns None when an earlier batch is still pending under the aside
name; that batch is processed in its own turn and the fresh file waits
for the next cycle rather than overwriting it.
"""
if incident_file.name.endswith(PROCESSING_SUFFIX):
if self._quarantine(incident_file):
return None
return incident_file
aside = incident_file.with_name(
incident_file.name[: -len(".php")] + PROCESSING_SUFFIX
)
if aside.exists() and self._pending(aside):
if not self._quarantine(aside):
return None
incident_file.rename(aside)
# rename keeps the plugin's mtime, so stamp the file to date the
# attempt rather than the last write to it.
os.utime(aside, None, follow_symlinks=False)
return aside
@staticmethod
def _pending(aside: Path) -> bool:
"""Whether an aside still holds a batch waiting to be stored.
Anything the site put there that is not a regular file is not one,
and the rename replaces it.
"""
try:
st = os.lstat(aside)
except OSError:
return False
return stat_module.S_ISREG(st.st_mode) and st.st_size > 0
def _retire(self, path: Path, suffix: str) -> Path | None:
"""Give a batch a name the collector will not pick up again.
Renaming touches the name, never what it points at, so it stays safe
in a directory the site owns.
"""
stem = path.name
for known in (PROCESSING_SUFFIX, ".php"):
if stem.endswith(known):
stem = stem[: -len(known)]
break
retired = path.with_name(stem + suffix)
try:
path.rename(retired)
except OSError as e:
logger.error("Failed to retire %s: %s", path.name, e)
return None
self._failed.discard(str(path))
return retired
def _quarantine(self, aside: Path) -> bool:
"""Retire an aside this process has read and still failed to clear."""
if str(aside) not in self._failed:
return False
try:
age = time.time() - os.lstat(aside).st_mtime
except OSError:
return True
if age < QUARANTINE_AFTER_SECONDS:
return False
retired = self._retire(aside, FAILED_SUFFIX)
if retired is None:
return False
logger.error(
"Gave up on %s after %d seconds, kept it as %s",
aside.name,
age,
retired.name,
)
return True
def _discard(self, incident_file: Path) -> bool:
"""Delete a stored batch, reporting whether it is gone.
Emptying one we cannot delete would mean writing through a path the
site owns, so it is retired under a name we never collect instead.
"""
try:
incident_file.unlink(missing_ok=True)
self._failed.discard(str(incident_file))
return True
except OSError as e:
logger.error("Failed to delete %s: %s", incident_file.name, e)
# Its incidents are stored: reading the file again would add to their
# counts, so retire it now rather than leaving it to be picked up.
retired = self._retire(incident_file, STORED_SUFFIX)
if retired is None:
self._failed.add(str(incident_file))
else:
logger.warning(
"Could not delete %s, kept the stored batch as %s",
incident_file.name,
retired.name,
)
return False
def _get_site_username(self, site: WPSite) -> str | None:
try:
user_info = pwd.getpwuid(site.uid)
return user_info.pw_name
except Exception as e:
logger.error(
"Failed to get username for uid=%d, site %s: %s",
site.uid,
site,
e,
)
return None
def _process_file_incidents(
self,
incidents: list[dict],
site: WPSite,
username: str | None,
incident_file_name: str,
) -> list:
incidents_to_insert = []
accepted: defaultdict = defaultdict(int)
dropped_count = 0
# Prepare all incidents for bulk insertion
with country_reader() as geo_reader:
for incident in incidents:
rule_id = incident.get("rule_id", "unknown")
attacker_ip = incident.get("REMOTE_ADDR") or incident.get(
"attacker_ip", "unknown"
)
allowed, reason = self.rate_limiter.check_rate_limit(
rule_id,
attacker_ip,
pending=accepted[(rule_id, attacker_ip)],
)
if not allowed:
logger.warning(
"Rate limit exceeded for site %s: %s",
site,
reason,
)
dropped_count += 1
continue
# Prepare incident data for bulk insert
site_info = {
"domain": site.domain,
"site_path": site.docroot,
"username": username,
"user_id": site.uid,
}
incident_data = build_incident_dict(
incident, site_info, geo_reader=geo_reader
)
incidents_to_insert.append(incident_data)
accepted[(rule_id, attacker_ip)] += 1
if not incidents_to_insert:
logger.info(
"Processed file %s: 0 stored, 0 aggregated, %d dropped",
incident_file_name,
dropped_count,
)
return []
aggregated = aggregate_incident_dicts(incidents_to_insert)
try:
bulk_create_wordpress_incidents(aggregated)
except Exception:
logger.error(
"Failed to store %d incident(s) from %s, keeping the file"
" for the next cycle",
len(incidents_to_insert),
incident_file_name,
exc_info=True,
)
raise
# Only a stored incident spends rate-limit budget; a kept file is
# retried next cycle and must not be throttled away unstored.
for (rule_id, attacker_ip), count in accepted.items():
for _ in range(count):
self.rate_limiter.record_incident(rule_id, attacker_ip)
logger.info(
"Processed file %s: %d stored, %d aggregated, %d dropped",
incident_file_name,
len(aggregated),
len(incidents_to_insert) - len(aggregated),
dropped_count,
)
return aggregated
defence360agent/wordpress/incident_parser.py 0000644 0000000 0000000 00000011724 00000000000 016326 0 ustar """Parser for WordPress plugin incident files."""
import base64
import json
import logging
import math
import os
from pathlib import Path
from defence360agent.utils.fd_ops import open_nofollow
logger = logging.getLogger(__name__)
class IncidentFileParser:
"""
Parse incident files written by the WordPress plugin.
These files have format:
<?php __halt_compiler();
#{base64-encoded JSON data for incident}
#{base64-encoded JSON data for incident}
...
File pattern: wp-content/imunify-security/incidents/yyyy-mm-dd-hh.php
"""
@classmethod
def parse_file(cls, file_path: Path) -> list[dict] | None:
"""Parse an incident file, or None when it could not be read.
A file that could not be read is not an empty one: the caller keeps
it for the next cycle instead of discarding a batch it never saw.
The file format is:
- First line: <?php __halt_compiler();
- Following lines: #{base64-encoded JSON}
Opens with O_NOFOLLOW to prevent reading arbitrary files if
the incident file was replaced with a symlink.
"""
incidents = []
try:
with open_nofollow(str(file_path)) as fd:
# dup: fdopen takes ownership, but open_nofollow also closes fd
with os.fdopen(os.dup(fd), "r", encoding="utf-8") as f:
for line_num, line in enumerate(f, 1):
line = line.strip()
incident = cls._process_line(line, line_num, file_path)
if incident is not None:
incidents.append(incident)
except Exception as e:
logger.error(
"Error reading incident file %s: %s",
file_path,
e,
)
return None
return incidents
@classmethod
def _process_line(
cls, line: str, line_num: int, file_path: Path
) -> dict | None:
"""
Process a single line from an incident file.
Args:
line: The line content (already stripped)
line_num: Line number for logging
file_path: Path to the file being processed
Returns:
Parsed incident dictionary or None if line should be skipped
"""
# Skip empty lines
if not line:
return None
if line.startswith("<?php"):
logger.debug(
"Skipping PHP header line %d in %s",
line_num,
file_path.name,
)
return None
# Lines should start with # followed by base64-encoded JSON
if not line.startswith("#"):
logger.debug(
"Line %d in %s doesn't start with #: %s",
line_num,
file_path.name,
line[:50],
)
return None
# Remove the # prefix
encoded_data = line[1:]
return cls._process_encoded_line(encoded_data, line_num, file_path)
@classmethod
def _process_encoded_line(
cls, encoded_data: str, line_num: int, file_path: Path
) -> dict | None:
"""
Decode base64-encoded JSON data from an incident line.
Args:
encoded_data: Base64-encoded JSON string
line_num: Line number for logging
file_path: Path to the file being processed
Returns:
Parsed incident dictionary or None if decoding/parsing fails
"""
try:
decoded_bytes = base64.b64decode(encoded_data)
decoded_str = decoded_bytes.decode("utf-8")
incident = json.loads(decoded_str)
if not isinstance(incident, dict):
logger.warning(
"Line %d in %s is not a JSON object: %s",
line_num,
file_path.name,
decoded_str[:100],
)
return None
if not cls._has_valid_timestamp(incident):
logger.warning(
"Line %d in %s has no usable ts: %r",
line_num,
file_path.name,
incident.get("ts"),
)
return None
return incident
except (Exception, json.JSONDecodeError) as e:
logger.error(
"Failed to decode base64 on line %d in %s: %s",
line_num,
file_path.name,
e,
)
return None
@staticmethod
def _has_valid_timestamp(incident: dict) -> bool:
"""The timestamp decides the aggregation window, so it must be usable.
json.loads accepts Infinity and NaN, which survive a bare > 0 check
and blow up when the window is computed.
"""
try:
ts = float(incident["ts"])
except (KeyError, TypeError, ValueError):
return False
return math.isfinite(ts) and ts > 0
defence360agent/wordpress/incident_sender.py 0000644 0000000 0000000 00000025131 00000000000 016307 0 ustar """Send WordPress incidents to the correlation server."""
import hashlib
import itertools
import json
import logging
from datetime import datetime
from functools import partial
from time import monotonic
from types import MappingProxyType
from typing import Any, Mapping
from defence360agent.contracts.messages import SensorWordpressIncidentList
from defence360agent.contracts.plugins import MessageSink
from defence360agent.internals import delivery_ack
from defence360agent.model.wordpress_incident import (
get_unsent_wordpress_incidents,
settle_wordpress_incidents_reported,
)
logger = logging.getLogger(__name__)
class IncidentSender:
"""
Send WordPress incidents to the correlation server.
WordPress incidents are already in the Incident table (visible to UI).
This class sends them to correlation via Reportable messages, which are
handled by the SendToServer/SendToServerNATS/SendToServerFGW plugins.
Those plugins queue a message rather than deliver it, and a send round
can lose its batch or be force-cancelled mid-publish while the agent
shuts down. Each incident therefore keeps a count of the occurrences the
transport has not acknowledged, and every collection cycle sends whatever
is still outstanding.
"""
# rows one cycle takes on, so a backlog is paged instead of read whole;
# the byte budget, not this, is what bounds a single message
MAX_INCIDENTS_PER_CYCLE = 1000
# how long to wait for an acknowledgement before assuming the round was
# lost; also paces retries, since a batch nobody acknowledges is re-sent
# at most once per timeout
ACK_TIMEOUT = 300
def __init__(self) -> None:
# message_id -> ({incident id: occurrences it reported}, deadline)
self._inflight: dict[str, tuple[dict[int, int], float]] = {}
def _prepare_incident_for_correlation(
self, incident: dict
) -> dict[str, Any]:
"""
Prepare an incident for sending to the correlation server.
WordPress incidents use extra_info JSON field to store plugin-specific data.
Args:
incident: WordpressIncident dictionary (with extra_info populated)
Returns:
Dictionary formatted for correlation server
"""
logger.info("Preparing incident for correlation: %s", incident)
# JSONField automatically deserializes to dict, fallback to empty dict if None
extra: dict = incident.get("extra_info") or {}
# Convert timestamp to int and format date
timestamp_value: float = float(incident.get("timestamp") or 0)
timestamp = int(timestamp_value)
dt = (
datetime.fromtimestamp(timestamp_value).strftime("%Y-%m-%d")
if timestamp_value
else ""
)
return {
"timestamp": timestamp,
"dt": dt,
"plugin_id": incident.get("plugin"),
"rule": incident.get("rule") or "unknown",
"name": incident.get("name"),
"message": incident.get("description"),
"severity": incident.get("severity"),
"attackers_ip": incident.get("abuser") or "",
"domain": incident.get("domain") or "",
# the occurrences this message reports, not the row's running
# total: re-reporting occurrences correlation already counted
# inflates the heuristics that consume this field
"retries": incident.get("unsent_retries") or 1,
"uri": extra.get("request_uri") or "",
"user_agent": extra.get("http_user_agent") or "",
"http_method": extra.get("request_method") or "",
"user_logged_in": extra.get("user_logged_in") == "true"
if extra.get("user_logged_in")
else None,
"file_path": extra.get("site_path") or "",
"user": extra.get("username") or "",
"tag": self._build_tags(extra),
# Include WordPress-specific fields
"target": extra.get("target") or "",
"slug": extra.get("slug") or "",
"version": extra.get("version") or "",
"mode": extra.get("mode") or "",
"details": extra,
}
def _build_tags(self, extra: dict) -> list[str]:
tags = ["wordpress", "cve"]
if extra.get("cve"):
tags.append(extra["cve"])
if extra.get("target"):
tags.append(f"target_{extra['target']}")
if extra.get("mode"):
tags.append(f"mode_{extra['mode']}")
return tags
async def send_pending_incidents(self, sink: MessageSink | None) -> int:
"""Send every incident the server has not acknowledged.
Runs once per collection cycle, after the freshly collected
incidents were stored, so one pass covers both the new rows and the
ones whose earlier message never left the agent.
"""
if sink is None:
logger.warning("No sink provided, skipping incident sending")
return 0
self._expire_inflight()
incidents = get_unsent_wordpress_incidents(
limit=self.MAX_INCIDENTS_PER_CYCLE,
exclude_ids=self._inflight_ids(),
)
return await self.send_incidents(sink, incidents)
async def send_incidents(
self, sink: MessageSink | None, incidents: list[dict]
) -> int:
"""
Send WordPress incidents to the correlation server.
Since incidents are already in the WordpressIncident table (visible to UI),
we just need to send them to correlation.
Args:
incidents: List of incidents to send
Returns:
Number of incidents sent
"""
if sink is None:
logger.warning("No sink provided, skipping incident sending")
return 0
if len(incidents) == 0:
logger.debug("No incidents to send, skipping")
return 0
logger.info(
"Sending %d incidents to correlation server", len(incidents)
)
correlation_batch = [
self._prepare_incident_for_correlation(incident)
for incident in incidents
]
pending = iter(
[
(incident.get("id"), incident.get("unsent_retries") or 1)
for incident in incidents
]
)
for batch in SensorWordpressIncidentList.batched(correlation_batch):
await self._send_batch(
sink,
batch,
{
incident_id: occurrences
for incident_id, occurrences in itertools.islice(
pending, len(batch)
)
if incident_id is not None
},
)
return len(correlation_batch)
async def _send_batch(
self,
sink: MessageSink,
correlation_batch: list[dict],
reported: Mapping[int, int] = MappingProxyType({}),
):
"""Send a batch of incidents to correlation server.
Uses SensorIncidentList Reportable message which is sent to
correlation via the SendToServer/SendToServerNATS/SendToServerFGW
plugins.
"""
logger.info(
"Sending batch of %d incidents to correlation server",
len(correlation_batch),
)
logger.info(
"Correlation batch json: %s",
json.dumps(correlation_batch, indent=2),
)
message = SensorWordpressIncidentList(correlation_batch)
# Pin the id the send path would otherwise generate itself, so its
# acknowledgement can be tied back to these rows. Deriving it from the
# rows also makes a re-send carry the id of the message it repeats,
# which lets the transport's de-duplication window collapse the two.
message_id = hashlib.sha1(
json.dumps(
[sorted(reported.items()), correlation_batch], sort_keys=True
).encode()
).hexdigest()
message["message_id"] = message_id
self._watch(message_id, reported)
try:
await sink.process_message(message)
logger.info(
"Queued %d wordpress incident(s) for correlation server"
" (message %s)",
len(correlation_batch),
message_id,
)
except Exception as e:
# the message never made it into the queue, so stop waiting for
# an acknowledgement and let the next cycle send it again
self._unwatch(message_id)
logger.error(
"Failed to queue incident batch: %s",
e,
)
raise
def _watch(self, message_id: str, reported: Mapping[int, int]) -> None:
if not reported:
return
reported = dict(reported)
self._inflight[message_id] = (
reported,
monotonic() + self.ACK_TIMEOUT,
)
delivery_ack.registry.watch(
message_id,
partial(self._on_delivered, message_id, reported),
)
def _unwatch(self, message_id: str) -> None:
self._inflight.pop(message_id, None)
delivery_ack.registry.unwatch(message_id)
def _on_delivered(self, message_id: str, reported: dict[int, int]) -> None:
# written here rather than buffered for the next cycle because a
# send round usually lands during shutdown, and a count kept in
# memory until then would not survive the restart
self._inflight.pop(message_id, None)
settled = settle_wordpress_incidents_reported(reported)
logger.info(
"Discounted %d wordpress incident(s) delivered to correlation",
settled,
)
def _expire_inflight(self) -> None:
"""Give up on batches the transport never acknowledged, so their
incidents become eligible to be sent again."""
now = monotonic()
expired = [
message_id
for message_id, (_, deadline) in self._inflight.items()
if deadline <= now
]
for message_id in expired:
reported, _ = self._inflight.pop(message_id)
delivery_ack.registry.unwatch(message_id)
logger.warning(
"No delivery confirmation for %d wordpress incident(s)"
" (message %s) in %ds, sending them again",
len(reported),
message_id,
self.ACK_TIMEOUT,
)
def _inflight_ids(self) -> set[int]:
return {
incident_id
for reported, _ in self._inflight.values()
for incident_id in reported
}
defence360agent/wordpress/plugin.py 0000644 0000000 0000000 00000224111 00000000000 014447 0 ustar import asyncio
import errno
import logging
import os
import pwd
import time
from collections import defaultdict
from collections.abc import Awaitable, Callable
from distutils.version import LooseVersion
from functools import cache
from pathlib import Path
from defence360agent.api import inactivity
from defence360agent.contracts.config import (
MalwareScanScheduleInterval as Interval,
SystemConfig,
ANTIVIRUS_MODE,
UserType,
choose_value_from_config,
)
from defence360agent.files import Index, WP_RULES
from defence360agent.sentry import log_message
from defence360agent.utils import importer
from defence360agent.utils.fd_ops import (
open_dir_no_symlinks,
open_nofollow,
rmtree_fd,
safe_dir,
)
from defence360agent.contracts.config import Wordpress
from defence360agent.subsys.panels import hosting_panel
from defence360agent.wordpress.wp_rules import (
get_wp_rules_data,
get_wp_ruleset_version,
)
from defence360agent.model.wordpress import WordpressSite, WPSite
from defence360agent.model.wp_disabled_rule import WPDisabledRule
from defence360agent.wordpress import cli, telemetry
from defence360agent.wordpress.constants import PLUGIN_VERSION_FILE
from defence360agent.wordpress.utils import (
_validate_preset,
calculate_next_scan_timestamp,
clear_get_cagefs_enabled_users_cache,
ensure_site_data_directory,
format_php_with_embedded_json,
get_imunify_package_versions,
get_last_scan,
get_malware_history,
prepare_plugin_config,
prepare_scan_data,
write_plugin_data_file_atomically,
)
from defence360agent.wordpress.site_repository import (
clear_manually_deleted_flag,
delete_site,
get_installed_sites_by_domains,
get_outdated_sites,
get_sites_for_user,
get_sites_to_adopt,
get_sites_to_install,
get_sites_to_mark_as_manually_deleted,
get_installed_sites,
insert_installed_sites,
mark_site_as_manually_deleted,
update_site_identity,
update_site_version,
)
from defence360agent.wordpress.proxy_auth import setup_site_authentication
logger = logging.getLogger(__name__)
@cache
def _get_user_schedule_config_imav():
return importer.get(
module="imav.malwarelib.plugins.schedule_watcher",
name="get_user_schedule_config",
default=None,
)
# Fallback when WORDPRESS keys are missing from config (old schema).
# True keeps WAF on for old schemas — no behavior change on upgrade.
_LEGACY_WAF_FALLBACK = True
_apply_waf_default_lock = asyncio.Lock()
_apply_waf_default_pending = False
# Default when ai_bot_protection is missing from config (old schema on
# a host where sibling packages haven't shipped the field yet). False
# because the feature is opt-in — if we can't determine admin intent,
# stay off rather than silently activate request-blocking logic.
_AI_BOT_PROTECTION_DEFAULT = False
_AI_BOT_PROTECTION_PRESET_DEFAULT = "balanced"
def _get_global_waf_enabled() -> bool:
try:
return bool(Wordpress.WAF_ENABLED)
except KeyError:
return _LEGACY_WAF_FALLBACK
def _get_waf_default() -> bool:
try:
return bool(Wordpress.WAF_DEFAULT)
except KeyError:
return _LEGACY_WAF_FALLBACK
def _get_security_plugin_enabled() -> bool:
# KeyError -> False (feature off), matching the schema default. Unlike the
# WAF keys there is no legacy "on" fallback: an absent key means the
# feature simply isn't present on this schema, and a missing key must not
# crash a read-only caller during agent/imunify-antivirus version skew.
try:
return bool(Wordpress.SECURITY_PLUGIN_ENABLED)
except KeyError:
return False
def _get_global_ai_bot_protection() -> bool:
"""Read WORDPRESS.ai_bot_protection from config, defaulting to False.
Returns _AI_BOT_PROTECTION_DEFAULT when the config key is missing
— e.g. the ai_bot_protection field hasn't rolled out to this
install's imunify360 yet, or a sibling package is still on an
older schema. Keeps the feature off in all ambiguous cases.
"""
try:
return bool(Wordpress.AI_BOT_PROTECTION)
except KeyError:
return _AI_BOT_PROTECTION_DEFAULT
def _get_global_ai_bot_protection_preset() -> str:
"""Read WORDPRESS.ai_bot_protection_preset from config, defaulting to
"balanced".
Two layers of safety: KeyError on a missing key (older schema, agent
upgrade in progress) and _validate_preset() on the value itself
(hand-edited override file, future preset rolled in via a sibling
package this version doesn't recognise). Both fall back to the same
canonical default so all layers — schema, agent, plugin — agree.
"""
try:
raw = Wordpress.AI_BOT_PROTECTION_PRESET
except KeyError:
return _AI_BOT_PROTECTION_PRESET_DEFAULT
return _validate_preset(raw)
WAF_SOURCE_DEFAULT = "default"
WAF_SOURCE_OVERRIDE = "override"
WAF_SOURCE_KILL_SWITCH = "global kill switch"
def waf_global_snapshot() -> tuple[bool, bool, bool]:
"""Read the three server-wide WAF flags in one call.
Returns (security_plugin_enabled, global_waf_enabled, waf_default), each
guarded against a missing config key (schema version skew during an
agent/imunify-antivirus upgrade) the same way the individual accessors are.
"""
return (
_get_security_plugin_enabled(),
_get_global_waf_enabled(),
_get_waf_default(),
)
def waf_status_and_source_for_user_sync(username: str) -> tuple[bool, str]:
if not _get_global_waf_enabled():
return False, WAF_SOURCE_KILL_SWITCH
try:
value, source = choose_value_from_config(
"WORDPRESS", "waf_enabled", username=username
)
except KeyError:
return _get_waf_default(), WAF_SOURCE_DEFAULT
if source == UserType.ROOT:
return _get_waf_default(), WAF_SOURCE_DEFAULT
return bool(value), WAF_SOURCE_OVERRIDE
def _is_waf_enabled_for_user_sync(username: str) -> bool:
enabled, _ = waf_status_and_source_for_user_sync(username)
return enabled
async def is_waf_enabled_for_user(username: str) -> bool:
"""Async wrapper — runs config file I/O in executor."""
loop = asyncio.get_running_loop()
return await loop.run_in_executor(
None, _is_waf_enabled_for_user_sync, username
)
def _user_has_explicit_waf_override_sync(username: str) -> bool:
try:
_, source = choose_value_from_config(
"WORDPRESS", "waf_enabled", username=username
)
except KeyError:
return False
return source != UserType.ROOT
COMPONENTS_DB_PATH = Path(
"/var/lib/cloudlinux-app-version-detector/components_versions.sqlite3"
)
def _get_user_schedule_config(username: str, admin_config: SystemConfig):
"""
Get user-specific schedule configuration with lazy import fallback.
Returns default values if imav.malwarelib is not available.
"""
get_user_schedule_config = _get_user_schedule_config_imav()
if get_user_schedule_config is None:
logger.debug(
"imav.malwarelib not available, returning default schedule config"
)
return Interval.NONE, 0, 1, 0
return get_user_schedule_config(username, admin_config)
def get_updated_wp_rules_data(index: Index) -> dict | None:
"""
Retrieve WordPress rules with ANTIVIRUS_MODE handling and global disable filtering.
In ANTIVIRUS_MODE, all rules are set to monitoring mode ("pass").
Globally disabled rules are filtered out entirely — they should not
appear in rules.php. Domain-specific disables are handled separately
via disabled-rules.php.
Args:
index: The Index object used to locate the wp-rules.zip file.
Returns:
The parsed wp-rules data with mode adjusted for ANTIVIRUS_MODE
and globally disabled rules removed, or None if rules cannot be loaded.
"""
rules_data = get_wp_rules_data(index)
if rules_data is None:
return None
if ANTIVIRUS_MODE:
# all rules will be in monitoring mode only for AV and AV+
for cve, params in rules_data.items():
params["mode"] = "pass"
# Filter out globally disabled rules — these are excluded from rules.php
globally_disabled = set(WPDisabledRule.get_global_disabled())
if globally_disabled:
rules_data = {
cve: params
for cve, params in rules_data.items()
if cve not in globally_disabled
}
return rules_data
def clear_caches():
"""Clear all WordPress-related caches."""
clear_get_cagefs_enabled_users_cache()
cli.clear_get_content_dir_cache()
def site_search(items: dict, user_info: pwd.struct_passwd, matcher) -> dict:
# Get all WordPress sites for the user (the main site is always last)
user_sites = get_sites_for_user(user_info)
result = {path: [] for path in user_sites}
for item in items:
# Find all matching sites for this item
matching_sites = [path for path in user_sites if matcher(item, path)]
if matching_sites:
# Find the most specific (longest) matching path
most_specific_site = max(matching_sites, key=len)
result[most_specific_site].append(item)
return result
async def _get_scan_data_for_user(
sink, user_info: pwd.struct_passwd, admin_config: SystemConfig
):
# Get the last scan data
last_scan = await get_last_scan(sink, user_info.pw_name)
# Extract the last scan date
last_scan_time = last_scan.get("scan_date", None)
# Get user-specific schedule configuration
interval, hour, day_of_month, day_of_week = _get_user_schedule_config(
user_info.pw_name, admin_config
)
next_scan_time = None
if interval != Interval.NONE:
next_scan_time = calculate_next_scan_timestamp(
interval, hour, day_of_month, day_of_week
)
# Get the malware history for the user
malware_history = get_malware_history(user_info.pw_name)
# Split malware history by site. This part relies on the main site being the last one in the list.
# Without this all malware could be attributed to the main site.
malware_by_site = site_search(
malware_history,
user_info,
lambda item, path: item["resource_type"] == "file"
and item["file"].startswith(path),
)
return last_scan_time, next_scan_time, malware_by_site
async def _send_telemetry_task(coro, semaphore: asyncio.Semaphore):
async with semaphore:
try:
await coro
except Exception as e:
logger.error(f"Telemetry task failed: {e}")
async def process_telemetry_tasks(coroutines: list, concurrency=10):
"""
Process a list of telemetry coroutines with a concurrency limit.s
"""
if not coroutines:
return
semaphore = asyncio.Semaphore(concurrency)
tasks = [
asyncio.create_task(_send_telemetry_task(coro, semaphore))
for coro in coroutines
]
try:
await asyncio.gather(*tasks)
except Exception as e:
logger.error(f"Some telemetry tasks failed: {e}")
async def load_wp_rules_php():
"""
Load WordPress rules from the index and format them as PHP.
Returns:
str or None: PHP-formatted rules data, or None if rules could not be loaded.
"""
try:
wp_rules_index = Index(WP_RULES, integrity_check=False)
await wp_rules_index.update()
wp_rules_data = get_updated_wp_rules_data(wp_rules_index)
except Exception as e:
logger.warning(
"Failed to load wp-rules index: %s, skipping rules installation",
e,
)
return None
if not wp_rules_data:
logger.warning(
"valid WordPress rules not found, skipping rules installation"
)
return None
# Get version and create ruleset dict with version and rules
wp_rules_version = get_wp_ruleset_version(wp_rules_index)
ruleset_dict = {
"version": wp_rules_version,
"rules": wp_rules_data,
}
return format_php_with_embedded_json(ruleset_dict)
async def install_everywhere(sink):
"""Install the imunify-security plugin for all sites where it is not installed."""
sites = get_sites_to_install()
installer = WordPressSiteInstaller(sink, sites)
return await installer.run()
async def adopt_found_sites(sink):
"""
Adopt WordPress sites where the plugin is installed but not tracked in our database
or flagged as manually removed.
This handles scenarios like:
- Sites copied/migrated from another location
- Sites migrated from another server
- Sites where the manually_deleted flag was incorrectly set (past bugs)
- Sites where the user installed the plugin from wordpress.org
"""
sites = get_sites_to_adopt()
processor = WordPressSiteAdopter(sink, sites)
return await processor.run()
def get_latest_plugin_version() -> str:
"""Get the latest version of the imunify-security plugin from the version file."""
try:
if not PLUGIN_VERSION_FILE.exists():
logger.error(
"Plugin version file does not exist: %s", PLUGIN_VERSION_FILE
)
return None
return PLUGIN_VERSION_FILE.read_text().strip()
except Exception as e:
logger.error("Failed to read plugin version file: %s", e)
return None
async def update_everywhere(sink):
"""Update the imunify-security plugin on all sites where it is installed."""
latest_version = get_latest_plugin_version()
if not latest_version:
logger.error("Could not determine latest plugin version")
return
logger.info(
"Updating imunify-security wp plugin to the latest version %s",
latest_version,
)
updated = set()
telemetry_coros = []
with inactivity.track.task("wp-plugin-update"):
try:
# Get sites with outdated versions
outdated_sites = get_outdated_sites(latest_version)
logger.info(f"Found {len(outdated_sites)} outdated sites")
if not outdated_sites:
return
# Create SystemConfig once for all users
admin_config = SystemConfig()
versions = await get_imunify_package_versions()
# Group sites by user id
sites_by_user = defaultdict(list)
for site in outdated_sites:
sites_by_user[site.uid].append(site)
# Process each user's sites
for uid, sites in sites_by_user.items():
try:
user_info = pwd.getpwuid(uid)
username = user_info.pw_name
except Exception as error:
logger.error(
"Failed to get username for uid=%d. error=%s",
uid,
error,
)
continue
# Get scan data once for all sites of this user
(
last_scan_time,
next_scan_time,
malware_by_site,
) = await _get_scan_data_for_user(
sink, user_info, admin_config
)
plugin_config = prepare_plugin_config(username)
for site in sites:
if await remove_site_if_missing(sink, site):
continue
try:
# Check if site still exists
if not await cli.is_wordpress_installed(site):
logger.info(
"WordPress site no longer exists: %s", site
)
continue
# Prepare scan data
scan_data = prepare_scan_data(
last_scan_time,
next_scan_time,
username,
site,
malware_by_site,
versions=versions,
)
# Resolve the data dir once; both writes reuse it.
data_dir = await ensure_site_data_directory(
site, user_info
)
# Update the scan data file
await update_scan_data_file(
site,
scan_data,
user_info=user_info,
data_dir=data_dir,
)
# Keep plugin_config.php fresh alongside scan_data
# — covers the case where a ConfigUpdate event
# was missed (plugin re-installed after the
# toggle, first scan after an upgrade, etc).
await update_plugin_config_file(
site,
plugin_config,
user_info=user_info,
data_dir=data_dir,
)
# Now update the plugin
await cli.plugin_update(site)
updated.add(site)
# Get the version after update
version = await cli.get_plugin_version(site)
if version:
# Store original version for comparison
original_version = site.version
# Update the database with the new version
update_site_version(site, version)
# Create a new WPSite with updated version
site = site.build_with_version(version)
# Determine if this is a downgrade
is_downgrade = LooseVersion(
version
) < LooseVersion(original_version)
# Prepare telemetry
telemetry_coros.append(
telemetry.send_event(
sink=sink,
event=(
"downgraded_by_imunify"
if is_downgrade
else "updated_by_imunify"
),
site=site,
version=version,
)
)
except Exception as error:
logger.error(
"Failed to update plugin on site=%s error=%s",
site,
error,
)
logger.info(
"Updated imunify-security wp plugin on %d sites",
len(updated),
)
except asyncio.CancelledError:
logger.info(
"Update of imunify-security wp plugin was cancelled. Plugin"
" was updated on %d sites",
len(updated),
)
except Exception as error:
logger.error(
"Error occurred during plugin update. error=%s", error
)
raise
finally:
# Send telemetry
await process_telemetry_tasks(telemetry_coros)
async def delete_plugin_files(site: WPSite):
data_dir = await cli.get_data_dir(site)
# Open both target and parent dirs with symlink protection before
# performing any destructive operations.
try:
dir_fd = open_dir_no_symlinks(data_dir)
except OSError as exc:
if exc.errno == errno.ENOENT:
return # directory does not exist — nothing to delete
if exc.errno in (errno.ELOOP, errno.ENOTDIR):
logger.warning(
"Skipping rmtree: data directory %s is a symlink", data_dir
)
return
raise
try:
with safe_dir(data_dir.parent) as parent_fd:
try:
await asyncio.to_thread(rmtree_fd, dir_fd)
finally:
os.close(dir_fd)
dir_fd = -1
# Remove the now-empty directory via the parent fd.
os.rmdir(data_dir.name, dir_fd=parent_fd)
except BaseException:
if dir_fd >= 0:
os.close(dir_fd)
raise
async def remove_from_single_site(site: WPSite, sink, telemetry_coros) -> int:
"""
Remove the imunify-security plugin from a single site, including all cleanup and telemetry.
Returns the number of affected sites (should be 1 if deletion was successful).
This function is intended to be protected with asyncio.shield to ensure it completes even if the parent task is cancelled.
"""
try:
# Check if site is still installed and accessible using WP CLI
is_installed = await cli.is_plugin_installed(site)
if not is_installed:
# Plugin is no longer installed. It was removed manually by the user.
await process_manually_deleted_plugin(
site, time.time(), sink, telemetry_coros
)
return 0
# Get the version of the plugin (for telemetry data)
version = await cli.get_plugin_version(site)
# Uninstall the plugin from WordPress site.
await cli.plugin_uninstall(site)
# Delete the data files from the site.
await delete_plugin_files(site)
# Delete the site from database.
affected = delete_site(site)
# Send telemetry for successful uninstall
telemetry_coros.append(
telemetry.send_event(
sink=sink,
event="uninstalled_by_imunify",
site=site,
version=version,
)
)
return affected
except Exception as error:
# Log any error that occurs during the removal process
logger.error("Failed to remove plugin from %s %s", site, error)
return 0
async def remove_all_installed(sink):
"""Remove the imunify-security plugin from all sites where it is installed."""
logger.info("Deleting imunify-security wp plugin")
telemetry_coros = []
affected = 0
with inactivity.track.task("wp-plugin-removal"):
try:
clear_caches()
to_remove = get_installed_sites()
for site in to_remove:
try:
affected += await asyncio.shield(
remove_from_single_site(site, sink, telemetry_coros)
)
except asyncio.CancelledError:
logger.info(
"Deleting imunify-security wp plugin was cancelled."
" Plugin was deleted from %d sites (out of %d)",
affected,
len(to_remove),
)
except Exception as error:
logger.error("Error occurred during plugin deleting. %s", error)
raise
finally:
logger.info(
"Removed imunify-security wp plugin from %s sites",
affected,
)
# send telemetry
await process_telemetry_tasks(telemetry_coros)
async def process_manually_deleted_plugin(site, now, sink, telemetry_coros):
"""
Process the manually deleted plugin for a single site.
Args:
site: The site to process.
now: The current time.
sink: The telemetry/event sink.
telemetry_coros: The list of telemetry coroutines to add the event to.
The process includes:
- marking the site as manually deleted in the database
- removing plugin data files
- sending telemetry for manual removal
"""
try:
# Mark the site as manually deleted in the database
mark_site_as_manually_deleted(site, now)
# Remove plugin data files
await delete_plugin_files(site)
# Send telemetry for manual removal
telemetry_coros.append(
telemetry.send_event(
sink=sink,
event="removed_by_user",
site=site,
version=site.version,
)
)
except Exception as error:
logger.error(
"Failed to process manually deleted plugin for site=%s error=%s",
site,
error,
)
async def tidy_up_manually_deleted(
sink, freshly_installed_sites: set[WPSite] = None
):
"""
Tidy up sites that have been manually deleted by the user.
Args:
sink: The telemetry/event sink.
freshly_installed_sites: Optional set of sites that were just installed and should be excluded
from being marked as manually deleted to avoid race conditions.
"""
telemetry_coros = []
try:
to_mark_as_manually_removed = get_sites_to_mark_as_manually_deleted(
freshly_installed_sites
)
if to_mark_as_manually_removed:
now = time.time()
for site in to_mark_as_manually_removed:
await process_manually_deleted_plugin(
site, now, sink, telemetry_coros
)
except Exception as error:
logger.error("Error occurred during site tidy up. %s", error)
finally:
if telemetry_coros:
await process_telemetry_tasks(telemetry_coros)
async def update_data_on_sites(sink, sites: list[WPSite]):
if not sites:
return
# Create SystemConfig once for all users
admin_config = SystemConfig()
versions = await get_imunify_package_versions()
# Group sites by user id
sites_by_user = defaultdict(list)
for site in sites:
sites_by_user[site.uid].append(site)
# Now iterate over the grouped sites
for uid, sites in sites_by_user.items():
try:
user_info = pwd.getpwuid(uid)
username = user_info.pw_name
except Exception as error:
logger.error(
"Failed to get username for uid=%d. error=%s",
uid,
error,
)
continue
(
last_scan_time,
next_scan_time,
malware_by_site,
) = await _get_scan_data_for_user(sink, user_info, admin_config)
plugin_config = prepare_plugin_config(username)
for site in sites:
if await remove_site_if_missing(sink, site):
continue
try:
# Prepare scan data
scan_data = prepare_scan_data(
last_scan_time,
next_scan_time,
username,
site,
malware_by_site,
versions=versions,
)
# Resolve the site's data directory once; both writes reuse it.
data_dir = await ensure_site_data_directory(site, user_info)
# Update the scan data file
await update_scan_data_file(
site, scan_data, user_info=user_info, data_dir=data_dir
)
# Keep plugin_config.php fresh alongside scan_data.
await update_plugin_config_file(
site, plugin_config, user_info=user_info, data_dir=data_dir
)
except Exception as error:
logger.error(
"Failed to update site data on site=%s error=%s",
site,
error,
)
async def _write_json_php_data_file(
site: WPSite,
filename: str,
data: dict,
*,
user_info: pwd.struct_passwd | None = None,
data_dir: Path | None = None,
) -> None:
"""Write ``data`` as embedded JSON to ``<site data dir>/<filename>``.
A caller writing several files into one site's directory can resolve
``user_info`` and ``data_dir`` once and pass them in, so the owner
lookup and directory-ensure are not repeated per file.
"""
if user_info is None:
user_info = pwd.getpwuid(site.uid)
if data_dir is None:
data_dir = await ensure_site_data_directory(site, user_info)
php_content = format_php_with_embedded_json(data)
write_plugin_data_file_atomically(
data_dir / filename, php_content, uid=site.uid, gid=user_info.pw_gid
)
async def update_scan_data_file(
site: WPSite,
scan_data: dict,
*,
user_info: pwd.struct_passwd | None = None,
data_dir: Path | None = None,
):
await _write_json_php_data_file(
site,
"scan_data.php",
scan_data,
user_info=user_info,
data_dir=data_dir,
)
async def update_plugin_config_file(
site: WPSite,
plugin_config: dict,
*,
user_info: pwd.struct_passwd | None = None,
data_dir: Path | None = None,
) -> None:
"""
Write plugin_config.php for a single WordPress site.
Separate file from scan_data.php so a config toggle doesn't force
rewriting the malware list, and so the mu-plugin hot path loads
only what it needs per request.
"""
await _write_json_php_data_file(
site,
"plugin_config.php",
plugin_config,
user_info=user_info,
data_dir=data_dir,
)
async def update_plugin_config_on_sites(sites: list[WPSite]) -> int:
"""
Rewrite plugin_config.php on every managed site in one pass.
Used by the ConfigUpdate handler that reacts to
WORDPRESS.ai_bot_protection toggles. Writes only plugin_config.php
— scan_data.php is untouched, so a toggle doesn't churn the
(potentially large) malware payload or wait on a scan cycle.
No sink is needed: unlike update_data_on_sites we emit no
telemetry here — the per-site write loop just needs local file
I/O plus the process-level logger for errors.
Returns the number of sites successfully updated so the caller
can decide whether to advance its cached state.
"""
if not sites:
return 0
updated = 0
# Group by uid so we look up username once per user, mirroring
# update_data_on_sites' pattern and making per-user error isolation
# straightforward.
sites_by_user: dict[int, list[WPSite]] = defaultdict(list)
for site in sites:
sites_by_user[site.uid].append(site)
for uid, user_sites in sites_by_user.items():
try:
user_info = pwd.getpwuid(uid)
username = user_info.pw_name
except Exception as error:
logger.error(
"Failed to get username for uid=%d. error=%s",
uid,
error,
)
continue
plugin_config = prepare_plugin_config(username)
for site in user_sites:
try:
await update_plugin_config_file(
site, plugin_config, user_info=user_info
)
updated += 1
except Exception as error:
logger.error(
"Failed to update plugin_config.php on site=%s error=%s",
site,
error,
)
return updated
async def update_wp_rules_for_site(
site: WPSite,
user_info: pwd.struct_passwd,
wp_rules_php: str,
updated: set,
failed: set,
) -> None:
"""
Deploy wp-rules to a single WordPress site and track the result.
Args:
site: WordPress site to deploy to
user_info: User information from pwd
wp_rules_php: Formatted PHP rules content
updated: Set to add site to if successful
failed: Set to add site to if failed
"""
gid = user_info.pw_gid
try:
data_dir = await ensure_site_data_directory(site, user_info)
rules_path = data_dir / "rules.php"
write_plugin_data_file_atomically(
rules_path, wp_rules_php, uid=site.uid, gid=gid
)
updated.add(site)
logger.info("Updated wp-rules for site %s", site.docroot)
except Exception as error:
failed.add(site)
logger.error(
"Failed to update wp-rules for site %s: %s",
site.docroot,
error,
)
async def _deploy_to_sites(
sites: list[WPSite],
make_task: Callable[
[WPSite, pwd.struct_passwd, set, set], Awaitable[None]
],
task_name: str,
fingerprint: str,
skip_waf_disabled: bool = False,
sink=None,
) -> None:
"""
Run a per-site async deployment over a list of WordPress sites.
Groups sites by user, resolves UIDs, then runs tasks concurrently
in batches.
Args:
sites: WordPress sites to deploy to
make_task: Callable that creates a coroutine for one site.
Signature: (site, user_info, updated_set, failed_set) -> awaitable
task_name: Human-readable name for logging and inactivity tracking
fingerprint: Sentry fingerprint for user-lookup failures
sink: Optional telemetry sink for remove_site_if_missing
"""
updated = set()
failed = set()
with inactivity.track.task(task_name):
try:
start_time = time.time()
sites_by_user = defaultdict(list)
for site in sites:
sites_by_user[site.uid].append(site)
tasks = []
for uid, user_sites in sites_by_user.items():
try:
user_info = pwd.getpwuid(uid)
username = user_info.pw_name
except Exception as error:
log_message(
"Skipping {task} update for {count} site(s)"
" belonging to user {user} because username"
" retrieval failed. Reason: {reason}",
format_args={
"task": task_name,
"count": len(user_sites),
"user": uid,
"reason": error,
},
level="warning",
component="wordpress",
fingerprint=fingerprint,
)
for site in user_sites:
failed.add(site)
continue
if skip_waf_disabled:
try:
waf_enabled = await is_waf_enabled_for_user(username)
except Exception:
logger.warning(
"Could not check WAF status for user %s,"
" proceeding with deployment",
username,
exc_info=True,
)
waf_enabled = True
if not waf_enabled:
logger.info(
"WAF disabled for user %s, skipping %d site(s)",
username,
len(user_sites),
)
continue
for site in user_sites:
if await remove_site_if_missing(sink, site):
continue
tasks.append(make_task(site, user_info, updated, failed))
max_concurrent = 10
for i in range(0, len(tasks), max_concurrent):
batch = tasks[i : i + max_concurrent]
await asyncio.gather(*batch, return_exceptions=True)
elapsed = time.time() - start_time
logger.info(
"%s deployment complete. Updated: %d, Failed: %d,"
" Duration: %.2fs",
task_name,
len(updated),
len(failed),
elapsed,
)
except asyncio.CancelledError:
logger.info(
"%s deployment was cancelled. Updated %d sites",
task_name,
len(updated),
)
except Exception as error:
logger.error(
"Error occurred during %s deployment. error=%s",
task_name,
error,
)
raise
async def _deploy_wp_rules_php(wp_rules_php: str, sink=None) -> None:
"""Deploy pre-formatted wp-rules PHP content to all active WordPress sites."""
clear_caches()
installed_sites = get_installed_sites()
if not installed_sites:
logger.debug("No active WordPress sites found")
return
def make_task(site, user_info, updated, failed):
return update_wp_rules_for_site(
site, user_info, wp_rules_php, updated, failed
)
await _deploy_to_sites(
installed_sites,
make_task,
task_name="wp-rules",
fingerprint="wp-rules-update-skip-user",
skip_waf_disabled=True,
sink=sink,
)
async def update_wp_rules_on_sites(index: Index, is_updated: bool) -> None:
"""
Hook that runs when wp-rules files are updated.
Extracts wp-rules.yaml from wp-rules.zip and deploys to all active WordPress sites.
Args:
index: Index object for wp-rules
is_updated: Whether files were actually updated
"""
if not Wordpress.SECURITY_PLUGIN_ENABLED:
logger.info(
"wordpress security plugin not enabled, skipping wp-rules"
" deployment"
)
return
if not is_updated:
logger.info("wp-rules not updated, skipping deployment")
return
logger.info("Starting wp-rules deployment to WordPress sites")
wp_rules_data = get_updated_wp_rules_data(index)
if not wp_rules_data:
logger.error("No valid wp-rules found, skipping deployment")
return
# Get version and create ruleset dict with version and rules
wp_rules_version = get_wp_ruleset_version(index)
ruleset_dict = {
"version": wp_rules_version,
"rules": wp_rules_data,
}
wp_rules_php = format_php_with_embedded_json(ruleset_dict)
await _deploy_wp_rules_php(wp_rules_php)
_redeploy_rules_php_lock = asyncio.Lock()
# Separate flag is needed because lock.locked() is always True inside the
# holder's context, so it cannot indicate whether another caller coalesced.
_redeploy_rules_php_pending = False
async def redeploy_rules_php() -> None:
"""
Re-deploy rules.php to all WordPress sites.
Used when globally disabled rules change, requiring rules.php
to be regenerated with updated rule filtering.
Uses a coalescing lock: if a redeployment is already running,
the request is merged into the current run rather than starting
a duplicate deployment.
"""
global _redeploy_rules_php_pending
if not Wordpress.SECURITY_PLUGIN_ENABLED:
logger.info(
"wordpress security plugin not enabled, skipping wp-rules"
" redeployment"
)
return
if _redeploy_rules_php_lock.locked():
_redeploy_rules_php_pending = True
logger.info("wp-rules redeployment already in progress, coalescing")
return
async with _redeploy_rules_php_lock:
while True:
_redeploy_rules_php_pending = False
logger.info(
"Starting wp-rules redeployment (global disable change)"
)
wp_rules_php = await load_wp_rules_php()
if not wp_rules_php:
logger.warning("Could not load wp-rules for redeployment")
return
await _deploy_wp_rules_php(wp_rules_php)
if not _redeploy_rules_php_pending:
break
logger.info("Re-running wp-rules redeployment (coalesced request)")
async def redeploy_waf_for_all_sites() -> None:
"""Global WAF turn-on: deploy rules.php and disabled-rules.php (stamping
disabled_rules_sync_ts) to all sites, matching install-with-WAF-on.
Wraps rather than extends redeploy_rules_php, which is also the
global-rule-change path where restamping sync_ts would skip unconsumed
changelog actions.
"""
await redeploy_rules_php()
await update_disabled_rules_on_sites()
def _remove_waf_files_for_dir(data_dir, docroot: str) -> None:
"""Remove WAF files from data_dir via a symlink-safe dir fd."""
try:
dir_fd = open_dir_no_symlinks(data_dir)
except FileNotFoundError:
return
except OSError as exc:
if exc.errno in (errno.ELOOP, errno.ENOTDIR):
logger.warning(
"Skipping WAF file removal: data dir %s is a symlink",
data_dir,
)
return
logger.error("Failed to open data dir for %s: %s", docroot, exc)
return
try:
for filename in ("rules.php", "disabled-rules.php"):
try:
os.remove(filename, dir_fd=dir_fd)
logger.info(
"Removed %s from %s (WAF disabled)", filename, docroot
)
except FileNotFoundError:
pass
except OSError as e:
logger.error(
"Failed to remove %s from %s: %s", filename, docroot, e
)
finally:
os.close(dir_fd)
async def _remove_waf_files_from_sites(sites: list[WPSite]) -> None:
"""Remove WAF files (rules.php, disabled-rules.php) from the given sites.
Deletion goes through open_dir_no_symlinks + dir_fd so a site owner
cannot redirect the root agent's removal via a symlinked data dir, the
same symlink-safe pattern as delete_plugin_files.
"""
for site in sites:
try:
data_dir = await cli.get_data_dir(site)
except Exception as e:
logger.error(
"Failed to resolve data dir for %s: %s", site.docroot, e
)
continue
await asyncio.to_thread(
_remove_waf_files_for_dir, data_dir, site.docroot
)
async def redeploy_waf_for_user(username: str) -> None:
"""Deploy rules.php and disabled-rules.php for a user's sites (WAF turn-on).
Caller must have confirmed WAF is enabled for the user. disabled-rules.php
is deployed even if the ruleset fails to load, because it stamps
disabled_rules_sync_ts — matching install, which writes it whenever WAF is
on regardless of rules.php content.
"""
if not Wordpress.SECURITY_PLUGIN_ENABLED:
return
loop = asyncio.get_running_loop()
try:
user_info = await loop.run_in_executor(None, pwd.getpwnam, username)
except KeyError:
logger.warning(
"User %s not found, skipping WAF rules redeploy", username
)
return
sites = await loop.run_in_executor(None, get_installed_sites)
user_sites = [s for s in sites if s.uid == user_info.pw_uid]
if not user_sites:
return
updated = set()
failed = set()
wp_rules_php = await load_wp_rules_php()
if wp_rules_php:
for site in user_sites:
await update_wp_rules_for_site(
site, user_info, wp_rules_php, updated, failed
)
else:
logger.warning("Could not load wp-rules for user redeploy")
disabled_rules_ts = time.time()
dr_updated = set()
dr_failed = set()
for site in user_sites:
await update_disabled_rules_for_site(
site, user_info, disabled_rules_ts, dr_updated, dr_failed
)
logger.info(
"Redeployed WAF artifacts for user %s: rules %d ok/%d failed,"
" disabled-rules %d ok/%d failed",
username,
len(updated),
len(failed),
len(dr_updated),
len(dr_failed),
)
async def remove_waf_rules_for_user(username: str) -> None:
"""Remove WAF files from all sites belonging to a user."""
loop = asyncio.get_running_loop()
try:
user_info = await loop.run_in_executor(None, pwd.getpwnam, username)
except KeyError:
logger.warning(
"User %s not found, skipping WAF rules removal", username
)
return
sites = await loop.run_in_executor(None, get_installed_sites)
user_sites = [s for s in sites if s.uid == user_info.pw_uid]
await _remove_waf_files_from_sites(user_sites)
async def remove_waf_rules_for_all_sites() -> None:
"""Remove WAF files from all installed sites (global WAF disable)."""
loop = asyncio.get_running_loop()
sites = await loop.run_in_executor(None, get_installed_sites)
logger.info(
"Global WAF disabled, removing WAF files from %d site(s)",
len(sites),
)
await _remove_waf_files_from_sites(sites)
async def apply_waf_default_change() -> None:
"""Redeploy/remove rules.php for users without an explicit waf_enabled override."""
global _apply_waf_default_pending
if not Wordpress.SECURITY_PLUGIN_ENABLED:
return
if _apply_waf_default_lock.locked():
_apply_waf_default_pending = True
logger.info("waf_default change already in progress, coalescing")
return
async with _apply_waf_default_lock:
while True:
_apply_waf_default_pending = False
if not _get_global_waf_enabled():
return
new_default = _get_waf_default()
usernames = await hosting_panel.HostingPanel().get_users()
loop = asyncio.get_running_loop()
for username in usernames:
try:
if await loop.run_in_executor(
None,
_user_has_explicit_waf_override_sync,
username,
):
continue
if new_default:
await redeploy_waf_for_user(username)
else:
await remove_waf_rules_for_user(username)
except Exception as e:
logger.warning(
"Failed to apply waf_default change for user %s: %s",
username,
e,
)
if not _apply_waf_default_pending:
break
logger.info("Re-running waf_default change (coalesced request)")
def generate_disabled_rules_php(domain: str, timestamp: float) -> str:
"""
Generate the disabled-rules.php content for a specific domain.
Only includes domain-specific disabled rules. Globally disabled rules
are handled separately by filtering them out of rules.php.
Args:
domain: The domain to generate disabled rules for
timestamp: Unix timestamp to embed in the file
Returns:
PHP file content string
"""
disabled_rule_ids = WPDisabledRule.get_domain_disabled(
domain, include_global=False
)
data = {
"ts": timestamp,
"rules": sorted(disabled_rule_ids),
}
return format_php_with_embedded_json(data)
async def update_disabled_rules_for_site(
site: WPSite,
user_info: pwd.struct_passwd,
timestamp: float,
updated: set,
failed: set,
) -> None:
"""
Deploy disabled-rules.php to a single WordPress site and track the result.
Args:
site: WordPress site to deploy to
user_info: User information from pwd
timestamp: Unix timestamp for both file content and DB record
updated: Set to add site to if successful
failed: Set to add site to if failed
"""
gid = user_info.pw_gid
try:
data_dir = await ensure_site_data_directory(site, user_info)
disabled_rules_path = data_dir / "disabled-rules.php"
php_content = generate_disabled_rules_php(site.domain, timestamp)
write_plugin_data_file_atomically(
disabled_rules_path, php_content, uid=site.uid, gid=gid
)
WordpressSite.update(disabled_rules_sync_ts=timestamp).where(
WordpressSite.docroot == site.docroot
).execute()
updated.add(site)
logger.info("Updated disabled-rules for site %s", site.docroot)
except Exception as error:
failed.add(site)
logger.error(
"Failed to update disabled-rules for site %s: %s",
site.docroot,
error,
)
async def update_disabled_rules_on_sites(
domains: list[str] | None = None,
sink=None,
) -> None:
"""
Deploy disabled-rules.php to WordPress sites.
If domains are specified, only updates sites for those domains.
If domains is None, updates all installed sites (e.g., after a global
disable/enable).
Args:
domains: List of domains to update, or None for all sites
sink: Optional telemetry sink for remove_site_if_missing
"""
if not Wordpress.SECURITY_PLUGIN_ENABLED:
logger.info(
"wordpress security plugin not enabled, skipping disabled-rules"
" deployment"
)
return
logger.info("Starting disabled-rules deployment to WordPress sites")
clear_caches()
if domains:
sites = get_installed_sites_by_domains(domains)
else:
sites = get_installed_sites()
if not sites:
logger.info("No WordPress sites found for disabled-rules deployment")
return
def make_task(site, user_info, updated, failed):
return update_disabled_rules_for_site(
site, user_info, time.time(), updated, failed
)
await _deploy_to_sites(
sites,
make_task,
task_name="disabled-rules",
fingerprint="disabled-rules-update-skip-user",
skip_waf_disabled=True,
sink=sink,
)
async def update_auth_everywhere(sink=None):
"""Update auth.php files for all existing WordPress sites."""
logger.info("Updating auth.php files for existing WordPress sites")
updated = set()
failed = set()
with inactivity.track.task("wp-auth-update"):
try:
clear_caches()
# Get all installed sites from db
installed_sites = get_installed_sites()
if not installed_sites:
logger.info("No installed WordPress sites found")
return
sites_by_user = defaultdict(list)
for site in installed_sites:
sites_by_user[site.uid].append(site)
# Process users concurrently
tasks = []
for uid, sites in sites_by_user.items():
try:
user_info = pwd.getpwuid(uid)
except Exception as error:
log_message(
"Skipping auth update for WordPress sites on"
" {count} site(s) because they belong to user"
" {user} and it is not possible to retrieve"
" username for this user. Reason: {reason}",
format_args={
"count": len(sites),
"user": uid,
"reason": error,
},
level="warning",
component="wordpress",
fingerprint="wp-plugin-auth-update-skip-user",
)
continue
for site in sites:
if await remove_site_if_missing(sink, site):
continue
task = update_site_auth(site, user_info, updated, failed)
tasks.append(task)
# Run all site updates concurrently with a reasonable limit
# Adjust max_concurrent based on your system's I/O capacity
max_concurrent = 10
for i in range(0, len(tasks), max_concurrent):
batch = tasks[i : i + max_concurrent]
await asyncio.gather(*batch, return_exceptions=True)
logger.info(
"Updated auth.php files for %d WordPress sites, %d failed",
len(updated),
len(failed),
)
except asyncio.CancelledError:
logger.info(
"Auth update for WordPress sites was cancelled. Auth was"
" updated for %d sites",
len(updated),
)
except Exception as error:
logger.error("Error occurred during auth update. error=%s", error)
raise
async def update_site_auth(site, user_info, updated, failed):
"""Process authentication setup for a single site."""
try:
await setup_site_authentication(site, user_info)
updated.add(site)
except Exception as error:
failed.add(site)
logger.error(
"Failed to update auth for site=%s error=%s",
site,
error,
)
async def remove_site_if_missing(sink, site: WPSite) -> bool:
"""
Checks if the site directory exists. If not, removes the site from the local database and sends a 'site_removed' telemetry event only if deletion is successful.
Returns True if the site was removed (directory missing), False otherwise.
Parameters:
sink: The telemetry/event sink.
site: The WPSite object to check and potentially remove.
Side effect: If the site is missing and successfully deleted from database, a telemetry event will be sent.
"""
if os.path.isdir(site.docroot):
return False
# Attempt to delete the site from the database first
rows_deleted = delete_site(site)
# Only send telemetry if the deletion was successful (at least one row was deleted)
if rows_deleted > 0:
if sink is not None:
await telemetry.send_event(
sink=sink,
event="site_removed",
site=site,
version=site.version,
)
else:
logger.warning(
"Failed to delete missing site %s from database, no rows affected",
site,
)
log_message(
"Failed to delete missing site {site} from database",
format_args={"site": site},
level="warning",
component="wordpress",
fingerprint="wp-plugin-site-delete-failed",
)
return True
async def fix_site_data_file_permissions(
site: WPSite, file_permissions: int
) -> bool:
"""Fix data file permissions for a single WordPress site."""
try:
data_dir = await cli.get_data_dir(site)
try:
dir_fd = open_dir_no_symlinks(data_dir)
except OSError as exc:
if exc.errno in (errno.ENOENT, errno.ELOOP, errno.ENOTDIR):
return False
raise
try:
# Fix directory permissions via fd.
current_dir_mode = os.stat(dir_fd).st_mode & 0o777
if current_dir_mode != 0o750:
os.chmod(dir_fd, 0o750)
for file_name in [
"scan_data.php",
"plugin_config.php",
"auth.php",
"rules.php",
"disabled-rules.php",
]:
try:
with open_nofollow(file_name, dir_fd=dir_fd) as file_fd:
st = os.fstat(file_fd)
if st.st_mode & 0o777 != file_permissions:
os.chmod(file_fd, file_permissions)
except FileNotFoundError:
continue
except OSError as exc:
if exc.errno == errno.ELOOP:
logger.warning(
"Skipping chmod: %s/%s is a symlink",
data_dir,
file_name,
)
continue
raise
finally:
os.close(dir_fd)
return True
except Exception as error:
logger.error(
"Failed to fix permissions for site=%s error=%s",
site,
error,
)
return False
async def fix_data_file_permissions_everywhere(sink):
"""
Fix data file permissions for all WordPress sites with imunify-security plugin installed.
Args:
sink: The telemetry/event sink
"""
fixed = set()
failed = set()
with inactivity.track.task("wp-plugin-fix-permissions"):
try:
clear_caches()
# Get all installed sites
installed_sites = get_installed_sites()
if not installed_sites:
return
# Determine file permissions based on hosting panel
from defence360agent.subsys.panels.hosting_panel import (
HostingPanel,
)
from defence360agent.subsys.panels.plesk import Plesk
file_permissions = (
0o440 if HostingPanel().NAME == Plesk.NAME else 0o400
)
# Process sites
for site in installed_sites:
if await remove_site_if_missing(sink, site):
continue
success = await fix_site_data_file_permissions(
site, file_permissions
)
if success:
fixed.add(site)
else:
failed.add(site)
logger.info(
"Fixed data file permissions for %d WordPress sites, %d"
" failed",
len(fixed),
len(failed),
)
except asyncio.CancelledError:
logger.info(
"Fixing data file permissions was cancelled. Permissions were"
" fixed for %d sites",
len(fixed),
)
except Exception as error:
logger.error(
"Error occurred during permission fixing. error=%s", error
)
class WordPressSiteInstaller:
"""
Handles installation of imunify-security plugin on WordPress sites.
This class processes WordPress sites and installs the imunify-security
plugin, including setting up authentication, scan data files, and rules.
"""
install_plugin = True
telemetry_event = "installed_by_imunify"
task_name = "wp-plugin-installation"
log_fingerprint_skip_user = "wp-plugin-install-skip-user"
messages = {
"start": "Installing imunify-security wp plugin",
"complete": "Installed imunify-security wp plugin on {count} sites",
"found": "Found {count} site(s) for installation",
"error": "Failed to install plugin to site={site} error={error}",
"cancelled": (
"Installation of imunify-security wp plugin was cancelled. "
"Plugin was installed for {count} sites"
),
"exception": (
"Error occurred during plugin installation. error={error}"
),
"skip_user": (
"Skipping installation of WordPress plugin on "
"{count} site(s) because they belong to user "
"{user} and it is not possible to retrieve "
"username for this user. Reason: {reason}"
),
}
def __init__(self, sink, sites):
self.sink = sink
self.sites = sites
self.processed = set()
self.authenticated = set()
self.rules_installed = set()
self.failed_rules_updates = set()
self.disabled_rules_installed = set()
self.failed_disabled_rules_updates = set()
self.disabled_rules_ts: float | None = None
self.failed_auth = set()
self._current_site: WPSite | None = None
async def is_site_ready(self, site):
"""
Check if site is ready for processing.
Override in subclasses to implement different readiness checks.
Args:
site: The WordPress site to check.
Returns:
bool: True if the site is ready for processing, False otherwise.
"""
is_wordpress_installed = await cli.is_wordpress_installed(site)
if not is_wordpress_installed:
logger.warning(
"WordPress site is not accessible using WP CLI. site=%s",
site,
)
log_message(
"WordPress site is not accessible using WP CLI. site={site}",
format_args={"site": site},
level="warning",
component="wordpress",
fingerprint="wp-plugin-cli-not-accessible",
)
return False
return True
def _record_processed_site(self, site, version):
"""
Record a successfully processed site and persist it to the database.
Each site is inserted immediately so that it is tracked in the DB
at all times — even if the overall installation loop is cancelled
mid-run.
Override in subclasses to implement different recording logic.
Args:
site: The WordPress site that was processed.
version: The plugin version installed on the site.
"""
self.processed.add(site)
insert_installed_sites({site})
self._stamp_disabled_rules_sync_ts(site)
async def _revert_in_flight_site(self):
"""Revert the site that was mid-processing when cancellation occurred.
Deletes data files and, if this processor installs plugins,
attempts to uninstall the partially-installed plugin.
Each step runs independently so one failure doesn't skip the other.
"""
site = self._current_site
self._current_site = None
try:
await delete_plugin_files(site)
except Exception as error:
logger.warning(
"Failed to delete data files for in-flight site %s: %s",
site,
error,
)
if self.install_plugin:
await cli.try_plugin_uninstall(site)
def _stamp_disabled_rules_sync_ts(self, site: WPSite) -> None:
"""
Stamp disabled_rules_sync_ts for a single site after it has been
inserted into the DB.
Called from ``_record_processed_site`` so the DB row already exists.
"""
if site not in self.disabled_rules_installed:
return
if self.disabled_rules_ts is None:
return
WordpressSite.update(
disabled_rules_sync_ts=self.disabled_rules_ts
).where(WordpressSite.docroot == site.docroot).execute()
async def run(self):
"""
Process WordPress sites for imunify-security plugin operations.
Returns:
set: The set of successfully processed sites.
"""
logger.info(self.messages["start"])
telemetry_tasks = []
with inactivity.track.task(self.task_name):
try:
clear_caches()
if not self.sites:
logger.info("No WordPress sites found, nothing to do")
return self.processed
logger.info(
self.messages["found"].format(count=len(self.sites))
)
# Create SystemConfig once for all users
admin_config = SystemConfig()
# Create wp rules once for all users
wp_rules_php = await load_wp_rules_php()
# Always set the timestamp, even when no disabled rules
# currently exist: previously disabled-then-enabled rules
# require deploying an empty disabled-rules.php.
self.disabled_rules_ts = time.time()
versions = await get_imunify_package_versions()
# Group sites by user id
sites_by_user = defaultdict(list)
for site in self.sites:
sites_by_user[site.uid].append(site)
# Now iterate over the grouped sites
for uid, sites in sites_by_user.items():
try:
user_info = pwd.getpwuid(uid)
username = user_info.pw_name
except Exception as error:
log_message(
self.messages["skip_user"],
format_args={
"count": len(sites),
"user": uid,
"reason": error,
},
level="warning",
component="wordpress",
fingerprint=self.log_fingerprint_skip_user,
)
continue
try:
waf_enabled = await is_waf_enabled_for_user(username)
except Exception:
logger.warning(
"Could not check WAF status for user %s,"
" proceeding with deployment",
username,
exc_info=True,
)
waf_enabled = True
if not waf_enabled:
logger.info(
"WAF disabled for user %s, skipping WAF"
" rules deployment for %d site(s)",
username,
len(sites),
)
(
last_scan_time,
next_scan_time,
malware_by_site,
) = await _get_scan_data_for_user(
self.sink, user_info, admin_config
)
plugin_config = prepare_plugin_config(username)
for site in sites:
if await remove_site_if_missing(self.sink, site):
continue
try:
# Check if site is ready for processing (WP CLI accessible + other checks)
if not await self.is_site_ready(site):
continue
self._current_site = site
# Prepare scan data
scan_data = prepare_scan_data(
last_scan_time,
next_scan_time,
username,
site,
malware_by_site,
versions=versions,
)
# Resolve the data directory once; the scan-data
# and plugin-config writes below reuse it.
data_dir = await ensure_site_data_directory(
site, user_info
)
# Create data files (scan data, plugin config, auth token)
await update_scan_data_file(
site,
scan_data,
user_info=user_info,
data_dir=data_dir,
)
await update_plugin_config_file(
site,
plugin_config,
user_info=user_info,
data_dir=data_dir,
)
await update_site_auth(
site,
user_info,
self.authenticated,
self.failed_auth,
)
# Install rules — skip when WAF is disabled for
# this user (global off or per-user override).
if wp_rules_php and waf_enabled:
await update_wp_rules_for_site(
site,
user_info,
wp_rules_php,
self.rules_installed,
self.failed_rules_updates,
)
# Install disabled rules
if waf_enabled:
await update_disabled_rules_for_site(
site,
user_info,
self.disabled_rules_ts,
self.disabled_rules_installed,
self.failed_disabled_rules_updates,
)
# Install the plugin
if self.install_plugin:
await cli.plugin_install(site)
# Get the version of the plugin
version = await cli.get_plugin_version(site)
if version:
site = WPSite.build_with_version(site, version)
# Record the processed site
self._record_processed_site(site, version)
self._current_site = None
telemetry_tasks.append(
asyncio.create_task(
telemetry.send_event(
sink=self.sink,
event=self.telemetry_event,
site=site,
version=version,
)
)
)
except Exception as error:
self._current_site = None
logger.error(
self.messages["error"].format(
site=site, error=repr(error)
)
)
logger.info(
self.messages["complete"].format(count=len(self.processed))
)
if self.failed_auth:
logger.warning(
"Failed to authenticate %d sites",
len(self.failed_auth),
)
if self.failed_rules_updates:
logger.warning(
"Failed to install wp-rules on %d sites",
len(self.failed_rules_updates),
)
if self.failed_disabled_rules_updates:
logger.warning(
"Failed to install disabled-rules on %d sites",
len(self.failed_disabled_rules_updates),
)
except asyncio.CancelledError:
if self._current_site:
await self._revert_in_flight_site()
logger.info(
self.messages["cancelled"].format(
count=len(self.processed)
)
)
except Exception as error:
logger.error(
self.messages["exception"].format(error=repr(error))
)
raise
finally:
if telemetry_tasks:
results = await asyncio.gather(
*telemetry_tasks, return_exceptions=True
)
for result in results:
if isinstance(result, Exception):
logger.warning(
"Failed to send telemetry: %s", result
)
return self.processed
class WordPressSiteAdopter(WordPressSiteInstaller):
"""
Handles adoption of existing WordPress sites with imunify-security plugin.
Adoption is a special case of installation where the site already has
the plugin installed but is not tracked in our database.
"""
install_plugin = False
telemetry_event = "site_found"
task_name = "wp-plugin-adoption"
log_fingerprint_skip_user = "wp-plugin-adopt-skip-user"
messages = {
"start": "Adopting imunify-security wp plugin",
"complete": "Adopted imunify-security wp plugin on {count} sites",
"found": "Found {count} site(s) for adoption",
"error": "Failed to adopt plugin to site={site} error={error}",
"cancelled": (
"Adoption of imunify-security wp plugin was cancelled. "
"Plugin was adopted for {count} sites"
),
"exception": "Error occurred during plugin adoption. error={error}",
"skip_user": (
"Skipping adoption of WordPress plugin on "
"{count} site(s) because they belong to user "
"{user} and it is not possible to retrieve "
"username for this user. Reason: {reason}"
),
}
def __init__(self, sink, sites):
super().__init__(sink, sites)
# Load existing docroots from database for adoption logic
self.existing_docroots = {
r.docroot for r in WordpressSite.select(WordpressSite.docroot)
}
def _record_processed_site(self, site, version):
"""
Record a successfully adopted site and persist it immediately.
For adoption, sites that already exist in the database (flagged as
manually deleted) have their flag cleared. New sites are inserted
into the database right away.
Args:
site: The WordPress site that was processed.
version: The plugin version installed on the site.
"""
self.processed.add(site)
if site.docroot in self.existing_docroots:
# Site exists in DB but is flagged - clear flag
clear_manually_deleted_flag(site)
update_site_identity(site)
if version:
update_site_version(site, version)
else:
insert_installed_sites({site})
self._stamp_disabled_rules_sync_ts(site)
async def is_site_ready(self, site):
"""
Check if site is ready for adoption.
Args:
site: The WordPress site to check.
Returns:
bool: True if the site is ready for adoption, False otherwise.
"""
if not await super().is_site_ready(site):
return False
# Verify plugin is actually installed
is_installed = await cli.is_plugin_installed(site)
if not is_installed:
logger.warning(
"Plugin not installed on site %s, skipping adoption",
site,
)
return False
return True
defence360agent/wordpress/proxy_auth.py 0000644 0000000 0000000 00000012110 00000000000 015345 0 ustar import asyncio
import logging
import os
import pwd
import secrets
from datetime import datetime, timedelta
from functools import lru_cache
from pathlib import Path
from defence360agent.utils import atomic_rewrite
from defence360agent.wordpress.utils import (
ensure_site_data_directory,
format_php_with_embedded_json,
write_plugin_data_file_atomically,
)
logger = logging.getLogger(__name__)
DEFAULT_TOKEN_EXPIRATION = timedelta(hours=72)
JWT_SECRET_PATH = "/etc/imunify-agent-proxy/jwt-secret"
JWT_SECRET_PATH_OLD = "/etc/imunify-agent-proxy/jwt-secret.old"
PROXY_SERVICE_NAME = "imunify-agent-proxy"
SECRET_EXPIRATION_TTL = timedelta(days=7)
def is_secret_expired():
try:
stat = os.stat(JWT_SECRET_PATH)
except FileNotFoundError:
st_mtime = 0.0
else:
st_mtime = stat.st_mtime
# NOTE: timedelta(days=7).seconds == 0 (the .seconds attribute only holds
# the sub-day component; .days holds the rest). Use .total_seconds() so
# the 7-day TTL is honored.
return (
datetime.now().timestamp() - st_mtime
> SECRET_EXPIRATION_TTL.total_seconds()
)
async def rotate_secret():
"""Rotate the proxy JWT secret on disk: backup current to .old and
write a fresh 32-byte secret atomically. Invalidates the in-process
cache so subsequent generate_token() calls read the new secret.
"""
secret_path = Path(JWT_SECRET_PATH)
try:
logger.info("Rotating proxy auth secret")
stub_secret = secrets.token_bytes(32)
secret_path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
secret_path.touch(mode=0o600)
atomic_rewrite(
secret_path,
stub_secret,
uid=-1,
backup=str(JWT_SECRET_PATH_OLD),
permissions=0o600,
)
load_secret_from_file.cache_clear()
except Exception as e:
logger.error(
"Got error while rotating the secret: %s", e, exc_info=True
)
@lru_cache(1)
def load_secret_from_file() -> bytes:
"""Load JWT secret from the configured file path."""
try:
with open(JWT_SECRET_PATH, "rb") as f:
return f.read().strip()
except FileNotFoundError:
logger.error("JWT secret file not found at %s", JWT_SECRET_PATH)
raise
except Exception as e:
logger.error("Failed to read JWT secret: %s", e)
raise
def generate_token(username: str, docroot: str) -> str:
"""
Generate a JWT token for the given username and docroots.
Args:
username: The username for the token
docroot: document root paths the user has access to
Returns:
The JWT token string
"""
exp_time = datetime.utcnow() + DEFAULT_TOKEN_EXPIRATION
claims = {"exp": exp_time, "username": username, "site_path": docroot}
try:
# jwt package is a heavy dependency (relying on native libraries)
# that is not needed in all execution paths.
# in order to save some RAM, jwt is only imporded when it's actually needed.
import jwt
token = jwt.encode(claims, load_secret_from_file(), algorithm="HS256")
return token
except Exception as e:
logger.error("Failed to generate JWT token: %s", e)
raise
async def create_auth_php_file(site, token: str, uid, gid: int) -> None:
"""
Create the auth.php file in the site's imunify-security directory.
Args:
site: WPSite instance
token: JWT token string
uid, gid: int used for file creation
"""
try:
# Get user_info to pass to ensure_site_data_directory
user_info = pwd.getpwuid(uid)
# Ensure data directory exists with protection (this also ensures directory listing protection)
data_dir = await ensure_site_data_directory(site, user_info)
auth_file_path = data_dir / "auth.php"
# Use helper function to format PHP with embedded JSON
auth_data = {"token": token}
php_content = format_php_with_embedded_json(auth_data)
# Run the file write operation in a thread pool
await asyncio.to_thread(
write_plugin_data_file_atomically,
auth_file_path,
php_content,
uid,
gid,
)
logger.info(
"Created auth.php file for site %s at %s", site, auth_file_path
)
except Exception as e:
logger.error("Failed to create auth.php file for site %s: %s", site, e)
raise
async def setup_site_authentication(
site, user_info: pwd.struct_passwd
) -> None:
"""
Set up authentication for a site by creating JWT token and auth.php file.
Args:
site: WPSite instance
user_info: pwd.struct_passwd data
"""
try:
token = generate_token(user_info.pw_name, str(site.docroot))
await create_auth_php_file(
site, token, user_info.pw_uid, user_info.pw_gid
)
logger.info("Successfully set up authentication for site %s", site)
except Exception as e:
logger.error(
"Failed to set up authentication for site %s: %s", site, e
)
raise
defence360agent/wordpress/site_repository.py 0000644 0000000 0000000 00000043743 00000000000 016426 0 ustar import asyncio
import logging
import pwd
from pathlib import Path
from peewee import SqliteDatabase, OperationalError, fn
from defence360agent.utils import retry_on
from defence360agent.model.wordpress import WPSite, WordpressSite
from defence360agent.wordpress.constants import PLUGIN_SLUG
logger = logging.getLogger(__name__)
COMPONENTS_DB_PATH = Path(
"/var/lib/cloudlinux-app-version-detector/components_versions.sqlite3"
)
def get_sites_by_path(path: str) -> list[WPSite]:
"""
Get a list of WordPress sites that match the given path.
Args:
path: The path to search for WordPress sites.
Note: The same WordPress site (real_path) can appear in multiple reports
if it was scanned directly and also as part of a parent folder scan.
We use only the entry from the latest report for each real_path.
Returns:
A list of WPSite objects that match the path.
"""
if not COMPONENTS_DB_PATH.exists():
logger.error(
"App detector database '%s' couldn't be found.",
str(COMPONENTS_DB_PATH),
)
return list()
cursor = SqliteDatabase(COMPONENTS_DB_PATH).execute_sql(
f"""
WITH latest_reports AS (
SELECT id, uid, domain, dir
FROM report
WHERE id IN (
SELECT MAX(id)
FROM report
WHERE domain IS NOT NULL
AND domain != ''
GROUP BY dir
)
),
-- Get all WordPress sites with their report IDs
all_wp_sites AS (
SELECT wp.real_path, lr.domain, lr.uid, lr.id as report_id
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE '{path}%'
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
)
-- For each real_path, keep only the entry from the latest report
SELECT real_path, domain, uid
FROM all_wp_sites
WHERE (real_path, report_id) IN (
SELECT real_path, MAX(report_id)
FROM all_wp_sites
GROUP BY real_path
)
"""
)
return [
WPSite(docroot=row[0], domain=row[1], uid=int(row[2]))
for row in cursor.fetchall()
]
def get_sites_for_user(user_info: pwd.struct_passwd) -> list[str]:
"""
Get a set of paths to WordPress sites belonging to a particular user. Paths are sorted by their length to make sure
that the main site is the last one in the list.
The data is pulled from the app-version-detector database.
Args:
user_info: The user info with ID to get sites for.
Returns:
A list of paths to WordPress sites.
"""
if not COMPONENTS_DB_PATH.exists() or user_info is None:
logger.error(
"App detector database '%s' couldn't be found.",
str(COMPONENTS_DB_PATH),
)
return list()
if user_info is None:
logger.error(
"No user info provided for getting sites",
)
return list()
cursor = SqliteDatabase(COMPONENTS_DB_PATH).execute_sql(
f"""
WITH latest_reports AS (
SELECT MAX(id) as id, dir
FROM report
WHERE uid = {user_info.pw_uid}
GROUP BY dir
)
SELECT wp.real_path
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
GROUP BY wp.real_path
ORDER BY length(wp.real_path) DESC
"""
)
return [row[0] for row in cursor.fetchall()]
def get_sites_without_plugin() -> set[WPSite]:
"""
Get a set of wp sites where imunify-security plugin is not installed.
The data is pulled from the app-version-detector database.
Note: The same WordPress site (real_path) can appear in multiple reports
if it was scanned directly and also as part of a parent folder scan.
We use only the entry from the latest report for each real_path.
Returns:
A set of WPSite objects where the plugin is not installed.
"""
if not COMPONENTS_DB_PATH.exists():
logger.error(
"App detector database '%s' couldn't be found.",
str(COMPONENTS_DB_PATH),
)
return set()
cursor = SqliteDatabase(COMPONENTS_DB_PATH).execute_sql(
f"""
WITH latest_reports AS (
SELECT id, uid, domain, dir
FROM report
WHERE id IN (
SELECT MAX(id)
FROM report
WHERE domain IS NOT NULL
AND domain != ''
GROUP BY dir
)
),
-- Get all WordPress sites with their report IDs.
-- The real_path LIKE guard filters out orphaned apps rows
-- left behind when AVD rescans and rebuilds the report table.
all_wp_sites AS (
SELECT wp.id as wp_id, wp.real_path, lr.domain, lr.uid,
lr.id as report_id
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
),
-- For each real_path, keep only the entry from the latest report
latest_wp_sites AS (
SELECT wp_id, real_path, domain, uid, report_id
FROM all_wp_sites
WHERE (real_path, report_id) IN (
SELECT real_path, MAX(report_id)
FROM all_wp_sites
GROUP BY real_path
)
)
SELECT real_path, domain, uid
FROM latest_wp_sites lws
WHERE NOT EXISTS (
SELECT 1
FROM apps AS plugin
WHERE plugin.parent_id = lws.wp_id
AND plugin.title = 'wp_plugin_{PLUGIN_SLUG.replace("-", "_")}'
)
"""
)
return {
WPSite(docroot=row[0], domain=row[1], uid=int(row[2]))
for row in cursor.fetchall()
}
def get_sites_to_install() -> set[WPSite]:
"""
Get a set of WordPress sites where we need to install the plugin.
This is determined by finding sites that don't have the plugin installed
and are not already tracked in our database.
Returns:
A set of WPSite objects where the plugin needs to be installed.
"""
sites_without_plugin = get_sites_without_plugin()
existing_docroots = {
r.docroot for r in WordpressSite.select(WordpressSite.docroot)
}
return {
s for s in sites_without_plugin if s.docroot not in existing_docroots
}
def insert_installed_sites(sites: set[WPSite]) -> None:
"""
Insert a set of installed WordPress sites into the database.
This is used to track which sites have the plugin installed.
Args:
sites: A set of WPSite objects representing sites where the plugin was installed.
"""
if not sites:
return
WordpressSite.insert_many(
[
{
"domain": site.domain,
"docroot": site.docroot,
"uid": site.uid,
"version": site.version,
"manually_deleted_at": None,
}
for site in sites
]
).execute()
def get_outdated_sites(latest_version: str) -> list[WPSite]:
"""
Get a list of WordPress sites that have outdated plugin versions.
Args:
latest_version: The latest available plugin version to compare against.
Returns:
A list of WPSite objects that have versions older than latest_version.
"""
if not latest_version:
logger.error(
"Cannot get outdated sites without a valid latest version"
)
return []
return [
WPSite.from_wordpress_site(r)
for r in WordpressSite.select().where(
WordpressSite.manually_deleted_at.is_null(),
WordpressSite.version != latest_version,
)
]
def mark_site_as_manually_deleted(site: WPSite, timestamp: float) -> None:
"""
Mark a WordPress site as manually deleted in the database.
Args:
site: The WPSite object to mark as deleted
timestamp: The timestamp when the site was deleted
"""
logger.info(
"Mark site %s as manually deleted at %s (WP-Plugin removed)",
site,
timestamp,
)
(
WordpressSite.update(manually_deleted_at=timestamp)
.where(WordpressSite.docroot == site.docroot)
.execute()
)
def get_sites_to_mark_as_manually_deleted(
freshly_installed_sites: set[WPSite] = None,
) -> set[WPSite]:
"""
Get a set of WordPress sites that should be marked as manually deleted.
These are sites that are in our database but no longer have the plugin installed.
Args:
freshly_installed_sites: Optional set of sites that were just installed and should be excluded
from being marked as manually deleted to avoid race conditions.
Returns:
set[WPSite]: A set of WordPress sites that should be marked as manually deleted
"""
# Get sites without plugin from AVD database
sites_without_plugin = get_sites_without_plugin()
docroots_without_plugin = {s.docroot for s in sites_without_plugin}
# Get sites from our database that haven't been marked as manually deleted
active_db_sites = {
r.docroot: WPSite.from_wordpress_site(r)
for r in WordpressSite.select().where(
WordpressSite.manually_deleted_at.is_null()
)
}
# Match by docroot only — AVD may report different domain/uid than our DB
docroots_to_mark = docroots_without_plugin & set(active_db_sites)
# Filter out freshly installed sites to avoid race condition with AppVersionDetector
if freshly_installed_sites:
docroots_to_mark -= {s.docroot for s in freshly_installed_sites}
return {active_db_sites[d] for d in docroots_to_mark}
def update_site_version(site: WPSite, version: str) -> None:
"""
Update the version of a WordPress site in the database.
Args:
site: The WPSite object to update
version: The new version to set
"""
WordpressSite.update(version=version).where(
WordpressSite.docroot == site.docroot
).execute()
def update_site_identity(site: WPSite) -> None:
"""
Update the domain and uid of a WordPress site in the database
to match what AVD currently reports.
Args:
site: The WPSite object with the current domain and uid from AVD.
"""
WordpressSite.update(domain=site.domain, uid=site.uid).where(
WordpressSite.docroot == site.docroot
).execute()
def get_installed_sites_paginated(
uid: int | None = None,
limit: int | None = None,
offset: int = 0,
) -> tuple[int, list[WPSite]]:
"""
Get active installed WordPress sites with optional filtering and pagination.
Args:
uid: Optional user ID to filter sites by owner
limit: Maximum number of sites to return
offset: Number of sites to skip
Returns:
Tuple of (total_count, paginated_sites)
"""
query = WordpressSite.select().where(
WordpressSite.manually_deleted_at.is_null(True)
)
if uid is not None:
query = query.where(WordpressSite.uid == uid)
total_count = query.count()
if limit is not None:
query = query.limit(limit)
if offset > 0:
query = query.offset(offset)
sites = [WPSite.from_wordpress_site(site) for site in query]
return total_count, sites
def count_installed_sites_by_uid() -> dict[int, int]:
"""
Count active installed WordPress sites per owner uid in one query.
Mirrors get_installed_sites_paginated's active-site filter
(manually_deleted_at IS NULL). Uids with no active sites are absent
from the result rather than mapped to 0.
Returns:
Mapping of uid -> number of active installed sites.
"""
query = (
WordpressSite.select(
WordpressSite.uid,
fn.COUNT(WordpressSite.docroot).alias("count"),
)
.where(WordpressSite.manually_deleted_at.is_null(True))
.group_by(WordpressSite.uid)
.dicts()
)
return {row["uid"]: row["count"] for row in query}
def get_installed_sites() -> list[WPSite]:
"""
Get a list of active installed WordPress sites.
These are sites that haven't been marked as manually deleted.
Returns:
A list of WPSite objects representing non-deleted sites.
"""
_, sites = get_installed_sites_paginated()
return sites
def get_installed_sites_by_domains(domains: list[str]) -> list[WPSite]:
"""
Get active installed WordPress sites filtered by domain names.
Args:
domains: List of domain names to filter by
Returns:
List of WPSite objects matching the given domains
"""
if not domains:
return []
return [
WPSite.from_wordpress_site(r)
for r in WordpressSite.select().where(
WordpressSite.manually_deleted_at.is_null(True),
WordpressSite.domain.in_(domains),
)
]
async def sleep_on_error(exception, attempt):
await asyncio.sleep(0.5)
@retry_on(
OperationalError,
max_tries=3,
silent=True,
log=False,
on_error=sleep_on_error,
)
def delete_site(site: WPSite) -> int:
"""
Delete a WordPress site from the database with retry logic.
Will retry up to 3 times on database operational errors with 0.5s delay between attempts.
Args:
site: The WPSite object to delete
Returns:
The number of rows affected by the delete operation
"""
return (
WordpressSite.delete()
.where(WordpressSite.docroot == site.docroot)
.execute()
)
def get_sites_with_plugin() -> set[WPSite]:
"""
Get a set of WordPress sites where the imunify-security plugin is installed.
The data is pulled from the app-version-detector database.
Note: The same WordPress site (real_path) can appear in multiple reports
if it was scanned directly and also as part of a parent folder scan.
We use only the entry from the latest report for each real_path.
Returns:
A set of WPSite objects where the plugin is installed.
"""
if not COMPONENTS_DB_PATH.exists():
logger.error(
"App detector database '%s' couldn't be found.",
str(COMPONENTS_DB_PATH),
)
return set()
cursor = SqliteDatabase(COMPONENTS_DB_PATH).execute_sql(
f"""
WITH latest_reports AS (
SELECT id, uid, domain, dir
FROM report
WHERE id IN (
SELECT MAX(id)
FROM report
WHERE domain IS NOT NULL
AND domain != ''
GROUP BY dir
)
),
-- Get all WordPress sites with their report IDs.
-- The real_path LIKE guard filters out orphaned apps rows
-- left behind when AVD rescans and rebuilds the report table.
all_wp_sites AS (
SELECT wp.id as wp_id, wp.real_path, lr.domain, lr.uid,
lr.id as report_id
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path LIKE RTRIM(lr.dir, '/') || '%'
),
-- For each real_path, keep only the entry from the latest report
latest_wp_sites AS (
SELECT wp_id, real_path, domain, uid, report_id
FROM all_wp_sites
WHERE (real_path, report_id) IN (
SELECT real_path, MAX(report_id)
FROM all_wp_sites
GROUP BY real_path
)
)
SELECT real_path, domain, uid
FROM latest_wp_sites lws
WHERE EXISTS (
SELECT 1
FROM apps AS plugin
WHERE plugin.parent_id = lws.wp_id
AND plugin.title = 'wp_plugin_{PLUGIN_SLUG.replace("-", "_")}'
)
"""
)
return {
WPSite(docroot=row[0], domain=row[1], uid=int(row[2]))
for row in cursor.fetchall()
}
def get_sites_to_adopt() -> set[WPSite]:
"""
Get a set of WordPress sites that should be adopted.
These are sites where the plugin is installed but either:
- Not tracked in our database (e.g., copied/migrated sites)
- Flagged as manually removed (from past bugs or manual reinstall)
Returns:
A set of WPSite objects that should be adopted.
"""
sites_with_plugin = get_sites_with_plugin()
# Compare by docroot only — AVD may report different domain/uid than our DB
tracked_docroots = {
r.docroot
for r in WordpressSite.select(WordpressSite.docroot).where(
WordpressSite.manually_deleted_at.is_null(True)
)
}
return {s for s in sites_with_plugin if s.docroot not in tracked_docroots}
def clear_manually_deleted_flag(site: WPSite) -> None:
"""
Clear the manually_deleted_at flag for a WordPress site.
This is used when adopting a site that was previously marked as manually deleted.
Args:
site: The WPSite object to clear the flag for
"""
logger.info(
"Clearing manually_deleted_at flag for site %s (plugin found)",
site,
)
(
WordpressSite.update(manually_deleted_at=None)
.where(WordpressSite.docroot == site.docroot)
.execute()
)
defence360agent/wordpress/telemetry.py 0000644 0000000 0000000 00000001035 00000000000 015161 0 ustar import logging
from defence360agent.contracts.messages import MessageType
from defence360agent.model.wordpress import WPSite
logger = logging.getLogger(__name__)
async def send_event(sink, event: str, site: WPSite, version: str = None):
if version is None:
version = "1.0.0"
await sink.process_message(
MessageType.WordpressPluginTelemetry(
event=event,
domain=site.domain,
site_path=site.docroot,
user=site.uid,
plugin_version=version,
)
)
defence360agent/wordpress/utils.py 0000644 0000000 0000000 00000054222 00000000000 014315 0 ustar import errno
import json
import logging
import os
import pwd
import shlex
import subprocess
from collections import defaultdict
from datetime import datetime, timedelta
from functools import cache, lru_cache
from pathlib import Path
from typing import Optional
from defence360agent.contracts.config import (
choose_value_from_config,
MalwareScanScheduleInterval as Interval,
)
from defence360agent.contracts.license import LicenseCLN
from defence360agent.subsys.panels.hosting_panel import HostingPanel
from defence360agent.subsys.panels.plesk import Plesk
from defence360agent.utils import (
IMUNIFY_PACKAGE_NAMES,
async_lru_cache,
atomic_rewrite,
check_run,
importer,
system_packages_info,
)
from defence360agent.utils.fd_ops import open_dir_no_symlinks, safe_dir
from defence360agent.model.wordpress import WPSite
from defence360agent.wordpress.constants import WP_CLI_WRAPPER_PATH
from defence360agent.wordpress.exception import PHPError
CAGEFS_ENTER_PATH = "/usr/sbin/cagefs_enter_user"
CAGEFS_CTL_PATH = "/usr/sbin/cagefsctl"
MalwareHit = importer.get(
module="imav.malwarelib.model", name="MalwareHit", default=None
)
@cache
def _queue_supervisor_cls():
return importer.get(
module="imav.malwarelib.scan.queue_supervisor_sync",
name="QueueSupervisorSync",
default=None,
)
@cache
def _fetch_user_list_fn():
return importer.get(
module="imav.malwarelib.utils.user_list",
name="fetch_user_list",
default=None,
)
@cache
def _sort_user_list_fn():
return importer.get(
module="imav.malwarelib.utils.user_list",
name="sort",
default=None,
)
_VALID_PRESETS = frozenset(("balanced", "strict", "monitor"))
logger = logging.getLogger(__name__)
def _validate_preset(value: object) -> str:
"""Coerce a config-read preset value to a canonical preset string.
Returns "balanced" for anything outside _VALID_PRESETS — including
None, non-strings, and hand-edited values like "extreme" or
"BALANCED". The agent always writes lowercase canonical values, so
a non-canonical read indicates either a manual edit or a future
preset that this version doesn't recognise; "balanced" is the safe
fallback in both cases.
"""
if isinstance(value, str) and value in _VALID_PRESETS:
return value
return "balanced"
@async_lru_cache(ttl=60)
async def get_domain_paths() -> dict[str, list[str]]:
"""
Get a mapping of docroots to their associated domains, with caching.
"""
hosting_panel = HostingPanel()
panel_paths = await hosting_panel.get_domain_paths()
docroot_map = defaultdict(list)
for domain, docroots in panel_paths.items():
for docroot in docroots:
docroot_map[docroot].append(domain)
return docroot_map
def wp_wrapper(php_path: str, docroot: str) -> list:
"""Get wp cli common command list"""
return [str(WP_CLI_WRAPPER_PATH), php_path, docroot]
@lru_cache(maxsize=1)
def get_cagefs_enabled_users() -> set:
"""Get the list of users enabled for CageFS."""
if not os.path.isfile(CAGEFS_CTL_PATH) or not os.access(
CAGEFS_CTL_PATH, os.X_OK
):
return set()
result = subprocess.run(
[CAGEFS_CTL_PATH, "--list-enabled"], capture_output=True, text=True
)
if result.returncode != 0:
return set()
lines = result.stdout.strip().split("\n")
return set(lines[1:]) # Skip the first line which is a summary
def clear_get_cagefs_enabled_users_cache():
"""Clear the cache for get_cagefs_enabled_users."""
get_cagefs_enabled_users.cache_clear()
def build_command_for_user(username: str, args: list) -> list:
"""Build the necessary command to run the given cmdline args with specified user."""
if username in get_cagefs_enabled_users():
if os.path.isfile(CAGEFS_ENTER_PATH) and os.access(
CAGEFS_ENTER_PATH, os.X_OK
):
return [
CAGEFS_ENTER_PATH,
"--no-io-and-memory-limit",
username,
*args,
]
return [
"su",
"-s",
"/bin/bash",
username,
"-c",
shlex.join(args),
]
async def get_domains_for_docroot(
docroot: str, domain_to_exclude: str
) -> list[str]:
"""
Get all domains associated with a given document root, excluding one domain.
It's panel-agnostic and uses a cached mapping.
"""
docroot_map = await get_domain_paths()
all_domains = docroot_map.get(docroot, [])
return [domain for domain in all_domains if domain != domain_to_exclude]
async def get_php_binary_path(site: WPSite, username: str) -> Optional[str]:
"""Determine PHP binary path for the given WPSite."""
from clcommon.cpapi import (
get_domains_php_info,
get_installed_php_versions,
)
domains_php_info = get_domains_php_info()
installed_php_versions = get_installed_php_versions()
def find_php_binary_for_domain(domain: str) -> Optional[str]:
domain_info = domains_php_info.get(domain)
if not domain_info or domain_info.get("username") != username:
return None
php_display_version = domain_info.get("display_version")
if not php_display_version:
return None
for php_version in installed_php_versions:
if php_version.get("identifier") == php_display_version:
return php_version.get("bin")
return None
# First, try with the main domain of the site.
php_binary_path = find_php_binary_for_domain(site.domain)
if php_binary_path:
return php_binary_path
# If not found, try with other domains for the site's docroot.
domains = await get_domains_for_docroot(
site.docroot, domain_to_exclude=site.domain
)
for domain in domains:
php_binary_path = find_php_binary_for_domain(domain)
if php_binary_path:
return php_binary_path
raise PHPError(
f"PHP binary was not identified for docroot: {site.docroot}, username:"
f" {username}"
)
def get_malware_history(username: str) -> list:
"""
Get malware history for the specified user.
This is an equivalent of calling `imunify360-agent malware history list --user {username}`.
Returns empty list if imav malware module is not available.
"""
if MalwareHit is None:
logger.debug(
"imav.malwarelib not available, returning empty malware history"
)
return []
(max_count, hits) = MalwareHit.malicious_list(user=username)
return hits
async def get_last_scan(sink, username: str) -> dict:
"""
Get the last scan for the specified user.
This is an equivalent of calling `imunify360-agent malware user list --user {username}`.
Returns empty dict if imav malware module is not available.
"""
queue_supervisor_cls = _queue_supervisor_cls()
fetch_user_list = _fetch_user_list_fn()
sort_user_list = _sort_user_list_fn()
if (
queue_supervisor_cls is None
or fetch_user_list is None
or sort_user_list is None
):
logger.debug(
"imav.malwarelib not available, returning empty last scan"
)
return {}
queue = queue_supervisor_cls(sink)
_, users = await fetch_user_list(
queue.get_scans_from_paths, match={username}
)
if not users:
return {}
users = sort_user_list(users, "scan_date", desc=True)
return users[0]
def calculate_next_scan_timestamp(interval, hour, day_of_month, day_of_week):
"""
Calculate the next scan timestamp based on schedule configuration.
Args:
interval: Scan interval (DAY, WEEK, MONTH, or NONE)
hour: Hour of day to run scan (0-23)
day_of_month: Day of month to run scan (1-31)
day_of_week: Day of week to run scan (0-6, where 0=Sunday)
Returns:
Timestamp of next scan, or None if interval is NONE
"""
today = datetime.utcnow()
if interval == Interval.DAY:
next_scan = today.replace(
hour=hour,
minute=0,
second=0,
microsecond=0,
)
if today >= next_scan:
next_scan += timedelta(days=1)
return next_scan.timestamp()
if interval == Interval.WEEK:
# today.weekday() returns 0 for Monday, 6 for Sunday, but day_of_week uses 0 for Sunday,
# 1 for Monday, ..., 6 for Saturday. So we need to adjust the calculation.
days_ahead = (day_of_week - (today.weekday() + 1) % 7 + 7) % 7
if days_ahead == 0 and today.hour >= hour:
days_ahead = 7
next_scan_date = today + timedelta(days=days_ahead)
return next_scan_date.replace(
hour=hour, minute=0, second=0, microsecond=0
).timestamp()
if interval == Interval.MONTH:
from calendar import monthrange
def find_next_suitable_month(year, month, days):
"""Find the next month that has at least given number of days."""
current_year, current_month = year, month
# Always start with the next month when advancing
current_month += 1
if current_month > 12:
current_month = 1
current_year += 1
# Keep advancing months until we find one with enough days
while True:
days_in_month = monthrange(current_year, current_month)[1]
if days <= days_in_month:
return current_year, current_month
current_month += 1
if current_month > 12:
current_month = 1
current_year += 1
# Check if we need to advance to next month
should_advance_month = (
# Today is after the scheduled day, scan already ran this month
today.day > day_of_month
# Today is the scheduled day and the hour is after the scheduled hour, scan already ran earlier today
or (today.day == day_of_month and today.hour >= hour)
# Current month doesn't have enough days, scan should run next suitable month
or day_of_month > monthrange(today.year, today.month)[1]
)
if should_advance_month:
# Find the next month that can accommodate the configured day
next_year, next_month = find_next_suitable_month(
today.year, today.month, day_of_month
)
next_scan_date = today.replace(
day=day_of_month, # Use the actual configured day
month=next_month,
year=next_year,
hour=hour,
minute=0,
second=0,
microsecond=0,
)
else:
# Current month can accommodate the configured day
next_scan_date = today.replace(
day=day_of_month,
hour=hour,
minute=0,
second=0,
microsecond=0,
)
return next_scan_date.timestamp()
async def get_imunify_package_versions() -> dict[str, str | None]:
"""Fetch installed versions of Imunify packages.
Returns a dict mapping package name to version string,
with None for packages that are not installed.
Intended to be called once per sync cycle (not per site).
"""
return await system_packages_info(IMUNIFY_PACKAGE_NAMES)
def prepare_scan_data(
last_scan_time: float,
next_scan_time: float,
username: str,
site: WPSite,
malware_by_site: dict,
versions: dict[str, str | None] | None = None,
) -> dict:
"""
Prepare scan data JSON for a WordPress site.
Args:
last_scan_time: Timestamp of the last scan
next_scan_time: Timestamp of the next scheduled scan
username: Username of the site owner
site: WordPress site object
malware_by_site: Dictionary mapping site docroots to their malware hits
versions: Optional dict mapping Imunify package names to version
strings (None for uninstalled packages). When provided, included
in the output as a ``versions`` key.
Returns:
dict: JSON data ready to be written to scan_data.php. The response includes:
- lastScanTimestamp: Timestamp of the last scan
- nextScanTimestamp: Timestamp of the next scheduled scan
- username: Username of the site owner
- malware: List of malware hits for the site
- config: Configuration items for the site
- license: License information including status and eligibility for Imunify patch
- versions: (optional) Installed Imunify package versions
"""
# Define the config sections and options needed
config_sections = [
("MALWARE_SCANNING", "enable_scan_cpanel"),
("MALWARE_SCANNING", "default_action"),
("PROACTIVE_DEFENCE", "blamer"),
]
# Build the config items
config_items = {}
for section, option in config_sections:
if section not in config_items:
config_items[section] = {}
try:
value, _ = choose_value_from_config(
section,
option,
username=username,
)
except KeyError:
value = None
config_items[section][option] = value
result = {
"lastScanTimestamp": last_scan_time,
"nextScanTimestamp": next_scan_time,
"username": username,
"malware": malware_by_site.get(site.docroot, []),
"config": config_items,
"license": LicenseCLN.license_info(),
}
if versions is not None:
result["versions"] = versions
return result
def _prepare_ai_bot_settings(username: str) -> dict:
"""The WP-plugin-facing WORDPRESS toggles, without the license read.
Split from prepare_plugin_config so callers that only need the admin
toggles (e.g. stats collection) don't trigger a license-token read.
"""
try:
ai_bot_protection, _ = choose_value_from_config(
"WORDPRESS",
"ai_bot_protection",
username=username,
)
except KeyError:
ai_bot_protection = False
try:
preset, _ = choose_value_from_config(
"WORDPRESS",
"ai_bot_protection_preset",
username=username,
)
except KeyError:
preset = "balanced"
return {
"ai_bot_protection": bool(ai_bot_protection),
"preset": _validate_preset(preset),
}
def prepare_plugin_config(username: str) -> dict:
"""
Prepare the plugin_config.php payload.
Dedicated channel for WP-plugin-facing configuration that the
mu-plugin reads on the request hot path. Kept separate from
scan_data.php so that a config toggle doesn't force rewriting the
(potentially large) malware list, and so the mu-plugin loads only
the data it actually needs per request.
Forward compatibility: the plugin ships with the agent, so their
versions are in lockstep. Any forward-compat gating lives here on
the writer side — the agent simply omits a field it doesn't know
about, and the plugin treats missing fields as "unset, use safe
default". No per-field version stamp is needed in the file itself.
Args:
username: Owner of the WP site.
Returns:
Dict ready to be encoded as PHP via format_php_with_embedded_json:
- ai_bot_protection: bool — admin WORDPRESS.ai_bot_protection
- preset: str — admin WORDPRESS.ai_bot_protection_preset,
normalised via _validate_preset to one of
"balanced"/"strict"/"monitor". Falls back to "balanced"
when the schema lacks the key (older agent) or the
configured value is non-canonical (manual edit, future
preset).
- license_type: str | None — server license edition
(imunify360 / imunify360Trial / imunifyAV / imunifyAVPlus),
or None when it can't be determined; the plugin treats None
as "do not gate".
"""
settings = _prepare_ai_bot_settings(username)
settings["license_type"] = LicenseCLN.get_license_type()
return settings
def write_plugin_data_file_atomically(
file_path, content: str, uid: int, gid: int, *, dir_fd: int | None = None
) -> None:
"""Write a plugin data file atomically.
When *dir_fd* is supplied by the caller (e.g. from
ensure_site_data_directory) it is used directly; otherwise the parent
directory is opened with symlink protection.
"""
permissions = 0o440 if HostingPanel().NAME == Plesk.NAME else 0o400
if dir_fd is not None:
atomic_rewrite(
file_path,
content,
backup=False,
uid=uid,
gid=gid,
permissions=permissions,
dir_fd=dir_fd,
)
return
with safe_dir(file_path.parent) as owned_dir_fd:
atomic_rewrite(
file_path,
content,
backup=False,
uid=uid,
gid=gid,
permissions=permissions,
dir_fd=owned_dir_fd,
)
def _escape_json_for_php_single_quoted_string(json_str: str) -> str:
"""
Escape a JSON string for embedding inside a PHP single-quoted string.
PHP single-quoted strings only recognise two escape sequences:
``\\\\`` (literal backslash) and ``\\'`` (literal single quote).
All other backslash sequences are kept verbatim. That means we must
double every ``\\`` *before* we escape ``'``, otherwise PHP will
consume JSON backslashes (e.g. ``\\\\s`` in JSON becomes ``\\s``
after PHP parsing, which is not a valid JSON escape).
"""
return json_str.replace("\\", "\\\\").replace("'", "\\'")
def _unescape_php_single_quoted_json(escaped: str) -> str:
"""
Reverse the escaping applied by :func:`_escape_json_for_php_single_quoted_string`.
"""
return escaped.replace("\\'", "'").replace("\\\\", "\\")
def format_php_with_embedded_json(data: dict) -> str:
"""
Format a dictionary as a PHP file that returns JSON-decoded data.
This creates a WordPress-safe PHP file that:
1. Checks if it's being included from WordPress (WPINC defined)
2. Returns the data as a decoded JSON string
Args:
data: Dictionary to embed in the PHP file
Returns:
Formatted PHP file content as a string
"""
return (
"<?php\n"
"if ( ! defined( 'WPINC' ) ) {\n"
"\texit;\n"
"}\n"
"return json_decode( '"
+ _escape_json_for_php_single_quoted_string(json.dumps(data))
+ "', true );"
)
def parse_php_with_embedded_json(content: str) -> dict:
"""
Parse a PHP file generated by format_php_with_embedded_json.
Extracts and returns the embedded JSON data.
Args:
content: PHP file content string
Returns:
Parsed JSON data as a dict
Raises:
ValueError: If the JSON data cannot be found or parsed
"""
marker = "json_decode( '"
start = content.find(marker)
if start == -1:
raise ValueError("No embedded JSON found in PHP content")
start += len(marker)
end = content.find("', true )", start)
if end == -1:
raise ValueError("Malformed embedded JSON in PHP content")
json_str = _unescape_php_single_quoted_json(content[start:end])
return json.loads(json_str)
def ensure_directory_listing_protection(
data_dir: Path, uid: int, gid: int, *, dir_fd: int
) -> None:
"""
Ensure directory listing protection files exist in the data directory.
Creates .htaccess, index.php, and index.html files to prevent directory
listing. All writes use the caller-supplied *dir_fd* so that no
path-based symlink check is required. atomic_rewrite skips the write
when the file already contains the expected content, preserving idempotency.
"""
protection_files = {
".htaccess": "DirectoryIndex index.php index.html\ndeny from all\n",
"index.php": "<?php\n// This file is intentionally blank.\n",
"index.html": "<!-- This file is intentionally blank. -->\n",
}
for filename, content in protection_files.items():
file_path = data_dir / filename
write_plugin_data_file_atomically(
file_path, content, uid=uid, gid=gid, dir_fd=dir_fd
)
async def ensure_site_data_directory(
site: WPSite, user_info: pwd.struct_passwd
) -> Path:
"""Ensure the site's data directory exists with correct permissions.
The directory is opened with symlink protection after creation
(or if it already exists) to obtain a stable file descriptor.
All subsequent operations use that descriptor.
Args:
site: WordPress site
user_info: User information from pwd
Returns:
Path to data directory
Raises:
Exception: If the data directory is a symlink or cannot be created
"""
from defence360agent.wordpress import cli
data_dir = await cli.get_data_dir(site)
newly_created = False
try:
dir_fd = open_dir_no_symlinks(data_dir)
except FileNotFoundError:
# Directory does not exist yet — create it as the site user so that
# it is owned by the user (not root), then re-open with O_NOFOLLOW.
command = build_command_for_user(
user_info.pw_name,
["mkdir", "-p", str(data_dir)],
)
await check_run(command)
try:
dir_fd = open_dir_no_symlinks(data_dir)
except OSError as exc:
if exc.errno in (errno.ELOOP, errno.ENOTDIR):
raise Exception(
f"Data directory {data_dir} is a symlink, skipping."
) from exc
raise Exception(
f"Failed to open data directory {data_dir}: {exc}"
) from exc
newly_created = True
except OSError as exc:
if exc.errno in (errno.ELOOP, errno.ENOTDIR):
raise Exception(
f"Data directory {data_dir} is a symlink, skipping."
) from exc
raise
try:
if newly_created:
os.chmod(dir_fd, 0o750)
ensure_directory_listing_protection(
data_dir, uid=site.uid, gid=user_info.pw_gid, dir_fd=dir_fd
)
finally:
os.close(dir_fd)
return data_dir
defence360agent/wordpress/wp_rules.py 0000644 0000000 0000000 00000006704 00000000000 015017 0 ustar """WordPress rules file management.
This module provides utilities for loading and parsing wp-rules.yaml
from the files.imunify360.com index system.
Available for both AV and IM360 modes.
"""
import logging
import yaml
import zipfile
from pathlib import Path
from defence360agent.files import Index
logger = logging.getLogger(__name__)
# WordPress rules file names within the index
WP_RULES_ZIP_FILENAME = "wp-rules.zip"
WP_RULES_VERSION_FILENAME = "VERSION"
def find_file_in_index(index: Index, filename: str) -> Path | None:
"""
Find a file path from the index by filename.
Args:
index: files.Index object
filename: Name of the file to find (e.g., WP_RULES_ZIP_FILENAME)
Returns:
Path to the file or None if not found
"""
for item in index.items():
if item["name"] == filename:
file_path = Path(index.localfilepath(item["url"]))
if file_path.exists():
return file_path
logger.error("%s not found in %s", filename, index.files_path(index.type))
return None
def extract_wp_rules_yaml(zip_path: Path) -> dict | None:
"""
Extract and parse wp-rules.yaml from the zip file.
Args:
zip_path: Path to wp-rules.zip file
Returns:
Parsed YAML data as dict or None if extraction/parsing fails
"""
try:
with zipfile.ZipFile(zip_path, "r") as zip_file:
with zip_file.open("wp-rules.yaml") as yaml_file:
rules_data = yaml.safe_load(yaml_file)
except (zipfile.BadZipFile, KeyError, yaml.YAMLError) as e:
logger.error("Failed to extract or parse wp-rules.yaml: %s", e)
return None
if not isinstance(rules_data, dict):
logger.error("Invalid wp-rules.yaml format: %s", rules_data)
return None
return rules_data
def get_wp_rules_data(index: Index) -> dict | None:
"""
Retrieve the latest WordPress rules and return them as a dictionary.
Args:
index: The files.Index object used to locate the wp-rules.zip file.
Returns:
The parsed wp-rules data as a dictionary.
If the wp-rules archive or data cannot be found or parsed, returns None.
Note:
This function returns the raw rules data. Callers that need to modify
rules based on product mode (e.g., ANTIVIRUS_MODE) should do so after
calling this function.
"""
# Find wp-rules.zip file
zip_path = find_file_in_index(index, WP_RULES_ZIP_FILENAME)
if not zip_path:
return None
# Extract and parse wp-rules.yaml
rules_data = extract_wp_rules_yaml(zip_path)
if not rules_data:
return None
logger.info("Successfully parsed wp-rules.yaml")
return rules_data
def get_wp_ruleset_version(index: Index) -> str:
"""
Retrieve the WordPress ruleset version string from the VERSION file.
Args:
index: The files.Index object used to locate the VERSION file.
Returns:
The version string from the VERSION file.
If the VERSION file cannot be found or read, returns "NA".
"""
# Find VERSION file
version_path = find_file_in_index(index, WP_RULES_VERSION_FILENAME)
if not version_path:
return "NA"
try:
version_string = version_path.read_text().strip()
logger.info("Successfully read wp-rules version: %s", version_string)
return version_string
except Exception as e:
logger.error("Failed to read VERSION file: %s", e)
return "NA"
imunify_core-8.12.1-py3.11.egg-info/ 0000755 0000000 0000000 00000000000 00000000000 013545 5 ustar imunify_core-8.12.1-py3.11.egg-info/PKG-INFO 0000644 0000000 0000000 00000000271 00000000000 014642 0 ustar Metadata-Version: 2.1
Name: imunify-core
Version: 8.12.1
Summary: ImunifyCore
Home-page: http://www.imunify360.com
Author: Cloud Linux Zug GmbH
Author-email: imunify-dev@imunify360.com
imunify_core-8.12.1-py3.11.egg-info/SOURCES.txt 0000644 0000000 0000000 00000064225 00000000000 015442 0 ustar MANIFEST.in
README.md
pyproject.toml
setup-core.py
setup.cfg
setup.py
defence360agent/__init__.py
defence360agent/__main__.py
defence360agent/_version.py
defence360agent/defence360.py
defence360agent/migrate.py
defence360agent/router.py
defence360agent/run.py
defence360agent/sentry.py
defence360agent/api/__init__.py
defence360agent/api/health.py
defence360agent/api/inactivity.py
defence360agent/api/integration_conf.py
defence360agent/api/jwt_issuer.py
defence360agent/api/newsfeed.py
defence360agent/api/pam_auth.py
defence360agent/api/server/__init__.py
defence360agent/api/server/analyst_cleanup.py
defence360agent/api/server/cleanup_revert.py
defence360agent/api/server/events.py
defence360agent/api/server/reputation.py
defence360agent/api/server/send_message.py
defence360agent/application/__init__.py
defence360agent/application/determine_hosting_panel.py
defence360agent/application/settings.py
defence360agent/application/tags.py
defence360agent/contracts/__init__.py
defence360agent/contracts/config.py
defence360agent/contracts/config_provider.py
defence360agent/contracts/eula.py
defence360agent/contracts/hook_events.py
defence360agent/contracts/hooks.py
defence360agent/contracts/license.py
defence360agent/contracts/messages.py
defence360agent/contracts/myimunify_id.py
defence360agent/contracts/permissions.py
defence360agent/contracts/plugins.py
defence360agent/contracts/sentry.py
defence360agent/feature_management/__init__.py
defence360agent/feature_management/checkers.py
defence360agent/feature_management/constants.py
defence360agent/feature_management/control.py
defence360agent/feature_management/exceptions.py
defence360agent/feature_management/hooks.py
defence360agent/feature_management/lookup.py
defence360agent/feature_management/model.py
defence360agent/feature_management/utils.py
defence360agent/feature_management/plugins/__init__.py
defence360agent/feature_management/plugins/native.py
defence360agent/feature_management/plugins/proactive_log_migration.py
defence360agent/feature_management/rpc/__init__.py
defence360agent/feature_management/rpc/endpoints/__init__.py
defence360agent/feature_management/rpc/endpoints/native.py
defence360agent/feature_management/rpc/endpoints/show.py
defence360agent/feature_management/rpc/endpoints/update.py
defence360agent/feature_management/rpc/endpoints/utils.py
defence360agent/feature_management/rpc/schema/native.pickle
defence360agent/feature_management/rpc/schema/native.yaml
defence360agent/feature_management/rpc/schema/show.pickle
defence360agent/feature_management/rpc/schema/show.yaml
defence360agent/feature_management/rpc/schema/update.pickle
defence360agent/feature_management/rpc/schema/update.yaml
defence360agent/files/__init__.py
defence360agent/files/hooks.py
defence360agent/hooks/__init__.py
defence360agent/hooks/execute.py
defence360agent/hooks/native.py
defence360agent/internals/__init__.py
defence360agent/internals/auth_protocol.py
defence360agent/internals/cln.py
defence360agent/internals/deadlock_detecting_lock.py
defence360agent/internals/delivery_ack.py
defence360agent/internals/feature_flags.py
defence360agent/internals/geo.py
defence360agent/internals/global_scope.py
defence360agent/internals/iaid.py
defence360agent/internals/lazy_load.py
defence360agent/internals/logger.py
defence360agent/internals/logging_protocol.py
defence360agent/internals/message_status_publisher.py
defence360agent/internals/persistent_message.py
defence360agent/internals/the_sink.py
defence360agent/migrations/001_initial.py
defence360agent/migrations/002_infected_domain_list.py
defence360agent/migrations/003_import_from_list.py
defence360agent/migrations/004_add_username_to_infected_domain_list.py
defence360agent/migrations/005_timeout_in_iplist.py
defence360agent/migrations/006_comment_in_plist.py
defence360agent/migrations/007_add_country_code_fields.py
defence360agent/migrations/008_fill_countries.py
defence360agent/migrations/009_drop_blocklist_history.py
defence360agent/migrations/010_drop_country_entities.py
defence360agent/migrations/011_create_new_country_entities.py
defence360agent/migrations/012_fill_countries_and_subnets.py
defence360agent/migrations/013_add_indexes_to_iplist.py
defence360agent/migrations/014_add_malware_hits.py
defence360agent/migrations/015_add_iplist_expiration_index.py
defence360agent/migrations/016_fix_autowhitelist_expiration.py
defence360agent/migrations/017_remove_sensor_prefix.py
defence360agent/migrations/018_license_info.py
defence360agent/migrations/019_purge_old_configs.py
defence360agent/migrations/020_malware_scan_types.py
defence360agent/migrations/021_add_testing_repo.py
defence360agent/migrations/022_mod_security_vendors_migrations.py
defence360agent/migrations/023_add_default_rule_in_modsec_custom_conf.py
defence360agent/migrations/024_ignore_from_graylist.py
defence360agent/migrations/025_malware_config_realtime.py
defence360agent/migrations/026_remove_old_temporary_file.py
defence360agent/migrations/027_disable_comdo_fp_rules.py
defence360agent/migrations/028_set_permanent_ttl_for_blacklist.py
defence360agent/migrations/029_custom_quarantine.py
defence360agent/migrations/030_rename_max_incident_repetition.py
defence360agent/migrations/031_add_mode_field.py
defence360agent/migrations/031_modsec_config_for_plesk_include.py
defence360agent/migrations/032_chmod_quarantine.py
defence360agent/migrations/033_disable_cphulk.py
defence360agent/migrations/034_hits_extras.py
defence360agent/migrations/035_add_dos_expiration_field.py
defence360agent/migrations/036_add_block_port.py
defence360agent/migrations/037_disabled_rules.py
defence360agent/migrations/038_disabled_rules_import.py
defence360agent/migrations/039_fix_malware_hits.py
defence360agent/migrations/040_ignore_mod_sec_rule_214920.py
defence360agent/migrations/041_fix_invalid_ignore_filed.py
defence360agent/migrations/042_rebuildinstalledssldb.py
defence360agent/migrations/043_disable_dos_scan_by_default.py
defence360agent/migrations/044_ignore_virtfs_on_cpanel.py
defence360agent/migrations/045_ignore_vdserver_dir_in_csf.py
defence360agent/migrations/046_foreign_key_fix.py
defence360agent/migrations/047_license_in_file.py
defence360agent/migrations/048_malware_hits_vendor_field.py
defence360agent/migrations/049_add_auto_added_field_to_iplist.py
defence360agent/migrations/050_fill_auto_whitelisted.py
defence360agent/migrations/051_cleanup_vd_license.py
defence360agent/migrations/052_whitelisted_crawlers.py
defence360agent/migrations/053_populate_whitelisted_crawlers.py
defence360agent/migrations/054_add_malicious_and_added_date_fileds.py
defence360agent/migrations/055_migrate_move_to_quar_option.py
defence360agent/migrations/056_populate_malicious_with_quarantined.py
defence360agent/migrations/057_filename_is_blob.py
defence360agent/migrations/058_convert_license_last_attempt.py
defence360agent/migrations/059_scans_error_field.py
defence360agent/migrations/061_migrate_backup_system_conf.py
defence360agent/migrations/062_drop_malware_extra_data.py
defence360agent/migrations/062_fix_null_expiration.py
defence360agent/migrations/063_fix_graylist_doslist_expiration_discrepancy.py
defence360agent/migrations/064_chmod_i360deploy_log.py
defence360agent/migrations/065_remove_capture_csf_lock_from_config.py
defence360agent/migrations/066_eula_table.py
defence360agent/migrations/067_drop_fields_from_modsec_conf.py
defence360agent/migrations/068_remove_rules_check_interval_from_config.py
defence360agent/migrations/069_incidents_domain_field.py
defence360agent/migrations/070_modsec_incident_names.py
defence360agent/migrations/071_malware_hits_hash_size_fields.py
defence360agent/migrations/072_add_malware_history_table.py
defence360agent/migrations/072_captcha_stat.py
defence360agent/migrations/072_extend_last_synclist.py
defence360agent/migrations/073_drop_dos_expiration.py
defence360agent/migrations/074_ip_as_int.py
defence360agent/migrations/075_ips_as_int.py
defence360agent/migrations/076_hash_model.py
defence360agent/migrations/077_alter_malware_scan.py
defence360agent/migrations/078_fix_signatures_permissions.py
defence360agent/migrations/079_add_uid_gid_fields.py
defence360agent/migrations/080_populate_uid_gid_size_hash_fields.py
defence360agent/migrations/081_fix_clamscan_broken_symlink.py
defence360agent/migrations/082_add_cl_on_premise_backup_option.py
defence360agent/migrations/082_add_manual_flag.py
defence360agent/migrations/083_drop_no_captcha_field.py
defence360agent/migrations/084_country_subnets_fields.py
defence360agent/migrations/085_country_subnets_fields.py
defence360agent/migrations/086_ignored_by_port_fields.py
defence360agent/migrations/087_ignored_by_port_fields.py
defence360agent/migrations/088_add_malware_i360_clamd_scan_option.py
defence360agent/migrations/089_proactive_tables.py
defence360agent/migrations/090_safe_user_config.py
defence360agent/migrations/091_compress_old_logs.py
defence360agent/migrations/092_ignore_proc_sys_dirs.py
defence360agent/migrations/092_remove_old_disabled_rules.py
defence360agent/migrations/093_make_quarantined_files_immutable.py
defence360agent/migrations/094_ignore_cagefs_proc.py
defence360agent/migrations/095_add_total_malicious_field.py
defence360agent/migrations/096_populate_total_malicious_field.py
defence360agent/migrations/097_remove_uid_and_gid.py
defence360agent/migrations/098_remote_proxy_tables.py
defence360agent/migrations/099_remove_old_disabled_rules.py
defence360agent/migrations/100_remove_captcha_ports_from_csf.py
defence360agent/migrations/101_remove_unneeded_acronis_ports_from_csf.py
defence360agent/migrations/102_proactive_ignore_list.py
defence360agent/migrations/102_replace_comodo.py
defence360agent/migrations/103_remove_vd_license.py
defence360agent/migrations/104_add_feature_management_permissions.py
defence360agent/migrations/105_populate_default_feature_management_permissions.py
defence360agent/migrations/106_add_malware_cleanup_in_config.py
defence360agent/migrations/106_malware_hit_status_field_add.py
defence360agent/migrations/107_add_bruteforce_rule_33339.py
defence360agent/migrations/107_malware_hit_status_field_populate.py
defence360agent/migrations/108_feature_management_cleanup_add.py
defence360agent/migrations/108_validate_config.py
defence360agent/migrations/109_dos_detector.py
defence360agent/migrations/110_ignore_list_ip_as_int.py
defence360agent/migrations/111_ignore_list_ip_as_int.py
defence360agent/migrations/112_hardened_php.py
defence360agent/migrations/113_move_quarantined_files.py
defence360agent/migrations/114_disable_auto-quarantine.py
defence360agent/migrations/115_feature_management_fields.py
defence360agent/migrations/116_feature_management_fields.py
defence360agent/migrations/117_remove_incorrect_fields.py
defence360agent/migrations/118_add_malware_user_infected.py
defence360agent/migrations/118_remove_country_subnets.py
defence360agent/migrations/119_populate_malware_user_infected.py
defence360agent/migrations/120_scheduled_scan.py
defence360agent/migrations/121_drop_captcha_stat.py
defence360agent/migrations/122_cagefs_unmount.py
defence360agent/migrations/123_add_last_user_scan.py
defence360agent/migrations/123_disable_scheduled_scan.py
defence360agent/migrations/123_rename_plesk_vendor.py
defence360agent/migrations/124_add_hook_management_functionality.py
defence360agent/migrations/124_add_infected_domains_vendor.py
defence360agent/migrations/125_rescan_scan_type.py
defence360agent/migrations/126_add_malware_scan_modified_files_option.py
defence360agent/migrations/126_move_malware_hits_list.py
defence360agent/migrations/127_remove_malware_hit_mode.py
defence360agent/migrations/128_move_cleanup_storage_files.py
defence360agent/migrations/129_fixed_cagefs_unmount.py
defence360agent/migrations/130_add_messages_to_send.py
defence360agent/migrations/131_incident_timestamp_index.py
defence360agent/migrations/132_add_timestamp_field.py
defence360agent/migrations/133_add_scope_field_to_iplist.py
defence360agent/migrations/134_change_default_of_intensity_ram.py
defence360agent/migrations/135_export_proactive.py
defence360agent/migrations/135_make_completed_nullable.py
defence360agent/migrations/136_drop_proactive.py
defence360agent/migrations/137_swap_initiator_and_cause.py
defence360agent/migrations/138_move_rapid_scan_dir.py
defence360agent/migrations/139_generic_modsec_config.py
defence360agent/migrations/140_cast_malware_hit_orig_file_as_blob.py
defence360agent/migrations/141_drop_last_user_scans.py
defence360agent/migrations/143_malware_hit_cascade_delete.py
defence360agent/migrations/144_remove_clamav_config_options.py
defence360agent/migrations/144_remove_hash_table.py
defence360agent/migrations/145_move_quarantine.py
defence360agent/migrations/146_malware_user_infected_cascade_delete.py
defence360agent/migrations/147_remove_vendor_field.py
defence360agent/migrations/147_user_scan_type.py
defence360agent/migrations/148_reconstruct_pickled_scan_queue.py
defence360agent/migrations/148_remove_malware_user_infected.py
defence360agent/migrations/149_add_captcha_passed_field_to_iplist.py
defence360agent/migrations/149_make_config_inactive.py
defence360agent/migrations/150_update_captcha_passed_field_for_iplist_entries.py
defence360agent/migrations/151_change_constraint_for_iplist.py
defence360agent/migrations/152_add_listname_to_primary_key.py
defence360agent/migrations/153_migrate_config_default_action.py
defence360agent/migrations/153_update_incident_name.py
defence360agent/migrations/154_migrate_config_user_override_malware_actions.py
defence360agent/migrations/155_migrate_config_user_override_proactive_defense.py
defence360agent/migrations/156_remove_default_values_from_config.py
defence360agent/migrations/157_move_i360_modsec_disable_conf.py
defence360agent/migrations/158_move_i360_modsec_disable_conf_symlink.py
defence360agent/migrations/159_remove_defaults_from_local_config.py
defence360agent/migrations/160_remove_quarantine.py
defence360agent/migrations/160_unmount_sigs_v1.py
defence360agent/migrations/161_remove_ea4_main_local_conf.py
defence360agent/migrations/162_add_resource_type.py
defence360agent/migrations/163_drop_malware_scanned_stat.py
defence360agent/migrations/164_add_resource_type_to_ignore.py
defence360agent/migrations/165_add_db_fields_to_malware_history.py
defence360agent/migrations/166_add_id_field_to_malware_ignore_path.py
defence360agent/migrations/167_remote_iplist.py
defence360agent/migrations/168_add_icontact_throttle.py
defence360agent/migrations/169_add_record_to_throttle_scan_not_schedule_events.py
defence360agent/migrations/170_add_db_fields_to_malware_history.py
defence360agent/migrations/180_move_captcha_configs.py
defence360agent/migrations/182_remove_constraints_from_icontact_throttle.py
defence360agent/migrations/183_add_user_field_to_malware_scans.py
defence360agent/migrations/184_create_a_table_for_secure_site_permissions.py
defence360agent/migrations/185_delete_all_secure_site_id.py
defence360agent/migrations/186_add_user_field_to_icontact_throttle.py
defence360agent/migrations/187_fix_scan_unserialization.py
defence360agent/migrations/188_add_protection_status_field_myimunify.py
defence360agent/migrations/189_add_messages_to_send_nr.py
defence360agent/migrations/190_add_analyst_cleanup_request_table.py
defence360agent/migrations/191_create_wordpress_incident_table.py
defence360agent/migrations/192_add_wordpress_incident_unique_index.py
defence360agent/migrations/193_remove_sent_to_server_from_wordpress_incident.py
defence360agent/migrations/194_add_wp_disabled_rules.py
defence360agent/migrations/194_create_nonprivileged_config.py
defence360agent/migrations/195_create_wordpress_site.py
defence360agent/migrations/196_add_disabled_rules_sync_ts.py
defence360agent/migrations/197_add_wordpress_site_manually_deleted_at.py
defence360agent/migrations/198_add_wordpress_site_version.py
defence360agent/migrations/199_proactive_log_permission.py
defence360agent/migrations/200_seed_per_user_waf_enabled.py
defence360agent/migrations/201_rerender_nonprivileged_config.py
defence360agent/migrations/202_add_wordpress_incident_bucket.py
defence360agent/migrations/203_add_wordpress_incident_unsent_retries.py
defence360agent/migrations/__init__.py
defence360agent/migrations/conf.py
defence360agent/model/__init__.py
defence360agent/model/analyst_cleanup.py
defence360agent/model/event_hook.py
defence360agent/model/icontact.py
defence360agent/model/infected_domain.py
defence360agent/model/instance.py
defence360agent/model/messages_to_send.py
defence360agent/model/simplification.py
defence360agent/model/tls_check.py
defence360agent/model/wordpress.py
defence360agent/model/wordpress_incident.py
defence360agent/model/wp_disabled_rule.py
defence360agent/mr_proper/__init__.py
defence360agent/myimunify/__init__.py
defence360agent/myimunify/billing.py
defence360agent/myimunify/constants.py
defence360agent/myimunify/model.py
defence360agent/myimunify/advice/__init__.py
defence360agent/myimunify/advice/advice_manager.py
defence360agent/myimunify/advice/dataclass.py
defence360agent/myimunify/advice/hosting_smart_advice_api.py
defence360agent/plugins/__init__.py
defence360agent/plugins/accumulate.py
defence360agent/plugins/analyst_cleanup_update.py
defence360agent/plugins/backup_info_sender.py
defence360agent/plugins/cagefs.py
defence360agent/plugins/checkpoint.py
defence360agent/plugins/client.py
defence360agent/plugins/config_merger.py
defence360agent/plugins/config_watcher.py
defence360agent/plugins/event_hook_executor.py
defence360agent/plugins/event_monitor.py
defence360agent/plugins/event_monitor_message_processor.py
defence360agent/plugins/feature_flags.py
defence360agent/plugins/files_recurring_update.py
defence360agent/plugins/icontact_sender.py
defence360agent/plugins/idle_time_out.py
defence360agent/plugins/lve_utils_install.py
defence360agent/plugins/myimunify.py
defence360agent/plugins/ping.py
defence360agent/plugins/send_domain_list.py
defence360agent/plugins/send_server_config.py
defence360agent/plugins/service_manager.py
defence360agent/plugins/wordpress.py
defence360agent/rpc_tools/__init__.py
defence360agent/rpc_tools/exceptions.py
defence360agent/rpc_tools/lookup.py
defence360agent/rpc_tools/middleware.py
defence360agent/rpc_tools/utils.py
defence360agent/rpc_tools/validate.py
defence360agent/simple_rpc/__init__.py
defence360agent/simple_rpc/advisor.py
defence360agent/simple_rpc/analyst_cleanup.py
defence360agent/simple_rpc/endpoints.py
defence360agent/simple_rpc/hooks.py
defence360agent/simple_rpc/hosting_panel.py
defence360agent/simple_rpc/myimunify.py
defence360agent/simple_rpc/permissions.py
defence360agent/simple_rpc/plesk_stats.py
defence360agent/simple_rpc/reputation_management.py
defence360agent/simple_rpc/schema.py
defence360agent/simple_rpc/wordpress_security_plugin.py
defence360agent/simple_rpc/wp_disabled_rules.py
defence360agent/simple_rpc/wp_waf_bulk.py
defence360agent/simple_rpc/schema/advisor.pickle
defence360agent/simple_rpc/schema/advisor.yaml
defence360agent/simple_rpc/schema/analyst-cleanup.pickle
defence360agent/simple_rpc/schema/analyst-cleanup.yaml
defence360agent/simple_rpc/schema/auth-cloud.pickle
defence360agent/simple_rpc/schema/auth-cloud.yaml
defence360agent/simple_rpc/schema/billing.pickle
defence360agent/simple_rpc/schema/billing.yaml
defence360agent/simple_rpc/schema/checkdb.pickle
defence360agent/simple_rpc/schema/checkdb.yaml
defence360agent/simple_rpc/schema/config.pickle
defence360agent/simple_rpc/schema/config.yaml
defence360agent/simple_rpc/schema/conflicts.pickle
defence360agent/simple_rpc/schema/conflicts.yaml
defence360agent/simple_rpc/schema/doctor.pickle
defence360agent/simple_rpc/schema/doctor.yaml
defence360agent/simple_rpc/schema/eula.pickle
defence360agent/simple_rpc/schema/eula.yaml
defence360agent/simple_rpc/schema/files.pickle
defence360agent/simple_rpc/schema/files.yaml
defence360agent/simple_rpc/schema/get-news.pickle
defence360agent/simple_rpc/schema/get-news.yaml
defence360agent/simple_rpc/schema/google-safe-engine.pickle
defence360agent/simple_rpc/schema/google-safe-engine.yaml
defence360agent/simple_rpc/schema/hook.pickle
defence360agent/simple_rpc/schema/hook.yaml
defence360agent/simple_rpc/schema/hooks.pickle
defence360agent/simple_rpc/schema/hooks.yaml
defence360agent/simple_rpc/schema/hosting-panel.pickle
defence360agent/simple_rpc/schema/hosting-panel.yaml
defence360agent/simple_rpc/schema/login.pickle
defence360agent/simple_rpc/schema/login.yaml
defence360agent/simple_rpc/schema/package-versions.pickle
defence360agent/simple_rpc/schema/package-versions.yaml
defence360agent/simple_rpc/schema/permissions.pickle
defence360agent/simple_rpc/schema/permissions.yaml
defence360agent/simple_rpc/schema/plesk-stats.pickle
defence360agent/simple_rpc/schema/plesk-stats.yaml
defence360agent/simple_rpc/schema/registration.pickle
defence360agent/simple_rpc/schema/registration.yaml
defence360agent/simple_rpc/schema/support.pickle
defence360agent/simple_rpc/schema/support.yaml
defence360agent/simple_rpc/schema/version.pickle
defence360agent/simple_rpc/schema/version.yaml
defence360agent/simple_rpc/schema/wordpress.pickle
defence360agent/simple_rpc/schema/wordpress.yaml
defence360agent/simple_rpc/schema/wp-disabled-rules.pickle
defence360agent/simple_rpc/schema/wp-disabled-rules.yaml
defence360agent/simple_rpc/schema/wp-waf.pickle
defence360agent/simple_rpc/schema/wp-waf.yaml
defence360agent/simple_rpc/schema_responses/AnalystCleanupAllowedResponse.json
defence360agent/simple_rpc/schema_responses/AnalystCleanupGetRequestsResponse.json
defence360agent/simple_rpc/schema_responses/AnalystCleanupRequestResponse.json
defence360agent/simple_rpc/schema_responses/ConfigAgentResponse.json
defence360agent/simple_rpc/schema_responses/FeaturesManagementDefaultsAgentResponse.json
defence360agent/simple_rpc/schema_responses/FeaturesManagementEditAgentResponse.json
defence360agent/simple_rpc/schema_responses/FeaturesManagementGetAgentResponse.json
defence360agent/simple_rpc/schema_responses/FeaturesManagementListAgentResponse.json
defence360agent/simple_rpc/schema_responses/FeaturesManagementNativeStatusAgentResponse.json
defence360agent/simple_rpc/schema_responses/FeaturesManagementShowAgentResponse.json
defence360agent/simple_rpc/schema_responses/GetNewsAgentResponse.json
defence360agent/simple_rpc/schema_responses/GetPackageVersionsAgentResponse.json
defence360agent/simple_rpc/schema_responses/NoItemsAndEulaAgentResponse.json
defence360agent/simple_rpc/schema_responses/NotificationConfigAgentResponse.json
defence360agent/simple_rpc/schema_responses/NullAgentResponse.json
defence360agent/simple_rpc/schema_responses/README.md
defence360agent/simple_rpc/schema_responses/ReputationAgentResponse.json
defence360agent/simple_rpc/schema_responses/TokenAgentResponse.json
defence360agent/simple_rpc/schema_responses/WhmcsUpdateResponse.json
defence360agent/simple_rpc/schema_responses/WordpressDomainsResponse.json
defence360agent/simple_rpc/schema_responses/WordpressIncidentsListAgentResponse.json
defence360agent/subsys/__init__.py
defence360agent/subsys/ainotify.py
defence360agent/subsys/backup_systems.py
defence360agent/subsys/clcagefs.py
defence360agent/subsys/notifier.py
defence360agent/subsys/persistent_state.py
defence360agent/subsys/svcctl.py
defence360agent/subsys/sysctl.py
defence360agent/subsys/systemd_notifier.py
defence360agent/subsys/web_server.py
defence360agent/subsys/features/__init__.py
defence360agent/subsys/features/abstract_feature.py
defence360agent/subsys/features/kernel_care.py
defence360agent/subsys/panels/__init__.py
defence360agent/subsys/panels/base.py
defence360agent/subsys/panels/hosting_panel.py
defence360agent/subsys/panels/cpanel/__init__.py
defence360agent/subsys/panels/cpanel/packages.py
defence360agent/subsys/panels/cpanel/panel.py
defence360agent/subsys/panels/cpanel/whm.py
defence360agent/subsys/panels/directadmin/__init__.py
defence360agent/subsys/panels/directadmin/config.py
defence360agent/subsys/panels/directadmin/panel.py
defence360agent/subsys/panels/generic/__init__.py
defence360agent/subsys/panels/generic/panel.py
defence360agent/subsys/panels/generic/users_script_schemas/schema-admins.yaml
defence360agent/subsys/panels/generic/users_script_schemas/schema-domains.yaml
defence360agent/subsys/panels/generic/users_script_schemas/schema-metadata.yaml
defence360agent/subsys/panels/generic/users_script_schemas/schema-panel_info.yaml
defence360agent/subsys/panels/generic/users_script_schemas/schema-users.yaml
defence360agent/subsys/panels/no_cp/__init__.py
defence360agent/subsys/panels/no_cp/panel.py
defence360agent/subsys/panels/plesk/__init__.py
defence360agent/subsys/panels/plesk/api.py
defence360agent/subsys/panels/plesk/panel.py
defence360agent/subsys/panels/plesk/upgrade_urls.py
defence360agent/subsys/panels/plesk/utils.py
defence360agent/utils/__init__.py
defence360agent/utils/_shutil.py
defence360agent/utils/antivirus_mode.py
defence360agent/utils/async_utils.py
defence360agent/utils/benchmark.py
defence360agent/utils/buffer.py
defence360agent/utils/check_db.py
defence360agent/utils/check_lock.py
defence360agent/utils/cli.py
defence360agent/utils/common.py
defence360agent/utils/completions.py
defence360agent/utils/config.py
defence360agent/utils/cronjob.py
defence360agent/utils/doctor.py
defence360agent/utils/fd_ops.py
defence360agent/utils/hyperscan.py
defence360agent/utils/importer.py
defence360agent/utils/ipecho.py
defence360agent/utils/json.py
defence360agent/utils/kwconfig.py
defence360agent/utils/net.py
defence360agent/utils/net_transport.py
defence360agent/utils/parsers.py
defence360agent/utils/resource_limits.py
defence360agent/utils/safe_fileops.py
defence360agent/utils/safe_sequence.py
defence360agent/utils/serialization.py
defence360agent/utils/sshutil.py
defence360agent/utils/subprocess.py
defence360agent/utils/support.py
defence360agent/utils/threads.py
defence360agent/utils/validate.py
defence360agent/utils/whmcs.py
defence360agent/utils/wordpress_mu_plugin.py
defence360agent/utils/zipsafe.py
defence360agent/wordpress/__init__.py
defence360agent/wordpress/bot_protection.py
defence360agent/wordpress/changelog_processor.py
defence360agent/wordpress/cli.py
defence360agent/wordpress/constants.py
defence360agent/wordpress/exception.py
defence360agent/wordpress/incident_collector.py
defence360agent/wordpress/incident_parser.py
defence360agent/wordpress/incident_sender.py
defence360agent/wordpress/plugin.py
defence360agent/wordpress/proxy_auth.py
defence360agent/wordpress/site_repository.py
defence360agent/wordpress/telemetry.py
defence360agent/wordpress/utils.py
defence360agent/wordpress/wp_rules.py
imunify_core.egg-info/PKG-INFO
imunify_core.egg-info/SOURCES.txt
imunify_core.egg-info/dependency_links.txt
imunify_core.egg-info/top_level.txt imunify_core-8.12.1-py3.11.egg-info/dependency_links.txt 0000644 0000000 0000000 00000000001 00000000000 017613 0 ustar
imunify_core-8.12.1-py3.11.egg-info/top_level.txt 0000644 0000000 0000000 00000000020 00000000000 016267 0 ustar defence360agent
Back to Directory
File Manager